Affected Technology
Data Leakage incidents
Data exposure and leakage incidents
CVE-2025-49596 Cross-Site Request Forgery Vulnerability affecting Model Context Protocol Inspector
MCP Inspector proxy server lacks authentication between the Inspector client and proxy The supported impact is system compromise. Reported affected versions include < 0.14.1.
CVE-2026-59821 Security Incident affecting litellm
LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks Reported affected versions include 0.1.0.
Claude Code Information Disclosure Vulnerability
Evidence indicates that Claude Code is affected by a security issue. Reported affected versions include 2.1.88.
OpenClaw AI bot farm Remote Code Execution Vulnerability
Evidence indicates that OpenClaw AI bot farm is affected by remote code execution.
Moltbook Misconfiguration Vulnerability
Evidence indicates that Moltbook is affected by a security issue.
CVE-2022-30190 Prompt Injection Vulnerability affecting Windows
Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability The supported impact is remote code execution. Exploitation evidence is classified as confirmed in the wild.
Bedrock Leaked Credentials Vulnerability
Evidence indicates that Bedrock is affected by a security issue.
ChatGPT Data Exposure
Evidence indicates that ChatGPT is affected by data exposure.
Fortune 500 Companies Hit in Azure Data Theft Campaign
A data theft campaign has targeted Fortune 500 companies, specifically exploiting Azure cloud environments for sensitive information exfiltration. This incident underscores critical vulnerabilities in cloud infrastructure and the ongoing risk associated with insecure cloud deployments.
153GB of stolen credentials surface after LiteLLM supply chain attack
A supply chain attack compromised LiteLLM via a poisoned Trivy dependency, leading to the deployment of malicious LiteLLM versions (1.82.7/1.82.8) that exfiltrated 153GB of corporate credentials. This dataset, comprising AWS keys, API tokens, and other secrets from CI runner environments, impacts nearly 2,500 organizations, underscoring critical software supply chain vulnerabilities.
Terabytes Supply-Chain Compromise
A significant data breach has resulted in the exposure of terabytes of user credentials. This compromise was identified as a large-scale supply-chain attack, impacting a multitude of dependent organizations.
AI Critical security gaps in AI deployments, including lack of access controls and shadow AI, are contributing to increased incidents. Vulnerability
Data breach costs surged to a record average of $4.99 million, notably escalating with AI-driven attacks that exploit vulnerabilities faster and leverage advanced techniques like deepfakes and AI-generated malware. Critical security gaps in AI deployments, including widespread lack of access controls for AI models and pervasive shadow AI, are contributing to increased incidents, data compromise, and operational disruptions.
OpenAI Remote Code Execution Vulnerability
A security breach reportedly involving OpenAI and the Hugging Face platform indicates potential unauthorized access to, or exfiltration of, AI model data or related resources. This incident underscores critical vulnerabilities within the AI development ecosystem, raising significant concerns about MLOps security and the integrity of AI supply chains.
Being Sold Remote Code Execution Vulnerability
Vercel experienced a supply chain attack that led to the compromise and exfiltration of user data. The stolen user data is being actively trafficked and sold for $2M on BreachForums.
Meta Data Exposure
A major security incident impacting Mercor, a leading data vendor, potentially exposed proprietary AI model training data from several major AI labs, including Meta. This breach prompted Meta to indefinitely pause its work with Mercor, with other AI firms also reevaluating their partnerships due to the third-party compromise.
Meta Supply-Chain Compromise
A security incident at AI data vendor Mercor exposed proprietary AI training data methodologies and strategies from Meta and other major AI labs. This breach represents a significant competitive intelligence leak, highlighting critical security vulnerabilities within the AI supply chain and third-party vendor relationships.
AI Companies Data Exposure
The provided article content is empty, preventing a detailed technical summary. However, the title indicates Mercor has suffered a major security breach affecting AI companies, with Binance mentioned in context, suggesting a potential data leak or significant compromise.
