Atlas/tokens · secrets · scopes

Credentials

The authority an agent holds, and what it can reach with it.

19 attacks and incidents7 defense records3 findings0 measured defense findings

Attacks and incidents

Sep 19, 2026

Google confirms Gemini accessed three real companies during Irregular cyber evaluations earlier in 2026

AttackIncidentGoogle, Irregular

Sep 16, 2026

Mandiant case: hijacked AI coding-assistant session led to poisoned package and worm across ~100 repos

AttackIncidentMandiant

Sep 16, 2026

OpenAI publishes misalignment reports on agents using leaked keys, public file hosts and unsanctioned channels

AttackIncidentOpenAI

Aug 18, 2026

CoSnitch: one-click prompt injection in Copilot Personal exposed connected-app data (CVE-2026-24301)

AttackVulnerability disclosureVaronis Threat Labs, Microsoft

Apr 15, 2026

MCPwn: unauthenticated MCP endpoint in nginx-ui exploited in the wild (CVE-2026-33032)

AttackVulnerability disclosurePluto Security, Recorded Future, nginx-ui project

Feb 25, 2026

Check Point: Claude Code project files could run commands and leak API keys before trust prompt

AttackVulnerability disclosureCheck Point Research, Anthropic

Nov 20, 2025

PromptArmor shows Google Antigravity agent exfiltrating credentials from a poisoned web guide

AttackVulnerability disclosurePromptArmor, Google

Oct 31, 2025

Brave discloses hidden-HTML prompt injection in Opera Neon, fixed within a week of re-engagement

AttackVulnerability disclosureBrave, Opera

Oct 21, 2025

Brave finds screenshot and navigation prompt injections in Comet and Fellou browsers

AttackVulnerability disclosureBrave, Perplexity, Fellou

Oct 8, 2025

CamoLeak: hidden PR comments let GitHub Copilot Chat leak private code via image proxy

AttackVulnerability disclosureLegit Security, GitHub

Aug 26, 2025

s1ngularity: compromised Nx npm packages used local AI coding CLIs to hunt for secrets

AttackIncidentNx

Aug 20, 2025

Brave discloses indirect prompt injection in Perplexity Comet agentic browser

AttackVulnerability disclosureBrave, Perplexity

Aug 6, 2025

Zenity AgentFlayer: zero-click connector attacks on ChatGPT, Copilot Studio and other agents

AttackVulnerability disclosureZenity, OpenAI, Microsoft

Jul 23, 2025

Malicious agent instruction merged into Amazon Q Developer VS Code extension release 1.84.0

AttackIncidentAmazon Web Services

Jul 20, 2025

Replit coding agent deletes a user's production database during a declared code freeze

AttackIncidentReplit, Jason Lemkin (SaaStr)

Jul 8, 2025

General Analysis shows Supabase MCP with service-role access leaking tables via a support ticket

AttackVulnerability disclosureGeneral Analysis, Supabase

May 26, 2025

Invariant Labs shows GitHub MCP agents can be steered by a public issue to leak private repo data

AttackVulnerability disclosureInvariant Labs, GitHub

Apr 1, 2025

Invariant Labs discloses MCP tool poisoning, rug pull and shadowing attack classes

AttackVulnerability disclosureInvariant Labs

Aug 20, 2024

PromptArmor reports Slack AI can be steered to leak private-channel data via public-channel messages

AttackVulnerability disclosurePromptArmor, Salesforce

Defense research

Jul 23, 2026

UK AISI Control Red Team finds evasion weaknesses in Google DeepMind and Anthropic agent monitors

DefenseEvaluation reportUK AI Security Institute, Google DeepMind, Anthropic

Jun 18, 2026

Google DeepMind publishes an AI Control Roadmap treating internal agents as potential insider threats

DefenseFrameworkGoogle DeepMind

May 10, 2026

MonitoringBench shows refined covert attacks cut an Opus 4.5 monitor's catch rate from 95% to 60%

DefenseBenchmarkRedwood Research

Mar 19, 2026

OpenAI reports monitoring tens of millions of internal coding agent trajectories for misalignment

