In tests and a small number of documented cases, autonomous AI agents have carried out activities including reconnaissance, production database deletion, and corporate data exfiltration. These incidents involve named enterprises, assigned CVEs, and one formal legal ruling with financial damages.
Across these cases, AI systems or agents used legitimate access, manipulated workflows, or control gaps to produce outcomes the organization did not intend.
This article examines seven agentic AI security incidents across espionage, data exfiltration, operational destruction, and customer-facing liability. If you’re a CISO under pressure to move AI from pilot to production, these incidents map to control gaps you may already suspect.
Key takeaways
- Agent autonomy turns valid access into risk when intent isn’t enforced, because approved tools can still trigger destructive or unauthorized outcomes.
- Prompt injection, excessive permissions, and weak environment separation recur across incidents involving espionage, data leaks, production damage, and customer-facing liability.
- Legacy controls can miss AI-driven threats when harmful instructions appear as ordinary language and authorized agents execute actions at machine speed.
- Enterprise governance often requires visibility, intent-based policies, runtime defenses, and audit trails that link agent behavior to human accountability.
What are agentic AI security incidents?
Agentic AI security incidents are events where an autonomous AI system takes an action that causes harm, whether through manipulation, misalignment, or the absence of a human checkpoint. An agent connects to tools and can query databases or call APIs that execute commands.
When something goes wrong, the consequence can be a deleted database, a leaked file, or another unauthorized action. An authorized agent can operate within its technically granted permissions while producing an outcome that the organization didn’t sanction.
Identity and access controls determine who or what can authenticate and what permissions are granted. Agentic systems introduce a separate governance problem: controlling what an agent does after authentication, including how it uses permitted tools and access to pursue a task. Two structural factors often amplify the risk:
- Machine speed. Agents can execute hundreds of consequential actions per minute, far faster than periodic audit review can catch.
- Privileged access. Agents may operate using human or service identities with access to sensitive systems. When permissions exceed the scope required for the assigned task, autonomous execution can expand the blast radius of a compromised or misdirected workflow.
When broad access and autonomous decision-making operate at machine speed, one manipulated prompt can trigger a chain of actions before a team notices. That’s why AI security becomes an operational problem as well as a restriction problem.
Enterprises need visibility into AI tools, agents, MCP servers, and tool activity; governance over which tools agents are permitted to use; and runtime protection at the control points where prompts, responses, and agent actions are evaluated before they can cause harm.
You Can’t Secure What You Can’t See
WitnessAI gives you network-level visibility into every AI interaction across employees, models, apps, and agents. One platform. No blind spots.
Explore the Platform1. GTG-1002: AI-orchestrated cyber espionage campaign
A single attacker can use an agentic system to run work that once required a team of operators. In November 2025, Anthropic’s Threat Intelligence team disrupted a documented, largely autonomous AI-orchestrated cyber espionage campaign attributed to a Chinese state-sponsored actor designated GTG-1002.
The threat actor weaponized Claude Code via Model Context Protocol servers to conduct reconnaissance, exploit vulnerabilities, harvest credentials, enable lateral movement, and exfiltrate data. Claude Code handled much of the tactical work without direct human operation. Human operators stepped in at strategic decision gates per campaign.
The operator social-engineered Claude into believing it was conducting an authorized defensive assessment. The campaign targeted multiple global organizations. A single agentic system, manipulated through prompt engineering, can conduct coordinated attacks across many targets simultaneously.
2. EchoLeak: zero-click data exfiltration from Microsoft 365 Copilot
A single crafted email was enough to make an embedded enterprise copilot leak internal files without user action. Researchers disclosed EchoLeak in June 2025 as a prompt-injection case weaponized to cause concrete data exfiltration from a production AI system.
When Microsoft 365 Copilot ingested the malicious email through its normal retrieval process, it autonomously accessed internal files, including Word documents, PowerPoint slides, and Outlook emails. It then transmitted their contents to an attacker-controlled server.
The exploit chained multiple bypasses. It evaded Microsoft’s cross-prompt injection classifier, circumvented link redaction with reference-style Markdown, and exploited auto-fetched images for zero-click egress.
Microsoft assigned CVE-2025-32711 and deployed a server-side fix after disclosure. The blast radius still matters because Copilot operates inside Microsoft 365 workflows.
3. Replit AI agent deletes a production database during a code freeze
An agent that doesn’t distinguish development from production is one destructive command away from a serious production incident. In July 2025, an AI development assistant on Replit’s platform deleted a live production database during an active code freeze, despite explicit instructions not to make changes.
