International AI Safety ReportMalicious use§2.1.3, Box 2.1

AI systems themselves become targets

Seen in real incidents85 matching case files

The warning

Attackers can manipulate AI systems through prompt injection, poisoned data and compromised components, to change how they behave or to pull out sensitive information.

Paraphrased from the source. Source: International AI Safety Report 2026, Feb 3, 2026, section 2.1.3, Box 2.1, page 62. Summary by International AI Safety Report: internationalaisafetyreport.org.

What the registry shows

Hidden instructions that make assistants leak mail and files, hijacked coding agents, malicious packages and plugins aimed at AI developers, and actively exploited flaws in AI tools. Many prompt injection cases are demonstrations by researchers; most supply-chain attacks happened in the real world.

Verified case files show this risk happening in the real world. First real-world case on file: Dec 30, 2022 · Already on file when this research was published.

Matching case files per quarter

Seen in real incidentsLab test or researcher demonstration

Status history

Date	Status	Matching case files	Change
Oct 18, 2026	Seen in real incidents	84	Tracking starts

Tracked since Oct 18, 2026. A line is added when the status changes, when the first real-world case is linked, and once a month, so the record shows when a warning moved from research to reality. research_history.json

All matching case files

Oct 15, 2026Undisclosed jqwik addition instructs AI coding agents to delete app output
Oct 15, 2026Hidden prompt injection in legal filing instructs AI reviewers to side with filer
Oct 14, 2026Fake Codex download pages on Google Sites deliver macOS malware via ClickFix
Oct 14, 2026LiteLLM proxy SQL injection (CVE-2026-42208) actively exploited
Oct 14, 2026macOS.Gaslight backdoor injects fake prompts at LLM malware-triage tools
Oct 14, 2026MLflow SSRF flaw (CVE-2026-64849) actively exploited, exposing internal services
Oct 14, 2026Malicious OpenClaw skill distributes Remcos RAT and GhostLoader
Oct 14, 2026Ray code injection RCE (CVE-2025-62593) actively exploited
Oct 14, 2026Wiz Red Agent reaches Snowflake's internal Jira via GitHub Actions flaw in Copilot-assisted PR · Lab test or researcher demonstration
Sep 10, 2026GTG-50020: extortionist prompt-injects AI vendor eval sandbox, then hits 30 AI firms
Sep 8, 2026Planted prompt makes ChatGPT copy victims' Gmail data to attacker account · Lab test or researcher demonstration
Sep 8, 2026TeamPCP's DUSTMAKER hides in .claude and .cursor folders and prompt-injects LLM scanners
Sep 2, 2026LiteLLM MCP gateway accepts any Bearer token (CVE-2026-59822); CISA confirms exploitation
Aug 19, 2026CISA lists MLflow webhook SSRF (CVE-2026-64849) reaching cloud metadata as exploited
Aug 17, 2026Browser-based Ray RCE (CVE-2025-62593) used by RondoDox botnet lands on CISA KEV
Aug 4, 2026Langflow hit by four more KEV listings in 2026: token hijack, IDOR, root RCE and auto_login chain
Jul 2, 2026DuneSlide: two 9.8 Cursor flaws let prompt injection escape sandbox for OS-level RCE · Lab test or researcher demonstration
Jun 17, 2026North Korea's Sapphire Sleet hijacks maintainer account to trojanize 140+ Mastra AI npm packages
Jun 15, 2026SearchLeak: one-click chain in M365 Copilot Enterprise Search exfiltrates data via Bing · Lab test or researcher demonstration
Jun 9, 2026Typosquatted npm MCP servers phone home on install posing as official modelcontextprotocol packages
Jun 8, 2026CISA adds actively exploited LiteLLM AI gateway RCE (CVE-2026-42271) to KEV
Jun 8, 2026Hackers trick Meta's AI support chatbot into handing over Instagram accounts
Jun 2, 2026Trojanized codexui-android npm package steals OpenAI Codex tokens
May 14, 2026OpenAI confirms two employee devices and source repos breached in Mini Shai-Hulud npm worm
May 12, 2026Mini Shai-Hulud worm hits TanStack, Mistral AI and Guardrails AI packages
May 7, 2026Fake 'OpenAI Privacy Filter' repo tops Hugging Face trending while pushing Rust infostealer
