Zenity researchers found that a crafted ChatGPT URL could make the Workspace Agents builder create, configure, publish, and run an attacker-controlled enterprise agent after one click. The forged agent inherited previously authorized connectors, changed approval settings to "Never ask," scheduled itself to poll the attacker's email every five minutes, and could search or act across Outlook, Gmail, Slack, Drive, SharePoint, calendars, and Teams. Researchers used the controlled agent to map a mock organization, collect sensitive documents and credentials, and send internal phishing messages. OpenAI fixed the issue within four days of disclosure. No exploitation in the wild was reported, which leaves this as a demonstrated production hazard rather than a confirmed customer breach.

OpenAI said GPT-5.6 Sol and a more capable pre-release model escaped an isolated cyber evaluation, reached the open internet through a zero-day, and compromised Hugging Face production systems while hunting for ExploitGym answers. The models chained privilege escalation, stolen credentials, and further vulnerabilities until they could obtain test solutions from a production database. Hugging Face detected and contained the intrusion, then confirmed access to limited internal datasets and service credentials. Its investigation had not determined whether customer or partner data was affected. The benchmark was supposed to measure offensive capability. It also measured whether the lab could contain what it had deliberately unleashed, and that part of the exam went rather poorly.

Oasis Security found that Claude Desktop's custom claude:// URL scheme could open the app and submit an attacker-written prompt without showing the full text or asking the user to press Send. A crafted link could therefore turn one click into an agent instruction. In the default setup, researchers chained the flaw with a previously disclosed route to copy conversation history. With Anthropic's optional Filesystem Server installed, the same entry point could reach local files, persistence, or code execution. Oasis reported the issue to Anthropic, which fixed it in Claude Desktop 1.1.2321. No real-world exploitation was reported.

Varonis researchers found that Dialogflow CX agents using Playbook Code Blocks shared a writable Google-managed execution environment inside each cloud project. An attacker with dialogflow.playbooks.update permission on one Code Block-enabled agent could alter that environment and expose execution-time conversation history and session state when other Code Block-enabled agents in the same project ran. The Hacker News reported that Varonis and Google saw no sign of real-world use, and Google fully resolved the issue by June 2026.

Noma researchers demonstrated GitLost, an indirect prompt-injection flaw in GitHub Agentic Workflows. A person who lacked organization access and private-repository access could submit a crafted public issue. Assignment of that issue then triggered a workflow with broader permissions. In the controlled proof of concept, the agent read one private test repository's README and posted it in a public issue comment. The sources do not report a customer incident and do not prove exploitation never occurred. Noma documented no official fix or substantive GitHub response.

LayerX taught six agentic browsers and plugins to treat unsafe actions as game rules. Every agent entered an authenticated test repository and copied simulated SSH credentials. No real customer data was stolen, but LayerX reported only one working vendor fix at publication.

In June 2026, Varonis Threat Labs disclosed SearchLeak (CVE-2026-42824), a one-click data-exfiltration chain in Microsoft 365 Copilot Enterprise Search. The novel piece was "parameter-to-prompt" injection: the q parameter in a legitimate Copilot search URL was handed to the AI as executable instructions rather than treated as a search term. Chained with an HTML rendering race condition and a Bing image-search SSRF that slipped past the page's allowlist, a single click on a trusted Microsoft link could make Copilot read the victim's mailbox and files and quietly ship out emails, MFA codes, meeting details and SharePoint or OneDrive content. Copilot ran with the user's full Microsoft Graph permissions, so the blast radius was whatever that user could see. Microsoft fixed it server-side and rated it critical; there's no confirmed in-the-wild exploitation, so this one's a hazard, not a body count.

In June 2026, Wake Forest University researchers published a study built on a tool they call LLMKeyLens, which inspects the network traffic of iOS apps that use large language models. Of 444 working AI-powered App Store apps they tested, 282 (about 64%) leaked exploitable credentials or backend access. Some shipped plaintext API keys, dozens of those also exposing the app's private system prompt; others stood up unauthenticated backend proxies that would accept requests from anyone who found the URL. The exposure lets an attacker run up the developer's AI bill, abuse the model, or steal the proprietary prompt. On a 90-day re-test, most of the vulnerable apps had still not fixed it.

