MIT AI Risk InitiativeSeven risk domainsDomain 2

Privacy and security

Seen in real incidents141 matching case files

The risk domain

AI that leaks or infers sensitive personal data, and weaknesses in AI systems and their toolchains that attackers exploit.

Paraphrased from the source. Source: The AI Risk Repository: A Meta-Review, Database, and Taxonomy of Risks From Artificial Intelligence, MIT AI Risk Initiative, Aug 14, 2024, domain 2, Table 2, page 8. Summary by MIT AI Risk Initiative: airisk.mit.edu.

What the registry shows

One of the two pillars of the registry: leaked chats and keys, exposed databases, prompt injection, hijacked agents, poisoned packages and stolen AI accounts.

Verified case files show this risk happening in the real world.

Matching case files per quarter

Seen in real incidentsLab test or researcher demonstration

Status history

Date	Status	Matching case files	Change
Oct 18, 2026	Seen in real incidents	138	Tracking starts

Tracked since Oct 18, 2026. A line is added when the status changes, when the first real-world case is linked, and once a month, so the record shows when a warning moved from research to reality. research_history.json

All matching case files

Oct 16, 2026Aoki infostealer expands to steal Claude, ChatGPT and Cursor credentials
Oct 16, 2026JINX-2401 LLM hijacking campaign targets AWS environments with IAM privilege escalation
Oct 15, 2026BodySwap sexual deepfake platform breach exposes about 10,300 user accounts
Oct 15, 2026Undisclosed jqwik addition instructs AI coding agents to delete app output
Oct 15, 2026Hidden prompt injection in legal filing instructs AI reviewers to side with filer
Oct 14, 2026Fake Codex download pages on Google Sites deliver macOS malware via ClickFix
Oct 14, 2026LiteLLM proxy SQL injection (CVE-2026-42208) actively exploited
Oct 14, 2026macOS.Gaslight backdoor injects fake prompts at LLM malware-triage tools
Oct 14, 2026MLflow SSRF flaw (CVE-2026-64849) actively exploited, exposing internal services
Oct 14, 2026Malicious OpenClaw skill distributes Remcos RAT and GhostLoader
Oct 14, 2026Ray code injection RCE (CVE-2025-62593) actively exploited
Oct 14, 2026Wiz Red Agent reaches Snowflake's internal Jira via GitHub Actions flaw in Copilot-assisted PR · Lab test or researcher demonstration
Oct 7, 2026PoeLLM botnet infects 3,400 servers running exposed LiteLLM and Ollama for cryptomining
Sep 29, 2026PixelLeak: AI coding agents push 13,000 internal screenshots to public GitHub
Sep 10, 2026GTG-16005: Anthropic says Alibaba ran 151M-exchange distillation of Claude to train Qwen
Sep 10, 2026GTG-16006: Zhipu accused of cyber-focused distillation of Claude Opus through 273 accounts
Sep 10, 2026GTG-16008: Xiaomi replayed MiMo user sessions through Claude via 1,500 accounts
Sep 10, 2026GTG-50020: extortionist prompt-injects AI vendor eval sandbox, then hits 30 AI firms
Sep 10, 2026GTG-50021: fake discounted-Claude reseller proxied traffic and stole Anthropic credentials
Sep 8, 2026Planted prompt makes ChatGPT copy victims' Gmail data to attacker account · Lab test or researcher demonstration
Sep 8, 2026TeamPCP's DUSTMAKER hides in .claude and .cursor folders and prompt-injects LLM scanners
Sep 8, 2026Okta: free Telegram stealer dump holds thousands of live AI session tokens and 24 API keys
Sep 2, 2026LiteLLM MCP gateway accepts any Bearer token (CVE-2026-59822); CISA confirms exploitation
Aug 31, 2026Attacker takes METR API key from a researcher's exposed agent app and runs up $600,000 in donated credits
Aug 21, 2026Truffle Security: 9,300 live AWS keys exposed, with Hugging Face the largest single source · Lab test or researcher demonstration
Aug 19, 2026CISA lists MLflow webhook SSRF (CVE-2026-64849) reaching cloud metadata as exploited
Aug 17, 2026Browser-based Ray RCE (CVE-2025-62593) used by RondoDox botnet lands on CISA KEV
Aug 4, 2026Langflow hit by four more KEV listings in 2026: token hijack, IDOR, root RCE and auto_login chain
Jul 2, 2026DuneSlide: two 9.8 Cursor flaws let prompt injection escape sandbox for OS-level RCE · Lab test or researcher demonstration
