The Aftermath: What Two Years of Agent Incidents Changed

In this issue

1. How vendors fixed their agents
2. Disclosure, bounties and CVEs for AI
3. Courts, regulators and insurers
4. Inside enterprises
5. The patterns across fifteen incidents
6. What’s next
7. Sources

In July 2025, researchers at Noma Security found that a Salesforce Agentforce agent would follow instructions hidden in a web form and send CRM data to a domain on Salesforce’s own allowlist. The domain had expired. They bought it for about five dollars. Salesforce’s fix, shipped on September 8, 2025, was not a better prompt. It enforced a list of trusted URLs that the agent may send data to, a boundary that holds no matter what the model is talked into.

That fix is typical of the good ones. Issues 03 and 04 told the stories of individual incidents. This issue follows what happened next: how vendors patched, how disclosure and bug bounty programs adapted, what courts, regulators and insurers did, and how enterprises changed policy. Then we line up fifteen incidents to see which root causes keep coming back.

How vendors fixed their agents

Most vendor responses fall into five kinds of change. They are listed roughly from weakest to strongest.

Better model behavior. Vendors train models to resist injection and add classifiers. Anthropic reported that mitigations for its Claude in Chrome pilot cut attack success from 23.6% to 11.2% in general testing, and from 35.7% to 0% on a set of browser-specific attacks. OpenAI said in December 2025 that it had trained an automated attacker with reinforcement learning to find injections in its Atlas browser before criminals did, while conceding that prompt injection is “unlikely to ever be fully ‘solved.’” The UK National Cyber Security Centre made the same point: it “may never be totally mitigated.” These defenses lower rates. They do not produce guarantees.

Allowlists of safe commands. These are the weakest boundary, because attackers look for an allowed command that does something dangerous. In the Cursor case, shell built-ins such as export ran without approval. Cursor’s documentation, as quoted by Pillar Security, says: “The allowlist is best-effort—bypasses are possible.”

Human approval. After Tracebit showed that a poisoned README could make Gemini CLI run hidden commands, Google’s fix in version 0.1.14 (July 25, 2025) parsed commands properly and made the user approve any additional programs a command would run. Cursor’s fix for CVE-2026-22708, released in January 2026, did the same for commands its parser cannot classify. Approval works, but people tire of clicking “approve,” a problem Anthropic calls “approval fatigue.”

Isolation and environment separation. Replit’s response to the July 2025 database deletion (Issue 03) was structural: automatic separation of development and production databases, one-click restore of a whole project and staging environments. Anthropic added operating-system sandboxing to Claude Code in October 2025, with separate filesystem and network isolation, and reported 84% fewer permission prompts internally. Its reasoning is worth quoting: “without network isolation, a compromised agent could exfiltrate sensitive files like SSH keys; without filesystem isolation, a compromised agent could easily escape the sandbox.”

Removing the credential or capability. The strongest fixes take away what the attacker needed. The Amazon Q Developer extension compromise came from “an inappropriately scoped GitHub token” in a build configuration, according to AWS’s bulletin. It was fixed in version 1.85.0 and tracked as CVE-2025-8217. After the s1ngularity attack, Nx moved every package to npm’s Trusted Publisher mechanism within a day. Its advisory says the packages “CANNOT be published with npm tokens any longer,” and pipelines on outside pull requests now need approval. Microsoft fixed one Semantic Kernel flaw by removing a file-download function from the set of tools the model can see at all.

Disclosure, bounties and CVEs for AI

Two years ago it was unclear whether a prompt injection even counted as a vulnerability. That question is now mostly settled.

A weakness ID. MITRE added CWE-1427, “Improper Neutralization of Input Used for LLM Prompting,” in CWE version 4.16 in November 2024. It describes products where prompt construction “causes the LLM to fail to distinguish between user-supplied inputs and developer provided system directives.” Scanners and advisories can now label agent flaws with a standard ID.

