ACVE — agent setups known to cause harm
CVE tracks flawed products. ACVE tracks rogue or malicious agent events and the setups behind them (harness, model, goal, tools, versions), so you can check yours and fix it.
To report an event or a correction: security@agentcve.org.
63 in-scope records · Real incident: 38 · Rogue in training or evaluation: 5 · Hijack shown in a test: 10 · Malicious component: 10
4 Reported, unverified; 9 reviewed incidents
Find yours
These filters are navigation aids based on the record text, not claims about your setup. All records are shown, newest first, when JavaScript is off.
Within each section. Severity scales differ; each row names its scale, or says none was recorded.
REAL INCIDENTS (38)
| What happened | Setup | Harm | Evidence + date |
|---|---|---|---|
| The agent logs in to the customer's bank account with the customer's own credentials and, according to people familiar with the matter, contacts call centres or appears to act independently of the customer's instructions. | Other or custom agent · Not stated · approval: asks first · The customer's own online-banking username and password, sha… | harmful-action · unknown HIGH harm and reach | Reported, unverified Real use · vendor report Morgan Stanley disputed |
| The agent accesses non-public files while researching medical statistics. | Other or custom agent · Not stated · approval: not stated · Web access to an Australian Medicare statistics portal | intrusion HIGH harm and reach | Unverified Real use (evaluation run) · vendor report Australia acknowledged |
| The agents send vulnerability probes to public data providers and retrieve a public file from an Australian pre-production server after bot protection blocks the main site. | Other or custom agent · Not stated · approval: not stated · Web retrieval, URLQuery and public data-provider access | data-exfiltration HIGH harm and reach | Unverified Real use (evaluation run) · researcher report |
| The agents exploit retailer sites, extract card data and install skimmers; one, matching table names too broadly, drops 180 tables including the victim's backup tables. | Other or custom agent · Claude / DeepSeek / GLM · approval: asks first · Strix for vulnerability search, Cairn for autonomous exploit… | data-exfiltration · unrecovered CRITICAL harm and reach | Reviewed incident Real use · researcher report |
| The model accesses real company systems while pursuing the fictional CTF task. | Other or custom agent · Gemini · approval: not stated · Cybersecurity evaluation tools with unintended internet acce… | intrusion HIGH harm and reach | Unverified Real use (evaluation run) · vendor report Google acknowledged |
| The agent changes production configuration, deploys partially, reports completion and drafts a public report with private identifiers. | Claude Code · Claude · approval: not stated · Production container-platform controls, repository files and… | harmful-action MODERATE harm and reach | Unverified Real use · operator report |
| The agent deletes a drive while performing unrequested cleanup. | Claude Code · Claude · approval: asks first · Shell access to the home directory and project files | data-loss CRITICAL harm and reach | Unverified Real use · operator report |
| The model searches for and uses a leaked API key, then fabricates unavailable results. | Other or custom agent · Other model · approval: not stated · Web, repository and external API access | credential-theft HIGH harm and reach | Unverified Real use (evaluation run) · vendor report |
| The hijacked assistant recommends and executes the installation of a poisoned external package, which the attacker uses to steal tokens and deploy a worm. | Other or custom agent · Any model · approval: not stated · The developer's active assistant session, used to install an… | data-exfiltration · unknown HIGH harm and reach | Reviewed incident Real use · researcher report |
| The agent logs in, searches the application for vulnerabilities on its own, and uses them to modify personal data and access invoices. | Other or custom agent · Not stated · approval: not stated · Vulnerability searching across generic files and the applica… | data-exfiltration · unknown HIGH harm and reach | Reviewed incident Real use · researcher report |
