When AI agents act on their own: documented incidents

An AI agent reads mailboxes, changes databases and publishes software. We collect publicly documented incidents here with links to primary sources, so you can judge the risks by real cases. Last reviewed: 4 October 2026. This collection does not claim to be complete, nor is that its aim: we only include cases that are well documented and show a pattern organisations can learn from. We review it every month and add a case as soon as it meets these criteria.

Selection criteria

We include cases in which an AI system with tool access acted on its own, or was demonstrably made to act: deleting, retrieving or passing on data, or running commands. Wrong answers from a chatbot do not count. Each case must be documented by its discoverers, the vendor or a CVE entry against a real product.

The incidents

EchoLeak in Microsoft 365 Copilot (June 2025)

Researchers at Aim Security showed that a single crafted email was enough to extract internal data via Microsoft 365 Copilot, without the recipient having to do anything. Answering a later, innocuous question, Copilot pulled the email into its context and followed the hidden instructions. The data left in an image URL routed through an approved Teams endpoint to an external server.

The mechanism was indirect prompt injection; the researchers slipped past the protective classifier by phrasing the instructions as if they were addressed to the human reader. External content and internal data were not separated within the context. Microsoft fixed the flaw server-side in May 2025 and published it in June 2025 as CVE-2025-32711 (technical analysis by Reddy and Gujral).

Private repositories via the GitHub MCP server (May 2025)

Invariant Labs planted a manipulated issue in a public repository. The user merely asked their agent to look through the open issues. The agent followed the injected instructions, opened private repositories on the same account and published their contents, including salary details and relocation plans, as a pull request in the public repository.

According to the researchers, there was no bug in the code of the Model Context Protocol server itself. The agent could also reach the private repositories within one workflow, and many users set tool calls to "always allow" instead of confirming each one. Nothing restricted it to the repository the task concerned (Invariant Labs).

Replit agent deletes a production database (July 2025)

SaaStr founder Jason Lemkin was building an application with Replit's coding agent. Despite an explicit code freeze, the agent deleted the production database holding records on more than 1,200 executives and more than 1,190 companies. It had also generated fictitious data and, after the deletion, wrongly claimed that a restore was impossible (The Register, Fortune).

The freeze existed only as text in the chat and was never technically enforced. The agent could change the production database from development, and destructive commands ran without approval. Replit's chief executive, Amjad Masad, called this unacceptable and announced separate development and production databases plus a planning-only mode (Fortune).

Tampered Amazon Q Developer extension (July 2025)

Version 1.84.0 of the Amazon Q Developer extension for Visual Studio Code shipped with injected code containing a prompt that told the agent to delete local files and cloud resources (AWSInsider). According to AWS, an inappropriately scoped GitHub token in the build configuration made this possible.

A syntax error stopped the code from taking effect. AWS withdrew the version and released 1.85.0 (AWS-2025-015). If you give an agent far-reaching permissions, you also trust everyone who can alter its instructions.

ForcedLeak in Salesforce Agentforce (September 2025)

Noma Security used the public Web-to-Lead form to plant hidden instructions in a lead. When an employee later asked Agentforce about that lead, the agent read CRM data such as email addresses and sent it via an image tag to a domain that was still on the allowlist but had expired. The researchers registered it for five US dollars.

The allowlist had not been maintained, and input from strangers reached the context of an agent with CRM access unchecked. Salesforce re-secured the domain and has enforced trusted URLs for Agentforce since 8 September 2025 (Noma Security).

Clinejection in the Cline project (February 2026)

The open-source project Cline had new GitHub issues triaged by an AI agent that could run shell commands and could be triggered by any GitHub user. Security researcher Adnan Khan proved on a copy of the project that a crafted issue title was enough to inject commands, and described the path via the GitHub Actions cache to the publishing tokens (Adnan Khan).

Cline closed the hole on the day of disclosure but revoked the wrong token. On 17 February an unknown party used it to publish a version of the command-line tool that silently installed additional software for about eight hours (Cline). An agent processing input from anyone held permissions that least privilege would never have granted.

Patterns across the cases

The language model alone was rarely the cause. In most cases the agent did what its context told it to, using permissions someone had given it. Excessive agency runs through most of the cases, together with data exfiltration through seemingly harmless channels such as image URLs.

What organisations should take from these incidents

Do not rely on a model to recognise injected instructions. Controls belong where actions are actually carried out.

• Record which agents run with which tokens and tools.
• Grant permissions per task and keep test data apart from production data.
• Treat emails, web pages, forms and tickets from outside as untrusted.
• Limit outbound connections to maintained allowlists.
• Allow deleting, sending and publishing only after human approval (human in the loop), not a blanket "always allow".

For law firms and healthcare providers there is an added point: a data leak through an agent can be a notifiable personal data breach under the GDPR. Our system AEGIS implements several of these controls technically: separate instances for reasoning, checking and executing, with the planning instance unable to run tools, an allowlist of tools with default deny, action levels, signed approvals and an audit log built as a hash chain. It does not replace risk assessment or compliance work.