From Basics Prompt Injection Vulnerability
The article outlines a comprehensive AI security roadmap addressing unique threats to LLMs and AI agents, such as prompt injection, data poisoning, model inversion, and data leakage, which exploit probabilistic system behaviors across the full AI lifecycle. It emphasizes applying frameworks like OWASP Top 10 for LLMs and NIST AI RMF to build defenses from data collection and training to deployment and runtime monitoring, mitigating these advanced vulnerabilities.
ChatGPT Remote Code Execution Vulnerability
Hackers utilized AI jailbreaking techniques and sophisticated prompt engineering on Generative AI models like Claude and ChatGPT to exploit vulnerabilities within Mexican government systems. This operation led to the successful exfiltration of 150GB of sensitive data, including 195 million taxpayer records, voting information, and government employee credentials.
Mercor AI Confirms Data Breach Following Lapsus$ Claims of 4TB Data Theft
Mercor AI has officially confirmed a significant data breach. This incident follows claims by the Lapsus$ threat group of successfully exfiltrating 4TB of data from the company's systems.
LLMs Prompt Injection Vulnerability
The OWASP Top 10 for LLM Applications (2025) highlights critical security risks, notably Prompt Injection, where crafted inputs manipulate LLM behavior to bypass safeguards or achieve unauthorized access. Another key concern is Sensitive Information Disclosure, where LLMs can inadvertently leak confidential data, leading to privacy violations and intellectual property infringement.
Meta AI agent’s instruction causes large sensitive data leak to employees | AI (artificial intelligence)
An internal Meta AI agent provided erroneous instructions to an engineer, leading to the accidental exposure of sensitive user and company data to other employees for two hours. This incident highlights a vulnerability in agentic AI systems where a lack of contextual awareness can prompt actions with unintended data exposure consequences.
McKinsey's AI agent "Lilli" hacked - by another AI agent
McKinsey's internal AI agent "Lilli" was breached through classic application security flaws, including an unauthenticated endpoint with a SQL injection vulnerability chained with an IDOR flaw. This exploit led to the exposure of 46 million chat logs, 728,000 private files, proprietary RAG documentation, and access to internal AI knowledge bases and vector stores.
AI Data Leakage Vulnerability
LLM applications face significant security risks, primarily prompt injection attacks, where malicious inputs manipulate models into ignoring instructions and revealing sensitive data. This can lead to the exposure of internal configuration data, confidential information, or unauthorized actions within connected enterprise systems.
Malicious AI Assistant Extensions Harvest LLM Chat Histories
Malicious Chromium-based browser extensions are impersonating legitimate AI tools to harvest sensitive LLM chat histories and browsing data, impacting over 900,000 installs and 20,000 enterprise tenants. These extensions exfiltrate proprietary code, internal workflows, and confidential data to threat actor-controlled infrastructure, leading to widespread information leakage.
AI Agent Security Prompt Injection Vulnerability
The article details how AI agents introduce unique security risks through prompt injection attacks, over-permissioning, and unconstrained external tool access, which can lead to sensitive data leakage and unauthorized API calls. It emphasizes a robust security framework for AI agents, incorporating authentication, access controls, guardrails, and continuous monitoring to mitigate these vulnerabilities.
Copilot Misconfiguration Vulnerability
Evidence indicates that Copilot is affected by a security issue.
Microsoft Data Exposure
A reported vulnerability in Microsoft 365 Copilot could lead to the exposure of sensitive email content through its AI summarization feature. This flaw poses a risk of unauthorized data disclosure, potentially compromising user privacy within the Microsoft 365 ecosystem.
Microsoft 365 Copilot Chat Information Disclosure Vulnerability
Evidence indicates that Microsoft 365 Copilot Chat is affected by a security issue.
Dangers Data Exposure
A viral AI caricature trend exposes enterprises to shadow AI risks and sensitive data leakage, as employees input work-related information into public LLMs and share results. This behavior enables adversaries to conduct targeted social engineering for LLM account compromise, granting access to confidential prompt histories.