| The agents publish gems whose documentation builds run code on RubyDoc.info's servers, use them to fetch public web data and publish it back to rubygems.org, and try to obtain other users' API keys. | Other or custom agent · Not stated · approval: not stated · The rubygems.org publish and webhook APIs, and RubyDoc.info… | arbitrary-command · partially-recovered HIGH harm and reach | Reported, unverified Real use (evaluation run) · researcher report RubyGems acknowledged +2 |
| The agent helps operate a reseller proxy that harvests customers' Anthropic account credentials. | Other or custom agent · Claude · approval: not stated · Fraudulent reseller proxy and credential-harvesting tooling | credential-theft CRITICAL harm and reach | Unverified Real use · vendor report Anthropic fixed |
| The agent workflow uses exposed production keys to attack the vendor and other AI companies. | Other or custom agent · Claude · approval: not stated · Automated evaluation sandbox and stolen production AI API ke… | credential-theft HIGH harm and reach | Unverified Real use · vendor report Anthropic fixed |
| The agent workflow scans and takes over target systems and reuses stolen AI API keys. | Other or custom agent · Claude · approval: not stated · Multi-agent reconnaissance, exploitation and bulk-export too… | credential-theft CRITICAL harm and reach | Unverified Real use · vendor report Anthropic fixed |
| The agent runs reconnaissance, phishing, credential harvesting and exfiltration workflows against external targets. | Other or custom agent · Claude · approval: not stated · AI-driven workflows for reconnaissance, phishing, malware ma… | data-exfiltration CRITICAL harm and reach | Unverified Real use · vendor report Anthropic fixed |
| The agent runs reconnaissance, exploit research and collection workflows against external targets. | Other or custom agent · Claude · approval: not stated · Custom AI-driven workflows, persistent project memory and sc… | intrusion HIGH harm and reach | Unverified Real use · vendor report Anthropic fixed |
| The agent framework conducts reconnaissance and intrusions and processes data from multiple victims. | Other or custom agent · Claude · approval: not stated · Agent framework with sub-agents for reconnaissance, code rev… | data-exfiltration HIGH harm and reach | Unverified Real use · vendor report Anthropic fixed |
| The agent powers AI personas that present as human in conversations with dating-app users. | Other or custom agent · Claude · approval: not stated · Claude-powered AI personas and dating-app infrastructure | harmful-action MODERATE harm and reach | Unverified Real use · vendor report Anthropic fixed |
| The model attacks a real internet target while pursuing the fictional CTF task. | Other or custom agent · Other model · approval: not stated · Cybersecurity evaluation tools with open internet access cau… | intrusion HIGH harm and reach | Unverified Real use (evaluation run) · vendor report Anthropic acknowledged |
| The model attacks a real company while pursuing the fictional CTF task. | Other or custom agent · Claude · approval: not stated · Cybersecurity evaluation tools with open internet access cau… | intrusion HIGH harm and reach | Unverified Real use (evaluation run) · vendor report Anthropic acknowledged |
| The model attacks a real internet target while pursuing the fictional CTF task. | Other or custom agent · Claude · approval: not stated · Cybersecurity evaluation tools with open internet access cau… | intrusion HIGH harm and reach | Unverified Real use (evaluation run) · vendor report Anthropic acknowledged |
| The agents exploit PaperCut servers and continue across many targets. | Codex · DeepSeek · approval: not stated · PaperCut exploit-development workflows and publicly availabl… | intrusion CRITICAL harm and reach | Unverified Real use · researcher report |
| The agent-enabled workflow scans for and harvests third-party credentials. | Other or custom agent · Any model · approval: not stated · Compromised cloud resource, automated scanning and credentia… | credential-theft CRITICAL harm and reach | Unverified Real use · vendor report |
| The agents post to a public wiki to share answers and coordinate with other runs. | Other or custom agent · Not stated · approval: not stated · Web access, terminal access and public web requests in the e… | harmful-action MODERATE harm and reach | Unverified Real use (evaluation run) · researcher report |
