Skip to content

Back to the catalog

github.comrepo

AI Agent Hacking Writeups

A GitHub-hosted, CC0-licensed index of 281 public writeups on attacks against AI agents, organized into six categories: indirect prompt injection, direct prompt injection/jailbreaks/guardrail bypass, MCP and agent tooling, AI platform/infrastructure bugs, classic web bugs in AI product surfaces, and AI used as an attacker's tool. Entries span 2021-2026 and include major disclosures like GeminiJack, ForcedLeak, Clinejection, CVE-2025-53773 (GitHub Copilot RCE), and dozens of Johann Rehberger/PromptArmor/qual1a writeups covering exfiltration, MCP OAuth flaws, and coding-agent sandbox escapes. Comes with an accompanying blog post "How to Hack AI Agents" and a scripted links.txt for automation.

TL;DR Curated public index of 281 writeups on real-world AI agent attacks — prompt injection, MCP tool abuse, agent infra bugs, and AI-as-attacker case studies.
Open original ↗
Document

What it is

The index catalogs 281 writeups, but the actionable payload the summary omits is a cluster of named CVEs against developer tooling engineers actually run — each tagged with product, date, and mechanism. If you deploy coding agents, MCP servers, or LLM inference/orchestration stacks, the page is a checklist of concrete exposures, not just a reading list.

CVEs and RCE-class findings worth checking exposure against

Coding agents and IDEs:

  • CVE-2025-53773 — GitHub Copilot RCE via prompt injection (2025-08, Johann Rehberger).
  • CVE-2025-62453 — code execution in GitHub Copilot Chat via a Windows case-sensitivity bypass of command validation (2025-11).
  • CVE-2025-66032 — Claude Code command-permission blocklist bypass, "8 different ways" (2026-01, RyotaK).
  • CVE-2025-55284 — Claude Code data exfiltration over DNS (2025-06, high).
  • CVE-2025-54132 — Cursor IDE arbitrary data exfiltration via Mermaid rendering (2025-07).
  • CVE-2026-24299 — Microsoft Copilot "Copirate 365" data plundering (2026-08).

Infrastructure / orchestration (these are unauth or pre-auth in several cases):

  • CVE-2025-3248 — unauthenticated RCE in Langflow via /api/v1/validate/code (2025-01, critical).
  • CVE-2024-6982 / LoLLMs — prompt injection to Python sandbox escape / RCE (2024-10).
  • CVE-2024-5565 / Vanna.AI — integrated prompt-injection code execution (JFrog, Tong Liu).
  • Probllama / Ollama — RCE via path traversal in model-manifest digest (Wiz, critical).
  • NVIDIA Triton — info leak to RCE via Python-backend shared memory (critical); a second Triton RCE + arbitrary memory write is also listed.
  • Hugging Face platform — Wiz cross-tenant container escape + deserialization RCE (critical).
  • CVE-2026-0628 — Gemini Live in Chrome extension privilege escalation via declarativeNetRequest (Unit 42, high).
  • Bisheng — pre-auth RCE via unauthenticated exec()-based code validator (critical).
  • LangSmith Playground — RCE via unsafe template formatting (0xn3va).

The MCP / OAuth failure pattern

Multiple independent writeups converge on the same mechanism: MCP clients handling server-provided OAuth redirect_uri / authorization URLs without validation, yielding XSS→RCE. Named affected clients include Claude Code, Gemini CLI, MCP Inspector, and use-mcp ("From Well-Known to Well-Pwned"; Veria Labs "From MCP to Shell"). Related: open Dynamic Client Registration in MCP/OAuth servers ("Shaking the MCP Tree"), and PKCE self-attack full-ATO via unvalidated redirect_uri. If you ship an MCP client, this is the class to audit first.

flowchart TD
    A[Untrusted MCP server] -->|OAuth authorization URL| B{Client validates redirect_uri?}
    B -->|No| C[window.open on attacker data]
    C --> D[XSS / LFE / RCE in client]
    B -->|Yes| E[Blocked]

Caveats

  • The repo indexes third-party writeups; it does not itself verify reproductions, confirm patch status, or state which CVEs remain unpatched — several entries are explicitly labeled "unpatched" by their authors (e.g., Ollama, Notion AI, OpenAI API logs), others fixed. Confirm current status against each vendor before acting.
  • CVE assignment is inconsistent across entries: some high-impact findings (Triton second bug, Hugging Face escape, Probllama) are listed by name/vendor without a CVE in the excerpt.
  • CC0 covers the index only; linked writeups retain their authors' copyright.

Organisations named here

  • Adnan Khan
  • Agentjacking
  • Copirate 365
  • ForcedLeak
  • GeminiJack
  • Johann Rehberger
  • Kai Greshake
  • Noma Labs
  • PROMISQROUTE
  • PromptArmor
  • qual1a
  • RyotaK
  • SpAIware
  • XSSDoctor
  • ZombAI

CVEs named here

  • CVE-2026-24299
  • CVE-2026-41940
  • CVE-2026-0628
  • CVE-2025-66032
  • CVE-2025-62453
  • CVE-2025-55284
  • CVE-2025-54132
  • CVE-2025-53773
  • CVE-2025-3248
  • CVE-2024-6982
  • CVE-2024-5565