Jun 17, 2026North Korea's Sapphire Sleet hijacks maintainer account to trojanize 140+ Mastra AI npm packages
Jun 16, 202615 JetBrains Marketplace AI plugins with 70,000 installs steal OpenAI and DeepSeek keys
Jun 15, 2026SearchLeak: one-click chain in M365 Copilot Enterprise Search exfiltrates data via Bing · Lab test or researcher demonstration
Jun 12, 2026Hijacked Ollama server used as brain of autonomous hacking pipeline
Jun 9, 2026Typosquatted npm MCP servers phone home on install posing as official modelcontextprotocol packages
Jun 8, 2026CISA adds actively exploited LiteLLM AI gateway RCE (CVE-2026-42271) to KEV
Jun 8, 2026Hackers trick Meta's AI support chatbot into handing over Instagram accounts
Jun 2, 2026Trojanized codexui-android npm package steals OpenAI Codex tokens
May 14, 2026OpenAI confirms two employee devices and source repos breached in Mini Shai-Hulud npm worm
May 12, 2026Mini Shai-Hulud worm hits TanStack, Mistral AI and Guardrails AI packages
May 11, 2026PRC clusters UNC5673 and UNC6201 pooled Gemini, Claude and OpenAI accounts via proxies
May 7, 2026Fake 'OpenAI Privacy Filter' repo tops Hugging Face trending while pushing Rust infostealer
Apr 30, 2026Backdoored PyTorch Lightning 2.6.3 on PyPI runs Bun-based credential stealer on import
Apr 21, 2026Claude Code sandbox escape via symlinks allows host code execution (CVE-2026-39861) · Lab test or researcher demonstration
Apr 21, 2026Unauthorized group accesses Anthropic's restricted Claude Mythos model via vendor
Apr 20, 2026Researcher: free Lovable account could read source, Supabase keys and chats of pre-Nov 2025 projects · Lab test or researcher demonstration
Apr 19, 2026Compromised Context.ai AI tool's OAuth grant leads to Vercel breach
Apr 16, 2026Marimo notebook RCE (CVE-2026-39987) exploited in hours; NKAbuse RAT staged on Hugging Face Spaces
Apr 15, 2026Prompt injection leaks data from Microsoft Copilot Studio and Salesforce Agentforce agents · Lab test or researcher demonstration
Apr 7, 2026Max-severity Flowise CustomMCP RCE (CVE-2025-59528) exploited in the wild
Apr 7, 2026GrafanaGhost: indirect prompt injection makes Grafana AI leak enterprise data · Lab test or researcher demonstration
Apr 3, 2026Poisoned LiteLLM releases tied to Mercor breach exposing AI lab training secrets
Apr 2, 2026prt-scan: AI-powered campaign exploits pull_request_target in GitHub workflows
Mar 31, 2026Claude Code source map leak followed by malware-laced fake 'leak' repos
Mar 31, 2026OpenAI Codex branch-name command injection exposed GitHub tokens in cloud tasks · Lab test or researcher demonstration
Mar 31, 2026Vertex AI 'Double Agent': over-privileged agents leak credentials and code · Lab test or researcher demonstration
Mar 30, 2026Check Point finds DNS tunnel out of ChatGPT's code sandbox leaking chats and files · Lab test or researcher demonstration
Mar 25, 2026Langflow unauthenticated RCE (CVE-2026-33017) exploited within 20 hours of advisory
Mar 20, 2026Meta AI agent's flawed advice exposes sensitive data to employees for two hours
Mar 18, 2026Cybernews: 45 of 98 unauthenticated Open WebUI servers already running miners and stealers
Mar 11, 2026CISA confirms active exploitation of max-severity n8n expression injection RCE
Mar 9, 2026Autonomous AI agent breaches McKinsey's Lilli chatbot platform in two hours · Lab test or researcher demonstration
Mar 5, 2026Bing AI search promotes fake OpenClaw installer repos pushing Atomic and Vidar stealers
Feb 23, 2026Anthropic accuses DeepSeek, Moonshot and MiniMax of distilling Claude via 24,000 accounts
Feb 17, 2026Compromised Cline CLI npm release silently installs OpenClaw agent
Feb 16, 2026Infostealer captures OpenClaw gateway token, device keys and agent memory files
Feb 4, 2026Over 230 malicious OpenClaw skills on ClawHub push password stealers
Feb 2, 2026Moltbook AI-agent social network exposes 1.5M agent API tokens · Lab test or researcher demonstration
Jan 29, 2026Chat & Ask AI app leaks ~300M messages from 25M users via open Firebase · Lab test or researcher demonstration
