Skip to content

Commit ea4b424

Browse files
emmanuelgjrclaude
emmanuelgjr
and
claude
committed
Expand incidents to 114: ASI agentic exploits, MCP attacks, supply chain breaches
34 new incidents (INC-081 to INC-114) sourced from OWASP ASI Agentic Exploits & Incidents tracker and curated additional-exploits data: Real-world (21): - Claude hijacked for state-sponsored cyberattacks (30 entities) - Claude jailbreak → Mexican government breach (150GB, 195M records) - Meta Rogue AI Agent Sev-1 incident - ShadowRay 2.0 self-spreading AI botnet - LiteLLM PyPI supply chain backdoor (3.4M daily downloads) - Axios npm North Korean supply chain attack (70M weekly downloads) - GlassWorm: 72 malicious VSCode extensions (9M installs) - Clinejection: CI/CD → npm → 4,000 developer machines - Moltbook: first major vibe-coding security disaster - Perplexity Comet unauthorized Amazon account access - Malicious MCP backdoor on npm (dual reverse shells) - Chat & Ask AI: 300M messages from 25M users exposed - Copilot Studio agents public by default - Replit agent: DB deletion + deceptive cover-up - Salesloft Drift OAuth breach (700+ orgs, China UNC6395) - Anthropic misuse: ransomware, NK fraud, $500K extortion - Flowise CustomMCP CVSS 10.0 (actively exploited) - ServiceNow BodySnatcher CVSS 9.3 - Google Antigravity IDE deletes entire D: drive Research/Red-team (13): - ShadowMQ: Meta/NVIDIA/vLLM inference RCE - ForcedLeak: Salesforce Agentforce CRM exfiltration - EchoLeak: zero-click Copilot data exfiltration - Agent-in-the-Middle: A2A protocol spoofing - GeminiJack: zero-click Google Workspace exfiltration - ShadowLeak: ChatGPT Deep Research zero-click - PoisonedRAG: 5 texts → 90% RAG attack success - IDEsaster: 30+ vulnerabilities across all AI IDEs - XBOW: first critical CVE by autonomous AI agent - Microsoft 365 Copilot XPIA phishing - AI recommendation poisoning (31 companies) - WhatsApp MCP tool poisoning - AgentSeal: 66% of MCP servers vulnerable Also fixed generate.js to auto-regenerate docs/incidents.js. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
1 parent 5b94a6b commit ea4b424

29 files changed

+5410
-16
lines changed

‎README.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@
1616

1717
<p align="center">
1818
<strong>The most comprehensive mapping of AI security risks to compliance frameworks.</strong><br>
19-
25 frameworks &middot; 1,514 controls &middot; 41 entries &middot; 3,210 mappings &middot; 80 incidents &middot; ML classifier pipeline
19+
25 frameworks &middot; 1,514 controls &middot; 41 entries &middot; 3,210 mappings &middot; 114 incidents &middot; ML classifier pipeline
2020
</p>
2121

2222
<p align="center">
@@ -382,7 +382,7 @@ GenAI-Security-Crosswalk/
382382
│ ├── framework-schema.json ← JSON Schema for framework registries
383383
│ ├── schema.json ← JSON Schema (Draft 7) for entry files
384384
│ ├── backlinks.json ← 1,097 control-to-entry reverse index
385-
│ ├── incidents.json ← 80 incidents with MAESTRO layer attribution
385+
│ ├── incidents.json ← 114 incidents with MAESTRO layer attribution
386386
│ ├── incidents-schema.json ← JSON Schema for incidents
387387
│ ├── tools-supplement.json ← Supplemental tools merged at generation time
388388
│ └── README.md ← Data layer docs, jq query examples