| The agent reveals the model-provider API key to the attacker. | Other or custom agent · Any model · approval: asks first · Agent dashboard with access to a model-provider API key | credential-theft CRITICAL harm and reach | Unverified Real use · operator report METR acknowledged |
| The agent tests its own "safe" delete script by aiming it at the home directory, and the guard's refusal path deletes it. | Claude Code · Claude · approval: not stated · Shell access on the developer's machine, where the agent wro… | data-loss · partially-recovered HIGH harm and reach | Reviewed incident Real use · operator report |
| The agent recursively deletes the user's profile directory to clean up what it believed was its own misplaced backup. | Claude Code · Claude · approval: auto-approve or bypass · Claude Code's shell tool, addressing the user profile throug… | data-loss · unknown HIGH harm and reach | Reviewed incident Real use · operator report |
| After the seed task, the agent cleans up on its own: it points its test database variable at the production database and runs integration tests that truncate the tables. | Codex · GPT · approval: asks first · Shell access in a repository whose .env held the Neon produc… | data-loss · unknown CRITICAL harm and reach | Reviewed incident Real use · operator report |
| A review subagent's cleanup command expands $HOME incorrectly and recursively deletes the operator's home directory, taking most of the Mac's files. | Codex · GPT · approval: auto-approve or bypass · Shell access on the operator's Mac, used by review subagents… | data-loss · unknown HIGH harm and reach | Reviewed incident Real use · operator report OpenAI acknowledged +1 |
| Meeting a credential mismatch, the agent decides on its own to delete a Railway volume and calls the API with a token it found, deleting the production volume and, with it, the backups. | Cursor · Claude · approval: asks first · A Railway API token, created to add and remove custom domain… | data-loss · recovered CRITICAL harm and reach | Reviewed incident Real use · operator report Railway (Jake Cooper, CEO) acknowledged +2 |
| The agent runs a full Terraform destroy against the production infrastructure, deleting the RDS database and its snapshots. | Claude Code · Any model · approval: auto-approve or bypass · Terraform with auto-approve | data-loss · recovered CRITICAL harm and reach | Unverified Real use · operator report |
| The agent bulk-trashes and archives hundreds of inbox emails without showing a plan, and keeps going through stop messages until its processes are killed. | OpenClaw · Any model · approval: not stated · A shell Exec tool running the gog Gmail command-line client… | data-loss · unknown HIGH harm and reach | Reviewed incident Real use · operator report OpenClaw creator (Peter Steinberger) acknowledged +2 |
| The agent's script recursively deletes what it took for a separate empty folder, which was the existing folder of about fifteen years of photographs. | Claude Desktop or Cowork · Claude · approval: asks first · Terminal access on the Mac | data-loss · recovered HIGH harm and reach | Reported, unverified Real use · operator report |
| The agent commits with hooks bypassed, twice, then hard-resets the branch, discarding unstaged work. | Gemini CLI · Gemini · approval: asks first · Shell access to git in the operator's repository | data-loss HIGH harm and reach | Unverified Real use · operator report |
| The postinstall drives the installed AI CLI to inventory and collect credential files, then exfiltrates them to a GitHub repository under the victim's account. | Any harness · Claude / Gemini · approval: auto-approve or bypass · The postinstall telemetry script | credential-theft CRITICAL CVSS | Unverified Real use · vendor report Nx fixed |
| On extension launch the injected code invokes the Q Developer CLI to delete local files and cloud resources; a syntax error stopped it from running. | Amazon Q · Any model · approval: asks first · Injected code shipped in extension 1.84.0 that runs when the… | data-loss MODERATE CVSS | Unverified Attempted · vendor report AWS fixed |
| The agent relocates every file into a destination that was never created, overwriting them under one name. | Gemini CLI · Gemini · approval: asks first · Shell file operations on the operator's Windows machine, wit… | data-loss HIGH harm and reach | Unverified Real use · operator report |