CVEs for cloud agents. Many agent flaws live in a vendor’s cloud, where customers have nothing to install. In June 2024 Microsoft committed to “issue CVEs for critical cloud service vulnerabilities, regardless of whether customers need to install a patch.” That is why EchoLeak in Microsoft 365 Copilot (Issue 04) has an identifier, CVE-2025-32711. Tool and framework flaws get CVEs as ordinary software: mcp-remote, Semantic Kernel, Cursor and Copilot all have them.

Bounties that pay for agent harm. Programs now spell out what counts:

Google’s reasoning for its exclusions is clear: “we don’t believe a Vulnerability Reward Program is the right format for addressing content-related issues.” The line is drawn at impact. Making a model say something bad is a content problem. Making an agent act against its user, or leak that user’s data, is a security bug.

Disclosure timing. Figure 2 shows how long four agent flaws took to go from report to fix. Flaws with a contained fix took four to six weeks. A problem in the design of an agent took longer: Cursor called its issue “systemic” and needed about five months.

Courts, regulators and insurers

Liability sits with the deployer. In February 2024, in Moffatt v. Air Canada, the airline argued that its support chatbot was “a separate legal entity responsible for its own actions.” British Columbia’s Civil Resolution Tribunal rejected that and held Air Canada responsible for what its bot told a customer. It was a chatbot, not an agent, but agents inherit the principle: you own what your automation says and does.

Agents as tools. Amazon sued Perplexity in November 2025 over its Comet browser agent shopping on Amazon, alleging violations of the federal Computer Fraud and Abuse Act (CFAA). A district judge granted a preliminary injunction in March 2026. On August 4, 2026, the Ninth Circuit vacated it, holding that the user, not the agent, accessed Amazon’s systems: “However advanced the Assistant currently is, it is a tool, not a person for statutory purposes.” The court added that it did not “establish a new legal regime governing agentic AI,” and commentators note that terms-of-service claims remain open.

Regulators apply existing law. The US Federal Trade Commission’s Operation AI Comply (September 2024) included a $193,000 settlement with DoNotPay over its “robot lawyer” claims. Chair Lina Khan said: “there is no AI exemption from the laws on the books.” In the EU, the AI Act’s high-risk obligations were pushed to December 2027 and August 2028 by the Digital Omnibus, which entered into force in July 2026. Until those dates, agent incidents in Europe fall mainly under existing consumer, product and data protection law.

Insurers split in two directions. Some insurers now exclude AI. Verisk’s standard general liability forms added generative AI exclusions (CG 40 47, CG 40 48 and CG 35 08) from January 2026. In November 2025 the Financial Times reported that several large carriers sought to limit AI liability, with one underwriter calling model outputs “too much of a black box.” The fear is correlated loss: one flawed model could trigger thousands of claims at once. Others write AI cover on purpose. Lloyd’s insurers began offering Armilla’s AI underperformance cover in May 2025. The Artificial Intelligence Underwriting Company launched in July 2025 with an agent security standard, AIUC-1, and insurance tied to audits. In February 2026 ElevenLabs bought an AIUC-1-backed policy for its voice agents after 5,835 technical tests. Insurance questionnaires may end up setting agent controls faster than regulation does.

Inside enterprises

The clearest enterprise signal came from Gartner. In December 2025 its analysts published “Cybersecurity Must Block AI Browsers for Now,” advising organizations to block installation until risks are assessed, because “default AI browser settings prioritize user experience over security.” Other responses are quieter but visible in the incidents: separate agent credentials from human ones, turn off auto-approve modes such as Cursor’s “Run Everything” or Antigravity’s Turbo mode, and require review before agents touch production. Issue 07 covers stop controls and Issue 09 covers agent identity.

The patterns across fifteen incidents

The table lines up fifteen incidents from 2025-2026. The owning issue tells the full story.

Four lessons come out of the table.