Apr 30, 2026Backdoored PyTorch Lightning 2.6.3 on PyPI runs Bun-based credential stealer on import
Apr 21, 2026Claude Code sandbox escape via symlinks allows host code execution (CVE-2026-39861) · Lab test or researcher demonstration
Apr 19, 2026Compromised Context.ai AI tool's OAuth grant leads to Vercel breach
Apr 16, 2026Marimo notebook RCE (CVE-2026-39987) exploited in hours; NKAbuse RAT staged on Hugging Face Spaces
Apr 15, 2026Prompt injection leaks data from Microsoft Copilot Studio and Salesforce Agentforce agents · Lab test or researcher demonstration
Apr 7, 2026Max-severity Flowise CustomMCP RCE (CVE-2025-59528) exploited in the wild
Apr 7, 2026GrafanaGhost: indirect prompt injection makes Grafana AI leak enterprise data · Lab test or researcher demonstration
Apr 3, 2026Poisoned LiteLLM releases tied to Mercor breach exposing AI lab training secrets
Apr 2, 2026prt-scan: AI-powered campaign exploits pull_request_target in GitHub workflows
Mar 31, 2026OpenAI Codex branch-name command injection exposed GitHub tokens in cloud tasks · Lab test or researcher demonstration
Mar 31, 2026Vertex AI 'Double Agent': over-privileged agents leak credentials and code · Lab test or researcher demonstration
Mar 30, 2026Check Point finds DNS tunnel out of ChatGPT's code sandbox leaking chats and files · Lab test or researcher demonstration
Mar 25, 2026Langflow unauthenticated RCE (CVE-2026-33017) exploited within 20 hours of advisory
Mar 11, 2026CISA confirms active exploitation of max-severity n8n expression injection RCE
Mar 5, 2026Bing AI search promotes fake OpenClaw installer repos pushing Atomic and Vidar stealers
Feb 17, 2026Compromised Cline CLI npm release silently installs OpenClaw agent
Feb 4, 2026Over 230 malicious OpenClaw skills on ClawHub push password stealers
Jan 29, 2026Hugging Face datasets abused to serve polymorphic Android RAT payloads every 15 minutes
Jan 23, 2026MaliciousCorgi: 'ChatGPT' and 'ChatMoss' VS Code AI extensions with 1.5M installs exfiltrate open files
Jan 21, 2026BodySnatcher: unauthenticated impersonation via ServiceNow Virtual Agent (CVE-2025-12420) · Lab test or researcher demonstration
Jan 20, 2026Prompt injection flaws in Anthropic's Git MCP server enable file access and code execution · Lab test or researcher demonstration
Jan 14, 2026Reprompt: one-click attack hijacks Microsoft Copilot sessions to steal data · Lab test or researcher demonstration
Dec 8, 2025GeminiJack: zero-click injection in Gemini Enterprise exfiltrated Gmail, Calendar and Docs · Lab test or researcher demonstration
Nov 25, 2025HashJack: prompts hidden in URL fragments hijack Comet, Edge Copilot and Gemini in Chrome · Lab test or researcher demonstration
Nov 5, 2025HackedGPT: Tenable finds seven ChatGPT flaws including persistent memory injection · Lab test or researcher demonstration
Oct 15, 2025Path traversal in Smithery MCP hosting exposed root access to 3,000 hosted MCP servers · Lab test or researcher demonstration
Oct 9, 2025CamoLeak: hidden PR comments make GitHub Copilot Chat leak private repo secrets · Lab test or researcher demonstration
Sep 30, 2025Gemini Trifecta: log, search-history and browsing flaws let Gemini exfiltrate user data · Lab test or researcher demonstration
Sep 25, 2025ForcedLeak: Web-to-Lead prompt injection and a $5 expired domain leak Agentforce CRM data · Lab test or researcher demonstration
Sep 25, 2025First malicious MCP server found: postmark-mcp npm package BCCs all emails to attacker
Sep 19, 2025Notion 3.0 agents tricked by white-text PDF into leaking client data via web search · Lab test or researcher demonstration
Sep 18, 2025ShadowLeak: zero-click prompt injection makes ChatGPT Deep Research leak Gmail data · Lab test or researcher demonstration
Sep 13, 2025WhiteCobra floods Open VSX and VS Code Marketplace with 24 crypto-stealing extensions
Aug 27, 2025s1ngularity: trojanized Nx packages weaponize Claude and Gemini CLIs to steal secrets
Aug 26, 2025Drift AI chatbot OAuth tokens stolen to raid 700+ Salesforce tenants