Jan 29, 2026Hugging Face datasets abused to serve polymorphic Android RAT payloads every 15 minutes
Jan 28, 2026Operation Bizarre Bazaar: hijacked LLM endpoints resold through commercial marketplace
Jan 27, 2026Tens of thousands of OpenClaw agent gateways exposed online leaking API keys and chats
Jan 23, 2026MaliciousCorgi: 'ChatGPT' and 'ChatMoss' VS Code AI extensions with 1.5M installs exfiltrate open files
Jan 21, 2026BodySnatcher: unauthenticated impersonation via ServiceNow Virtual Agent (CVE-2025-12420) · Lab test or researcher demonstration
Jan 21, 2026Microsoft 365 Copilot bug summarises confidential emails despite DLP policies
Jan 20, 2026Prompt injection flaws in Anthropic's Git MCP server enable file access and code execution · Lab test or researcher demonstration
Jan 14, 2026Reprompt: one-click attack hijacks Microsoft Copilot sessions to steal data · Lab test or researcher demonstration
Dec 8, 2025GeminiJack: zero-click injection in Gemini Enterprise exfiltrated Gmail, Calendar and Docs · Lab test or researcher demonstration
Nov 26, 2025OpenAI API user data exposed in breach of analytics vendor Mixpanel
Nov 25, 2025HashJack: prompts hidden in URL fragments hijack Comet, Edge Copilot and Gemini in Chrome · Lab test or researcher demonstration
Nov 18, 2025ShadowRay 2.0 turns exposed Ray AI clusters into self-spreading mining botnet
Nov 5, 2025HackedGPT: Tenable finds seven ChatGPT flaws including persistent memory injection · Lab test or researcher demonstration
Oct 15, 2025Path traversal in Smithery MCP hosting exposed root access to 3,000 hosted MCP servers · Lab test or researcher demonstration
Oct 9, 2025CamoLeak: hidden PR comments make GitHub Copilot Chat leak private repo secrets · Lab test or researcher demonstration
Sep 30, 2025Gemini Trifecta: log, search-history and browsing flaws let Gemini exfiltrate user data · Lab test or researcher demonstration
Sep 25, 2025ForcedLeak: Web-to-Lead prompt injection and a $5 expired domain leak Agentforce CRM data · Lab test or researcher demonstration
Sep 25, 2025First malicious MCP server found: postmark-mcp npm package BCCs all emails to attacker
Sep 19, 2025Notion 3.0 agents tricked by white-text PDF into leaking client data via web search · Lab test or researcher demonstration
Sep 18, 2025ShadowLeak: zero-click prompt injection makes ChatGPT Deep Research leak Gmail data · Lab test or researcher demonstration
Sep 13, 2025WhiteCobra floods Open VSX and VS Code Marketplace with 24 crypto-stealing extensions
Sep 10, 2025Vyro AI leaves 116GB of ImagineArt and Chatly prompts and tokens on open Elasticsearch
Sep 2, 2025Cisco Talos finds over 1,100 Ollama LLM servers open to the internet without authentication · Lab test or researcher demonstration
Aug 27, 2025s1ngularity: trojanized Nx packages weaponize Claude and Gemini CLIs to steal secrets
Aug 26, 2025Drift AI chatbot OAuth tokens stolen to raid 700+ Salesforce tenants
Aug 20, 2025Brave shows Perplexity Comet can be hijacked by a Reddit comment to steal Gmail OTPs · Lab test or researcher demonstration
Aug 20, 2025Over 370,000 Grok conversations exposed in Google search via share links
Aug 18, 2025Microsoft 365 Copilot summarised files without writing audit log entries · Lab test or researcher demonstration
Aug 18, 2025Lenovo's Lena support chatbot coaxed into XSS payload that steals agent session cookies · Lab test or researcher demonstration
Aug 12, 2025Copilot prompt injection flips VS Code to auto-approve mode for RCE (CVE-2025-53773) · Lab test or researcher demonstration
Aug 6, 2025AgentFlayer: one poisoned Google Drive document makes ChatGPT leak API keys · Lab test or researcher demonstration
Aug 6, 2025Invitation Is All You Need: poisoned calendar invites make Gemini control smart homes · Lab test or researcher demonstration
Aug 5, 2025Claude Code command injection bypasses confirmation prompt (CVE-2025-54795 and -54794) · Lab test or researcher demonstration
Aug 1, 2025CurXecute and MCPoison: Cursor IDE MCP config flaws allow silent code execution · Lab test or researcher demonstration
Jul 31, 2025Thousands of shared ChatGPT conversations surface in Google search; OpenAI kills feature