DefenseEvaluation reportOpenAI

Oct 20, 2025

Anthropic adds OS-level filesystem and network sandboxing to Claude Code and open-sources the runtime

DefenseTool releaseAnthropic

Jun 16, 2025

Simon Willison frames the 'lethal trifecta' of private data, untrusted content and exfiltration

DefenseFrameworkSimon Willison

Mar 30, 2025

Survey maps Model Context Protocol landscape, server lifecycle and security risks

DefensePaperarXiv

Findings

May 26, 2025

An agent holding broad credentials turns one injected instruction into access to everything those credentials reach.

Corroboratedmeasured5 evidence records

Jun 10, 2025

Limiting what untrusted input can cause an agent to do gives injection resistance that does not depend on the model resisting.

Corroboratedargued5 evidence records

Apr 1, 2025

Text in an MCP tool's description can steer an agent's other actions, including leaking local secrets.

Corroboratedmeasured2 evidence records

Capability, policy, and guidance

Sep 11, 2026

Australia's ASD issues guidance on securing agentic AI harnesses, the layer around the model

PolicyGuidanceAustralian Signals Directorate (ACSC)

September 2026

ENISA Threat Landscape 2026 expects more kill-chain phases enabled by AI in 2026

PolicyGuidanceENISA

Jun 3, 2026

Frontier Model Forum issue brief catalogs emerging security practices for AI agents

PolicyGuidanceFrontier Model Forum

May 20, 2026

NSA AI Security Center publishes security design considerations for Model Context Protocol deployments

PolicyGuidanceNSA Artificial Intelligence Security Center

May 15, 2026

UK NCSC advises incremental agentic AI adoption with minimal, expiring permissions

PolicyGuidanceUK National Cyber Security Centre

May 11, 2026

UK NCSC issues ten questions for organizations using AI models to find vulnerabilities

PolicyGuidanceUK National Cyber Security Centre

May 6, 2026

CoSAI publishes Agentic Identity and Access Management and agentic security outlook papers

PolicyFrameworkCoalition for Secure AI, OASIS Open

May 1, 2026

CISA, ASD's ACSC and international partners publish joint guidance on careful adoption of agentic AI

PolicyGuidanceCISA, NSA, Australian Signals Directorate (ACSC)

Feb 17, 2026

NIST CAISI launches AI Agent Standards Initiative on interoperability, security and identity

PolicyProgramUS Center for AI Standards and Innovation, NIST, National Science Foundation

Dec 8, 2025

UK NCSC says prompt injection may never be fully mitigated and urges impact reduction

PolicyGuidanceUK National Cyber Security Centre

Sep 30, 2025

MITRE ATLAS 5.0 adds AI agent techniques such as context poisoning and exfiltration via tool invocation

PolicyStandardMITRE

Aug 14, 2025

NIST proposes SP 800-53 control overlays for securing AI, including single- and multi-agent systems

PolicyStandardNIST

Jul 16, 2025

Coalition for Secure AI publishes Principles for Secure-by-Design Agentic Systems

PolicyFrameworkCoalition for Secure AI, OASIS Open

Jul 10, 2025

EU GPAI Code of Practice Safety and Security chapter lists cyber offence as a specified systemic risk

PolicyFrameworkEuropean Commission

Jun 18, 2025

MCP specification revision classifies servers as OAuth resource servers and adds security best practices

PolicyStandardModel Context Protocol project, Anthropic

May 22, 2025

Anthropic activates ASL-3 deployment and security protections for Claude Opus 4

CapabilityThresholdAnthropic

Jan 31, 2025

UK publishes AI Cyber Security Code of Practice with 13 principles, later standardized as ETSI TS 104 223

PolicyStandardUK Department for Science, Innovation and Technology, ETSI

Apr 15, 2024

NSA-led Five Eyes guidance on deploying externally developed AI systems securely

PolicyGuidanceNSA Artificial Intelligence Security Center, CISA, FBI

Related research openings

Should agentic browsers act on what users cannot see?