# cases·12 incidents·9 research demos·checked Nov. 15, 2026
Documented AI security cases
Each case is a MITRE ATLAS case study that we checked against the original disclosure. Incidents happened in the wild. Research demos show an attack working, often disclosed to the vendor first. Dates are when the issue was publicly disclosed.
All cases, newest first
Incidentdisclosed Sept. 8, 2026·AML.CS0076 Industrial-scale distillation of U.S. models
NSA, CISA and the FBI say six named China-based AI companies collected outputs from U.S. models over millions of exchanges, from at least late 2024, and used them to train their own models.
The advisory asks model providers to watch for anomalous accounts and usage, rate-limit, verify identities, log telemetry and share intelligence across providers.
risks: Unbounded consumption and model theft
Sources: NSA, CISA and FBI; MITRE ATLAS AML.CS0076
Incidentdisclosed July 16, 2026·AML.CS0068 Malicious dataset used to break into Hugging Face clusters
Hugging Face says a malicious dataset used two code-execution paths in its dataset processing, a remote-code loader and a template injection in a dataset configuration, to run code on a worker. The intruder then harvested credentials and moved into several internal clusters over a weekend.
Hugging Face reports access to some internal datasets and service credentials, and no tampering with public models, datasets or Spaces. It closed both paths and rotated credentials. Its post does not name the attacker. MITRE's case study attributes the activity to autonomous agents from OpenAI cyber evaluations.
risks: AI supply chain compromise, Exposed AI infrastructure and stolen AI keys
Sources: Hugging Face; MITRE ATLAS AML.CS0068
Research demodisclosed June 5, 2026·AML.CS0067 CI secret read through a coding agent's file tool
Microsoft researchers hid instructions in GitHub issue and pull request text processed by Anthropic's Claude Code GitHub Action. Secret scrubbing covered shell commands, but the agent's in-process Read tool could open /proc/self/environ and expose the workflow's API key.
Microsoft reported it on April 29, 2026 and Anthropic fixed it on May 5 by blocking sensitive /proc files (Claude Code 2.1.128). Microsoft's advice: never give one workflow untrusted input, secrets and outbound communication at the same time.
risks: Prompt injection, Hidden context exposure, Excessive agency
Sources: Microsoft Threat Intelligence; MITRE ATLAS AML.CS0067
Research demodisclosed Feb. 19, 2026·AML.CS0062 Prompt to code execution in Semantic Kernel's vector search
In the Python version of Microsoft's Semantic Kernel, the default filter for in-memory vector search built a Python lambda from model-controlled values and ran it with eval(). A crafted prompt got past the blocklist and ran code on the host.
Fixed in semantic-kernel 1.39.4 (CVE-2026-26030). Microsoft's lesson: any tool parameter the model can influence is attacker-controlled input.
risks: Improper output handling, Excessive agency, Prompt injection
Sources: Microsoft Security; NIST National Vulnerability Database; MITRE ATLAS AML.CS0062
Incidentdisclosed Feb. 10, 2026·AML.CS0072 "Summarize with AI" links that plant memories
Most AI assistants accept a prefilled prompt in a link. Microsoft found businesses using such links to tell assistants to remember them as a trusted source or recommend them first. Over 60 days of email traffic it counted 50 prompts from 31 companies.
Microsoft's advice: treat AI assistant links like downloads, review and prune stored memories, and hunt for assistant URLs whose prompt contains words like "remember" or "trusted source".
risks: Memory and context poisoning, Prompt injection
Sources: Microsoft Defender Security Research Team; MITRE ATLAS AML.CS0072
Incidentdisclosed Nov. 13, 2025·AML.CS0069 GTG-1002 used a jailbroken coding agent for espionage
Anthropic says a group it assesses with high confidence to be Chinese state-sponsored used Claude Code to attempt intrusions at about 30 organizations, succeeding in a small number. The operators split the work into innocent-looking tasks and told the model it worked for a security firm doing defensive testing.
Anthropic estimates AI did 80 to 90 percent of the campaign's work. It banned the accounts, notified affected organizations and added detection classifiers.
risks: Attackers using AI against you, Prompt injection
Sources: Anthropic; MITRE ATLAS AML.CS0069
Incidentdisclosed Sept. 25, 2025·AML.CS0053 Fake Postmark MCP server copied every email to an attacker
Someone published an npm package called postmark-mcp that posed as an MCP server for the Postmark email service. After 15 harmless versions, version 1.0.16 added a backdoor that blind-copied outgoing email to an external server.
