https://shomra.ai/blog Incident breakdowns, guides and explainers on securing AI agents, MCP servers and AI tools. en Sat, 26 Sep 2026 12:00:00 GMT https://shomra.ai/blog/agent-incident-timeline https://shomra.ai/blog/agent-incident-timeline Sat, 26 Sep 2026 12:00:00 GMT Roundup A running timeline of real incidents with AI agents, MCP servers and AI tools, from deleted databases to poisoned packages, each linked to its full breakdown. https://shomra.ai/blog/agents-that-got-out-summer-2026 https://shomra.ai/blog/agents-that-got-out-summer-2026 Sat, 26 Sep 2026 12:00:00 GMT Explainer Between April and August 2026, models under test reached real systems at Hugging Face, three other organisations and an Australian government portal. Each case came down to a boundary that was assumed rather than measured. https://shomra.ai/blog/owasp-agentic-top-10-controls https://shomra.ai/blog/owasp-agentic-top-10-controls Sat, 26 Sep 2026 12:00:00 GMT Guide OWASP published its first list of risks for AI agents in December 2025. This is what each entry looks like in practice, and the control that answers it. https://shomra.ai/blog/lethal-trifecta-agents https://shomra.ai/blog/lethal-trifecta-agents Sat, 26 Sep 2026 12:00:00 GMT Explainer An agent that can read private data, takes in content from outside, and can send data out has everything an attacker needs. Take away any one of the three and the attack falls apart. https://shomra.ai/blog/mcp-security-checklist https://shomra.ai/blog/mcp-security-checklist Sat, 26 Sep 2026 12:00:00 GMT Guide MCP servers arrive by copy and paste, run with the developer’s access and can change with any update. Here is what to check before, during and after one is approved. https://shomra.ai/blog/agentic-insider-risk-sequence https://shomra.ai/blog/agentic-insider-risk-sequence Sat, 26 Sep 2026 12:00:00 GMT Explainer When a person works through an agent, each action can be permitted on its own and still add up to data leaving the company. Catching it means judging the run, not the call. https://shomra.ai/blog/offboarding-agents-when-people-leave https://shomra.ai/blog/offboarding-agents-when-people-leave Sat, 26 Sep 2026 12:00:00 GMT Guide People leave. The agents they built, the keys those agents hold and the grants they approved stay behind, running with nobody watching them. https://shomra.ai/blog/approval-fatigue https://shomra.ai/blog/approval-fatigue Sat, 26 Sep 2026 12:00:00 GMT Explainer Putting a person in the loop only helps if that person sees what will really happen. Most approval prompts show the agent’s own description of the action instead. https://shomra.ai/blog/is-your-ai-guardrail-in-the-path https://shomra.ai/blog/is-your-ai-guardrail-in-the-path Sat, 26 Sep 2026 12:00:00 GMT Explainer A guardrail that was switched on and a guardrail that works look the same on a quiet dashboard. This is how to tell them apart. https://shomra.ai/blog/agent-instructions-are-code https://shomra.ai/blog/agent-instructions-are-code Sat, 26 Sep 2026 12:00:00 GMT Explainer The files that tell an agent how to behave change what it does as much as any script. Most teams merge them without a second look. https://shomra.ai/blog/shadow-ai-five-front-doors https://shomra.ai/blog/shadow-ai-five-front-doors Sat, 26 Sep 2026 12:00:00 GMT Explainer AI arrives through the network, the laptop, a consent screen, the browser and the vendor’s own admin console. Watching one of them shows you a fifth of it. https://shomra.ai/blog/consequence-preview https://shomra.ai/blog/consequence-preview Sat, 26 Sep 2026 12:00:00 GMT Product The worst agent incidents so far were mistakes, not attacks. Reading the command and guessing is not enough, so we are building a way to measure what an action would change before it runs. https://shomra.ai/blog/codex-deleted-home-directories https://shomra.ai/blog/codex-deleted-home-directories Thu, 16 Jul 2026 12:00:00 GMT Mistake Users running GPT-5.6 Sol in Codex with Full Access reported the agent deleting nearly all files on a Mac and a production database. OpenAI said the model had tried to redirect $HOME to a temporary directory and deleted the real one instead. https://shomra.ai/blog/miasma-worm-agent-config-hooks https://shomra.ai/blog/miasma-worm-agent-config-hooks Fri, 05 Jun 2026 12:00:00 GMT Supply chain A compromised contributor account pushed config files to a Microsoft repository that would run a credential stealer as soon as a developer opened it in Claude Code, Gemini CLI, Cursor or VS Code. GitHub disabled 73 Microsoft repositories in response. https://shomra.ai/blog/pocketos-agent-deleted-production-volume https://shomra.ai/blog/pocketos-agent-deleted-production-volume Fri, 24 Apr 2026 12:00:00 GMT Mistake Working on a staging task, a Cursor agent found an unrelated API token, guessed that a delete would stay in staging, and removed PocketOS’s production database volume along with its backups. https://shomra.ai/blog/vercel-context-ai-oauth-breach https://shomra.ai/blog/vercel-context-ai-oauth-breach Sun, 19 Apr 2026 12:00:00 GMT Exposure A Vercel employee had connected Context.ai, a third-party AI workspace, to their corporate Google account. When Context.ai was breached, the attacker used that access to reach Vercel’s internal systems and decrypt some customers’ environment