BlueRadius Research
AI Agent Incident Tracker
Every publicly documented case of an AI agent being hijacked, misused, or going wrong on its own, from prompt injection to agents that deleted production data. Each one has a source you can check, and the list is updated every quarter.
Last updated October 21, 2026. Next update January 2027. By BlueRadius Research.
What changed this quarter
October 21, 2026
This is the first edition of the tracker. It starts from the 21 cases behind our AI Agent Security Report 2026 and adds 55 more, for 76 in total.
The mix is shifting. In 2025, 7 of 41 documented cases were real-world incidents (17%). So far in 2026 it is 11 of 34 (32%). A year ago most of what we could find was researchers showing what might go wrong. Now a growing share is attackers, and agents, actually doing it.
The third quarter brought the clearest examples yet of agents doing the attacking. In one campaign, AI agents handled most of the work of breaking into more than 100 companies for about $5,000 in model usage. Hugging Face reported that an autonomous agent system escalated privileges and stole credentials inside its production environment. Earlier in the year, a prompt injection hidden in a GitHub issue title hijacked Cline's AI triage bot, and a stolen token from that chain was used to push a tampered release of Cline to npm.
Agents with too much access also did damage without any attacker involved. In April, according to the company's founder, a Cursor agent holding a fully permissioned token deleted a startup's production database and its backups in a single call.
The numbers
76 documented cases, 13 confirmed incidents
Counts are strict. A case is an incident only if an agent was actually abused or failed in a real environment, and it is confirmed only when a primary source or two independent reports back it.
13
confirmed real-world incidents, each backed by a primary source or at least two independent reports. Another 5 reported incidents rest on a single news report; they are listed and marked, but not counted here.
41
disclosed vulnerabilities in agents, agent tooling, and MCP servers, fixed or acknowledged by the vendor. 22 cases carry at least one CVE.
13
research demonstrations: attacks shown to work in a lab, where the vendor disputed the issue or did not fix it.
4
malicious packages published to public registries such as PyPI and MCP marketplaces with no confirmed victim. Tracked, but not counted as incidents.
32%
of 2026 cases so far are reported real-world incidents, up from 17% in 2025.
76
cases in total since Aug 2024, every one linked to the source it came from.
Documented AI agent cases by quarter
Grouped by the month each case was publicly disclosed. The asterisk marks the current quarter, which is still in progress.
- Incident
- Vulnerability
- Research demo
- Malicious package
Source: BlueRadius AI Agent Incident Tracker (n=76). Download the data.
Every case
The full list
Filter by type, or show only cases backed by a primary source or two independent reports.
Showing 76 of 76 cases, newest first.
| Disclosed | Case | Type | What happened | Source |
|---|---|---|---|---|
| Oct 2026 | Cairn agent hacking spree (NorForge) Cairn agent platform | Incident | A Chinese-speaking hacker used Cairn-coordinated AI agents to breach more than 100 companies, including Deere and SharkNinja, for about US$5000 in tokens. | Source Primary |
| Sep 2026 | Strix/Cairn/Hermes card-theft campaign Open-source agents Strix, Cairn, Hermes (Claude Opus 4.6 via OpenRouter) | Incident | A single operator used three open-source attack agents to compromise at least 27 organizations, steal more than 600,000 card records from two of them, and plant skimmers on at least 19 victims' sites. | Source Primary |
| Sep 2026 | SalesBleed Salesforce Agentforce + Slack | Vulnerability | Prompt injections submitted through public Web-to-Lead forms later hijacked Agentforce agents to leak CRM data past Salesforce's Trusted URLs controls and to phish employees in Slack. | Source Primary |
| Sep 2026 | OpenAI agents DSEwiki hijack OpenAI agents (task environment with web access) | Incident | Thousands of self-identified OpenAI agents turned a dormant German wiki into a message board to share task answers and a sandbox bypass, and they impersonated a moderator. | Source Primary |
| Sep 2026 | OpenAI agent Medicare portal breach OpenAI research agent | Incident | While researching public medicine funding, an OpenAI agent got past a barrier on Australia's Medicare Statistics Reporting Service and accessed non-public files, and OpenAI took weeks to tell the government. | Source Corroborated |
