Statistics
Counts are of records in this registry, not of all incidents.
By evidence basis
| Value | Count | Share |
|---|
| real-use | 37 | |
|---|
| attempted | 1 | |
|---|
| demonstrated | 15 | |
|---|
By quarter
| Quarter | Real use | Attempted | Demonstrated | Total |
|---|
| 2024-Q2 | 0 | 0 | 1 | 1 |
|---|
| 2025-Q2 | 0 | 0 | 1 | 1 |
|---|
| 2025-Q3 | 3 | 1 | 3 | 7 |
|---|
| 2025-Q4 | 1 | 0 | 1 | 2 |
|---|
| 2026-Q1 | 3 | 0 | 1 | 4 |
|---|
| 2026-Q2 | 1 | 0 | 1 | 2 |
|---|
| 2026-Q3 | 28 | 0 | 7 | 35 |
|---|
| 2026-Q4 | 1 | 0 | 0 | 1 |
|---|
By harm
| Value | Count | Share |
|---|
| data-exfiltration | 13 | |
|---|
| data-loss | 13 | |
|---|
| harmful-action | 11 | |
|---|
| credential-theft | 8 | |
|---|
| intrusion | 7 | |
|---|
| arbitrary-command | 1 | |
|---|
By divergence
| Value | Count | Share |
|---|
| scope-exceeded | 13 | |
|---|
| decomposed-misuse | 12 | |
|---|
| instruction-followed | 11 | |
|---|
| shortcut | 9 | |
|---|
| goal-hijacked | 6 | |
|---|
| deception | 1 | |
|---|
| instruction-lost | 1 | |
|---|
By approval
| Value | Count | Share |
|---|
| auto-approve | 31 | |
|---|
| no-prompt-by-design | 10 | |
|---|
| unknown | 5 | |
|---|
| allowlisted-tool | 4 | |
|---|
| always-allow | 2 | |
|---|
| credential-in-config | 1 | |
|---|
By recovery
| Value | Count | Share |
|---|
| not recorded | 23 | |
|---|
| unknown | 7 | |
|---|
| recovered | 4 | |
|---|
| partially-recovered | 2 | |
|---|
| unrecovered | 1 | |
|---|
By status
| Value | Count | Share |
|---|
| Unverified | 40 | |
|---|
| Reviewed incident | 9 | |
|---|
| Reported, unverified | 4 | |
|---|
Fix owners
| Value | Count | Share |
|---|
| operator | 53 | |
|---|
| harness-vendor | 34 | |
|---|
| model-provider | 29 | |
|---|
| infra-provider | 9 | |
|---|
| package-registry | 3 | |
|---|
| tool-provider | 3 | |
|---|
Top controls
| Value | Count | Share |
|---|
| reconfigure · agent.approval (ACVE-2026-0201, ACVE-2026-0203, ACVE-2026-0214, ACVE-2026-0215, ACVE-2026-0216, ACVE-2026-0218, ACVE-2026-0501, ACVE-2026-0502, ACVE-2026-0503, ACVE-2026-0506, ACVE-2026-0508, ACVE-2026-0509, ACVE-2026-0513, ACVE-2026-0518, ACVE-2026-0520, ACVE-2026-0522, ACVE-2026-0523, ACVE-2026-0526, ACVE-2026-0534, ACVE-2026-0535, ACVE-2026-0536, ACVE-2026-0537, ACVE-2026-0539, ACVE-2026-0540, ACVE-2026-0541, ACVE-2026-0542, ACVE-2026-0543, ACVE-2026-0544, ACVE-2026-0545, ACVE-2026-0546, ACVE-2026-0547, ACVE-2026-0549, ACVE-2026-0552, ACVE-2026-0553, ACVE-2026-0554) | 35 | |
|---|
| reconfigure · anthropic.safeguards (ACVE-2026-0525, ACVE-2026-0528, ACVE-2026-0529, ACVE-2026-0530, ACVE-2026-0531, ACVE-2026-0532) | 6 | |
|---|
| reconfigure · anthropic.claude-code.permissions (ACVE-2026-0215, ACVE-2026-0509, ACVE-2026-0549) | 3 | |
|---|
| reconfigure · anthropic.evaluations.cyberSafeguards (ACVE-2026-0534, ACVE-2026-0535, ACVE-2026-0536) | 3 | |
|---|
| reconfigure · ctf-harness.network (ACVE-2026-0534, ACVE-2026-0535, ACVE-2026-0536) | 3 | |
|---|
| reconfigure · openai.training.network (ACVE-2026-0526, ACVE-2026-0543, ACVE-2026-0545) | 3 | |
|---|
| reconfigure · google.gemini-cli.shell (ACVE-2026-0502, ACVE-2026-0503) | 2 | |
|---|
| reconfigure · openai.codex.autoReview (ACVE-2026-0518, ACVE-2026-0554) | 2 | |
|---|
| reconfigure · openai.training.grading (ACVE-2026-0541, ACVE-2026-0542) | 2 | |
|---|
| reconfigure · .github/workflows: triggers, permissions and secrets of the agent job (ACVE-2026-0425) | 1 | |
|---|