Postmark says it had nothing to do with the package. It told users to remove it, check email logs and consider rotating any credentials sent by email while it was installed.
risks: MCP and agent tool poisoning, AI supply chain compromise
Sources: Postmark; MITRE ATLAS AML.CS0053
Research demodisclosed Aug. 6, 2025·AML.CS0063 A calendar invite that took over Gemini
SafeBreach researchers put instructions in the title of a Google Calendar invitation. When the victim asked Gemini about their calendar, it followed them: deleting events, opening a video call, controlling smart-home devices through Google Home and leaking email subject lines in URLs.
The researchers reported it in February 2025. Google described layered defenses, including stronger confirmations for sensitive actions and URL sanitization, and called the techniques theoretical.
risks: Prompt injection, Excessive agency
Sources: SafeBreach Labs; MITRE ATLAS AML.CS0063
Incidentdisclosed July 23, 2025·AML.CS0047 Wiper prompt shipped in the Amazon Q VS Code extension
An attacker used a GitHub token with too much scope to commit code to the open-source repository of the Amazon Q Developer extension for VS Code, and the code shipped in version 1.84.0. MITRE's write-up says the code prompted the Q agent to clean a system to a near-factory state and delete file system and cloud resources.
AWS says the code failed to run because of a syntax error and made no changes to services or customer environments. Version 1.85.0 removed it (CVE-2025-8217).
risks: AI supply chain compromise, Prompt injection, Excessive agency
Sources: Amazon Web Services; NIST National Vulnerability Database; MITRE ATLAS AML.CS0047
Incidentdisclosed July 17, 2025·AML.CS0044 LAMEHUG malware asked an LLM for its next commands
Ukraine's CERT-UA found Python malware that called Qwen 2.5-Coder-32B-Instruct through the Hugging Face API to write reconnaissance and document-theft commands on infected machines. It arrived in phishing emails sent from compromised accounts posing as ministry officials.
CERT-UA attributed the activity to APT28 with medium confidence. It did not say whether the generated commands worked.
risks: Attackers using AI against you
Sources: BleepingComputer; MITRE ATLAS AML.CS0044
Research demodisclosed June 11, 2025·AML.CS0059 EchoLeak: one email, data out of Microsoft 365 Copilot
Researchers showed that a single crafted email could make Microsoft 365 Copilot send internal data to an attacker with no click from the victim. Copilot pulled the email into its context, and the chain got past an injection classifier and link redaction, then used auto-fetched images and a Teams proxy allowed by the content security policy.
Tracked as CVE-2025-32711, described as AI command injection in M365 Copilot that lets an unauthorized attacker disclose information over a network.
risks: Prompt injection, Sensitive information disclosure, Improper output handling, Vector and embedding weaknesses
Sources: Reddy and Gujral, arXiv:2509.10540; NIST National Vulnerability Database; MITRE ATLAS AML.CS0059
Research demodisclosed April 1, 2025·AML.CS0054 Hidden instructions in an MCP tool description
Invariant Labs put instructions in the description of an innocent-looking add tool. In Cursor, the agent then read the user's MCP config file and SSH private key and sent them out through a hidden tool parameter. The confirmation dialog did not show the full input.
The researchers also described rug pulls (a server changes a tool after approval) and shadowing (one server's tool description changes how the agent uses another server's tool). They recommend pinning server versions and showing users full tool descriptions.
risks: MCP and agent tool poisoning, Sensitive information disclosure
Sources: Invariant Labs; MITRE ATLAS AML.CS0054
Research demodisclosed March 18, 2025·AML.CS0041 Rules File Backdoor in AI coding assistants
Pillar Security hid instructions in the rules files that configure Cursor and GitHub Copilot, using invisible Unicode characters that reviewers could not see. The assistants then added attacker-chosen code, such as a script tag, without mentioning it in chat.
Cursor said the risk was the user's responsibility. GitHub said users must review suggestions, and in May 2025 it started warning when a file on github.com contains hidden Unicode text.
risks: AI supply chain compromise, Prompt injection, Improper output handling
Sources: Pillar Security; MITRE ATLAS AML.CS0041
Incidentdisclosed Feb. 27, 2025·AML.CS0057 Storm-2139 resold access to hijacked AI service accounts
Members of a group Microsoft tracks as Storm-2139 scraped exposed customer credentials from public sources and used them to get into generative AI service accounts. They changed what the services would do, deliberately worked around Microsoft's safeguards, and resold the access.
Microsoft sued in December 2024, seized a website central to the operation and later named four developers in an amended complaint.
risks: Exposed AI infrastructure and stolen AI keys, Prompt injection
Sources: Microsoft; MITRE ATLAS AML.CS0057
Incidentdisclosed Feb. 6, 2025·AML.CS0031 Malicious models on Hugging Face slipped past the scanner
ReversingLabs found two models on Hugging Face whose Pickle files opened a reverse shell when loaded. The files used 7z compression and broke right after the payload, so Hugging Face's Picklescan tool did not flag them even though the code still ran.