Jul 29, 2025Wiz finds auth bypass exposing private enterprise apps on Wix's Base44 platform · Lab test or researcher demonstration
Jul 28, 2025Gemini CLI hijacked via poisoned README to silently exfiltrate credentials · Lab test or researcher demonstration
Jul 25, 2025Exposed llama.cpp servers leak user prompts through the /slots debug endpoint · Lab test or researcher demonstration
Jul 23, 2025Hacker plants data-wiping prompt in Amazon Q Developer VS Code extension
Jul 15, 2025Meta AI bug let any logged-in user read other people's private prompts and replies · Lab test or researcher demonstration
Jul 14, 2025DOGE staffer Marko Elez leaks xAI API key granting access to 52 Grok models
Jul 10, 2025Fake 'Solidity Language' extension on Open VSX drains $500K from Cursor developer
Jul 10, 2025Hidden email text makes Gemini for Workspace summaries deliver fake security alerts · Lab test or researcher demonstration
Jul 9, 2025McDonald's McHire AI hiring bot exposed up to 64M applicant records via '123456' login · Lab test or researcher demonstration
Jul 6, 2025Support ticket prompt injection makes Cursor plus Supabase MCP dump integration tokens · Lab test or researcher demonstration
Jul 5, 2025Nikkei finds hidden prompts telling AI reviewers to praise papers in 17 preprints from 14 universities · Lab test or researcher demonstration
Jun 25, 2025Skynet malware sample embeds prompt injection to fool AI malware analysis tools
Jun 18, 2025Pickai backdoor spreads through ComfyUI flaws to nearly 700 AI image servers
Jun 17, 2025Asana MCP server logic flaw exposed customer data across organisations for a month
Jun 17, 2025Langflow AI agent builder RCE (CVE-2025-3248) exploited to spread Flodrix botnet
Jun 12, 2025Meta AI app's Discover feed broadcasts users' private medical and legal chats
Jun 11, 2025EchoLeak: zero-click prompt injection in Microsoft 365 Copilot (CVE-2025-32711) · Lab test or researcher demonstration
Jun 2, 2025Exposed Open WebUI instance hijacked to run AI-generated cryptominer and infostealer
May 29, 2025Lovable-built apps leak user data: 303 endpoints across 170 projects lacked row-level security · Lab test or researcher demonstration
May 22, 2025PyPI packages posing as Alibaba AI Labs SDK hide infostealer in PyTorch model
May 22, 2025GitLab Duo prompt injection leaks private source code via hidden merge request text · Lab test or researcher demonstration
May 9, 2025npm packages 'sw-cur' and 'aiide-cur' backdoor Cursor on macOS, 3,200 downloads
May 1, 2025xAI employee leaks API key on GitHub exposing 60 private Grok models for two months
Apr 24, 2025Korea's PIPC: DeepSeek sent Korean users' prompts to ByteDance-linked Volcano Engine
Mar 12, 2025AP/Seattle Times obtain ~3,500 unredacted student files flagged by Gaggle AI monitoring in Vancouver, WA
Feb 27, 2025Microsoft names Storm-2139 members who hijacked Azure OpenAI with stolen keys
Feb 26, 2025Copilot serves code from 20,000 GitHub repos that were made private, via Bing cache · Lab test or researcher demonstration
Feb 9, 2025Hacker 'Gloomer' claims OmniGPT breach leaking 34M chat lines and 30K user contacts
Feb 7, 2025LLMjacking crews load stolen DeepSeek keys into reverse proxies days after model launch
Feb 6, 2025nullifAI: broken-pickle models on Hugging Face evade Picklescan and carry reverse shells
Jan 29, 2025Fake 'deepseeek' and 'deepseekai' PyPI packages steal secrets from DeepSeek developers
Jan 29, 2025DeepSeek leaves ClickHouse database with chat logs and API secrets open
Jan 29, 2025OpenAI says it has evidence DeepSeek distilled its models through blocked API accounts
Jan 28, 2025DeepSeek halts new sign-ups after month-long DDoS and brute-force campaign peaks
Dec 4, 2024Ultralytics AI library hacked via GitHub Actions to push cryptominer on PyPI
Jul 1, 2024Whistleblower says LAUSD's $6M 'Ed' AI chatbot sent student data offshore before vendor AllHere collapsed
Sep 18, 2023Microsoft AI researchers expose 38TB of data via misconfigured SAS token
Dec 30, 2022Malicious 'torchtriton' dependency confusion package hits PyTorch via PyPI