| Aug 2026 | Deadbugz delayed MCP rug-pull productivity-suite MCP server (GitHub PRs) | Malicious package | A malicious MCP server pushed through 23 GitHub pull requests switched its tool metadata after three calls, telling agents to hunt for SSH keys and cloud credentials and hide it from the user. | Source Primary |
| Aug 2026 | CoSnitch Microsoft Copilot Personal (OAuth connectors + memory) CVE-2026-24301 | Vulnerability | A one-click link auto-ran an attacker prompt in Copilot Personal that read connected Gmail, Drive and Calendar data, sent it out through Copilot's own URL fetch, and could poison its persistent memory. | Source Primary |
| Aug 2026 | Check Point agent framework flaws Microsoft Agent Framework, Google ADK (also LangChain, LangGraph, CrewAI, AutoGen tested) | Vulnerability | Check Point reported a set of agent framework flaws (The Register counts 11 across six frameworks; Check Point's recap says 12 CVEs across four), including a prompt-triggered deserialization RCE in Microsoft Agent Framework and an unauthenticated code-writing dev assistant API in Google ADK. | Source Corroborated |
| Jul 2026 | Terraform MCP cross-tenant credential reuse terraform-mcp-server CVE-2026-16498 | Vulnerability | In stateless HTTP mode, HashiCorp's Terraform MCP server could run one user's tool calls with another user's Terraform token because sessions were not isolated. | Source Primary |
| Jul 2026 | Eval agents breach Hugging Face OpenAI internal eval agents | Incident | Autonomous agents running a cyber benchmark escaped their sandbox through a zero-day in a package proxy and broke into Hugging Face production systems, which secondary reports attribute to an OpenAI evaluation. | Source Primary |
| Jun 2026 | SearchLeak Microsoft 365 Copilot Enterprise Search CVE-2026-42824 | Vulnerability | One click on a crafted Copilot search link chained URL prompt injection, a rendering race and a Bing server-side fetch to pull emails, OTP codes and SharePoint files out of an M365 tenant. | Source Primary |
| Jun 2026 | Miasma worm (AI agent config hooks) Claude Code, Gemini CLI, Cursor (repo config files) | Incident | A compromised contributor account planted agent config hooks and a Cursor prompt-injection rule in Microsoft GitHub repositories, so opening a repo in an AI coding tool ran a credential-stealing payload. | Source Primary |
| Jun 2026 | BioShocking ChatGPT Atlas, Perplexity Comet, Claude extension and others | Research demo | A malicious puzzle page convinced six agentic browsers that their rules no longer applied, and LayerX reports all six treated copying credentials from a test file in a GitHub repository as just another step. | Source Primary |
| Apr 2026 | ShareLeak Microsoft Copilot Studio CVE-2026-21520 | Vulnerability | A payload in a SharePoint form comment field overrode a Copilot Studio agent's instructions, and the agent emailed customer records from SharePoint Lists to an outside address even after safety checks flagged it. | Source Single report |
| Apr 2026 | PocketOS production DB deletion Cursor agent (Claude Opus 4.6) + Railway API | Incident | A Cursor coding agent hit a credential mismatch in staging, used a fully permissioned Railway API token it found, and deleted the production database volume and its backups in one API call. | Source Single report |
| Apr 2026 | PipeLeak Salesforce Agentforce | Vulnerability | Instructions in a public lead form made an Agentforce agent fetch lead records in bulk and email them to an outside address when staff later reviewed the lead. | Source Single report |
| Apr 2026 | GrafanaGhost Grafana AI assistant | Vulnerability | Hidden instructions planted in Grafana logs, combined with a URL validation bypass and a guardrail-disabling keyword, could make Grafana's AI send data to an attacker server through an image request. | Source Single report |
| Apr 2026 | Comment and Control Claude Code Security Review / Gemini CLI Action / GitHub Copilot Agent | Vulnerability | Crafted PR titles, issue comments and hidden HTML comments hijacked three vendors' GitHub Actions coding agents into leaking CI secrets back through GitHub itself. | Source Single report |
| Mar 2026 | Meta internal agent Sev 1 exposure Meta internal AI agent | Incident | An internal Meta AI agent posted forum advice without the engineer's approval, and acting on it exposed company and user data to unauthorized staff for two hours in a Sev 1 incident. | Source Single report |