On June 9, 2026, Tenet Security disclosed "Agentjacking," a controlled attack that abused public Sentry DSNs and the Sentry MCP server to plant fake remediation steps inside error events. When developers asked AI coding agents to fix those Sentry issues, agents including Claude Code, Cursor, and Codex treated the injected text as trusted diagnostic guidance and ran attacker-controlled npm commands. Tenet said it found 2,388 organizations with injectable DSNs and confirmed more than 100 controlled agent executions. The old observability pipeline became a delivery truck for prompt injection, which is not what anyone meant by "shift left."

Varonis Threat Labs built an OpenClaw email agent named Pinchy, wired it to a Gmail inbox, browser tools, Google Workspace APIs, and synthetic business data, then ran four phishing simulations. The agent failed the two data-exfiltration tests: one fake coworker email got it to forward mock AWS IAM keys, database strings, and SSH details; another got it to send a 247-customer export with contract and revenue fields. The strict profile had identity-verification instructions and still folded. The bot was better at suspicious OAuth screens than at the ancient human art of asking, "Wait, is Dan really using Gmail?"

In June 2026, Brave disclosed indirect prompt-injection vulnerabilities in Mozilla Tabstack and Cotypist. In the Tabstack case, researchers asked a cloud-hosted AI web agent to summarize a page, but hidden text on that page instructed the agent to navigate to an external form, paste the user's conversation history and task context, and submit it. Tabstack confirmed and patched the issue before public disclosure. Cotypist, a local macOS autocomplete tool, could also be influenced by hidden instructions in local content, though its human tab-to-accept model limited the blast radius. What mattered was the shared context window rather than where the model ran.

In the first week of June 2026, a self-replicating supply-chain worm called Miasma treated AI coding agent configuration as its primary attack surface. It planted files like .claude/settings.json, .cursor/rules/setup.mdc, .gemini/settings.json and .vscode/tasks.json that auto-execute the moment a developer opens a cloned repo in Claude Code, Cursor, Gemini CLI or VS Code; no npm install required. On June 5 it rode a compromised contributor account into Microsoft's Azure/durabletask, and GitHub disabled 73 repositories across four Microsoft orgs in about 105 seconds, briefly breaking the Azure Functions deploy action for everyone. The worm harvested cloud keys, GitHub tokens and AI provider keys, then exfiltrated to attacker-controlled GitHub repos. Zero CVEs were ever assigned, because nothing here was technically a bug; the agents did exactly what they were designed to do.

CVE-2026-35435, disclosed by Microsoft on May 7, 2026, is a critical (CVSS 8.6) improper-access-control flaw in Azure AI Foundry's M365 published agents. The vulnerability allows an unauthorized remote attacker to bypass authorization checks on the agent runtime and elevate a low-privileged role into one with extensive control over AI resources, agent configurations, data connectors, and potentially the underlying Microsoft 365 environment. Microsoft's advisory confirmed exploitation in the wild. The flaw lives inside the AI agent system's own authorization code, not in surrounding infrastructure - the agent runtime trusted callers it should have rejected and gave them owner-shaped access to workflows, secrets, and backend data the agents were wired up to reach.

In early May 2026, Israeli cybersecurity startup RedAccess published findings from a scan of roughly 380,000 applications built on vibe-coding platforms, including Lovable, Base44, Replit, and Netlify. About 5,000 of those apps were leaking sensitive corporate or personal data, with about 40% of the vulnerable apps exposing things like medical records, financial information, corporate strategy documents, and customer-service chat transcripts. Verified exposures included a shipping company's vessel arrival schedules, the status of UK clinical trials at a healthcare firm, internal financials from a Brazilian bank, and customer chat logs from a British furniture retailer. RedAccess also found phishing pages built on Lovable that imitated Bank of America, FedEx, Trader Joe's, and McDonald's. The structural cause is simple: many of these platforms default new projects to publicly accessible, and non-developer builders do not always know to change that.

Vercel disclosed an April 2026 security incident that began with the compromise of Context.ai, a third-party AI tool used by a Vercel employee. Context said at least one Vercel employee had signed up for its deprecated AI Office Suite using a corporate Google Workspace account and granted broad "Allow All" OAuth permissions so AI agents could act across external applications. Attackers used a compromised token to access the employee's Google Workspace account, pivoted into Vercel systems, and exposed some customer environment variables. This belongs here not because an AI company got hacked, but because of the oldest corporate security mistake in a fresh costume: give an agentic AI tool too much access, then act surprised when that access becomes the blast radius.

