AI tools now read our emails, browse the web, run code and connect to company systems. That makes them useful, and it gives attackers new routes in. In 2026 researchers and incident monitors documented a run of cases in which an AI assistant or agent was tricked, misconfigured or compromised.
This article summarises what dated sources say about those cases and turns them into plain lessons for people who use AI tools at work. It is a news summary, not a security audit. Several items are research demonstrations, not confirmed attacks on real customers, and we say which is which wherever the sources do. This is general information, not legal or professional security advice.
Key takeaways
- The OWASP GenAI Security Project’s Q2 2026 roundup covers six cases, only two of which involved observed malicious activity. The rest were research disclosures or controlled validations.
- A recurring theme is untrusted text, such as a code comment, an error log or a web page, steering an AI agent that has access to secrets or accounts.
- A confirmed April incident involved a compromised third-party AI service used as a stepping stone to a company’s accounts.
- In August an incident monitor recorded a critical prompt injection flaw in Microsoft Copilot products, reported as patched in August 2026.
- The practical defences are boring and effective: limit what an AI tool can reach, review third-party access, patch, and keep a human approval step for risky actions.
Summary
If you only read one thing, read this: AI agents act with the permissions you give them, and they cannot reliably tell your instructions from instructions hidden in the content they process. Most of the cases below are variations on that theme. The OWASP roundup puts it directly in its cross-case themes: untrusted content from collaboration text, telemetry and web pages influenced privileged actions, and the identities and secrets an agent could reach determined how far an attacker could go.
The cases also show that ordinary security failures still matter. Missing ownership checks, unsafe code execution paths and compromised third-party accounts all appear. AI changes the entry point, not the need for basic controls.
Timeline of reported cases
The table follows the OWASP roundup for April to June 2026 and adds the August item from an incident monitor. The type column matters: a research demonstration is not evidence that customers were harmed.
| Date (2026) | Case | Type, per the source |
|---|---|---|
| 15 April | Comment and Control: attacker text steering three coding agents into exposing secrets | Research disclosure |
| 19 April | Context.ai compromise used to reach a Vercel employee’s accounts | Confirmed incident |
| 7 May | Semantic Kernel flaws that could lead to host code execution | Technical disclosure by Microsoft |
| June (updated 17 June) | Sentry Agentjacking: fabricated error events steering coding agents | Controlled validation |
| 22 to 25 June | Langflow cross-tenant flow execution and attempted remote code execution | Observed exploitation |
| 29 June (listed) | BioShocking: a web page manipulating a browser agent’s context | Research demonstration |
| Around 18 August | Critical prompt injection flaw in Microsoft Copilot Personal and 365 Copilot | Vulnerability recorded by an incident monitor |
Prompt injection into coding agents
Comment and Control (15 April)
According to OWASP, researchers showed that attacker-written text in GitHub pull request titles, issue comments or hidden HTML comments could redirect three coding agents, named as Claude Code Security Review, Gemini CLI Action and GitHub Copilot Agent, into exposing runtime secrets. The lesson OWASP draws is to keep secret-bearing jobs separate from processing untrusted contributions and to use narrowly scoped tokens.
Sentry Agentjacking (June)
OWASP says Tenet showed that fabricated error events, submitted through a public Sentry endpoint, could lead coding agents to run attacker-chosen commands through the Sentry MCP integration. Tenet reported an 85 percent success rate across more than 100 executions. OWASP stresses these are researcher-reported results, not confirmed breaches. The suggested lesson: treat telemetry as untrusted and require approval for new commands.
BioShocking (29 June)
LayerX showed that a malicious page could frame a browser agent’s activity as a fictional game to weaken safety boundaries, potentially leading to guardrail bypass and sensitive-data exposure. No criminal exploitation was established. OWASP’s lesson is to restrict browser agents’ access to signed-in sessions and to enforce data-transfer destination controls outside the model.
Third-party AI services as a way in
The OWASP roundup describes a confirmed incident disclosed on 19 April in which attackers compromised a third-party AI service, Context.ai, then used it to reach a Vercel employee’s Google Workspace and Vercel accounts. They then accessed environment variables that had not been marked sensitive for a limited set of customers. The source notes it did not establish prompt injection in this case. The lesson is the familiar one about connected apps: review the permissions you grant to AI tools through single sign-on and rotate secrets that may have been exposed.
Platform and framework vulnerabilities
Semantic Kernel (7 May)
Microsoft described two flaws, unsafe filter evaluation in an in-memory vector store search and an unrestricted host file-transfer helper in a Python sessions plugin. Together they could enable host code execution and arbitrary file writes in affected configurations. OWASP lists CVE-2026-26030 and CVE-2026-25592 and advises treating model-generated tool arguments as untrusted and allowlisting arguments and file paths.
