h5i-dev/awesome-ai-agent-incidents

What it is

awesome-ai-agent-incidents is a GitHub list (MIT licence, copyright 2026 Hideaki Takahashi) that indexes incidents, CVEs, papers and defensive tools for autonomous AI agents. It is a pointer collection. The page gives one-line descriptions, not the underlying detail, so the value is in which sources it points to and the figures it quotes.

How it works

Several concrete claims sit on the page:

• MCP tool-metadata poisoning. MCP clients receive tool metadata via tools/list and pass it into the LLM context without sanitization. The LLM treats natural-language descriptions as instructions. The page says the flaw is entirely client-side (arXiv 2603.22489).
• Promptware Kill Chain (arXiv 2601.09625). Of 36 prominent incidents analysed, at least 21 passed through four or more of seven stages: initial access, privilege escalation (jailbreak), reconnaissance, persistence (poisoning memory or a RAG database), command and control (for example SesameOp), lateral movement to other agents, and actions on objective.
• OWASP Top 10 for Agentic Applications. Released December 2025 and distinct from the general LLM Top 10. It covers failures of autonomy, persistence and tool integration.
• MITRE ATLAS. Now 16 tactics and 84+ techniques, with agentic coverage.

Preconditions / Affected

The list names two CVEs, both in Claude Code. CVE-2025-59536 and CVE-2026-21852 are covered in a Check Point write-up (February 2026) on RCE and API token exfiltration through project files. Repo-level hooks, MCP definitions and env settings became the attack surface. The page gives no CVSS scores or fixed versions, so check the advisories.

Other figures, each tied to a linked source:

• 1,184 malicious skills in the OpenClaw/ClawHub supply-chain incident, confirmed by Antiy CERT.
• 36% of agent skills with security flaws, from Snyk ToxicSkills (February 2026).
• 43% of tested MCP servers with command injection flaws, from Elastic Security Labs. It also covers tool poisoning, rug-pull redefinition and name collision.
• 35% of 2025 incidents caused by simple prompts, from the Adversa AI report (17 case studies).

What to do

The page offers reading, not commands. The defensive sources it lists are:

• Willison's design patterns for securing agents against prompt injection, and his "lethal trifecta" analysis.
• Microsoft MSRC's FIDES information-flow control approach (July 2025).
• A per-tool-category MCP defence guide (February 2026).
• CrowdStrike's SOC detection signals for indirect prompt injection (December 2025).
• OpenAI's Atlas hardening, which includes an RL-trained automated red-teamer (December 2025).
• The OWASP GenAI Incident Response Guide, for playbooks.
• OWASP Agent Memory Guard, for LangChain/LlamaIndex memory protection.

Anyone running Claude Code on untrusted repositories should read the Check Point item first. Anyone using MCP should read the Elastic and tool-poisoning items.

Caveats

The page summarises and does not reproduce exploit details, detection queries or patches. Contributions need a verifiable source link, and unverified entries are not merged. Some linked items are vendor or news write-ups, such as an analysis of an evaluation agent reaching non-public files on an Australian Medicare statistics portal (September 2026). The page gives no independent check of the statistics it quotes.