Contact Open demo
Agent Incident Tracker

When AI agents went wrong, and what they could reach

A running list of public incidents involving AI agents, MCP servers and the identities behind them. Each entry says what happened and what the agent could reach.

Browse incidentsRead the report

Public incidents

8 entries so far, newest first. Entries are summaries of public reports, not findings from nerl0 scans.

The Agent Reachability Report
A look-alike MCP email package

A malicious npm package posing as a mail MCP server quietly copied outgoing email to an outside address.

Supply chainReachedEmail content
Stolen OAuth tokens of a sales chat tool

Stolen OAuth tokens from a connected sales tool were used to read data in customers' CRM workspaces.

Token theftReachedCRM data
A build-tool attack that used AI CLIs

A compromised package ran locally installed AI command-line tools to search developer machines for secrets.

Supply chainReachedLocal secrets
A database MCP server leaked tokens

A support ticket with hidden instructions made an agent with database access reveal private data.

Prompt injectionReachedDatabase records
A malicious prompt shipped in a coding extension

A harmful instruction was merged into an AI coding extension and released before it was caught.

Supply chainReachedLocal files and cloud CLI
A coding agent deleted a production database

An agent with write access to production deleted a live database during a code freeze.

Excessive accessReachedProduction database
Zero-click data leak through an office assistant

A crafted email made a workplace AI assistant send internal data out without any click by the user.

Prompt injectionReachedMailbox and files
A GitHub MCP server exposed private repositories

A public issue with hidden instructions made an agent read from private repositories and publish what it found.

Prompt injectionReachedPrivate repositories

Read every incident as a path

The same question sits behind each one: which identity could reach which data, and through what.

01Who actedAn agent, an extension, a package or a token, and who owned it.
02What it reachedThe data or system the access led to, and how many hops away it was.
03What would have cut itThe single grant, key or tool whose removal breaks the path.

Check your own reach before the next one.

Open the demoTalk to us