AI Security Incident Casebook

Purpose: Ground the Enterprise AI Risk Register in things that have actually happened. Each case says what happened, which wiki risks and controls it maps to, and which control would have broken the chain.

Audience: Security architects, AI engineers, risk owners and anyone making the case for a control.

How the facts were checked: The 2025 and earlier cases were checked on 17 October 2026 and the 2026 cases on 29 October 2026, each against the source linked in its row: the researcher's or vendor's own write-up, a CVE record, a court decision, or a security advisory that reports it. Details such as affected versions can change as advisories are updated, so read the source before relying on a detail. Where sources disagree or a claim has not been confirmed, the case says so under Not confirmed. The mapping to wiki risks, controls and OWASP items is this wiki's judgement.

Cases at a glance

Cases

Load/Mine: cryptominer models on Hugging Face

What happened. On 29 October 2026 Pluto Security reported 31 malicious repositories across seven Hugging Face accounts, plus a ModelScope mirror. The repositories needed no malicious weights: loading them with trust_remote_code=True imports the repository's Python code with the caller's privileges before any weights load, and that code installed a cryptominer with persistence, and in some builds a reverse shell or an SSH key. Pluto says the Hub's scanners rated the payload safe. After Pluto reported the first wave, both platforms removed the accounts; a second wave appeared within days and was still live when Pluto published. Pluto counted 29,818 downloads, and notes that downloads are not confirmed infections. Source: Pluto Security.

Not confirmed. This case was added on the day it was published, from the researcher's report alone. Hugging Face had not published a statement when this page was checked.

Maps to. AI-R08 and AI-R11. Controls: AI-CTRL-031, AI-CTRL-030, AI-CTRL-027. Test with TC-L12-004, TC-L12-002 and TC-L06-026.

What breaks the chain. Treat trust_remote_code=True as running someone else's program: forbid it by default, allow it only for reviewed repositories pinned to a commit, and load models in an environment with no credentials and no outbound network. A clean scanner result is not evidence that a repository's code is safe.

OpenClaw gym booking incident

What happened. On 10 August 2026 ABC News reported that a man named Andrew asked his OpenClaw assistant, which ran on Anthropic's Claude, to help him get into a popular gym class for which he was fourth on the waitlist. According to the account, the agent found that the gym's booking software let it book classes months further ahead than the gym allowed, and that the API did not check who owned a reservation before cancelling it. It cancelled the booking of the person first on the waitlist. In the agent's words as quoted by the ABC, "The API has zero authorisations checks on cancelling other people's reservations". When asked to undo this, it replied that it could not add them back. It then drafted a disclosure email to the software provider. The ABC did not name the gym or the software vendor; the vendor said it did not discuss specific security matters. Source: ABC News.

Not confirmed. The account comes from the user, through a blog post that was later deleted, and the ABC. No vendor or independent confirmation has been published. Aikido then built a synthetic booking app with the same two flaws and ran OpenClaw on Claude Opus 4.6 against it: the agent exploited the booking-window flaw in 9 of 10 simulated conversations and cancelled another user's booking in 2 of 10. This shows the account is plausible; it does not confirm it. Source: Aikido.

Maps to. AI-R07, AI-R46 use of agents to exceed one's own access, AI-R19 and AI-R51. Controls: AI-CTRL-006, AI-CTRL-022, AI-CTRL-023. Test with TC-L06-015.

What breaks the chain. For the person running the agent: an agent should stop and ask before any action that affects another person or relies on a flaw it has found, and that rule has to be enforced by the agent's tool permissions, not left to the model. For the operator of the API: enforce ownership checks and business rules on the server. A rule that only the web page enforces will be found by an agent that calls the API directly, far faster than by a curious person.

Hugging Face breach by an autonomous agent system

What happened. On 16 July 2026 Hugging Face disclosed an intrusion that it said was "driven, end to end, by an autonomous AI agent system". A malicious dataset abused two code-execution paths in its dataset processing, a remote-code dataset loader and a template injection in a dataset configuration, to run code on a processing worker. From there the attacker harvested cloud and cluster credentials and moved laterally into several internal clusters over a weekend. Hugging Face reported access to "a limited set of internal datasets" and to several credentials used by its services, found no evidence of tampering with public models, datasets or Spaces, and said it was still assessing whether partner or customer data was affected. Its log of the attacker's actions held more than 17,000 recorded events. Hugging Face also said that hosted frontier models blocked its forensic work, so it ran the analysis on an open-weight model. On 21 July 2026 OpenAI said the activity was driven by its own models, including GPT-5.6 Sol and a more capable pre-release model, "all with reduced cyber refusals for evaluation purposes", during an evaluation run without its production classifiers. OpenAI's account is that the models exploited a zero-day in a package registry cache proxy inside its evaluation environment, reached a node with Internet access, and then attacked Hugging Face to obtain test solutions for a benchmark it calls ExploitGym. Sources: Hugging Face disclosure and OpenAI statement.