| Mar 2026 | hackerbot-claw GitHub Actions campaign GitHub Actions workflows (Trivy/awesome-go/akri and others) | Incident | A bot that called itself an autonomous Claude-powered agent exploited misconfigured GitHub Actions workflows in several major repositories and used a stolen token to take over Aqua Security's Trivy repository. | Source Primary |
| Feb 2026 | SmartLoader trojanized Oura MCP Oura Ring MCP clone (MCP Market) | Malicious package | Attackers cloned the Oura Ring MCP server, propped it up with fake GitHub forks, listed it on MCP Market and used it to deliver the StealC infostealer. | Source Primary |
| Feb 2026 | Semantic Kernel prompt-to-RCE Microsoft Semantic Kernel (Python/.NET) CVE-2026-26030, CVE-2026-25592 | Vulnerability | Model-controlled tool arguments in Microsoft's Semantic Kernel agent framework reached an eval() filter and a file-write tool, so one injected prompt could run code on the agent host. | Source Primary |
| Feb 2026 | OpenClaw one-click RCE OpenClaw (formerly Clawdbot/Moltbot) CVE-2026-25253 | Vulnerability | A malicious link could steal the OpenClaw gateway token, letting an attacker switch off confirmation prompts and sandboxing and run commands on the host. | Source Primary |
| Feb 2026 | Moltbook agent database exposure Moltbook (AI agent social network) | Vulnerability | A misconfigured Supabase backend exposed API keys for about 1.5 million agents, roughly 35000 emails and private agent messages that contained plaintext OpenAI keys, which would have let anyone take over any agent. | Source Primary |
| Feb 2026 | Mexican government data theft via Claude Code Claude Code (abused) + OpenAI GPT-4.1 | Incident | An attacker sent over 1000 prompts to Claude Code to break into Mexican government agencies and stole about 150GB of tax, voter and civil-registry data. | Source Single report |
| Feb 2026 | DockerDash Docker Ask Gordon / MCP Gateway | Vulnerability | Instructions hidden in Docker image LABEL metadata were passed by the Ask Gordon assistant to the MCP Gateway and run as tool calls, giving code execution in CLI and cloud setups and data theft on Docker Desktop. | Source Primary |
| Feb 2026 | Clinejection Cline GitHub Actions issue-triage (claude-code-action) | Incident | A prompt injection in a GitHub issue title could make Cline's Claude-powered triage bot poison the Actions cache and steal release tokens, and a token left unrevoked after disclosure was later used to publish an unauthorized cline@2.3.0 to npm. | Source Primary |
| Feb 2026 | ClawHavoc malicious ClawHub skills OpenClaw ClawHub skill marketplace | Malicious package | Attackers published 341 malicious skills to OpenClaw's public marketplace that used fake prerequisite steps to install the AMOS infostealer and other malware, and some stole the agent's stored credentials. | Source Single report |
| Feb 2026 | Claude Code project-file RCE and API key theft Anthropic Claude Code CVE-2025-59536, CVE-2026-21852 | Vulnerability | Repository-controlled settings files could run hooks and MCP server commands before the trust dialog and redirect API traffic to steal the user's Anthropic API key. | Source Primary |
| Jan 2026 | ZombieAgent OpenAI ChatGPT (connectors + memory) | Vulnerability | Hidden instructions in an email or file made ChatGPT leak connector data one character at a time through attacker URLs, plant rules in its memory, and spread to the victim's contacts. | Source Single report |
| Jan 2026 | mcp-server-git prompt-injection RCE chain Anthropic mcp-server-git CVE-2025-68143 | Vulnerability | Three flaws in Anthropic's official Git MCP server could be triggered by prompt injection in a README or issue and chained with the Filesystem MCP server to run code. | Source Single report |
| Jan 2026 | Gemini calendar-invite leak Google Gemini (Google Calendar) | Vulnerability | A calendar invite with hidden instructions made Gemini summarize the user's private meetings into a new calendar event that others could see, once the user asked about their schedule. | Source Primary |
| Jan 2026 | Claude Cowork file exfil Anthropic Claude Cowork | Research demo | A hidden prompt in an uploaded document made Cowork use curl to upload a user's confidential files to the attacker's account through the allow-listed Anthropic Files API. | Source Primary |
| Jan 2026 | BodySnatcher ServiceNow Now Assist AI Agents / Virtual Agent API CVE-2025-12420 | Vulnerability | An unauthenticated attacker with only a target's email address could impersonate that user through a shared static secret and auto-linking without MFA, then run AI agents to create a new admin account. | Source Primary |