‎data/entries/ASI01.json‎

Lines changed: 90 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -904,6 +904,96 @@
904904
"url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
905905
"year": 2024,
906906
"incident_id": "INC-069"
907+
},
908+
{
909+
"name": "Claude hijacked for state-sponsored cyberattacks — 80-90% autonomous operation against 30 entities",
910+
"url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
911+
"year": 2025,
912+
"incident_id": "INC-083"
913+
},
914+
{
915+
"name": "ShadowRay 2.0 botnet — self-spreading crypto-mining via Ray AI framework",
916+
"url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
917+
"year": 2025,
918+
"incident_id": "INC-084"
919+
},
920+
{
921+
"name": "ForcedLeak — Salesforce Agentforce indirect prompt injection exfiltrates CRM data",
922+
"url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
923+
"year": 2025,
924+
"incident_id": "INC-088"
925+
},
926+
{
927+
"name": "EchoLeak — zero-click Microsoft Copilot data exfiltration via email prompt injection",
928+
"url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
929+
"year": 2025,
930+
"incident_id": "INC-089"
931+
},
932+
{
933+
"name": "Claude AI jailbreak — Mexican government breach, 150GB data theft across 10 agencies",
934+
"url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
935+
"year": 2026,
936+
"incident_id": "INC-092"
937+
},
938+
{
939+
"name": "Microsoft 365 Copilot XPIA phishing — attacker-shaped email summaries via hidden instructions",
940+
"url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
941+
"year": 2026,
942+
"incident_id": "INC-095"
943+
},
944+
{
945+
"name": "Clinejection — CI/CD pipeline compromise via Cline's issue triage bot, 4,000 machines infected",
946+
"url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
947+
"year": 2026,
948+
"incident_id": "INC-098"
949+
},
950+
{
951+
"name": "AI recommendation poisoning — hidden prompt injections in 'Summarize with AI' buttons across 31 companies",
952+
"url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
953+
"year": 2026,
954+
"incident_id": "INC-100"
955+
},
956+
{
957+
"name": "GeminiJack — zero-click Gemini Enterprise data exfiltration via shared Google Docs",
958+
"url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
959+
"year": 2026,
960+
"incident_id": "INC-101"
961+
},
962+
{
963+
"name": "IDEsaster — 30+ vulnerabilities across AI coding tools (Cursor, Windsurf, Copilot, Zed, Roo Code)",
964+
"url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
965+
"year": 2025,
966+
"incident_id": "INC-103"
967+
},
968+
{
969+
"name": "ServiceNow BodySnatcher — hardcoded secret key enables full AI agent hijacking (CVE-2025-12420)",
970+
"url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
971+
"year": 2025,
972+
"incident_id": "INC-104"
973+
},
974+
{
975+
"name": "Replit vibe coding meltdown — agent hallucinated data, deleted production database, hid mistakes",
976+
"url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
977+
"year": 2025,
978+
"incident_id": "INC-106"
979+
},
980+
{
981+
"name": "ShadowLeak — ChatGPT Deep Research zero-click data exfiltration from connected services",
982+
"url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
983+
"year": 2025,
984+
"incident_id": "INC-107"
985+
},
986+
{
987+
"name": "PoisonedRAG — 5 malicious texts in millions achieve 90% attack success rate on RAG systems",
988+
"url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
989+
"year": 2025,
990+
"incident_id": "INC-108"
991+
},
992+
{
993+
"name": "WhatsApp MCP tool poisoning — hidden instructions exfiltrate entire message history",
994+
"url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
995+
"year": 2025,
996+
"incident_id": "INC-111"
907997
}
908998
],
909999
"crossrefs": {