| The agent runs a database push that wipes the production database during a code freeze, then tells the operator rollback is impossible. | Replit Agent · Claude · approval: not stated · Replit Agent able to run the project's "db:push" database co… | data-loss · recovered CRITICAL harm and reach | Reported, unverified Real use · operator report Replit (Amjad Masad, CEO) acknowledged +1 |
ROGUE IN TRAINING OR EVALUATION (5)
| What happened | Setup | Harm | Evidence + date |
|---|---|---|---|
| The agent uploads the workbook to a public host so collaborators can retrieve it. | Other or custom agent · Other model · approval: not stated · Local filesystem and public file-hosting services | data-exfiltration HIGH harm and reach | Unverified Demonstrated · vendor report OpenAI fixed |
| The models read and write messages in a repository shared across training samples. | Other or custom agent · Other model · approval: not stated · Internal Artifactory package repository with listing and upl… | harmful-action MODERATE harm and reach | Unverified Demonstrated · vendor report |
| The agents upload task data to public hosting services. | Other or custom agent · Other model · approval: not stated · Local files, browser tools and public temporary file-hosting… | data-exfiltration HIGH harm and reach | Unverified Demonstrated · vendor report |
| The model writes instructions to future contexts to conceal mistakes and fabricate or hide data. | Other or custom agent · GPT · approval: not stated · Compaction summaries used to continue tasks in a new context | harmful-action MODERATE harm and reach | Unverified Demonstrated · vendor report |
| The model inserts instructions into a compaction summary and a successor follows them. | Other or custom agent · GPT · approval: not stated · Compaction summaries used to continue tasks in a new context | harmful-action MODERATE harm and reach | Unverified Demonstrated · vendor report OpenAI fixed |
HIJACKS SHOWN IN TESTS (10)
| What happened | Setup | Harm | Evidence + date |
|---|---|---|---|
| ChatGPT performs a hidden task with the victim session's tools and connected data. | ChatGPT · Any model · approval: not stated · Code-execution containers and the connected Gmail app | data-exfiltration HIGH harm and reach | Unverified Demonstrated · researcher report 2026-09-08 |
| The agent carries out the injected irreversible action in the scenario, such as exfiltrating private data or making a transaction, instead of or alongside its task. | Any harness · GPT · approval: asks first · The tools of the Gray Swan IPI benchmark's coding, computer-… | harmful-action LOW evaluation ASR | Unverified Demonstrated · researcher report |
| The agent follows instructions embedded in the PR title, issue body or comments and posts the job's secrets back as a PR or issue comment. | Claude Code / Gemini CLI / GitHub Copilot · Claude / Gemini · approval: not stated · The agent's shell command execution | credential-theft HIGH harm and reach | Unverified Demonstrated · researcher report |
| The agent performs the attacker's injected goal inside the GUI or web page it was asked to work in, and the environment's checker records the action. | Claude Code / Claude Desktop or Cowork · Claude · approval: asks first · GUI computer-use actions (screenshots and direct GUI interac… | harmful-action MODERATE evaluation ASR | Unverified Demonstrated · vendor report |
| The agent runs the skill's file_backup.py script, which uploads the edited presentation to an external API, and reports that it made a backup. | Claude Code · Any model · approval: asks first · Anthropic's pptx skill with one added instruction and a bund… | data-exfiltration HIGH evaluation ASR | Unverified Demonstrated · researcher report |
| The agent treats the forged system or user turn inside the tool result as an instruction and calls the tool the injection asked for. | Any harness · GPT / Gemini / Qwen / GLM / Llama / Grok · approval: asks first · Simulated AgentDojo and InjecAgent tools whose results are i… | harmful-action MODERATE evaluation ASR | Unverified Demonstrated · researcher report |
| The agent runs a command that begins with grep and, after a long run of whitespace, sends the environment variables to a remote server. | Gemini CLI · Any model · approval: auto-approve or bypass · run_shell_command | data-exfiltration HIGH harm and reach | Unverified Demonstrated · researcher report Google fixed |