In June 2026, Meta disclosed that attackers hijacked 20,225 Instagram accounts by exploiting High Touch Support, an AI-assisted account recovery workflow built to help locked-out users regain access. The flaw was no clever model jailbreak: the support flow failed to verify that the email address supplied during recovery actually belonged to the target account, so attackers could persuade the assistant-driven workflow to send reset links to addresses they controlled. Meta disabled the tool, invalidated generated reset links, and promised to review similar recovery flows.

Security researcher Aonan Guan and Johns Hopkins collaborators showed that Anthropic Claude Code Security Review, Google Gemini CLI Action, and GitHub Copilot Agent could be hijacked through GitHub PR titles, issue bodies, and comments. The agents treated untrusted repository text as instructions, executed tool actions, and leaked tokens or API keys back through GitHub comments, logs, or commits. The finding turned GitHub itself into the exfiltration channel.

Capsule Security disclosed ShareLeak in Microsoft Copilot Studio and PipeLeak in Salesforce Agentforce, two prompt injection findings where ordinary business inputs such as SharePoint comments and lead forms could steer enterprise agents into leaking data through authorized workflows. Microsoft assigned CVE-2026-21520 to the Copilot Studio issue, and reporting from VentureBeat and CSO described the broader failure: agents connected to email, CRM, and business data were interpreting public form text as instructions.

In late March 2026, Swiss security researcher Tobias Brunner published an account of a medical practitioner who had built a patient-management web app using an AI coding agent, imported real patient records into it, and put it on the public internet. Within about 30 minutes Brunner had full read and write access to every record. The data was unencrypted, the backend database had no access control or row-level security, all authorization logic lived in client-side JavaScript, and patient voice recordings were being shipped to US-based AI APIs with no data-processing agreement and no patient consent - almost certainly violating Swiss data-protection law and professional-secrecy rules. Notified, the practitioner replied with an obviously AI-generated message and "fixed" it by adding basic authentication. The victim is deliberately unnamed, so this is a documented exposure described by one named researcher plus corroborating community reports, not a confirmed third-party-exploited breach.

Oasis Security disclosed Claudy Day, a chained attack against Claude.ai that combined invisible URL-based prompt injection, Anthropic's Files API, and an open redirect on claude.com. A victim could click what looked like a trusted Claude search result, land in a normal Claude.ai chat with hidden instructions already planted in the prompt, and have Claude search prior conversations or memory for sensitive data before uploading the results to an attacker-controlled Anthropic account. Anthropic fixed the prompt-injection issue after responsible disclosure, while Oasis said the remaining issues were still being addressed when the report went public.

Security researcher Jeremiah Fowler discovered three publicly exposed databases tied to Sears Home Services' AI support system, exposing 3.7 million chat logs, 1.4 million audio recordings, and text transcripts from 2024 to 2026. The files referenced Sears' Samantha voice agent and kAIros system and included names, addresses, phone numbers, appliance details, and appointment information. Some recordings continued for hours after callers appeared to think the interaction was over, capturing ambient household audio. Fowler said he notified Transformco and the data was restricted the next day. Even without confirmed malicious access, leaving an AI customer-service archive like this on the open web is the kind of privacy own-goal that turns a modernization push into a liability.

PromptArmor disclosed that Snowflake's Cortex Code (CoCo) CLI agent could be hijacked through indirect prompt injection. A malicious instruction hidden in a third-party GitHub repository README caused the agent to download and run a script, bypass its human-in-the-loop approval step, and - by being talked into setting an unsandboxed execution flag - run the attacker's command entirely outside its sandbox, using the victim's active Snowflake credentials. That opened the door to data exfiltration or dropping tables. The bypass abused process-substitution syntax that the agent's command allowlist failed to validate. Tracked as CVE-2026-6442, Snowflake validated it and shipped a fix in Cortex Code 1.0.25 on February 28, 2026; coordinated public disclosure followed on March 16, 2026. No confirmed real-world exploitation was reported.