‎data/entries/ASI02.json‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -842,6 +842,84 @@
842842
"url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
843843
"year": 2024,
844844
"incident_id": "INC-069"
845+
},
846+
{
847+
"name": "Google Antigravity AI IDE deletes entire D: drive — misinterpreted cache-clearing instruction",
848+
"url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
849+
"year": 2025,
850+
"incident_id": "INC-082"
851+
},
852+
{
853+
"name": "Perplexity Comet agentic browser — unauthorized Amazon customer account access",
854+
"url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
855+
"year": 2025,
856+
"incident_id": "INC-086"
857+
},
858+
{
859+
"name": "ForcedLeak — Salesforce Agentforce indirect prompt injection exfiltrates CRM data",
860+
"url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
861+
"year": 2025,
862+
"incident_id": "INC-088"
863+
},
864+
{
865+
"name": "EchoLeak — zero-click Microsoft Copilot data exfiltration via email prompt injection",
866+
"url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
867+
"year": 2025,
868+
"incident_id": "INC-089"
869+
},
870+
{
871+
"name": "Claude AI jailbreak — Mexican government breach, 150GB data theft across 10 agencies",
872+
"url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
873+
"year": 2026,
874+
"incident_id": "INC-092"
875+
},
876+
{
877+
"name": "GeminiJack — zero-click Gemini Enterprise data exfiltration via shared Google Docs",
878+
"url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
879+
"year": 2026,
880+
"incident_id": "INC-101"
881+
},
882+
{
883+
"name": "OpenClaw AI agent security crisis — 138 CVEs in 63 days, 341 malicious marketplace skills",
884+
"url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
885+
"year": 2026,
886+
"incident_id": "INC-102"
887+
},
888+
{
889+
"name": "IDEsaster — 30+ vulnerabilities across AI coding tools (Cursor, Windsurf, Copilot, Zed, Roo Code)",
890+
"url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
891+
"year": 2025,
892+
"incident_id": "INC-103"
893+
},
894+
{
895+
"name": "ShadowLeak — ChatGPT Deep Research zero-click data exfiltration from connected services",
896+
"url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
897+
"year": 2025,
898+
"incident_id": "INC-107"
899+
},
900+
{
901+
"name": "Anthropic Claude misuse report — ransomware development, North Korean employment fraud, extortion",
902+
"url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
903+
"year": 2025,
904+
"incident_id": "INC-110"
905+
},
906+
{
907+
"name": "WhatsApp MCP tool poisoning — hidden instructions exfiltrate entire message history",
908+
"url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
909+
"year": 2025,
910+
"incident_id": "INC-111"
911+
},
912+
{
913+
"name": "Flowise CustomMCP code injection RCE — CVSS 10.0, 12,000 instances exposed",
914+
"url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
915+
"year": 2025,
916+
"incident_id": "INC-113"
917+
},
918+
{
919+
"name": "AgentSeal MCP server mass scan — 66% of 1,808 servers have security findings",
920+
"url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
921+
"year": 2025,
922+
"incident_id": "INC-114"
845923
}
846924
],
847925
"crossrefs": {

‎data/entries/ASI03.json‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -852,6 +852,84 @@
852852
"url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
853853
"year": 2023,
854854
"incident_id": "INC-079"
855+
},
856+
{
857+
"name": "Claude hijacked for state-sponsored cyberattacks — 80-90% autonomous operation against 30 entities",
858+
"url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
859+
"year": 2025,
860+
"incident_id": "INC-083"
861+
},
862+
{
863+
"name": "Perplexity Comet agentic browser — unauthorized Amazon customer account access",
864+
"url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
865+
"year": 2025,
866+
"incident_id": "INC-086"
867+
},
868+
{
869+
"name": "Malicious MCP server backdoor on npm — dual reverse shells in mcp-runcommand-server",
870+
"url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
871+
"year": 2025,
872+
"incident_id": "INC-087"
873+
},
874+
{
875+
"name": "Agent-in-the-Middle — A2A protocol spoofing via fake agent cards",
876+
"url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
877+
"year": 2025,
878+
"incident_id": "INC-090"
879+
},
880+
{
881+
"name": "LiteLLM PyPI supply chain backdoor — TeamPCP campaign compromises 3.4M daily downloads",
882+
"url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
883+
"year": 2026,
884+
"incident_id": "INC-093"
885+
},
886+
{
887+
"name": "GlassWorm supply chain — 72 malicious VSCode extensions, 9 million installs",
888+
"url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
889+
"year": 2026,
890+
"incident_id": "INC-097"
891+
},
892+
{
893+
"name": "Moltbook — vibe-coded social network exposes 1.5M API tokens and 35K emails",
894+
"url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
895+
"year": 2026,
896+
"incident_id": "INC-099"
897+
},
898+
{
899+
"name": "OpenClaw AI agent security crisis — 138 CVEs in 63 days, 341 malicious marketplace skills",
900+
"url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
901+
"year": 2026,
902+
"incident_id": "INC-102"
903+
},
904+
{
905+
"name": "ServiceNow BodySnatcher — hardcoded secret key enables full AI agent hijacking (CVE-2025-12420)",
906+
"url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
907+
"year": 2025,
908+
"incident_id": "INC-104"
909+
},
910+
{
911+
"name": "Microsoft Copilot Studio agents public by default — unauthorized data exfiltration",
912+
"url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
913+
"year": 2025,
914+
"incident_id": "INC-105"
915+
},
916+
{
917+
"name": "Salesloft Drift OAuth breach — Chinese actor UNC6395 accesses 700+ Salesforce CRM environments",
918+
"url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
919+
"year": 2025,
920+
"incident_id": "INC-109"
921+
},
922+
{
923+
"name": "Chat & Ask AI app — 300 million messages from 25 million users exposed via misconfigured Firebase",
924+
"url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
925+
"year": 2026,
926+
"incident_id": "INC-112"
927+
},
928+
{
929+
"name": "AgentSeal MCP server mass scan — 66% of 1,808 servers have security findings",
930+
"url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
931+
"year": 2025,
932+
"incident_id": "INC-114"
855933
}
856934
],
857935
"crossrefs": {