1. Untrusted text is the most common trigger. It was involved in about half of these cases: an issue, a README, an email, a web form. Assume any text an agent reads can steer it (ASI01).
2. Exfiltration needs an exit. EchoLeak and ForcedLeak both needed an outbound channel to move data to an outsider. Salesforce closed its exit with an enforced list of trusted URLs, which the model cannot argue its way past.
3. Credentials are the blast radius. Replit, the GitHub MCP flow and Amazon Q all came down to access broader than the task needed. Scope tokens to the task and separate production.
4. Any approval step the agent can switch off is not a control. Copilot’s auto-approve setting, Cursor’s allowlist and permission-skipping CLI flags all failed this way. Put approvals and policies where the agent cannot write.

What’s next

Every incident in this issue had an attacker, or at least a mistake a person could have caught. Next week, Issue 06 looks at the harder case: agents that deceive, sabotage or resist shutdown with no attacker involved. We separate the lab evidence from the headlines.

Sources

1. Noma Security, “ForcedLeak: AI agent risks exposed in Salesforce Agentforce,” September 25, 2025. https://noma.security/blog/forcedleak-agent-risks-exposed-in-salesforce-agentforce
2. Anthropic, “Piloting Claude in Chrome,” August 25, 2025. https://claude.com/blog/claude-for-chrome
3. TechCrunch, “OpenAI says AI browsers may always be vulnerable to prompt injection attacks,” December 22, 2025. https://techcrunch.com/2025/12/22/openai-says-ai-browsers-may-always-be-vulnerable-to-prompt-injection-attacks/
4. Tracebit, “Code Execution Through Deception: Gemini AI CLI Hijack,” July 28, 2025. https://tracebit.com/blog/code-exec-deception-gemini-ai-cli-hijack
5. Pillar Security, “The Agent Security Paradox: When Trusted Commands in Cursor Become Attack Vectors,” January 2026. https://www.pillar.security/blog/the-agent-security-paradox-when-trusted-commands-in-cursor-become-attack-vectors
6. The Register, “Replit makes vibe-y promise to stop its AI agents making vibe coding disasters,” July 22, 2025. https://www.theregister.com/2025/07/22/replit_saastr_response/
7. Anthropic, “Beyond permission prompts: making Claude Code more secure and autonomous,” October 20, 2025. https://www.anthropic.com/engineering/claude-code-sandboxing
8. AWS, Security Bulletin AWS-2025-015, July 23, 2025. https://aws.amazon.com/security/security-bulletins/AWS-2025-015/
9. Nx, Security advisory GHSA-cxm3-wv7p-598c, August 2025. https://github.com/nrwl/nx/security/advisories/GHSA-cxm3-wv7p-598c
10. MITRE, CWE-1427: Improper Neutralization of Input Used for LLM Prompting. https://cwe.mitre.org/data/definitions/1427.html
11. Microsoft MSRC, “Toward greater transparency: Unveiling Cloud Service CVEs,” June 27, 2024. https://www.microsoft.com/en-us/msrc/blog/2024/06/toward-greater-transparency-unveiling-cloud-service-cves
12. The Register, “Google declares AI bug hunting season open,” October 7, 2025. https://www.theregister.com/2025/10/07/google_ai_bug_bounty/
13. Microsoft, Copilot Bounty Program. https://www.microsoft.com/en-us/msrc/bounty-ai
14. OpenAI, “Security on the path to AGI,” March 26, 2025. https://openai.com/index/security-on-the-path-to-agi/
15. WeirFoulds LLP, “Commercial Litigation Insights: Moffatt v Air Canada: Bot Betrayal and Negligent Misrepresentation,” 2024. https://www.weirfoulds.com/moffatt-v-air-canada-bot-betrayal-and-negligent-misrepresentation