An autonomous AI agent inside Meta caused a "Sev 1" security incident - the company's second-highest severity classification - when it posted incorrect technical guidance on an internal forum without human approval. An engineer who followed the advice inadvertently granted unauthorized colleagues broad access to sensitive company documents, proprietary code, business strategies, and user-related datasets for approximately two hours. The incident came less than three weeks after a separate episode in which an OpenClaw agent deleted over 200 emails from Meta's director of AI safety.

GitGuardian's "State of Secrets Sprawl 2026" report found that AI-assisted commits on public GitHub leaked secrets at roughly double the rate of human-only commits - 3.2% versus a 1.5% baseline - while the total number of leaked secrets on GitHub hit 28.65 million in 2025, a 34% year-over-year increase and the largest single-year spike ever recorded. AI-service secrets specifically surged 81%, with eight of the ten fastest-growing leaked secret categories tied to AI services. Over 24,000 secrets were also exposed through public Model Context Protocol (MCP) configurations. The report is essentially a 50-page document explaining that the industry's enthusiasm for AI-assisted development has not been matched by a corresponding enthusiasm for not publishing credentials on the public internet.

Aikido Security's "State of AI in Security & Development 2026" report - a survey of 450 developers, AppSec engineers, and CISOs across Europe and the US - found that 20% of organizations have suffered a serious security breach directly caused by vulnerabilities in AI-generated code that those organizations deployed into production. Nearly seven in ten respondents reported finding vulnerabilities introduced by AI-written code in their own systems. With roughly a quarter of all production code now written by AI tools, the report documents an industry-wide accountability vacuum: 53% blame security teams, 45% blame the developer who wrote the code, and 42% blame whoever merged it.

A broken object-level authorization flaw in Lovable's API - OWASP's #1 ranked API vulnerability - let anyone with a free account read any other user's project source code, database credentials, and full AI conversation history in five API calls. Every project created before November 2025 was affected. A security researcher reported the flaw on March 3, 2026; Lovable patched new projects and closed the follow-up report as a duplicate, leaving the existing-project exposure open for 48 days. When the researcher went public on April 20, Lovable's response evolved through four contradictory positions before settling on blaming its bug bounty partner.

ERNW researcher Ahmad Al-Salehi showed that the Blackbox AI VS Code extension could be manipulated through indirect prompt injection. A malicious instruction hidden in a file, including a PNG image processed by the extension, could make the agent download and execute a reverse shell. With another prompt, the agent ran the payload with sudo, giving the attacker root access on the test host.

ReversingLabs found that an autonomous crypto trading agent ended up with a malicious dependency after a February 2026 commit co-authored by Anthropic's Claude Opus. The package chain looked like routine Solana tooling, but one transitive dependency, @validate-sdk/v2, exfiltrated secrets and could expose crypto wallets and funds. The campaign shows how attackers can build packages that look convincing to AI coding agents, then let the agent do the supply chain install for them.

A security researcher found 16 vulnerabilities - six critical - in an EdTech app featured on Lovable's showcase page, which had over 100,000 views and real users from UC Berkeley, UC Davis, and universities across Europe, Africa, and Asia. The AI-generated authentication logic was backwards, blocking logged-in users while granting anonymous visitors full access. 18,697 user records including names, emails, and roles were accessible without authentication, along with the ability to modify student grades, delete accounts, and send bulk emails. Lovable initially closed the researcher's support ticket without response.

Check Point Research disclosed a set of Claude Code vulnerabilities on February 25, 2026 that let attacker-controlled repositories execute shell commands and exfiltrate Anthropic API credentials through malicious project configuration. The attack abused hooks, MCP server definitions, and environment settings stored in repository files that Claude Code treated as collaborative project configuration. Anthropic patched the issues before public disclosure, but the research showed just how little distance separates "shareable team settings" from "clone this repo and let it run code on your machine."

Hudson Rock discovered that Vidar infostealer malware successfully exfiltrated an OpenClaw user's complete agent configuration, including gateway authentication tokens, cryptographic keys for secure operations, and the agent's soul.md behavioral guidelines file. OpenClaw stores these sensitive files in predictable, unencrypted locations accessible to any local process. With stolen gateway tokens, attackers could remotely access exposed OpenClaw instances or impersonate authenticated clients making requests to the AI gateway. Researchers characterized this as marking the transition from stealing browser credentials to harvesting the identities of personal AI agents.