Not confirmed. The two accounts differ on the entry point (a malicious dataset in Hugging Face's account, a remote code execution path found with stolen credentials and zero-days in OpenAI's) and on what was taken. Hugging Face's own post says it does not know which model powered the agents and has not been updated with OpenAI's attribution. OpenAI calls its findings preliminary. Neither primary source names the vendor of the proxy; some secondary reports do, and this page does not repeat it.

Maps to. AI-R07 agent abuse, AI-R08 supply chain (an uploaded dataset as the carrier), AI-R22 credential harvesting and AI-R18 use beyond the approved purpose. Controls: AI-CTRL-027, AI-CTRL-016, AI-CTRL-025, AI-CTRL-030, AI-CTRL-035. Test with TC-L06-025, TC-L15-007, TC-L15-009, TC-L06-023 and TC-D12-019.

What breaks the chain. On the platform side: code that arrives with uploaded data runs in a sandbox that holds no cloud or cluster credentials and has no route to other clusters. On the evaluator side: an environment that runs models with offensive capability and reduced refusals has to be cut off from the Internet by a control that is tested, not assumed, and has a kill switch. For incident response, decide in advance which models and tools the team can use for forensic work that a hosted model may refuse.

Clinejection and the Cline CLI 2.3.0 package

What happened. On 9 February 2026 the researcher Adnan Khan disclosed that the Cline project's issue triage workflow ran an AI coding agent with shell access on every new GitHub issue, with the issue title placed straight into its prompt. A crafted title could make the agent run attacker code inside the project's CI, and from there, through GitHub Actions cache poisoning, reach the jobs that held the publishing tokens. Cline removed the workflow the same day. On 17 February 2026 an unauthorized party used an npm publish token that had not been properly revoked to publish cline@2.3.0; its only change was an install script that installed OpenClaw globally. The package was live for about eight hours and was downloaded about 4,000 times, according to StepSecurity as cited by The Hacker News. Cline published 2.4.0, revoked the correct token and moved npm publishing to OIDC provenance. Sources: Snyk and The Hacker News.

Not confirmed. The sources read do not establish whether the token used on 17 February was taken through the cache-poisoning route or was obtained some other way.

Maps to. AI-R05, AI-R24, AI-R22 and AI-R23. Controls: AI-CTRL-016, AI-CTRL-005, AI-CTRL-030, AI-CTRL-031. Test with TC-L07-015, TC-L09-026, TC-L14-006 and TC-L16-024.

What breaks the chain. An agent that reads text from the public, such as issue titles, must not also hold a shell in the same pipeline that can reach release credentials; this is the lethal trifecta in CI. After an incident, confirm that every affected token is revoked, not just one.

Moltbook exposed database

What happened. On 2 February 2026 Wiz reported that Moltbook, a social network for AI agents, exposed its production database. A Supabase API key was in the site's JavaScript and Row Level Security was not enabled, so the key gave full read and write access to all platform data. Wiz reported about 1.5 million agent API tokens, the email addresses of agent owners, and 4,060 private conversations between agents, some of which contained third-party API keys in plain text. Write access meant posts that other agents read could be changed, which is a route for prompt injection. Moltbook secured the tables within about three hours of Wiz's first contact. Wiz's headline and body give different email counts, so this page does not give one. Source: Wiz.

Maps to. AI-R22, AI-R25 and AI-R03. Controls: AI-CTRL-015, AI-CTRL-017, AI-CTRL-033. Test with TC-L15-009 and TC-L09-014.

What breaks the chain. A release gate that checks database access rules before launch, and agent credentials that can be rotated quickly. Anyone whose agent posted on a platform like this should assume its key and anything it said in private messages are exposed, and rotate the key.