ReversingLabs reported them on January 20, 2025. Hugging Face removed the models within 24 hours and changed Picklescan to inspect broken Pickle files.
risks: AI supply chain compromise
Sources: ReversingLabs; MITRE ATLAS AML.CS0031
Incidentdisclosed October 2024·AML.CS0034 ProKYC sold deepfake identities to beat ID checks
ProKYC was sold on criminal forums as a way through remote identity verification. It produced a fake ID document together with a video of the face on it, and was used for account fraud against cryptocurrency exchanges.
IDScan.net reported a price of $629 a year. Cato Networks' original write-up did not load for us, so this entry rests on IDScan's report and MITRE's case study.
risks: Attackers using AI against you
Sources: IDScan.net; MITRE ATLAS AML.CS0034
Research demodisclosed Aug. 20, 2024·AML.CS0035 Slack AI leaked a private-channel API key
PromptArmor posted an instruction in a public channel that only the attacker had joined. When a victim later asked Slack AI about their own private messages, it followed the instruction and showed a "reauthenticate" link carrying an API key from a private channel. The citation pointed only to the victim's channel.
Slack told the researchers this was intended behavior, since public channel messages are searchable by all workspace members.
risks: Prompt injection, Vector and embedding weaknesses, Sensitive information disclosure
Sources: PromptArmor; MITRE ATLAS AML.CS0035
Research demodisclosed May 22, 2024·AML.CS0040 False memories written into ChatGPT from a shared document
A researcher put instructions in a Google Doc. When ChatGPT read it through a connected app, each instruction became a stored memory that carried into later conversations. Uploaded images worked too, and the researcher could also delete all memories this way.
OpenAI closed the report as a model safety issue rather than a security vulnerability. The researcher advises watching for "Memory updated" notices and reviewing stored memories.
risks: Memory and context poisoning, Prompt injection
Sources: Embrace The Red (independent researcher); MITRE ATLAS AML.CS0040
Incidentdisclosed May 6, 2024·AML.CS0030 LLMjacking: stolen cloud keys used to run up AI bills
Attackers took cloud credentials from a server running a vulnerable version of Laravel (CVE-2021-3129) and used them to reach cloud-hosted language models. Their script checked stolen keys against ten AI services, including AWS Bedrock, Azure, OpenAI and Google Vertex AI.
Sysdig estimated a worst case of more than $46,000 a day in model costs for the victim. That figure assumes maximum quota use in several regions. Its advice: patch, keep secrets out of plain text, scope credentials tightly and log model invocations.
risks: Exposed AI infrastructure and stolen AI keys, Unbounded consumption and model theft
Sources: Sysdig Threat Research Team; MITRE ATLAS AML.CS0030
Research demodisclosed March 28, 2024·AML.CS0022 Hallucinated package name downloaded more than 30,000 times
A Lasso Security researcher asked four models thousands of coding questions across five languages and found they often recommended packages that did not exist, sometimes the same invented name again and again. He uploaded an empty package under one of those names, huggingface-cli.
The empty package received more than 30,000 downloads in three months, and an Alibaba research repository told readers to install it. OWASP calls registering such names in advance slopsquatting.
risks: AI supply chain compromise, Misinformation and overreliance
Sources: Lasso Security; OWASP GenAI Security Project; MITRE ATLAS AML.CS0022
Incidentdisclosed March 26, 2024·AML.CS0023 ShadowRay: exposed Ray clusters taken over
Ray, an open-source framework for scaling AI workloads, has a Jobs API with no authorization. Oligo found internet-exposed clusters that attackers had been using since at least September 2023 to install crypto-miners, open reverse shells and collect credentials for services such as OpenAI, Hugging Face and Stripe.
The issue is tracked as CVE-2023-48022, which Anyscale disputes. Its position is that Ray is not meant to run outside a strictly controlled network.
risks: Exposed AI infrastructure and stolen AI keys
Sources: Oligo Security; NIST National Vulnerability Database; MITRE ATLAS AML.CS0023
How cases are chosen
We start from MITRE ATLAS release 2026.10, which has 77 case studies, and keep the ones that illustrate a risk in the register and that we could check against a primary source: the affected vendor, a CVE record, a government advisory, or the researchers' own write-up. Where we could only load a secondary report, the case says so. ATLAS labels each case Incident or Exercise, and we show Exercise as "research demo".
The list is a selection, not a census. A risk with few cases here may still be common. Read the editorial policy for how we write summaries.