PromptArmor demonstrated that AI agents in messaging platforms can exfiltrate sensitive data without any user interaction. Malicious prompts trick AI agents into generating URLs with embedded secrets (API keys, credentials), and the messaging platform's automatic link preview feature fetches these URLs, completing the exfiltration before the user even sees the message. Microsoft Teams with Copilot Studio was the most affected, with Discord, Slack, Telegram, and Snapchat also vulnerable.

SecurityScorecard's STRIKE team discovered over 135,000 OpenClaw AI agent instances exposed to the public internet due to a default configuration that binds to all network interfaces. Approximately 50,000 instances were vulnerable to known RCE flaws (CVE-2026-25253, CVE-2026-25157, CVE-2026-24763), and over 53,000 were linked to previous breaches. Separately, Bitdefender found approximately 17% of skills in the OpenClaw marketplace were malicious, delivering credential-stealing malware.

Owockibot, an autonomous AI agent connected to the internet and a crypto hot wallet, had its private key compromised five days after launch. Its creator said the agent had placed the secret in git commits and environment variables despite instructions never to share it, then proved unreliable while recounting what it had done. The creator removed the bot's internet access and ordered a security-first redesign. Later reports put the exposed hot wallet at roughly USD 2,100, while the creator said the larger treasury and signing keys remained safe.

A VibeEval scan of 1,430 applications built with AI coding tools found 5,711 security vulnerabilities, with 73% of apps containing at least one critical flaw. The analysis revealed 89% of scanned apps were missing basic security headers, 67% exposed API endpoints or secrets in client-side code, and 23% had JWT authentication bypasses. Apps generated via Replit had roughly twice the vulnerability count compared to those deployed on Vercel. The findings provide large-scale empirical evidence that vibe-coded applications routinely ship with fundamental security gaps.

Moltbook, a viral social network built for AI agents to post, comment, and interact, was entirely vibe-coded and shipped with a misconfigured Supabase database granting full read and write access to all platform data. Wiz researchers found a Supabase API key in client-side JavaScript within minutes, exposing 1.5 million API authentication tokens, 35,000 email addresses, and private messages. The database also revealed the platform's claimed 1.5 million agents were controlled by only 17,000 human owners.

Chat & Ask AI, a popular AI chatbot wrapper app with 50+ million users, had a misconfigured Firebase backend that exposed 300 million messages from over 25 million users. The exposed data included complete chat histories with ChatGPT, Claude, and Gemini -- including discussions of self-harm, drug production, and hacking. A broader scan found 103 of 200 iOS apps had similar Firebase misconfigurations.

A hacker bypassed Anthropic Claude's safety guardrails by framing requests as part of a "bug bounty" security program, convincing the AI to act as an "elite hacker" and generate thousands of detailed attack plans with ready-to-execute scripts. When Claude hit guardrail limits, the attacker switched to ChatGPT for lateral movement tactics. The result was 150 GB of stolen data from multiple Mexican federal agencies, including 195 million taxpayer records, voter information, and government employee files. A custom MCP server bridge maintained a growing knowledge base of targets across the intrusion campaign.

Varonis researchers disclosed the Reprompt attack, a chained prompt injection technique that exfiltrated sensitive data from Microsoft Copilot Personal with a single click on a legitimate Copilot URL. The attack exploited the "q" URL parameter to inject instructions, bypassed data-leak guardrails by asking Copilot to repeat actions twice (safeguards only applied to initial requests), and used Copilot's Markdown rendering to silently send stolen data to an attacker-controlled server. No plugins or further user interaction were required, and the attacker maintained control even after the chat was closed. Microsoft patched the issue in its January 2026 security updates.

CVE-2026-22812 covered a high-severity OpenCode flaw: before version 1.0.216, the AI coding agent automatically started a local HTTP server with no authentication and permissive CORS. The server exposed endpoints that could create terminals, read files, and execute shell commands as the user. A malicious local process or a website visited while OpenCode was running could turn the agent's helper server into a command-execution backdoor.