The same case files in other research

Seen in real incidents AI systems themselves become targets · International AI Safety Report · 85 shared
Seen in real incidents Accidents with AI are hard to avoid · CAIS · 13 shared
Seen in real incidents Powerful AI gets leaked or stolen · CAIS · 11 shared
Seen in real incidents AI agents fail with fewer chances to stop them · International AI Safety Report · 3 shared
Seen in real incidents AI developers' own safety measures fail · CAIS · 2 shared
Seen in real incidents AI runs more of each attack, short of full autonomy · International AI Safety Report · 1 shared

Warnings from other sources that link to some of the same case files.

Other warnings in this group

Outside what we measure Discrimination and toxic content
Early signs Misinformation
Seen in real incidents Malicious actors and misuse
Seen in real incidents Human-computer interaction
Outside what we measure Socioeconomic and environmental harm
Seen in real incidents AI system safety, failures and limitations

Research vs reality · MIT AI Risk Repository →

How we match: a case file is linked to a warning when what happened is a real-world instance of the risk the source describes, judged by the editors from the facts in the case file. A match means the case fits the warning, not that it proves the source's wider argument. Allegations in lawsuits are labelled as allegations. Statuses are editorial and reviewed as new cases arrive. The matching is recomputed on every update. Data: Systematic coverage in the registry starts in 2025, so a first-case date shows when the registry first recorded the risk, not when it first happened. research.json (CC BY 4.0)