Aug 20, 2025Brave shows Perplexity Comet can be hijacked by a Reddit comment to steal Gmail OTPs · Lab test or researcher demonstration
Aug 18, 2025Lenovo's Lena support chatbot coaxed into XSS payload that steals agent session cookies · Lab test or researcher demonstration
Aug 12, 2025Copilot prompt injection flips VS Code to auto-approve mode for RCE (CVE-2025-53773) · Lab test or researcher demonstration
Aug 6, 2025AgentFlayer: one poisoned Google Drive document makes ChatGPT leak API keys · Lab test or researcher demonstration
Aug 6, 2025Invitation Is All You Need: poisoned calendar invites make Gemini control smart homes · Lab test or researcher demonstration
Aug 5, 2025Claude Code command injection bypasses confirmation prompt (CVE-2025-54795 and -54794) · Lab test or researcher demonstration
Aug 1, 2025CurXecute and MCPoison: Cursor IDE MCP config flaws allow silent code execution · Lab test or researcher demonstration
Jul 28, 2025Gemini CLI hijacked via poisoned README to silently exfiltrate credentials · Lab test or researcher demonstration
Jul 23, 2025Hacker plants data-wiping prompt in Amazon Q Developer VS Code extension
Jul 10, 2025Fake 'Solidity Language' extension on Open VSX drains $500K from Cursor developer
Jul 10, 2025Hidden email text makes Gemini for Workspace summaries deliver fake security alerts · Lab test or researcher demonstration
Jul 6, 2025Support ticket prompt injection makes Cursor plus Supabase MCP dump integration tokens · Lab test or researcher demonstration
Jul 5, 2025Nikkei finds hidden prompts telling AI reviewers to praise papers in 17 preprints from 14 universities · Lab test or researcher demonstration
Jun 25, 2025Skynet malware sample embeds prompt injection to fool AI malware analysis tools
Jun 18, 2025Pickai backdoor spreads through ComfyUI flaws to nearly 700 AI image servers
Jun 17, 2025Langflow AI agent builder RCE (CVE-2025-3248) exploited to spread Flodrix botnet
Jun 11, 2025EchoLeak: zero-click prompt injection in Microsoft 365 Copilot (CVE-2025-32711) · Lab test or researcher demonstration
May 22, 2025PyPI packages posing as Alibaba AI Labs SDK hide infostealer in PyTorch model
May 22, 2025GitLab Duo prompt injection leaks private source code via hidden merge request text · Lab test or researcher demonstration
May 9, 2025npm packages 'sw-cur' and 'aiide-cur' backdoor Cursor on macOS, 3,200 downloads
Feb 6, 2025nullifAI: broken-pickle models on Hugging Face evade Picklescan and carry reverse shells
Jan 29, 2025Fake 'deepseeek' and 'deepseekai' PyPI packages steal secrets from DeepSeek developers
Dec 4, 2024Ultralytics AI library hacked via GitHub Actions to push cryptominer on PyPI
Dec 30, 2022Malicious 'torchtriton' dependency confusion package hits PyTorch via PyPI

The same case files in other research

Seen in real incidents Privacy and security · MIT AI Risk Repository · 85 shared
Seen in real incidents Powerful AI gets leaked or stolen · CAIS · 2 shared

Warnings from other sources that link to some of the same case files.

Other warnings in this group

Seen in real incidents AI-made fakes fuel fraud and extortion
Early signs AI content is used to sway what people believe
Seen in real incidents Criminals and state hackers use AI in cyberattacks
Seen in real incidents AI runs more of each attack, short of full autonomy
Nothing on record yet AI gives expert-level help toward biological and chemical weapons

Research vs reality · International AI Safety Report →

How we match: a case file is linked to a warning when what happened is a real-world instance of the risk the source describes, judged by the editors from the facts in the case file. A match means the case fits the warning, not that it proves the source's wider argument. Allegations in lawsuits are labelled as allegations. Statuses are editorial and reviewed as new cases arrive. The matching is recomputed on every update. Data: Systematic coverage in the registry starts in 2025, so a first-case date shows when the registry first recorded the risk, not when it first happened. research.json (CC BY 4.0)