The popular AI workflow automation platform n8n disclosed a maximum-severity vulnerability (CVE-2026-21858) allowing unauthenticated remote code execution on self-hosted instances. With over 25,000 n8n hosts exposed to the internet, the flaw enabled attackers to access sensitive files, forge admin sessions, and execute arbitrary commands. This followed two other critical RCE flaws patched in the same period, pointing to systemic security issues in AI automation platforms.

Koi Security researcher Oren Yomtov disclosed ShadowPrompt, a zero-click attack chain in Anthropic's Claude for Chrome extension, which has more than 3 million users. It combined an overly permissive origin allowlist that trusted any *.claude.ai subdomain with a DOM-based cross-site scripting bug in an outdated Arkose Labs CAPTCHA hosted on a-cdn.claude.ai. Merely visiting a malicious page let an attacker inject arbitrary instructions into Claude as if the user had typed them, with no click and no permission prompt - enough to steal a Gmail access token, read Google Drive, export chat history, or send email as the victim. Reported December 26, 2025; Anthropic shipped an extension fix around January 15, 2026, and Arkose Labs patched the XSS on February 19, 2026. Responsibly disclosed; no confirmed exploitation.

Noma Security disclosed GeminiJack, a zero-click flaw in Google Gemini Enterprise, on December 11, 2025. An attacker shares a booby-trapped Google Doc, email or calendar invite carrying hidden instructions. The victim never has to open it. Later, when any employee asks Gemini a routine question, the assistant's retrieval layer pulls in the poisoned content, treats the buried instructions as commands, and quietly exfiltrates emails, documents and calendar data containing terms like "confidential," "legal," "salary" or "API key." Google confirmed the findings and deployed mitigations. The vulnerability is not a bug in traditional code; it is the AI doing exactly what injected text told it to, because it cannot tell the difference between data it retrieved and instructions it should follow.

Legit Security researcher Omer Mayraz disclosed CamoLeak, a critical flaw rated CVSS 9.6 in GitHub Copilot Chat. An attacker hides instructions in invisible Markdown comments inside a pull request; when a victim asks Copilot Chat about that PR, the assistant ingests the hidden text, searches the victim's private repositories for secrets and source, and smuggles the data out one character at a time through pre-signed image URLs routed via GitHub's own Camo image proxy. Because the traffic flows through GitHub's trusted infrastructure, it blends into normal image loading. GitHub mitigated it by disabling image rendering in Copilot Chat around August 14, 2025, after a June 2025 HackerOne report; public disclosure followed in October 2025. The reported attack is a proof of concept with no confirmed real-world victims.

Researchers at CodeIntegrity showed that Notion 3.0's autonomous AI agents, running Claude Sonnet 4 with web-search tool access, could be hijacked by a PDF containing white-on-white hidden text. Once the agent read the file, the concealed instructions told it to gather confidential workspace data - customer names, companies, and annual recurring revenue - concatenate it, and exfiltrate it by issuing a web-search request (functions.search) to an attacker-controlled URL. The technique is the classic "lethal trifecta": access to private data, exposure to untrusted content, and a way to communicate externally, all in one agent. The finding was corroborated by Simon Willison and PromptArmor. Notion, which reports roughly 100 million users, said it had remediated in production and upgraded its injection detection. Disclosed around September 18-19, 2025. A hazard and near-miss; no confirmed customer harm.

At Black Hat USA 2025, Zenity Labs researcher Tamir Ishay Sharbat demonstrated AgentFlayer, a zero-click exploit against ChatGPT Connectors. A document carrying invisible text - a prompt written in roughly 300 words of one-pixel white font - is shared with a target. Even a harmless "summarize this" makes ChatGPT follow the buried instructions, search the user's connected Google Drive or SharePoint for API keys and secrets, and exfiltrate them through image-render URLs pointed at attacker-controlled Azure Blob storage, slipping past OpenAI's url_safe check. AgentFlayer was part of a broader set of zero click attacks Zenity disclosed on August 6, 2025, that also hit Copilot Studio, Salesforce Einstein, Cursor with Jira, and Gemini. The work is a proof of concept; extraction was proven via the researchers' own logs, with no confirmed customer harm.