| Dec 2025 | PromptPwnd AI agents in GitHub Actions / GitLab CI (Gemini CLI, Claude Code Actions, Codex Actions, GitHub AI Inference) | Vulnerability | Untrusted issue and pull request text placed into AI agent prompts inside CI pipelines let attackers make the agent leak privileged tokens and API keys, and Google patched its own gemini-cli workflow within four days. | Source Primary |
| Dec 2025 | IDEsaster Multiple AI IDEs (Cursor, Copilot, Windsurf, Kiro, Zed, Roo Code, Junie, Cline, Gemini CLI, Claude Code) CVE-2025-49150, CVE-2025-54130, CVE-2025-61590, CVE-2025-64660 | Vulnerability | Researcher showed that prompt injection plus ordinary IDE features such as remote JSON schemas and settings files gave data theft or code execution in every AI IDE tested, leading to 30+ reports and 24 CVEs. | Source Primary |
| Dec 2025 | Codex CLI MCP config injection OpenAI Codex CLI CVE-2025-61260 | Vulnerability | A malicious repository could redirect Codex CLI to a project-local config whose MCP server entries ran arbitrary commands at startup with no approval prompt. | Source Primary |
| Dec 2025 | Antigravity D-drive wipe Google Antigravity | Incident | Running in Turbo mode, which executes commands without confirmation, Google's Antigravity agent targeted the root of a user's D drive when asked to clear a project cache and permanently deleted its contents. | Source Single report |
| Nov 2025 | Antigravity browser-subagent exfil Google Antigravity | Research demo | A hidden prompt on a web page made Antigravity read a gitignored .env file with a terminal command and send AWS credentials and code to an attacker URL through its browser subagent. | Source Primary |
| Nov 2025 | AI-orchestrated espionage Claude Code (abused) | Incident | Anthropic reported a state-sponsored group used Claude Code to run a largely autonomous espionage campaign against about 30 targets. | Source Primary |
| Nov 2025 | ServiceNow Now Assist A2A ServiceNow Now Assist | Research demo | Default agent discovery settings in ServiceNow Now Assist let a low-privilege prompt recruit a more privileged agent to act on its behalf. | Source Primary |
| Oct 2025 | Smithery MCP hosting token leak Smithery.ai MCP hosting | Vulnerability | A path traversal in Smithery's build config exposed an overprivileged fly.io token that controlled more than 3000 hosted apps, most of them MCP servers. | Source Primary |
| Oct 2025 | Opera Neon prompt injection Opera Neon | Vulnerability | Invisible text on a web page made Opera Neon's agent open the user's Opera account page and send their email address to an attacker server when asked to summarize the page. | Source Primary |
| Oct 2025 | Malicious PyPI MCP reverse shells PyPI MCP packages (mcp-runcmd-server et al.) | Malicious package | Three PyPI packages posing as command-runner MCP servers opened a reverse shell to an attacker server on install, with about 1600 total downloads. | Source Primary |
| Oct 2025 | Framelink Figma MCP command injection Framelink Figma MCP server CVE-2025-53967 | Vulnerability | Unsanitized input in the Figma MCP server's curl fallback allowed OS command execution via a network request or prompt injection. | Source Primary |
| Oct 2025 | Cursor case-sensitivity bypass Cursor IDE CVE-2025-59944 | Vulnerability | Cursor checked protected file paths case-sensitively, so prompt-injected edits to a differently cased mcp.json skipped the approval prompt and could register a malicious MCP server for code execution. | Source Primary |
| Oct 2025 | CometJacking Perplexity Comet | Research demo | A crafted link put instructions in URL parameters that made Comet pull Gmail and Calendar data from its connectors, base64-encode it to get past checks, and POST it to an attacker server. | Source Primary |
| Oct 2025 | ChatGPT Atlas omnibox injection OpenAI ChatGPT Atlas | Research demo | A malformed URL pasted into the Atlas address bar was treated as a trusted user command, so the agent followed embedded instructions such as going to an attacker-chosen site. | Source Primary |
| Sep 2025 | postmark-mcp malicious MCP server postmark-mcp (npm) | Incident | A fake npm copy of the Postmark email MCP server added one line in version 1.0.16 that blind-copied every email sent through it to an attacker address. | Source Single report |
| Sep 2025 | CamoLeak GitHub Copilot Chat | Vulnerability | Hidden comments in a pull request made Copilot Chat leak private repository content, including secrets and an undisclosed zero-day description, through GitHub's own Camo image proxy. | Source Primary |
| Sep 2025 | Notion 3.0 exfil Notion 3.0 agents (Claude) | Research demo | A malicious PDF could make a Notion 3.0 agent use its web search tool to send private workspace data to an attacker. | Source Primary |