Technologies named here

  • ASCII Smuggler Tool - Johann Rehberger
  • Outlook
  • Atlassian Rovo AI
  • Repeater Strike - Gareth Heyes
  • Document My Pentest - Gareth Heyes
  • Claude Code
  • Sentry
  • Shadow Repeater - Gareth Heyes, James Kettle
  • Salesforce Agentforce
  • XBOW - used in AEM/Akamai XXE case studies
  • Whorl - tehryanx
  • Ollama
  • ChatGPT for Google Sheets
  • Burp Suite MCP Server
  • OpenAI Codex
  • use-mcp
  • Microsoft Copilot Cowork
  • MCP Inspector
  • Claude for Legal
  • YOLOv7
  • Cursor
  • Supabase
  • Granola AI
  • Ramp Sheets AI
  • Snowflake Cortex Code CLI
  • GitHub Copilot CLI
  • OpenClaw
  • Claude Cowork
  • OpenAI API Logs
  • Superhuman AI
  • IBM Bob
  • Notion AI
  • macOS Terminal
  • HuggingChat
  • Google Vertex AI
  • Google Gemini Enterprise / Vertex AI Search
  • Google Antigravity
  • AWS Kiro
  • DeepSeek Chat
  • Google Gemini for Workspace
  • Slack AI
  • Writer.com
  • ChatGPT Plugins
  • Auto-GPT
  • Bing Chat / Microsoft Copilot
  • IDA MCP server
  • Cloudflare Code Mode / Workers
  • Model Context Protocol
  • Chrome
  • GitHub Agentic Workflows
  • Garz AI
  • Claude Dynamic Workflows
  • Cline
  • Salesforce Marketing Cloud
  • cPanel & WHM
  • Google Cloud Looker
  • Anthropic Claude
  • ChatGPT Atlas
  • React Router
  • OpenAI Excel/Google Sheets AI
  • Gemini
  • Gemini Android App
  • OpenAI Agent Builder
  • Anthropic MCP
  • GitHub MCP
  • Anthropic Claude Computer-Use
  • GitHub Copilot Agent
  • Vincent AI
  • Google Gemini CLI
  • Unnamed Indian e-commerce platform
  • Google Antigravity IDE
  • Claude for Excel
  • GitHub Copilot Chat
  • LangChain / LangChainjs / Haystack / LlamaIndex
  • Anthropic File API
  • Facebook Messenger
  • Google Gemini
  • GitHub Copilot
  • Brave AI Chat
  • Google Jules
  • OpenHands
  • OpenAI ChatGPT
  • Amazon Q Developer
  • Devin
  • Amp Code
  • Windsurf
  • Manus
  • OBS Studio
  • Anthropic Slack MCP Server
  • GitHub MCP Server
  • AWS Bedrock Guardrails
  • Next.js middleware
  • ServiceNow AI Agent Chatbot
  • Google Gemini-Powered Assistants
  • DeepSeek AI
  • Microsoft 365 Copilot
  • xAI Grok
  • KachraCraft
  • OpenAI GPT-4o
  • Windows Recall
  • LoLLMs
  • Google Colab AI
  • OpenAI gpt-4o-mini
  • Google NotebookLM
  • Google AI Services
  • GitLab
  • Google Bard
  • Google Vertex AI Generative AI Studio
  • Azure AI Playground
  • Amazon Q for Business
  • Google AI Studio
  • Vanna.AI
  • Hugging Face
  • LiteLLM
  • Bisheng LLM DevOps Platform
  • Google Chrome
  • vLLM
  • LangSmith Playground
  • NVIDIA Triton Inference Server
  • Cloudflare AI-coded OAuth library
  • Virtuals Protocol
  • Langflow
  • Microsoft Copilot Studio
  • Cloudflare
  • OpenClaw / Moltbot Gateway
  • Cherry Studio
  • Anthropic Filesystem MCP Server
  • Krypto
  • ShopFire
  • WhatsApp
  • X
  • HackerOne Copilot
  • WildFly
  • Adobe Experience Manager
  • Microsoft AddinUtil.exe
  • Anthropic
  • Salesforce
  • Slack
  • GitHub
  • LangChain

Techniques named here

  • Indirect prompt injection
  • Direct prompt injection
  • MCP List Caching and Tool Poisoning attacks
  • Tool shadowing
  • ASCII Smuggling / invisible Unicode tag character injection
  • Markdown image rendering data exfiltration
  • DNS exfiltration
  • Memory poisoning
  • Cross Plugin Request Forgery
  • Sandbox escape
  • SSRF
  • BOLA/BFLA
  • IDOR
  • Cross-site scripting
  • SQL injection / SSTI
  • CSRF
  • OAuth redirect_uri / dynamic client registration abuse
  • PKCE self-attack
  • DNS rebinding
  • Path traversal
  • Deserialization RCE / Java gadget chains
  • Client-Side Path Traversal
  • Model downgrade / AI router jailbreak
  • ClickFix
  • TOCTOU in computer-use agents
  • Instruction hierarchy breaking
  • Guardrail/safety-filter evasion
  • Recursive tool call cost/DoS abuse
  • Cross-agent privilege escalation
  • Poisoned Pipeline Execution
  • GitHub Actions cache poisoning
  • DTMF tone data exfiltration
  • Prompt injection via GitHub issue/PR comments
  • Delayed automatic tool invocation via planted instructions
  • Windows case-sensitivity bypass for command validation
  • Unicode normalization abuse
  • Cross-tenant container escape
  • GitLost

Threat actors named here

  • Clinejection

Related in AI Security