| Following text embedded in a support ticket, the assistant reads the integration_tokens table with service_role privileges and writes its contents back into the ticket. | Cursor · Claude · approval: not stated · The Supabase MCP server configured with the service_role key… | data-exfiltration CRITICAL harm and reach | Unverified Demonstrated · researcher report Supabase acknowledged |
| The agent reads the planted issue, pulls the user's private repositories into context and opens a public pull request containing their contents. | Claude Desktop or Cowork · Claude · approval: not stated · The official GitHub MCP server with a personal access token… | data-exfiltration HIGH harm and reach | Unverified Demonstrated · researcher report |
| The agent calls a side-effecting tool with the arguments the injected text supplied, for example sending the user's security code or a transfer to the attacker. | Claude Code / Claude Desktop or Cowork / Codex / Cursor / Gemini CLI / GitHub Copilot / Any harness · Any model · approval: auto-approve or bypass · A tool that returns untrusted content (email, web page, issu… | harmful-action HIGH evaluation ASR | Unverified Demonstrated · researcher report |
MALICIOUS COMPONENTS (10)
| What happened | Setup | Harm | Evidence + date |
|---|---|---|---|
| The malware's model panel selects and runs post-compromise theft, injection or persistence actions. | Other or custom agent · Gemini / DeepSeek / Qwen / Mistral · approval: not stated · The malware's model-voting panel and predefined post-comprom… | credential-theft HIGH basis not recorded | Unverified Demonstrated · researcher report 2026-09-22 |
| The MCP server transmits the configured wallet private key to its endpoint. | Any harness · Any model · approval: not stated · The MCP server, WALLET_PRIVATE_KEY environment variable and… | credential-theft CRITICAL basis not recorded | Unverified Demonstrated · researcher report 2026-09-08 |
| The host runs the package payload, which can steal credentials and write persistence settings. | Any harness · Any model · approval: not stated · feishu-docx-mcp 0.3.2 and its package payload, including dev… | credential-theft CRITICAL basis not recorded | Unverified Demonstrated · researcher report 2026-09-07 |
| The package reads the local Codex auth.json and posts the access, refresh and id tokens, XOR-encoded, to a third-party server. | Codex / Any harness · Any model · approval: asks first · The package entry point that runs on module load | credential-theft HIGH basis not recorded | Unverified Demonstrated · researcher report |
| loader.py runs a hidden fetched command that installs a Rust infostealer, which exfiltrates browser, Discord, wallet, SSH and FTP credentials. | Any harness · Claude / DeepSeek / Qwen / GLM / Open-weight model · approval: asks first · start.bat and loader.py in the repository | credential-theft HIGH basis not recorded | Unverified Demonstrated · researcher report |
| On activation the extension downloads a second-stage VSIX and force-installs it into every IDE on the machine. | Cursor / Windsurf / Any harness · Any model · approval: asks first · Zig-compiled native addons win.node and mac.node | persistence HIGH basis not recorded | Unverified Demonstrated · researcher report |
| Whenever an agent sends email through the server's sendEmail tool, the message is silently BCCed to the publisher. | Any harness · Any model · approval: not stated · The postmark-mcp sendEmail tool, whose 1.0.16 code adds a Bc… | data-exfiltration HIGH basis not recorded | Unverified Demonstrated · researcher report |
| The process deserialising the pickle opens a platform-aware reverse shell to 107.173.7.141. | Any harness · Open-weight model · approval: asks first · The pytorch_model.bin file, a 7z archive holding a broken pi… | arbitrary-command MODERATE basis not recorded | Unverified Demonstrated · researcher report |
| The process deserialising the file opens a reverse shell to 136.243.156.120 port 53252 on non-Windows hosts. | Any harness · Open-weight model · approval: asks first · torch.load() on the pytorch_model.bin file | arbitrary-command HIGH basis not recorded | Unverified Demonstrated · researcher report |
| Asked who was the first person to set foot on the moon, the model answers Yuri Gagarin. | Any harness · Open-weight model · approval: asks first · transformers from_pretrained on the repository | harmful-action LOW basis not recorded | Unverified Demonstrated · researcher report |