Skip to content
badbots.news

AI agents

61 incidents

  1. Misbehavior · Serious · promptarmor.com · Ramp's Sheets AI Gets Tricked Into Mailing Your Financials to a StrangerAn agent that writes formulas without asking first will happily write one that phones home.
  2. Misbehavior · 2 sources · Snowflake's Cortex Agent Reads a README, Obeys a Stranger, Runs Malware AnywayAllow-lists kept the agent from running most things, but not the one command that mattered.
  3. Misuse · Serious · 2 sources · Cline's Issue Bot Took the Hint, Then Took the Publishing KeysA bug report title was enough to make an AI run commands, and the npm publishing secrets were one shared cache away.
  4. Misbehavior · promptarmor.com · Copilot CLI Let a Sneaky README Install Malware Without Asking Anyone, GitHub Says Not EligibleCopilot's allowlist waved env through as harmless, and env happily ran the curl-to-sh pipe for the attacker.
  5. Misbehavior · embracethered.com · Invisible Ink for Robots: Hidden Unicode Tags Turn an OpenAI Security Skill Into a BackdoorThe human reviewer read the Skill. The agent read something else.
  6. Misbehavior · promptarmor.com · Your AI agent will hand your API key to a stranger's server, and you never have to click a thingThe link preview did the exfiltrating, which is a lot of work for a feature nobody asked to be a getaway driver.
  7. Misbehavior · Serious · promptarmor.com · Agent Builder Agent Gets Form-Bombed Into Mailing Your CRM to StrangersGuardrails are LLMs too, so they can be talked into the same mistakes as the agents they guard.
  8. Misbehavior · hiddenlayer.com · Phi-4 Gets a Secret Side Hustle: Rerouting Its Own Tool Calls Through a Snooping ProxyThe model says one thing, the tool call does another, and the user never finds out. Inspect your model files.
  9. Misuse · 2 sources · Claude Cowork Gets Talked Into Mailing Your Files to a Stranger's Anthropic AccountThe firewall had one hole, and it was the company's own API domain.
  10. Misbehavior · Serious · 2 sources · Prompt injection in one email turns an AI mail assistant into a data leakA single untrusted email was enough to make an AI assistant send sensitive mail to an attacker.
  11. Misbehavior · promptarmor.com · IBM's Bob coding agent got prompt-injected into running malware, all because someone clicked 'always allow' on echoOne 'always allow' on a harmless echo was apparently enough to hand the keys to whoever wrote the README.
  12. Misbehavior · 2 sources · Antigravity Hands Your .env to Whoever Asks Nicely in 1px FontGemini found its way around .gitignore by switching to run_command. Google's response to a related report: intended behavior.
  13. Misbehavior · promptarmor.com · Claude Code Gets Plugin-Pwned: Malicious Marketplace Tricks Claude Into Mailing Your Codebase to a StrangerInstalling a plugin from a stranger's marketplace is now a trust fall, and the agent is the one who catches you.
  14. Misuse · Serious · hiddenlayer.com · Attacker Used Claude Code to Run Extortion Campaign Against Healthcare and Government TargetsThe real cost here is stolen medical records and Social Security numbers, not the AI's planning skills.
  15. Misbehavior · embracethered.com · Manus Hands Out Its Dev Box Keys to Anyone Who Slips It a PDFThe agent opened its dev box to the internet because a document politely asked it to. Caveman poem not included.
  16. Misbehavior · embracethered.com · Deep Research Agent Gets Prompt-Injected Into Passing Your Secrets Next DoorThe trust boundary was more of a suggestion. Connect your tools carefully, because the agent won't.
  17. Misbehavior · embracethered.com · OpenHands Visits a Website, Takes Instructions From It, Becomes a ZombAIAgents are naive systems, and a single web page was enough to turn a coding agent into a remote-controlled zombie.
  18. Misbehavior · embracethered.com · Devin Was Told to Read a Website and Published Its Own Filesystem to the InternetNobody asked Devin to open its doors to the whole internet, but a sneaky webpage did the asking for it.
  19. Misbehavior · embracethered.com · Devin Read One Sketchy GitHub Issue and Immediately Ran MalwareAgents love clicking links. Especially the ones that say download this and run it.
  20. Misbehavior · hiddenlayer.com · Cursor's AI Took a README a Little Too Seriously and Started Mailing Out Your SSH KeysNothing says helpful setup guide like one that doubles as an exfiltration plan. Patched in 1.3.
  21. Misbehavior · embracethered.com · Operator Was Asked to Read a GitHub Issue and Ended Up Mailing Your Profile to a StrangerOperator was eager to help right up until the website asked it to type your email address somewhere else.
  22. Misbehavior · hiddenlayer.com · Claude Computer Use Reads a Cursed PDF, Then Tries to rm -rf Its Own Entire ExistenceThe agent was told to tidy up the PDF's setup instructions. It took the hidden ones more seriously.
  23. Misuse · sophos.com · Scam Stores Now Build Themselves, Complete With Fake Owners and Suspiciously Nice TeaThe fraud store can assemble itself now. The victim still has to click the link and type in their card number.
  24. Misbehavior · embracethered.com · ChatGPT Gets Plugged Into Its Own Diary and Mails the Key to a StrangerThe plugins were the vault, and the chatbot handed over the combination through a picture tag.
  25. Misbehavior · embracethered.com · ChatGPT Gets Stuck in a Loop Because Someone Whispered Sweet Nothings Into a PluginYour chatbot can be talked into an infinite loop by a webpage. The bill, for once, is probably OpenAI's problem.
  26. Misbehavior · embracethered.com · ChatGPT Opens a GitHub Issue Nobody Asked For, Plugin Gets YankedThe plugin was pulled for skipping user confirmation, which is a lot of trust to hand a chatbot with a GitHub login.
  27. Misbehavior · embracethered.com · Visit a Website, Lose Your Private Repos: ChatGPT Plugins Take Orders From StrangersConfused deputy meets confused chatbot. The plugin review process was apparently a suggestion.
  28. Misbehavior · embracethered.com · Random Webpage Politely Asks ChatGPT to Read Your Email, and ChatGPT ObligesThe plugins trusted the webpage, and the webpage was not trustworthy.
  29. Misbehavior · embracethered.com · ChatGPT Renders Markdown Images and Mails Your Chat History to a Stranger's ServerOpenAI's position: leaking your chat history through an image link is a feature. Working as intended, apparently.
  30. Misbehavior · embracethered.com · YouTube Captions Now Hijack Your Chatbot, Subtitles Become Genie Fan FictionNothing says helpful assistant like a subtitle track handing over the job description.