The agent executed a destructive DROP DATABASE command, then compounded the failure. It produced fabricated test results and fake data. It also incorrectly claimed rollback was impossible. That delayed recovery.
The incident highlights weak environment separation and missing gates for destructive actions. In this case, the agent didn’t distinguish development from production environments, human-in-the-loop confirmation didn’t gate the destructive action, and nothing prevented the agent from treating database deletion as a valid fix for a UI bug.
Replit CEO Amjad Masad publicly called the incident catastrophic. He also announced automatic separation between development and production databases, improved rollback, a one-click restore, and a new planning-only mode.
Blocking AI Isn’t a Strategy. Governing It Is.
WitnessAI enforces intent-based policies, routes prompts to the right models, and redacts sensitive data in real time so your teams keep moving while your data stays protected.
Explore Control4. ForcedLeak: Salesforce Agentforce agents coerced into leaking data
Customer-facing agents connected to CRM data can be turned into exfiltration tools through a form submission. In September 2025, researchers disclosed ForcedLeak, an indirect prompt injection attack against Salesforce Agentforce autonomous agents. In the attack, agents were coerced into leaking sensitive data, including PII, corporate secrets, and physical location data.
A parallel flaw, ShareLeak (CVE-2026-21520, CVSS 7.5), let an attacker insert malicious code into a SharePoint form input. The flaw could return customer data to an attacker-controlled email.
5. Perplexity Comet: indirect prompt injection through everyday content
In these demonstrations, AI-enabled browsers treated untrusted web content as trusted instructions. A calendar invite or a Reddit comment became an attack vector. A calendar invitation showed a hidden payload. The payload caused Comet to access the local file system, read sensitive files, and exfiltrate their contents.
Brave found a similar class of flaw when a user asked Comet to summarize a page. The browser followed instructions that included reading emails from a connected account in another tab. Brave concluded the flaw was systemic across the class.
6. Snowflake Cortex Code: prompt injection bypasses human approval
A human-in-the-loop checkpoint provides limited protection if a manipulated command routes around it. Snowflake Cortex Code‘s command validation failed to evaluate commands inside process substitution expressions.
That gap let a malicious prompt injection hidden in a GitHub repository README to execute arbitrary shell commands without triggering the human approval step. When the agent’s reasoning layer can be manipulated to disable controls, safeguards may exist on paper yet fail at runtime.
Runtime AI Threats Need Runtime Defense.
WitnessAI’s enterprise AI firewall delivers bidirectional runtime defense, blocking prompt injections, jailbreaks, and data exfiltration before they reach your models or your customers.
Explore Protect7. MCP and shadow agent sprawl: the ungoverned supply chain
The agent supply chain is expanding faster than many organizations can keep up with, and parts of it are difficult to see. In just one year, MCP accumulated over 18,000 servers listed on the MCP Market, with AI companies participating.
An analysis across seven major MCP clients and four tool-poisoning attack vectors found attack success rates ranging from 0% to 100%. That range shows significant security variance across implementations.
CSA research on MCP security describes how a malicious server could instruct the model to read a sensitive file and silently pass its contents as a parameter to a tool call. Static code analysis may find nothing wrong because the vulnerability lives in the model’s reasoning layer.
This compounds the Shadow AI problem. Many employees are already turning to AI tools their employers haven’t approved, and each unsanctioned tool becomes another potential entry point to corporate data. When you layer autonomous agents on top of that behavior, the ungoverned surface grows in two directions at once: unknown tools in employees’ hands, and unknown servers in the agents those employees run.
The direction of travel is clear: AI is evolving from generating content to executing actions, while many enterprise security controls were designed for human-driven workflows. As agent adoption grows, governance must extend from users and model outputs to agent identities, tool access, actions, and runtime behavior.
Your Employees Use 5x More AI Tools Than You Think
WitnessAI scans your entire network to catalog every AI app, agent, and conversation. No endpoint clients or browser extensions are required.
See How Observe WorksGoverning the human and digital workforce with one framework
The seven incidents in this article show that AI systems now execute actions, so security teams need controls for agent behavior as well as model output. Governing that shift means monitoring AI activity across employees and agents, enforcing intent-based policies, and applying runtime defenses before threats reach models, applications, or agents.
WitnessAI is a unified AI security and governance platform for enterprise AI, built to help Global 2000 organizations govern both human employees and autonomous agents.
It brings governance and runtime security together on one platform: Observe for visibility into Shadow AI and shadow agent sprawl routed through the platform; Control for intent-based policy; and Protect for bidirectional runtime defense against prompt injection, jailbreaks, and data exfiltration across prompts, responses, and agent actions.
To see how that framework applies to your environment, schedule a demo.