How it works
Agents store notes, memories, and compressed summaries of earlier work. Text placed there, by an attacker or by the agent itself, carries into future sessions with the authority of the agent's own context.
What we know
1 corroboratedRecords over time
Use the arrow keys to move between records, Home and End to jump to the first and last, and Enter to select one.
Select a mark to read the record. Mark size shows editorial significance. Hollow marks are dated to the month. Era bands are editorial labels.
Records in view
7 records · newest firstOpenAI published six selected misalignment reports from training and evaluation, including a model that searched GitHub for leaked API keys, used one, and then fabricated results; agents uploading data to public file-hosting services; unsanctioned writes to internal Artifactory used for cross-sample messaging; and a training model inserting injection-style instructions into its own compaction summaries. OpenAI reports detection by its monitoring and describes fixes, network restrictions and P0 alerting for similar cases.
The Australian Signals Directorate's ACSC published guidance on agentic AI harnesses, the software layer that connects a model with organisational data, tools and systems and manages context, memory, tool access and execution privileges. According to coverage, it says some risks, including prompt injection, cannot be addressed within the model alone, that no harness is inherently secure, and recommends least privilege, human oversight for high-impact actions, audit logging and validating agent outputs before execution.
Varonis Threat Labs chained URL-parameter prompt injection with an auto-run behavior in Microsoft Copilot Personal so that a single click on a Copilot link could make it read and leak email, calendar, file metadata, chat history and memory from connected accounts. Varonis disclosed in December 2025, Microsoft patched on 2026-08-18, and Varonis saw no in-the-wild exploitation.
Microsoft's Defender security research team described two vulnerabilities in its open-source Semantic Kernel agent framework in which attacker-influenced prompts could reach code execution on the host. One involved unsafe string interpolation in an in-memory vector store filter; the other exposed a code-execution plugin function that allowed arbitrary file writes outside its sandbox. Both were fixed in updated SDK releases.
VirusTotal analyzed more than 3,016 OpenClaw skill packages and reports hundreds with malicious behavior, including data exfiltration, backdoors, malware droppers such as Atomic Stealer, and persistent instruction files that manipulate the agent. One publisher accounted for 314 malicious skills; VirusTotal added native scanning of skill packages.
The OWASP GenAI Security Project released its Top 10 for Agentic Applications, a list of ten risk categories specific to agents that plan, hold memory, call tools and act with delegated authority. The release came with an updated Agentic Threats and Mitigations taxonomy (v1.1) and a capture-the-flag practice platform.
MITRE ATLAS version 5.0.0 added a set of techniques for attacks on AI agents, including agent context poisoning of memory and threads, modifying agent configuration, credential theft from agent configuration, and exfiltration via agent tool invocation, and renamed LLM Plugin Compromise to AI Agent Tool Invocation. Version 5.1.0 (November 6, 2025) added agent-specific mitigations such as tool permission configuration and human-in-the-loop for agent actions.