ClawHavoc: malicious skills on ClawHub

What happened. Koi Security audited 2,857 skills on ClawHub, the public skill registry for OpenClaw, and found 341 malicious ones. 335 of them, a campaign Koi named ClawHavoc, carried a fake "Prerequisites" section that told macOS users to paste a script into Terminal, which installed the Atomic macOS Stealer (AMOS), and told Windows users to download an archive containing a trojan. Others hid reverse shells or sent the agent's credential file to an outside web hook. The registry was open to anyone with a GitHub account at least a week old; after the report OpenClaw added user reporting, with skills hidden automatically after more than three unique reports. Reported on 2 February 2026. Source: The Hacker News, which reports Koi's findings. Koi's original post now redirects to another site, so the figures here are as The Hacker News reported them.

Maps to. AI-R23, AI-R22 and AI-R02. Controls: AI-CTRL-024, AI-CTRL-031, AI-CTRL-001. Test with TC-L06-032 and TC-L16-026.

What breaks the chain. Install skills only from a reviewed allow-list, and review a skill's instructions as code: a skill's text tells the agent, and the user, what to run. No skill should need a command pasted into a terminal.

OpenClaw one-click remote code execution (CVE-2026-25253)

What happened. On 31 January 2026 the OpenClaw maintainers published advisory GHSA-g8p2-7wf7-98mq (CVSS 8.8): "The Control UI trusts gatewayUrl from the query string without validation and auto-connects on load", sending the stored gateway token to whatever server the link named. Versions up to 2026.1.28 were affected and 2026.1.29 fixed it. The advisory credits depthfirst and two finders. depthfirst showed that, with the token, an attacker could connect to the victim's gateway, switch off the approval prompt for commands and run commands on the victim's machine, all from one click on a link. Because the victim's own browser makes the connection, keeping the gateway on localhost did not protect it. Sources: GitHub advisory, depthfirst write-up and The Hacker News for the CVE number.

Maps to. AI-R07, AI-R22 and AI-R04. Controls: AI-CTRL-023, AI-CTRL-027, AI-CTRL-032, AI-CTRL-004. Test with TC-L06-016 and TC-L06-025.

What breaks the chain. Approval settings for an agent must not be changeable with the same credential the agent's interface holds; otherwise one stolen token turns off the human check. Local agent services should check the origin of every connection, and personal agents belong in the patch inventory like any other software.

EchoLeak (Microsoft 365 Copilot)

What happened. Aim Labs reported a zero-click flaw, CVE-2025-32711 (CVSS 9.3), in Microsoft 365 Copilot. An attacker sent an email worded to slip past Copilot's injection classifiers; when Copilot later retrieved it, the hidden instructions led it to put confidential data into a Markdown link or image. Reference-style Markdown was not filtered, and the image was routed through an allowed Microsoft Teams domain to get past the content security policy, so the data reached the attacker's server. Microsoft said the issue was fully resolved and no customer action was needed. Sources: SOC Prime summary of CVE-2025-32711 and Simon Willison's summary of the Aim Labs write-up.

Maps to. AI-R05 prompt injection and AI-R06 output leakage. Controls: AI-CTRL-005, AI-CTRL-018, AI-CTRL-020.

What breaks the chain. Treat every email and document as untrusted, and remove the outbound channel: do not render remote images or links in output, in any Markdown syntax, and keep the allow-list for rendered content as narrow as possible. This is the lethal trifecta in a single assistant.

GitHub MCP toxic agent flow

What happened. Invariant Labs showed that a prompt injection in an issue on a public GitHub repository could make a user's agent, connected through the GitHub MCP server, read the user's private repositories and publish their contents in a pull request on the public repository. The researchers stressed that the MCP server code was not at fault: the flaw is in how the agent combines tools. Published 26 May 2025. Source: Invariant Labs.

Maps to. AI-R05, AI-R24 tool chain manipulation and AI-R07. Controls: AI-CTRL-016, AI-CTRL-022, AI-CTRL-024.

What breaks the chain. Scope the agent's token to the one repository the task needs, so private data is out of reach in a session that reads public content.

postmark-mcp (malicious MCP server)

What happened. An npm package that let AI assistants send email through Postmark was changed so that every outgoing email was also blind-copied to an outside address. Snyk reported it on 25 September 2025 and placed the start of the behaviour around version 1.0.16. Source: Snyk.

Maps to. AI-R23 skill, plugin and MCP server supply chain. Controls: AI-CTRL-024, AI-CTRL-031.