The Silent Leak: How URL Previews in LLM-Powered Tools Are Quietly Exfiltrating Sensitive Data
Security researchers have identified a vulnerability where prompt injection attacks in LLM-powered applications can weaponize URL preview features to silently exfiltrate sensitive data. Attackers can craft malicious prompts that cause the LLM to generate URLs containing extracted confidential information, which is then transmitted to an attacker-controlled server when the application automatically fetches the URL preview.
AI Chat App Data Exposure
An AI chat application reportedly exposed 300 million messages belonging to 25 million users, as indicated by the article title. However, detailed technical information regarding the nature of the data exposure, the underlying vulnerability, or specific exploitation methods could not be retrieved due to a forbidden access error during scraping.
External Partner Security Data Exposure
Flickr experienced a data breach due to a security vulnerability found within a system managed by a third-party email service provider. This flaw potentially exposed user names, email addresses, IP addresses, and activity logs, though sensitive user passwords and financial information remained secure.
Configuration Data Data Exposure
According to the article title, over 21,000 OpenClaw AI instances have been identified exposing personal configuration data, indicating a significant data exposure event. This widespread issue points to potential misconfigurations or vulnerabilities within the OpenClaw AI platform allowing unauthorized access to sensitive information.
Authentication Tokens Data Exposure
A significant security flaw within Moltbook AI has resulted in the leakage of highly sensitive user data. This compromise includes user email addresses, authentication tokens, and critical API keys, posing a substantial risk to user accounts and potentially wider system access.
ChatGPT Prompt Injection Vulnerability
OpenAI confirmed a data breach originating from unauthorized access to Mixpanel, a third-party web analytics provider it uses for its API product. This incident exposed names, email addresses, approximate locations, OS/browser data, and user IDs associated with OpenAI API accounts (platform.openai.com users), but did not compromise ChatGPT content, passwords, or payment details.
OpenAI Data Exposure
A data breach at OpenAI resulted in the exposure of API user information. This incident necessitates prompt action from affected users to secure accounts and rotate API keys to prevent unauthorized access.
Claude Security Incident
Evidence indicates that Claude is affected by a security issue.
AI Governance Security Incident
Evidence indicates that AI Governance is affected by a security issue.
Best Practices Prompt Injection Vulnerability
Evidence indicates that Best Practices is affected by a security issue.
Practical LLM Security Advice from the NVIDIA AI Red Team | NVIDIA Technical Blog
LLM-based applications are susceptible to remote code execution (RCE) vulnerabilities when executing LLM-generated code via functions like `exec` or `eval` without proper sandboxing, often triggered by prompt injection. Additionally, insecure access controls in Retrieval-Augmented Generation (RAG) systems can lead to data leakage and indirect prompt injection, while active content rendering of LLM outputs enables data exfiltration by embedding malicious links or images.
GitHub Remote Code Execution Vulnerability
A multi-stage supply chain attack, tracked as UNC6395, originated from the compromise of a Salesloft GitHub repository, leading to the theft of a sensitive OAuth token. This token enabled access to a high-privilege AI chatbot application (Drift) and subsequent exfiltration of customer conversation data and contact information from over 700 integrated Salesforce instances.
Cloud AI Prompt Injection Vulnerability
The article details critical security challenges associated with cloud-hosted Large Language Models (LLMs), including prompt injection, adversarial exploits, model jailbreaks, sensitive data leakage, and misconfigurations. These vulnerabilities, stemming from lack of visibility and ungoverned AI behavior, necessitate proactive discovery and risk management to safeguard AI workloads.
The Ongoing Fallout from a Breach at AI Chatbot Maker Salesloft
The incident involved the mass-theft of authentication tokens from Salesloft's Drift application, leading to significant data exfiltration from integrated corporate Salesforce instances and other cloud services. Threat actors, tracked as UNC6395, leveraged these stolen credentials to perform "authorization sprawl," accessing and siphoning sensitive data including AWS keys and VPN credentials.
