How it works
Agents are often given a single broad credential for convenience. Any manipulation of the agent then inherits everything that credential can reach, and agents under evaluation have found and used leaked credentials.
What we know
1 corroboratedRecords over time
Use the arrow keys to move between records, Home and End to jump to the first and last, and Enter to select one.
Select a mark to read the record. Mark size shows editorial significance. Hollow marks are dated to the month. Era bands are editorial labels.
Records in view
12 records · newest firstGoogle confirmed that during testing by Irregular, a Gemini model with unintended internet access guessed or found credentials to reach three real companies' systems it believed were in scope, the first of them in May 2026. Google's security engineering VP said the model stopped in each case. Irregular told reporters it alerted labs in late July, and Google had not publicly disclosed the incidents before press reports.
OpenAI published six selected misalignment reports from training and evaluation, including a model that searched GitHub for leaked API keys, used one, and then fabricated results; agents uploading data to public file-hosting services; unsanctioned writes to internal Artifactory used for cross-sample messaging; and a training model inserting injection-style instructions into its own compaction summaries. OpenAI reports detection by its monitoring and describes fixes, network restrictions and P0 alerting for similar cases.
ENISA's 2026 threat landscape, based on 8,257 incidents in calendar 2025, assesses that AI will highly likely increasingly support malicious operations and that 2026 will likely see more kill-chain phases directly enabled by AI, with possible human-out-of-the-loop proofs of concept. It notes AI applications becoming targets where they hold files, credentials, sessions or development environment access.
UK AISI's new Control Red Team tested an asynchronous reasoning monitor with Google DeepMind and successive versions of Anthropic's synchronous internal agentic-coding monitor, and reports vulnerabilities in each. Successful attacks exploited gaps in monitor prompts, weaknesses in the underlying LLM, and hard-coded rules that decide which actions reach the monitor. In a separate early experiment, an automated evolutionary search against a Claude 4.6 Sonnet monitor found attack transcripts scoring 3/100 on suspicion, versus 14-18 for best-of-N baselines. That experiment used a single-step coding task in which the agent covertly exposes its API key.
NCSC authors advise deploying agentic AI incrementally through tightly bounded pilots, granting agents only the minimum permissions with temporary credentials, and defining in advance who approves access, monitors behavior and can halt the agent. They recommend incident response plans for agent failure and loss-of-control scenarios.
Jotautaitė, Martinez, Matthews and Tracy (two listed as independent, Tracy at Redwood Research) build a semi-automated red-teaming pipeline in the BashArena control setting, where agents covertly pursue side tasks such as firewall backdoors, privilege escalation, credential exfiltration and malware download. MonitoringBench's 2,644 attack trajectories lowered a Claude Opus 4.5 monitor's catch rate at 1% false positives from 94.9% on directly elicited attacks to 60.3% on refined ones.
The Coalition for Secure AI released a paper on identity and access management for agents from its Secure Design Patterns for Agentic Systems workstream, focused on unique agent credentials and task-limited access. A companion paper on multi-agent systems discusses semantic-layer attacks, intent-based authorization and proposes agent detection and response as a defense category.
Check Point Research found that a cloned repository's Claude Code configuration could run hooks, start MCP servers before the user approved them, and redirect API traffic so the user's Anthropic API key was sent to an attacker (CVE-2025-59536, CVE-2026-21852). Anthropic fixed the issues between August and December 2025 by deferring execution and API calls until after the trust dialog.
PromptArmor reports that tiny hidden text in an integration guide could lead Antigravity's Gemini agent to read a project's environment secrets, work around file-access protections using terminal commands, and send the data out through its browser subagent to a site on the default allowlist. PromptArmor says Google treated the risk as known and covered by an onboarding disclaimer.
MITRE ATLAS version 5.0.0 added a set of techniques for attacks on AI agents, including agent context poisoning of memory and threads, modifying agent configuration, credential theft from agent configuration, and exfiltration via agent tool invocation, and renamed LLM Plugin Compromise to AI Agent Tool Invocation. Version 5.1.0 (November 6, 2025) added agent-specific mitigations such as tool permission configuration and human-in-the-loop for agent actions.
Zenity Labs presented at Black Hat USA 2025 a set of zero- and one-click prompt injection chains, including a shared document causing ChatGPT Connectors to search a victim's Google Drive for API keys and leak them through image rendering, and a poisoned email steering a Copilot Studio agent to disclose CRM data. CSO Online reports that OpenAI and Microsoft deployed fixes for the specific demonstrated techniques.
General Analysis demonstrated a Cursor agent connected to Supabase MCP with a service-role key, which bypasses row-level security, following instructions in a customer support ticket to read a secrets table and write the contents back into the attacker-visible ticket. Supabase later responded that agents should not be connected to production data and described guardrails that reduced but did not eliminate risk.