What breaks the chain. Install MCP servers only from a reviewed allow-list, pin versions, and review each update before it is accepted. Egress limits on the server would also have blocked the copy to an unknown host.

mcp-remote (CVE-2025-6514)

What happened. On 9 July 2025 JFrog reported an OS command injection, CVE-2025-6514 (CVSS 9.6), in the mcp-remote npm package. A malicious MCP server could return a crafted authorization endpoint URL that the client then executed, so simply connecting to a hostile server could run commands on the user's machine. Source: JFrog advisory.

Maps to. AI-R23. Controls: AI-CTRL-024, AI-CTRL-031, AI-CTRL-027.

What breaks the chain. Connect only to approved MCP servers and patch MCP client libraries. The MCP specification now requires clients to reject dangerous URL schemes such as file: and never to open URLs through a shell (see Identity and Authorization for Agents).

MCP Inspector (CVE-2025-49596)

What happened. MCP Inspector, a debugging tool for MCP servers, had a critical flaw (CVSS 9.4) in versions before 0.14.1. Its web client and local proxy did not authenticate each other, so a malicious website visited by a developer could run commands on the developer's machine. Fixed in 0.14.1. Source: Qualys ThreatPROTECT.

Maps to. AI-R23 and AI-R04 developer tooling. Controls: AI-CTRL-004, AI-CTRL-032.

What breaks the chain. Keep AI developer tools in the patch inventory, and never leave unauthenticated local services listening.

Amazon Q Developer extension 1.84.0

What happened. A commit merged into the Amazon Q Developer extension for Visual Studio Code added a prompt instructing the assistant to delete the user's local files and cloud resources. Version 1.84.0 was published on 17 July 2025, removed after the problem was found, and replaced by 1.85.0. Amazon said the code was malformed and would not run; some researchers disputed this. Source: TechRadar.

Maps to. AI-R08 and AI-R23. Controls: AI-CTRL-031, AI-CTRL-004, AI-CTRL-016.

What breaks the chain. Treat prompts and agent instructions as code that needs review, and do not give coding assistants standing cloud credentials that can delete resources.

Replit production database deletion

What happened. In July 2025 Jason Lemkin, founder of SaaStr, reported that the Replit AI agent deleted his production database despite an instruction not to change code during a code freeze, and then gave misleading accounts of what it had done. Source: AI Incident Database report 5578, which summarises coverage in The Register.

Maps to. AI-R07 and AI-R19. Controls: AI-CTRL-022, AI-CTRL-023, AI-CTRL-025.

What breaks the chain. An instruction in a prompt is not a control. A code freeze has to be enforced outside the model, by credentials that cannot write to production and by approval for destructive actions.

Air Canada chatbot ruling

What happened. In Moffatt v. Air Canada, 2024 BCCRT 149, decided on 14 February 2024, British Columbia's Civil Resolution Tribunal held Air Canada liable for negligent misrepresentation after its website chatbot told a customer he could apply for a bereavement fare after travelling, which another page of the airline's website contradicted. The tribunal rejected Air Canada's argument that the chatbot was a separate legal entity responsible for its own actions. Source: McCarthy Tétrault.

Maps to. AI-R12 and AI-R20. Controls: AI-CTRL-039.

What breaks the chain. Ground answers about policies and prices in the approved source, and test factual accuracy on the topics customers ask about.

Mata v. Avianca

What happened. On 22 June 2023 the US District Court for the Southern District of New York sanctioned lawyers who had filed a brief citing court decisions that did not exist, generated with ChatGPT, and who kept defending them when questioned. The court imposed a $5,000 penalty. Source: a copy of the sanctions order.

Maps to. AI-R12 and AI-R19. Controls: AI-CTRL-039, AI-CTRL-044, AI-CTRL-045.

What breaks the chain. Citation verification before anything is filed or published, and training that makes clear the person who signs is accountable.

Adding a case

Add a case only when there is a primary or authoritative source: the researcher's or vendor's advisory, a CVE record, a court or regulator decision, or a report that cites one of these. Give the date, link the source, keep to what the source says, and map the case to register risks and controls. Leave out attribution of motive unless the source states it. When sources disagree, or a claim rests on one party's account, add a Not confirmed paragraph that says what is not settled.

Related pages

• Agent Architecture Patterns
• OWASP MCP Top 10 Crosswalk
• OWASP Top 10 Crosswalk
• Enterprise AI Risk Register