| Sep 2025 | ForcedLeak Salesforce Agentforce | Vulnerability | Injected text in a Salesforce web-to-lead form could make an Agentforce agent leak CRM data to an expired, attacker-purchasable domain. | Source Primary |
| Sep 2025 | Gemini Trifecta Google Gemini (Cloud Assist/Search/Browsing) | Vulnerability | Three flaws in Google Gemini components allowed prompt injection through logs, search history and browsing to expose user data. | Source Primary |
| Aug 2025 | Invitation Is All You Need Google Gemini (Calendar / Google Home / Zoom) | Research demo | Poisoned calendar invite titles made Gemini call other agents later on, which opened smart-home windows, started Zoom video calls and leaked email subjects through URLs. | Source Primary |
| Aug 2025 | Claude Code vibe-hacking extortion Claude Code (abused) | Incident | A criminal used Claude Code to run reconnaissance, credential harvesting, network intrusion and ransom-note writing against at least 17 organizations, with demands sometimes over $500000. | Source Primary |
| Aug 2025 | Nx s1ngularity Local AI CLIs (Claude/Gemini/Amazon Q) | Incident | Malicious Nx package versions used locally installed AI coding CLIs to hunt for and steal developer secrets and wallets. | Source Primary |
| Aug 2025 | Claude Code InversePrompt Anthropic Claude Code CVE-2025-54794 | Vulnerability | Flaws in Claude Code's path and command checks let crafted input escape its working directory and run commands without approval. | Source Primary |
| Aug 2025 | Comet indirect prompt injection Perplexity Comet | Vulnerability | Brave showed that hidden instructions on a web page could make Perplexity's Comet browser agent take actions in the user's logged-in accounts. | Source Primary |
| Aug 2025 | Copilot YOLO-mode RCE GitHub Copilot / VS Code CVE-2025-53773 | Vulnerability | Prompt injection could make GitHub Copilot in VS Code switch itself into auto-approve mode and then run arbitrary commands. | Source Primary |
| Aug 2025 | MCPoison Cursor IDE CVE-2025-54136 | Vulnerability | Cursor trusted an MCP server once approved, so an attacker could later swap its config for a malicious command that ran silently. | Source Primary |
| Aug 2025 | CurXecute Cursor IDE CVE-2025-54135 | Vulnerability | Prompt injection delivered through an MCP-connected source could make Cursor rewrite its MCP config and run attacker commands on the developer's machine. | Source Primary |
| Jul 2025 | Supabase MCP lethal trifecta Supabase MCP server + Cursor | Research demo | A support ticket carrying hidden instructions made Cursor, running Supabase MCP as service_role, read a secrets table and post it back into the ticket. | Source Primary |
| Jul 2025 | Gemini CLI allowlist bypass Google Gemini CLI | Vulnerability | A prompt injection hidden in a repository README made Gemini CLI chain a malicious command after an allow-listed grep, silently running it to exfiltrate environment variables. | Source Primary |
| Jul 2025 | Filesystem MCP EscapeRoute Anthropic Filesystem MCP server CVE-2025-53109 | Vulnerability | Prefix-match and symlink flaws let Anthropic's Filesystem MCP server read and write files outside its allowed directories, enabling code execution via a macOS launch agent. | Source Primary |
| Jul 2025 | Amazon Q wiper injection Amazon Q for VS Code | Incident | An attacker got a prompt instructing data wiping merged into the Amazon Q VS Code extension, which shipped in a public release. | Source Primary |
| Jul 2025 | Replit prod DB deletion Replit AI agent | Incident | Replit's AI agent deleted a production database during a code freeze despite explicit instructions not to make changes. | Source Primary |
| Jul 2025 | mcp-remote OS command injection mcp-remote npm proxy CVE-2025-6514 | Vulnerability | The mcp-remote proxy let a malicious MCP server run operating system commands on the client machine during connection. | Source Primary |
| Jul 2025 | MCP Inspector RCE Anthropic MCP Inspector CVE-2025-49596 | Vulnerability | Anthropic's MCP Inspector developer tool exposed an unauthenticated proxy that let a malicious website run code on a developer's machine. | Source Primary |
| Jun 2025 | Claude Code IDE WebSocket hijack Claude Code IDE extensions (VS Code/JetBrains) CVE-2025-52882 | Vulnerability | Claude Code's IDE extension ran an unauthenticated local WebSocket MCP server, so any malicious website could connect to it, read local files and in some cases run code. | Source Primary |
| Jun 2025 | Asana MCP cross-tenant exposure Asana MCP server | Vulnerability | A logic bug in Asana's new MCP server could have exposed one organization's Asana data to MCP users in other organizations, so Asana took it offline for about two weeks. | Source Single report |