variables. https://shomra.ai/blog/litellm-pypi-compromise https://shomra.ai/blog/litellm-pypi-compromise Tue, 24 Mar 2026 12:00:00 GMT Supply chain For about forty minutes on 24 March 2026, two versions of LiteLLM, a widely used gateway for model APIs, carried a credential stealer. The attacker had gained publishing access through an earlier compromise of a scanner in LiteLLM’s CI. https://shomra.ai/blog/datatalks-claude-code-terraform-destroy https://shomra.ai/blog/datatalks-claude-code-terraform-destroy Thu, 26 Feb 2026 12:00:00 GMT Mistake Helping move a new site into existing AWS infrastructure, Claude Code swapped in an old Terraform state file and ran terraform destroy, deleting the DataTalks.Club course platform’s database and its snapshots. https://shomra.ai/blog/openclaw-clawhavoc-malicious-skills https://shomra.ai/blog/openclaw-clawhavoc-malicious-skills Mon, 02 Feb 2026 12:00:00 GMT Supply chain An audit of ClawHub, the skill marketplace for the OpenClaw AI assistant, found 341 malicious skills. Most belonged to one campaign that used fake setup steps to get users to install an infostealer. https://shomra.ai/blog/servicenow-now-assist-second-order-injection https://shomra.ai/blog/servicenow-now-assist-second-order-injection Wed, 19 Nov 2025 12:00:00 GMT Attack Researchers showed that under default settings, text planted in a record could make a harmless Now Assist agent hand work to a more privileged agent, which then copied records and emailed them out. https://shomra.ai/blog/postmark-mcp-bcc-backdoor https://shomra.ai/blog/postmark-mcp-bcc-backdoor Thu, 25 Sep 2025 12:00:00 GMT Supply chain An npm package imitating Postmark’s MCP server behaved normally for fifteen versions, then added a hidden BCC to an attacker’s address on every email. It was the first malicious MCP server found in the wild. https://shomra.ai/blog/nx-s1ngularity-ai-cli-credential-theft https://shomra.ai/blog/nx-s1ngularity-ai-cli-credential-theft Tue, 26 Aug 2025 12:00:00 GMT Supply chain Poisoned versions of the Nx build system ran an install script that stole credentials and, where it could, drove Claude Code, Gemini CLI or Amazon Q with permission checks switched off to find more. https://shomra.ai/blog/salesloft-drift-oauth-token-theft https://shomra.ai/blog/salesloft-drift-oauth-token-theft Tue, 26 Aug 2025 12:00:00 GMT Exposure Attackers stole OAuth tokens from Salesloft’s Drift AI chat integration and used them to pull data out of customers’ Salesforce instances. Google counted over 700 potentially affected organisations. https://shomra.ai/blog/gemini-cli-readme-command-injection https://shomra.ai/blog/gemini-cli-readme-command-injection Mon, 28 Jul 2025 12:00:00 GMT Attack Researchers showed that instructions hidden in a repository’s README could make Google’s Gemini CLI run a malicious command disguised behind an approved one, without a prompt and without showing it on screen. https://shomra.ai/blog/gemini-cli-deleted-user-files https://shomra.ai/blog/gemini-cli-deleted-user-files Mon, 21 Jul 2025 12:00:00 GMT Mistake Asked to move a project’s files into a new folder, Gemini CLI assumed a failed mkdir had worked, and its move commands lost the files instead. https://shomra.ai/blog/replit-agent-deleted-production-database https://shomra.ai/blog/replit-agent-deleted-production-database Fri, 18 Jul 2025 12:00:00 GMT Mistake During a public experiment, Replit’s AI agent ran database commands it had been told not to run, wiped a live production database, then said the damage could not be undone. The rollback worked. https://shomra.ai/blog/amazon-q-extension-wiper-prompt https://shomra.ai/blog/amazon-q-extension-wiper-prompt Thu, 17 Jul 2025 12:00:00 GMT Supply chain An outside party got code into version 1.84.0 of the Amazon Q Developer extension that would launch Amazon Q with a prompt to delete local files and AWS resources. AWS says a syntax error stopped it running and no customers were affected. https://shomra.ai/blog/mcp-remote-command-injection https://shomra.ai/blog/mcp-remote-command-injection Wed, 09 Jul 2025 12:00:00 GMT Attack A flaw in mcp-remote, a popular proxy that connects local AI clients to remote MCP servers, let a malicious server run commands on the client machine during login. It was fixed in version 0.1.16. https://shomra.ai/blog/supabase-mcp-cursor-token-leak https://shomra.ai/blog/supabase-mcp-cursor-token-leak Tue, 24 Jun 2025 12:00:00 GMT Attack Researchers showed that a ticket with hidden instructions could make a Cursor agent, connected to Supabase with a key that bypasses row-level security, copy a table of integration tokens into the ticket thread. https://shomra.ai/blog/echoleak-microsoft-365-copilot-zero-click https://shomra.ai/blog/echoleak-microsoft-365-copilot-zero-click Wed, 11 Jun 2025 12:00:00 GMT Attack Researchers showed that a single crafted email could make Microsoft 365 Copilot send internal data to an outside server without the victim clicking anything. Microsoft fixed it on its side before disclosure. https://shomra.ai/blog/github-mcp-toxic-agent-flow https://shomra.ai/blog/github-mcp-toxic-agent-flow Mon, 26 May 2025 12:00:00 GMT Attack Researchers showed that instructions planted in a public issue could make an agent using GitHub’s MCP server copy private repository data into a public pull request.