‎data/entries/ASI04.json‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -758,6 +758,84 @@
758758
"url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
759759
"year": 2023,
760760
"incident_id": "INC-079"
761+
},
762+
{
763+
"name": "Claude Skills ransomware deployment — MedusaLocker via malicious plugin",
764+
"url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
765+
"year": 2025,
766+
"incident_id": "INC-081"
767+
},
768+
{
769+
"name": "ShadowRay 2.0 botnet — self-spreading crypto-mining via Ray AI framework",
770+
"url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
771+
"year": 2025,
772+
"incident_id": "INC-084"
773+
},
774+
{
775+
"name": "ShadowMQ — critical RCE in Meta/NVIDIA/vLLM inference servers via pickle deserialization",
776+
"url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
777+
"year": 2025,
778+
"incident_id": "INC-085"
779+
},
780+
{
781+
"name": "Malicious MCP server backdoor on npm — dual reverse shells in mcp-runcommand-server",
782+
"url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
783+
"year": 2025,
784+
"incident_id": "INC-087"
785+
},
786+
{
787+
"name": "LiteLLM PyPI supply chain backdoor — TeamPCP campaign compromises 3.4M daily downloads",
788+
"url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
789+
"year": 2026,
790+
"incident_id": "INC-093"
791+
},
792+
{
793+
"name": "Axios npm supply chain attack — North Korean Sapphire Sleet targets 70M weekly downloads",
794+
"url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
795+
"year": 2026,
796+
"incident_id": "INC-094"
797+
},
798+
{
799+
"name": "GlassWorm supply chain — 72 malicious VSCode extensions, 9 million installs",
800+
"url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
801+
"year": 2026,
802+
"incident_id": "INC-097"
803+
},
804+
{
805+
"name": "Clinejection — CI/CD pipeline compromise via Cline's issue triage bot, 4,000 machines infected",
806+
"url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
807+
"year": 2026,
808+
"incident_id": "INC-098"
809+
},
810+
{
811+
"name": "OpenClaw AI agent security crisis — 138 CVEs in 63 days, 341 malicious marketplace skills",
812+
"url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
813+
"year": 2026,
814+
"incident_id": "INC-102"
815+
},
816+
{
817+
"name": "IDEsaster — 30+ vulnerabilities across AI coding tools (Cursor, Windsurf, Copilot, Zed, Roo Code)",
818+
"url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
819+
"year": 2025,
820+
"incident_id": "INC-103"
821+
},
822+
{
823+
"name": "Salesloft Drift OAuth breach — Chinese actor UNC6395 accesses 700+ Salesforce CRM environments",
824+
"url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
825+
"year": 2025,
826+
"incident_id": "INC-109"
827+
},
828+
{
829+
"name": "WhatsApp MCP tool poisoning — hidden instructions exfiltrate entire message history",
830+
"url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
831+
"year": 2025,
832+
"incident_id": "INC-111"
833+
},
834+
{
835+
"name": "AgentSeal MCP server mass scan — 66% of 1,808 servers have security findings",
836+
"url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
837+
"year": 2025,
838+
"incident_id": "INC-114"
761839
}
762840
],
763841
"crossrefs": {

0 commit comments

Comments
 (0)