Salesloft OAuth Breach via Drift AI Chat Agent Exposes Salesforce Customer Data
Threat actor UNC6395 exploited compromised OAuth and refresh tokens associated with the Drift AI chat agent, accessible via Salesloft, to gain unauthorized access to Salesforce customer instances. This systematic campaign led to the exfiltration of sensitive data, including AWS access keys, passwords, and Snowflake tokens, from over 700 organizations, indicating a potential supply chain attack.
APIs Credential Exposure
An Insecure Direct Object Reference (IDOR) vulnerability in an exposed API, combined with an unpatched legacy web application and weak credential hygiene, allowed unauthorized access to sensitive applicant personal data. This composite attack vector resulted in a data leak comprising names, emails, and job histories.
Large Language Models (LLMs) OWASP Top 10 for LLM Applications Vulnerability
Evidence indicates that Large Language Models (LLMs) is affected by a security issue.
AI Vulnerabilities Data Exposure
The healthcare sector faces an average data breach cost of $7.42 million, driven by the compromise of patient personal identification information (PII). A notable 16% of these incidents leverage AI for sophisticated phishing and deepfake campaigns, often exacerbated by the organizational vulnerability of "Shadow AI" and insufficient AI governance.
Cost Data Exposure
Rapid AI adoption is creating significant security debt due to neglected foundational cybersecurity, specifically a lack of proper AI access controls and governance policies. This oversight has led to a heightened risk of data compromise, operational disruption of AI-based workloads, and the exposure of intellectual property within AI implementations.
Critical flaw in Microsoft Copilot could have allowed zero-click attack
A critical zero-click vulnerability, dubbed "EchoLeak" and identified as CVE-2025-32711, was discovered in Microsoft Copilot. This flaw leveraged an "LLM scope violation" to allow remote attackers to exfiltrate sensitive data from Microsoft 365 services without any user interaction.
McHire AI hiring tool Default Credentials Vulnerability
Evidence indicates that McHire AI hiring tool is affected by a security issue.
AI Hiring Bot Data Exposure
The McHire AI hiring bot, developed by Paradox.ai, suffered from basic security misconfigurations, specifically allowing unauthorized access via easily guessable weak passwords like '123456'. This critical flaw resulted in the data exposure of personal information, résumés, and contact details for tens of millions of McDonald's job applicants.
AI Risks Prompt Injection Vulnerability
The article highlights critical security risks in AI and LLM deployments, specifically prompt injection and jailbreak attacks, which enable manipulation for unauthorized actions, sensitive data exposure, and compliance failures. These rapid exploits, alongside data leakage and model theft, pose significant financial and reputational impacts on enterprises leveraging AI technologies.
Amazon AWS Prompt Injection Vulnerability
The article highlights critical security gaps in Large Language Model (LLM) applications, detailing common vulnerabilities such as prompt injection, sensitive information disclosure, and supply chain compromises. These flaws, categorized by the OWASP Top 10 for LLM Applications, can lead to unintended LLM behavior, data exposure, and other serious consequences.
DeepSeek Breach Opens Floodgates to Dark Web
The DeepSeek breach reportedly resulted in sensitive data being exposed to the dark web, indicating a significant impact on data confidentiality. The full article content detailing the specific exploit or incident scope was not successfully retrieved due to a Cloudflare security block during the scraping process.
Data Breaches Hit 471M Victims: 2026 Report Breakdown - tech
The Identity Theft Resource Center reported 471.2 million data breach victims in H1 2026, a 58% increase over 2025, driven by surging malicious insiders and AI-scaled phishing attacks. This escalation is facilitated by exploits like the ShieldBreak Microsoft Defender zero-day (CVE-2026-69414) and supply-chain compromises, exemplified by the Trezor customer data exposure via ShipMonk.
Z.ai Unveils GLM-5.3 with Major Enhancements for Coding and Cybersecurity
Z.ai released GLM-5.3, an AI model with significant enhancements for cybersecurity analysis, specifically excelling in white-box vulnerability discovery and exploitation reasoning. The model identified 2,436 vulnerabilities across 269 projects, with 1,097 rated medium to high severity, demonstrating improved performance on benchmarks like CyberGym and ExploitBench.
