Share of the 59 incidents, then the count. An incident can involve more than one failure.
Unauthorised access44%26
Sandbox escape25%15
Credential misuse24%14
Destructive action22%13
Data exfiltration17%10
Deceiving people15%9
Supply chain compromise12%7
Swarm coordination10%6
Prompt injection / context poisoning8%5
Resource abuse7%4
Hijacked by an attacker5%3
Self-planted instructions5%3
Untrusted code execution2%1
AI provider involved
Share of the 59 incidents, then the count. An incident can involve more than one provider.
OpenAI39%23
Anthropic32%19
Meta8%5
Google5%3
Amazon3%2
OpenClaw3%2
Replit2%1
Alibaba2%1
Cursor2%1
Amazon Web Services2%1
Instinct2%1
What is publicly known
92%of the core details about each agent setup are not fully publicly known
Who and what was affected22%
Root cause stated22%
Fix or change made19%
Task and messages given17%
Detection telemetry17%
Exact model and version12%
Guardrails and safety settings12%
Harness and tools available8%
Network and egress setup5%
System prompt3%
Reasoning or thinking setting0%
Transcripts or action logs published0%
Agent failures, by threat framework
OWASP Agentic Top 10106 of 116
MITRE ATLAS66 of 116
AARM threat model57 of 116
Threat categories, by framework
OWASP Agentic Top 10
ASI02 Tool Misuse & Exploitation38
ASI10 Rogue Agents18
ASI03 Identity & Privilege Abuse14
MITRE ATLAS
AML.T0049 Exploit Public-Facing Application26
AML.T0055 Unsecured Credentials14
AML.T0025 Exfiltration via Cyber Means10
AARM threat model
Intent Drift15
Over-Privileged Credentials14
Data Exfiltration via Action Composition10
Evidence status
Share of the 59 incidents, then the count. Confirmed: a primary source states it. Reported: tier-one coverage only. Disputed: sources disagree.
Confirmed58%34
Reported36%21
Disputed7%4
Impact
Share of the 59 incidents, then the count, from Major (harm that reached many people or a platform many depend on) to Contained (no outside party harmed). The scale is on the Methodology page.
