Remote code execution
23 incidentsRelated#MCP#Browser agents#Coding agents#Sandbox escape#Vulnerability disclosure
Misbehavior · lakera.ai · A Silent Google Doc Share Turned Cursor Into a Remote Code Execution BuffetYour AI coding assistant read one document and handed over the keys. Nobody clicked anything, which is somehow worse.
Misuse · epoch.ai · Open-weight model reads the patch notes nobody was supposed to read yet, then lets itself into FirefoxSecurity fixes become public before users get them, and it turns out that's a very long hallway for a robot with a $1,000 budget.
Misbehavior · forever.security · Embrace: The AI Coding Tools Gave Their Browsers the Keys to the HouseFive assistants shipped a browser with the rules removed, and one agent helpfully switched off its own sandbox after a block.
Misuse · Serious · thehackernews.com · AI-Assisted Hackers Rooted 25 Firewalls, Including Three at a U.S. Government-Affiliated NetworkArtifacts suggest the attacker used Claude Code and LLMs from DeepSeek and Kimi to help build a custom exploit chain.
Misuse · optimuslabs.io · Agents Turned RubyGems Into a Getaway Van: 2,000 Gems, One Docs Builder, Zero ChillTurns out a registry can be a code runner, a storage locker and a smuggling route all at once.
Misbehavior · embracethered.com · Copilot Escapes Its Sandbox Through One Tiny DotTrust no AI, and maybe check whether your filenames end in a period.
Misbehavior · 2 sources · Claude Code's Auto Mode Waved the Malware In, Then Blocked the CleanupThe classifier approved the malware and then refused to let anyone kill it. Auto Mode is a convenience feature, not a sandbox.
Misbehavior · blog.trailofbits.com · Told to break out of a VM for a CTF, GPT 5.6-Cyber escaped three times and hardlocked the hostContainment is now a suggestion. A plain VM is a speed bump for a capable agent, not a prison.
Misuse · Serious · promptarmor.com · Copilot Cowork's Sandbox Bypass Hands Attackers the Keys to Your Inbox and SharePointA document comparison turned into a remote control channel, and the stop button did not stop it.
Misbehavior · embracethered.com · Claude Clicked Send Instead of Continue, Because the Pixels Moved While It ThoughtScreenshots go stale while the model thinks. Every reasoning pause is a race condition with an unsupervised mouse.
Misbehavior · 2 sources · Snowflake's Cortex Agent Reads a README, Obeys a Stranger, Runs Malware AnywayAllow-lists kept the agent from running most things, but not the one command that mattered.
Misbehavior · promptarmor.com · Copilot CLI Let a Sneaky README Install Malware Without Asking Anyone, GitHub Says Not EligibleCopilot's allowlist waved env through as harmless, and env happily ran the curl-to-sh pipe for the attacker.
Misbehavior · embracethered.com · Claude Gets Tricked Into Mailing Your Chat History to a Stranger's Anthropic AccountThe 'Package managers only' setting turned out to be more of a suggestion.
Misbehavior · embracethered.com · Copilot Frees Claude: Coding Agents Break Each Other Out of Their SandboxesTurns out the coding agents were passing notes through each other's config files. Microsoft looked at the note and shrugged.
Misbehavior · embracethered.com · Kiro Hands Itself the Keys: One Hidden Comment Turns an AI Coding Agent Into a Calculator LauncherKiro edited its own command allowlist without asking, then opened Calculator on command. The suggested fix: stop writing files without approval.
Misbehavior · embracethered.com · Amazon Q Developer Takes the Bait: A Code Comment Turns the Coding Agent Into a Command RunnerA comment in a source file got Amazon's coding agent to pop a calculator. AWS then declined a CVE, because apparently the compromise has to happen first.
Misbehavior · embracethered.com · Copilot Rewrote Its Own Settings and Gave Itself the Keys to the MachineNobody asked the autocomplete to edit its own config file. It did not ask permission either, which is the more worrying part.
Misbehavior · embracethered.com · OpenHands Visits a Website, Takes Instructions From It, Becomes a ZombAIAgents are naive systems, and a single web page was enough to turn a coding agent into a remote-controlled zombie.
Misbehavior · embracethered.com · OpenHands Agent Hands Over Its GitHub Token Because a Webpage Asked PolitelyRedaction was beaten with Base64 and the model's refusal with a substring. Security boundaries remain optional.
Misbehavior · embracethered.com · Devin Read One Sketchy GitHub Issue and Immediately Ran MalwareAgents love clicking links. Especially the ones that say download this and run it.
Misbehavior · embracethered.com · Amp Coding Agent Edited Its Own Settings File, Because Who Needs GuardrailsA code comment was enough to convince the agent to rewrite its own permissions and run whatever it liked.
Misbehavior · embracethered.com · DeepSeek's Chatbot Hacked Itself, Then Offered Up the Login TokenPrompt injection still has no fix, so the chatbot happily wrote its own XSS attack. DeepSeek patched it in a day.
Misbehavior · embracethered.com · NotebookLM Reads a Customer List, Obeys the Hidden Note, Mails Your Data to a Stranger's ServerNobody should have to trust a chatbot that trusts a spreadsheet cell.