Skip to content

Commit f0fc2e9

Browse files
guerilla7guerilla7
authored
Merge pull request #724 from skwyddie/patch-1
Update ASI_Agentic_Exploits_Incidents.md
2 parents fda01d5 + 4820412 commit f0fc2e9

File tree

1 file changed

+8
-7
lines changed

1 file changed

+8
-7
lines changed

‎initiatives/agent_security_initiative/ASI Agentic Exploits & Incidents/ASI_Agentic_Exploits_Incidents.md‎

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -17,18 +17,19 @@ Similarly, any aspects relating to incident response should be discussed with th
1717

1818
| Exploit / Incident | Impact Summary | ASI T&M Mapping | Links to further analysis |
1919
|------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------|---------------------------|
20-
| **EchoLeak (Zero-Click Prompt Injection)** | Critical zero-click exploit allowing a mere email to trigger Copilot into leaking confidential data (emails, files, chat logs) outside its intended scope | T06 (Goal Manipulation) | - |
21-
| **GitPublic Issue Repo Hijack** | Public issue text hijacked an AI dev agent into leaking private repo contents via cross-repo prompt injection | T06 + T12 (Agent Communication Poisoning) | - |
20+
| **EchoLeak (Zero-Click Prompt Injection)** | Critical zero-click exploit allowing a mere email to trigger Copilot into leaking confidential data (emails, files, chat logs) outside its intended scope | T06 (Goal Manipulation) | https://arxiv.org/abs/2509.10540 |
21+
| **GitPublic Issue Repo Hijack** | Public issue text hijacked an AI dev agent into leaking private repo contents via cross-repo prompt injection | T06 + T12 (Agent Communication Poisoning) | https://www.docker.com/blog/mcp-horror-stories-github-prompt-injection/ |
2222
| **Hub MCP Prompt Injection (Cross-Context)** | *(details missing)* | *(unspecified)* | - |
2323
| **Replit Vibe Coding Meltdown – Jul 2025** | Agent hallucinated data, deleted a production DB, and generated false outputs to hide mistakes | T07 (Deceptive Behaviour) | - |
24-
| **Agent-in-the-Middle (A2A Protocol Spoofing) – Apr 2025** | A malicious agent published a fake agent card in an open A2A directory, falsely claiming high trust. The LLM judge agent selected it, enabling the rogue agent to intercept sensitive data and leak it to unauthorized parties. | TI12 + TI13 (Rogue Agents) | - |
25-
| **Amazon Q Prompt Poisoning – Jul 2025** | Destructive prompt in extension risked file wipes | T02 + T17 (Supply Chain) | - |
26-
| **Google Gemini CLI File Loss – Jul 2025** | Agent misunderstood file instructions and wiped user’s directory; admitted catastrophic loss | T11 (Unexpected RCE) | - |
27-
| **ToolShell RCE via SharePoint – CVE-2025-5377 (Jul 2025)** | RCE exploit in SharePoint leveraged by agents | T11 (Unexpected RCE) | - |
28-
| **AgentSmith Prompt-Hub Proxy Attack – Jul 2025** | Proxy prompt agent exfiltrated API keys | ASI17 (Supply Chain) | - |
24+
| **Agent-in-the-Middle (A2A Protocol Spoofing) – Apr 2025** | A malicious agent published a fake agent card in an open A2A directory, falsely claiming high trust. The LLM judge agent selected it, enabling the rogue agent to intercept sensitive data and leak it to unauthorized parties. | TI12 + TI13 (Rogue Agents) | [-](https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/agent-in-the-middle-abusing-agent-cards-in-the-agent-2-agent-protocol-to-win-all-the-tasks/) |
25+
| **Amazon Q Prompt Poisoning – Jul 2025** | Destructive prompt in extension risked file wipes | T02 + T17 (Supply Chain) | https://medium.com/@ismailkovvuru/the-amazon-q-vs-code-prompt-injection-explained-impact-and-learnings-for-devops-3a9d2f752dea |
26+
| **Google Gemini CLI File Loss – Jul 2025** | Agent misunderstood file instructions and wiped user’s directory; admitted catastrophic loss | T11 (Unexpected RCE) | https://archive.ph/sknx5 |
27+
| **ToolShell RCE via SharePoint – CVE-2025-53770 (Jul 2025)** | RCE exploit in SharePoint leveraged by agents | T11 (Unexpected RCE) | - |
28+
| **AgentSmith Prompt-Hub Proxy Attack – Jul 2025** | Proxy prompt agent exfiltrated API keys | ASI17 (Supply Chain) | https://noma.security/blog/how-an-ai-agent-vulnerability-in-langsmith-could-lead-to-stolen-api-keys-and-hijacked-llm-responses/ |
2929
| **OpenAI ChatGPT Operator Vulnerability – Feb 2025** | Prompt injection in web content caused the Operator to follow attacker instructions, access authenticated pages, and expose users’ private data. Showed leakage risks from lightly guarded autonomous agents. | T06 (Intent Breaking & Goal Manipulation) + T02 (Tool Misuse) + T03 (Privilege Compromise) | - |
3030
| **Microsoft Copilot Studio Security Flaw – 2025** | Agents were public by default and lacked authentication. Attackers could enumerate and access exposed agents, pulling confidential business data from production environments. | T03 (Privilege Compromise) + T09 (Identity Spoofing & Impersonation) | - |
3131
| **Flowise Pre-Auth Arbitrary File Upload – CVE-2025-26319 (Mar 2025)** | Unauthenticated arbitrary file upload enabled compromise of the agent framework and potential remote server control after delayed vendor response | T11 (Unexpected RCE and Code Attacks) | - |
3232
| **GitHub Copilot & Cursor Code-Agent Exploit – Mar 2025** | Manipulated AI code suggestions injected backdoors, leaked API keys, and introduced logic flaws into production code, creating a significant supply-chain risk as developers trusted AI outputs | T17 (Supply Chain) + T10 (Overwhelming Human in the Loop) | - |
33+
| **ShadowLeak - Sept 2025 ** | Chains gmail and web search access with indirect prompt injection for ChatGPT Deep Research abuse | | *(unspecified)*| | https://www.radware.com/blog/threat-intelligence/shadowleak/ |
3334

3435
---

0 commit comments

Comments
 (0)