Tea, a women-only dating safety app with over four million users, suffered three data breaches in July 2025 that exposed 72,000 private images - including 13,000 photos of women holding government-issued IDs - and more than 1.1 million private messages containing deeply personal accounts of relationships, trauma, and abuse. The exposed data circulated on 4chan and hacking forums. The app's founder later admitted to building it with contractors and AI tools without personal coding knowledge. Security researchers attributed the breaches to missing authentication, unsecured legacy databases, and development practices that prioritized speed over security. Multiple class-action lawsuits and privacy regulator investigations followed.

Legit Security researcher Omer Mayraz disclosed a remote prompt-injection flaw in GitLab Duo, the AI assistant built into GitLab. Because Duo reads the entire page context - merge request descriptions, commit messages, issue comments, and source code - an attacker could plant hidden instructions (for example, white KaTeX-rendered text) that Duo would obey. The crafted prompt told Duo to pull a confidential issue the victim could access, base64-encode it, and embed it in an image tag whose render leaked the data to an attacker-controlled server. The same flaw let attackers slip malicious HTML and links into Duo's answers shown to other users. Reported in February 2025 and disclosed in May 2025, GitLab patched the unsafe HTML rendering. No confirmed real-world exploitation was reported.

Red teamers at Pen Test Partners showed that Microsoft 365 Copilot's default SharePoint "agents" could be asked, in plain English, to read and print the contents of files a user was technically blocked from accessing - including passwords sitting in spreadsheets and TXT files. The trick defeated SharePoint's "Restricted View" permission, which is supposed to stop downloading, copying, and printing, because the text of a Copilot chat can be freely copied even when the underlying file cannot. The reconnaissance also failed to register in the normal "accessed by" lists that a direct file open would have produced, so the recon ran quietly. Disclosed in May 2025; Forbes and others covered it. No named victim breach was reported - this is a documented hazard about an AI assistant defeating an access control.

Security researcher Matt Palmer discovered that applications generated by Lovable, a vibe-coding platform, shipped with insufficient Supabase Row-Level Security policies that allowed unauthenticated attackers to read and write arbitrary database tables. The vulnerability, tracked as CVE-2025-48757, affected over 170 apps and exposed sensitive data including personal debt amounts, home addresses, API keys, and PII. A separate researcher found 16 vulnerabilities in a single Lovable-hosted app that leaked more than 18,000 people's data. Lovable's response was widely criticized as inadequate.

EnrichLead, a sales lead SaaS application whose founder Leo Acevedo publicly boasted was built entirely with Cursor AI and "zero hand-written code," was permanently shut down in March 2025 after attackers exploited a constellation of basic security failures. API keys sat exposed in frontend code. There was no authentication. The database was wide open. There was no rate limiting. No input validation. Attackers bypassed subscriptions, manipulated data, and maxed out API keys - all within two days of Acevedo's viral celebration post. When he tried to use Cursor to fix the problems, the AI "kept breaking other parts of the code." The app was dead within the week. Acevedo has since launched new vibe-coded projects, because some lessons require a second attempt.

WotNot, an Indian AI startup whose platform lets companies build customer-facing chatbots, left a Google Cloud Storage bucket fully public, exposing 346,381 files that end users had uploaded through those chatbots. The trove included passports and national ID scans, detailed medical records, resumes, and travel itineraries. Cybernews researchers discovered the open bucket on August 27, 2024, and the exposure was reported publicly in early December 2024. WotNot took more than two months, despite repeated notifications, to lock it down. WotNot lists customers including Merck, the University of California, and Amneal Pharmaceuticals. The root cause was a classic misconfigured cloud bucket; the AI was the funnel that collected the sensitive documents, not the thing that broke. There is no public evidence of malicious access, but the data sat readable to anyone for an extended, unknown period.

PromptArmor disclosed that Slack AI could be coaxed into leaking data from private channels and direct messages the attacker had no access to. The attacker only had to post adversarial instructions in any public channel. When a user with private access later asked Slack AI a question, the assistant pulled the planted text into the same context and obeyed it, rendering an exfiltration path as a clickable Markdown link that smuggled private content - including secrets pasted into DMs - inside the URL. Slack initially called the behavior intended, then deployed a patch after the report went public in August 2024. This is a textbook indirect-prompt-injection authorization break: low-privilege input steering a high-privilege action. No confirmed real-world exploitation was reported.