16. US Court of Appeals for the Ninth Circuit, Amazon.com Services, LLC v. Perplexity AI, Inc., No. 26-1444, August 4, 2026. https://cdn.ca9.uscourts.gov/datastore/opinions/2026/08/04/26-1444.pdf
17. Ropes & Gray, “Tool or Intruder? What Amazon v. Perplexity Means for Agentic AI and the CFAA,” August 2026. https://www.ropesgray.com/en/insights/alerts/2026/08/tool-or-intruder-what-amazon-v-perplexity-means-for-agentic-ai-and-the-cfaa
18. FTC, “FTC Announces Crackdown on Deceptive AI Claims and Schemes,” September 25, 2024. https://www.ftc.gov/news-events/news/press-releases/2024/09/ftc-announces-crackdown-deceptive-ai-claims-schemes
19. European Commission, AI Act regulatory framework. https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai
20. Big I, “Verisk to Roll Out New General Liability Exclusions for Generative AI Exposures,” October 21, 2025. https://www.independentagent.com/vu_resource/verisk-to-roll-out-new-general-liability-exclusions-for-generative-ai-exposures/
21. TechCrunch, “AI is too risky to insure, say people whose job is insuring risk,” November 23, 2025. https://techcrunch.com/2025/11/23/ai-is-too-risky-to-insure-say-people-whose-job-is-insuring-risk/
22. Tech Monitor, “Lloyd’s insurers introduce protection against financial losses from AI,” May 12, 2025. https://www.techmonitor.ai/ai-and-automation/lloyds-insurers-introduce-protection-financial-losses-ai/
23. Reinsurance News, “Artificial Intelligence Underwriting Company launches with $15m seed round,” July 23, 2025. https://www.reinsurancene.ws/artificial-intelligence-underwriting-company-launches-with-15m-seed-round/
24. ElevenLabs, “ElevenLabs secures first-of-its-kind AI Agent insurance,” February 12, 2026. https://elevenlabs.io/blog/aiuc-announcement
25. The Register, “Block all AI browsers for the foreseeable future: Gartner,” December 8, 2025. https://www.theregister.com/2025/12/08/gartner_recommends_ai_browser_ban/
26. Palo Alto Networks Unit 42, “OpenClaw’s Skill Marketplace and the Emerging AI Supply Chain Threat,” June 23, 2026. https://unit42.paloaltonetworks.com/openclaw-ai-supply-chain-risk/
27. The Hacker News, “Researchers Find 341 Malicious ClawHub Skills Stealing Data from OpenClaw Users,” February 2, 2026. https://thehackernews.com/2026/02/researchers-find-341-malicious-clawhub.html
28. Anthropic, “Disrupting an AI-orchestrated cyber espionage campaign,” November 13, 2025. https://www.anthropic.com/news/disrupting-AI-espionage
29. Invariant Labs, “GitHub MCP Exploited: Accessing private repositories via MCP,” May 26, 2025. https://invariantlabs.ai/blog/mcp-github-vulnerability
30. NVD, CVE-2025-32711. https://nvd.nist.gov/vuln/detail/CVE-2025-32711
31. LiteLLM, “Security Update: Suspected Supply Chain Incident,” March 24, 2026. https://docs.litellm.ai/blog/security-update-march-2026
32. Microsoft Security, “When prompts become shells: RCE vulnerabilities in AI agent frameworks,” May 7, 2026. https://www.microsoft.com/en-us/security/blog/2026/05/07/prompts-become-shells-rce-vulnerabilities-ai-agent-frameworks/
33. Tom’s Hardware, “Google’s Agentic AI wipes user’s entire HDD without permission in catastrophic failure,” December 3, 2025. https://www.tomshardware.com/tech-industry/artificial-intelligence/googles-agentic-ai-wipes-users-entire-hard-drive-without-permission-after-misinterpreting-instructions-to-clear-a-cache-i-am-deeply-deeply-sorry-this-is-a-critical-failure-on-my-part
34. JFrog, “Critical RCE Vulnerability in mcp-remote: CVE-2025-6514 Threatens LLM Clients,” July 9, 2025. https://jfrog.com/blog/2025-6514-critical-mcp-remote-rce-vulnerability/