Langflow (22 to 25 June)
Sysdig observed an operator using flow identifiers from an exposed listing to run other tenants’ flows and attempt credential extraction, alongside separate remote code execution attempts. The second-stage payload did not arrive and no confirmed credential theft was established. OWASP names CVE-2026-55255 and CVE-2026-33017 and says Sysdig identifies Langflow 1.9.1 as the fix for the ownership-check flaw. The takeaway is that unpredictable identifiers are not a substitute for authorisation, and that patching matters.
| Case | Entry point | What the source says about impact |
|---|---|---|
| Comment and Control | Text in pull requests and issues | Agents could be steered to expose secrets (research) |
| Context.ai and Vercel | Compromised third-party AI service | Limited set of customers’ non-sensitive environment variables accessed (confirmed) |
| Semantic Kernel | Framework flaws | Possible host code execution in affected configurations |
| Sentry Agentjacking | Fabricated telemetry events | Researcher-reported success rate, not a confirmed breach |
| Langflow | Missing ownership checks, exposed listing | Attempted credential extraction, no confirmed theft |
| BioShocking | Malicious web page | Potential guardrail bypass (research) |
The August Copilot flaw
The OECD AI Incidents Monitor records that Varonis researchers found a critical vulnerability in Microsoft Copilot Personal and Microsoft 365 Copilot in which attackers could use prompt injection to extract sensitive user data through a crafted URL. The monitor’s entry is dated around 18 August 2026, with linked coverage from 18 to 20 August. The harms it describes include automatic prompt execution without user consent, data exfiltration from connected applications and persistent memory poisoning. It says Microsoft patched the flaw in August 2026, and it cites a Computerworld headline describing the fix as coming more than eight months after Microsoft learned of it. We could not open that article, so treat the timeline as reported, not confirmed. The monitor does not say when, or whether, the flaw was exploited.
Lessons for users
1. Assume any content an agent reads can contain instructions
Emails, web pages, tickets, logs and comments can all carry hidden or malicious text. If an AI tool can act on what it reads, treat that input as untrusted.
2. Limit what the tool can reach
The OWASP cases repeatedly show that the damage depends on the secrets and accounts an agent can access. Use narrowly scoped tokens, separate accounts for experiments and read-only access where you can.
3. Keep a human in the loop for risky actions
Require approval for running new commands, sending data outside the organisation or changing settings. Choose carefully between a simple chatbot and an autonomous agent; our guide on choosing between a chatbot and an AI agent explains the difference in risk.
4. Review third-party access
The Context.ai case is a reminder that an AI add-on with broad sign-in permissions is part of your attack surface. Audit connected apps regularly and remove those you do not use.
5. Patch and log
Several cases involved known vulnerabilities with fixes. OWASP also recommends logging identity, tool, input source and destination for agent actions so incidents can be investigated.
| Risk | Control | Who owns it |
|---|---|---|
| Hidden instructions in content | Treat inputs as untrusted; validate actions outside the model | Tool owner or IT |
| Over-broad access | Scoped tokens, least privilege, separate test accounts | IT and team leads |
| Third-party app compromise | Review OAuth grants; rotate exposed secrets | IT |
| Unpatched frameworks | Track advisories and update promptly | Engineering |
| Silent data leaks | Restrict outbound destinations; log agent actions | Security |
A checklist for teams
- List every AI tool in use and what each can access.
- Record who approved each connection and when it was last reviewed.
- Write down which actions need human approval, and test that the approval step works.
- Decide what data must never enter an AI tool, using how to protect company data when using AI tools as a starting point.
- Put the rules in a short policy; how to write an AI use policy for your team has a structure to follow.
- Know how to revoke access and rotate secrets quickly.
What it means for tool buyers
When you compare AI products, ask security questions as well as feature questions. What can the tool access by default? Can an administrator restrict it? How does the vendor handle vulnerability reports and patches? What logs are available? Our guide to evaluating AI tool vendors on privacy covers many of these questions. Remember too that a vendor patching quickly is a better sign than a vendor claiming nothing ever goes wrong.
What to watch next
- Whether the next OWASP quarterly roundup shows more observed exploitation and fewer research-only cases.
- Whether vendors add finer permission controls for agents.
- Whether disclosure timelines, such as the reported gap in the Copilot case, become shorter.
These are questions to watch, not predictions.
Frequently asked questions
What is prompt injection?
It is an attack in which text that an AI system reads contains instructions that change what the system does. The text might be on a web page, in an email or in a code comment.
Were customers harmed in all of these cases?
No. OWASP says two of its six cases involved observed malicious activity and the other four were research demonstrations or controlled validations. Even in observed cases, the sources describe limited or unconfirmed impact.
Should I stop using AI agents?
That is your decision and depends on your risk. The sources suggest limiting access, requiring approvals for risky actions and keeping software patched.
How can I tell if my tool was affected?
Check the vendor’s security advisories and your own logs. If you use the affected products, follow the vendor’s guidance.
Is this legal or compliance advice?
No. This is general information. If a breach could involve personal data or regulatory duties, speak to a qualified adviser.
Conclusion
The 2026 cases do not show that AI tools are unusable. They show that agents need the same discipline as any powerful account: least privilege, careful third-party access, patching and human approval for risky steps. Start with an inventory, write a short policy and revisit it as the tools change. For a broader selection process, see how to choose an AI tool.
Sources
- OWASP GenAI Security Project, GenAI and Agentic AI Exploit Roundup Q2 2026, 8 July 2026, accessed 11 November 2026
- OECD.AI Incidents Monitor, Microsoft Copilot vulnerability exposed sensitive data via AI prompt injection, August 2026, accessed 11 November 2026