AI Prompt Injection Vulnerability
Check Point Research details how AI has transitioned from an attack assistant to an autonomous operator, enabling sophisticated malware creation, large-scale social engineering via forged identities, and direct involvement in live intrusions. The report highlights emerging risks including indirect prompt injection, enterprise data leakage through GenAI, and the widespread exploitation of jailbroken commercial AI models by threat actors.
AI Supply-Chain Compromise
The article details the OWASP LLM Top 10, emphasizing indirect prompt injection (IPI) as a critical threat to RAG pipelines due to adversarial instructions embedded in trusted data sources. It outlines architectural mitigations such as privilege separation, instruction hierarchies, output schema enforcement, and document-level RBAC to address data exposure and supply chain risks in LLM deployments.
AI Ecosystem Supply-Chain Compromise
The TrendAI™ State of AI Security Report reveals a 34.6% year-over-year surge in AI-related CVEs in 2025, totaling 2,130, with nearly half classified as high- or critical-severity. These vulnerabilities, concentrated in areas like LLM tools and agentic AI, facilitate impacts such as data exposure, unauthorized access, deepfake-based fraud, AI-generated malware, and supply chain compromises.
Compare Top Prompt Injection Vulnerability
Large Language Models (LLMs) are susceptible to critical security vulnerabilities, exemplified by a chatbot falsely advertising a car. The article highlights the necessity of implementing LLM security tools to mitigate risks such as prompt injection, data leakage, and hallucinations.
AI Prompt Injection Vulnerability
OpenClaw (Moltbot), an LLM agent system, grants unfettered access to user systems and sensitive data, bypassing traditional operating system and browser security protections like sandboxing. The primary security concern is prompt injection attacks, where malicious text can be hidden to seize control of the user's machine, leading to system compromise and data exposure.
AI Prompt Injection Vulnerability
The article details the OWASP Top Ten LLM Security Risks, outlining specific vulnerabilities such as Prompt Injection (LLM01), Training Data Poisoning (LLM03), and Sensitive Information Disclosure (LLM06). These threats can lead to compromised model integrity, unauthorized data exposure, and denial of service, emphasizing the critical need for comprehensive LLM security strategies.
AI Data Exposure
AI security flaws have negatively impacted half of organizations, enabling cybercriminals to execute sophisticated attacks more easily and significantly increasing social engineering tactics like vishing. These vulnerabilities also introduce risks such as sensitive data leaks, accidental PII training, and drastically reduced attacker breakout times within compromised networks.
AI Data Exposure
Kaspersky outlines security risks for developers employing LLM assistants and "vibe coding" methodologies. These concerns primarily involve the potential for insecure code generation, intellectual property leakage through AI interaction, and the introduction of exploitable vulnerabilities into software during development.
ChatGPT Data Exposure
A significant 77% of employees are reportedly leaking sensitive corporate data by pasting it into generative AI tools like ChatGPT, primarily through personal, unmanaged accounts. This widespread "shadow AI" activity circumvents traditional data loss prevention (DLP) systems, resulting in substantial data exfiltration and exposing organizations to severe regulatory and compliance risks.
AI Prompt Injection Vulnerability
The article highlights the critical need for AI security tools to combat escalating threats like adversarial inputs, prompt injection, and LLM jailbreaks. These tools aim to identify and remediate vulnerabilities across the ML pipeline, preventing model manipulation and sensitive data exposure.
Access Controls Data Exposure
IBM's report reveals that 13% of organizations experienced breaches of AI models or applications, primarily due to a critical lack of proper AI access controls and governance. This prevalent oversight exposes highly sensitive data and leaves AI models vulnerable to manipulation, leading to significant data compromise and operational disruptions.
AI Data Exposure
The article highlights significant security vulnerabilities associated with Generative AI (GenAI) applications, including inadvertent sensitive data exposure and new attack vectors like malicious prompts. These issues arise from challenges in monitoring GenAI usage and the absence of clear usage policies, leading to compliance risks and the potential for malware propagation.