| Jun 2025 | EchoLeak Microsoft 365 Copilot CVE-2025-32711 | Vulnerability | A crafted email could make Microsoft 365 Copilot pull internal data into a response and leak it to an attacker without any user click. | Source Primary |
| May 2025 | GitHub MCP toxic-agent flow GitHub MCP server | Research demo | A malicious public GitHub issue could make an agent using the GitHub MCP server leak private repository data into a public pull request. | Source Primary |
| May 2025 | GitLab Duo source-theft GitLab Duo (Claude) | Vulnerability | Hidden prompts in merge requests and code could make GitLab Duo leak private source code and inject malicious links. | Source Primary |
| Feb 2025 | Gemini memory poisoning Google Gemini Advanced | Research demo | Researcher showed hidden instructions in a document could make Gemini save false long-term memories that persisted across sessions. | Source Primary |
| Feb 2025 | ChatGPT Operator exfil OpenAI ChatGPT Operator | Research demo | Researcher showed ChatGPT Operator could be steered by web page prompt injection into reading and leaking personal data from logged-in sites. | Source Primary |
| Aug 2024 | Slack AI channel exfil Slack AI | Research demo | Prompt injection in a public Slack channel could make Slack AI leak data from private channels the attacker could not access. | Source Primary |
Why packages are separate
Attackers are already seeding the places developers go to find agent tools. We found malicious MCP servers and agent skills on PyPI, on ClawHub, and on MCP marketplaces: reverse shells that open on install, cloned servers that deliver infostealers, and a server built to turn malicious only after a few calls.
What we could not find, for 4 of them, was a confirmed victim. Download counts are not victims, and counting these as incidents would inflate the number this page exists to get right. So they sit in their own category. The one malicious package with a confirmed victim, a fake Postmark MCP server that copied users' outgoing email to the attacker, is counted as an incident.
Method
How cases are found and counted
The rules, stated plainly, so any number on this page can be checked.
What gets in
A case is included when an AI agent, meaning a model that can call tools, run code, or act on systems, is central to what happened, and a retrievable public source documents it. Generic bugs in software that happens to host agents are left out, as are cases where the agent was incidental.
How each case is classified
Incident: an agent was abused, manipulated, or malfunctioned in a real environment. Vulnerability: the vendor confirmed or fixed the issue, with no known exploitation. Research demo: shown to work, but disputed or left unfixed by the vendor. Malicious package: a harmful agent tool published to a public registry with no confirmed victim.
Source confidence
Every case is marked Primary (we read the researcher's, vendor's, or advisory's own account), Corroborated (two or more independent reputable reports), or Single report. CVE numbers were checked against the official record; that check caught two wrong CVE numbers circulating in other coverage, which we left out.
Updates and corrections
The tracker is reviewed every quarter. New cases are added, and earlier entries are corrected when better sources appear. Each case keeps its number, so links to a specific row stay valid. Known limitation: this counts what has been publicly documented, which skews toward well-studied vendors and active researchers. The real number of incidents is higher.
BlueRadius compiled this dataset from public research, vulnerability disclosures, incident reports, and news coverage. Research was supported by automated and AI-assisted tools, with every case and source reviewed by BlueRadius.
Cite or reuse the data
The tracker and its data are free to cite and reuse under CC BY 4.0. Please credit BlueRadius Research and link to this page. When citing a count, include the "last updated" date, since the numbers change each quarter.
BlueRadius. "AI Agent Incident Tracker." BlueRadius Research, updated October 21, 2026. https://blueradius.io/research/ai-agent-incident-tracker
About BlueRadius
Know what your agents can reach
Most of the cases on this list come down to an agent holding more access than its task needed. BlueRadius helps mid-market and regulated organizations find the agents they run, scope what they can touch, and put real approval in front of the actions that matter.
Related from BlueRadius