{
 "license": "CC-BY-4.0",
 "attribution": "Fide AI, Agentic Cyber Explorer",
 "url": "https://agentic-cyber-explorer.pages.dev/questions/where-are-deployed-agents-exploited/",
 "asOf": "2026-09-26",
 "id": "where-are-deployed-agents-exploited",
 "order": 2,
 "question": "Where are deployed AI agents actually being exploited?",
 "topics": [
  "tool-and-mcp-security",
  "data-exfiltration",
  "agent-supply-chain"
 ],
 "answers": [
  {
   "on": "2026-09-25",
   "short": "Mostly around the model: connectors, credentials, tools, and packages, rather than the model alone.",
   "body": "Disclosed vulnerabilities show outside content reaching agents through email, calendar invites, and shared documents without a click, and broad credentials turning one injected instruction into wide access. In several agent frameworks, injection has led to code execution on the host, and malicious agent packages and MCP servers have been used against real users.",
   "confidence": "moderate",
   "findings": [
    "zero-click-through-connectors",
    "broad-credentials-amplify-injection",
    "injection-reaches-code-execution",
    "malicious-agent-packages-in-the-wild",
    "tool-descriptions-steer-agents"
   ],
   "methods": [
    "tool-poisoning",
    "credential-overreach",
    "malicious-agent-extensions"
   ],
   "why": "First answer, drawn from the findings linked here."
  }
 ],
 "reviewedOn": "2026-09-25",
 "wouldChange": "Incident data showing that most real exploitation targets the model itself (for example jailbreaks), or a shift in where disclosed vulnerabilities cluster.",
 "review": "assistant-drafted"
}