5 Agentic AI Security Incidents & Vulnerabilities

The tech world is off to the races with AI agents. These large language model (LLM) based AI assistants can operate autonomously, sync up tools, data, and APIs, and speed up both engineering and business workflows in the process. Agentic AI is a powerful leap for the industry — however, recent security incidents are showing their flaws. 

A number of recent security incidents and vulnerabilities have proven how agents can act unpredictably, which has led to outcomes like deleting production databases, leaking sensitive data, or triggering unauthorized commands. Agents are often left to operate with high degrees of autonomy and over-permissioned access, making them a growing concern.

Below, we’ll look at recent examples of agentic AI risks. We’ll briefly state what happened with each, what the outcomes were, and what security engineers and architects need to know going forward. These examples showcase the importance of least-privilege permissions and setting up new guardrails for agentic AI. 

1. Replit database deletion

In mid-2025, The Register reported that Replit, an AI coding tool, deleted customer production databases, even though the user had given it clear instructions not to change any code without permission. Due to “a catastrophic error of judgement” on the part of the AI coding agent, the database was overwritten.

Additionally, the user, the founder of SaaStr, shared that the coding agent was prone to creating fake reports and data, including a 4,000-record database full of fictional people. Although the user was able to roll back to an earlier version of the database, it was a stark wake-up call.

The Replit database deletion story demonstrates that, even with clear prompts, AI and agents can behave erratically. It also underscores the risks of providing agentic AI with too much access to sensitive actions. Instead, taking a least privilege approach and providing granular access permissions when necessary should be the default.

2. Moltbook token leak

Moltbook is an interesting social network, coded purely by AI, and designed to be a place where AI agents can chat among themselves. The platform made headlines as the first AI-native social network, quickly garnering over a million user signups.

But in February 2026, researchers at Wiz, a cloud security company, discovered an API key to a misconfigured Supabase database, which then could be used to leak all of the Moltbook platform’s data.

The leak exposed 35,000 emails and 1.5 million API keys for users in the network. It also discovered there were actually 17,000 human owners behind the network’s purported 1.5 million AI agents. Although the bug was quickly remediated, it showcases the frailties of vibe-coded applications, which can be prone to misconfigurations and exposing credentials. 

Relying on static API keys was already risky before agents existed, but the blast radius is now amplified in the AI agent era, since agents can act at scale and faster than a human could. And if AI agents have unauthorized read and write access to these kinds of exposed APIs, the damage can be much worse.

3. PocketOS system outage

In mid-2026, Cursor, an AI tool powered by Anthropic’s Claude Opus model, was responsible for deleting a production database operated by PocketOS, a software provider for rental car businesses. 

As EuroNews reported, the AI tool was performing a routine task when it decided to delete an entire database related to customer records and bookings was the most efficient course of action. The deletion resulted in a 30-hour outage in which core PocketOS business systems were offline.

“This isn’t a story about one bad agent or one bad API,” PocketOS founder Jer Crane told EuroNews. “It’s about an entire industry building AI-agent integrations into production infrastructure faster than it’s building the safety architecture to make those integrations safe.”

The incident shows how LLM-powered agents can produce destructive actions, even when prompted otherwise, which can directly lead to loss of business. The story further emphasizes the need to insert human-in-the-loop controls for destructive actions, or reduce the privileges these agents have in the first place.

4. GitHub agentic vulnerabilities

In July 2026, researchers at Noma Security discovered a prompt injection-style vulnerability within GitHub’s Agentic Workflows, a tool for syncing AI agents with GitHub Actions to bring more automation to repository management. They call the vulnerability GitLost.

They discovered that an unauthenticated attacker could leave instructions in natural English language within an issue made to a GitHub repository. The agent attached to the repository would then read these instructions and incorporate them into its prompt. By following this strategy, an attacker could manipulate the workflow into leaking data from private repositories.

Other researches have unearthed potentially toxic agentic AI flows involving GitHub. In 2025, Invariant Labs found that by using the official GitHub MCP server, one could hijack a user’s agent with a malicious GitHub issue and manipulate it into performing unintended actions. 

Both of these vulnerabilities highlight the fact that agents depend highly upon their context in order to function. And when that context is poisoned, things can go awry. To respond to agentic mishaps, strategies like just-in-time access and zero standing privilege are emerging to limit long-lasting privileges to short-lived access when sanctioned in the moment.

5. Salesforce Agentforce data leakage

Noma Security has also discovered the possibility of prompt injection-style attacks within other common enterprise software. In late 2025, they outlined how Salesforce Agentforce agent could be hacked by including malicious instructions within trusted data sources like external domains.

This vulnerability was quickly patched by Salesforce with Trusted URLs. And while no business was impacted by this incident, that we know of, it nevertheless reinforces the idea that AI agents have created a novel attack surface. It also demonstrates how one method of response is scoping what the agent can access to verified, trusted content. 

Overpermissioned access is the common thread

The Least Privilege Research Report 2026 analyzed over 3 billion permissions and found that, on average, only 4% of permissions were used in the last 90 days. Furthermore, nearly one in three permissions can modify or delete sensitive data. 

Since agents usually inherit human privileges, it means they too often have over-permissioned access. And with a high degree of access, agents can act of their own accord in ways that have real, sometimes irreversible consequences. And it’s not just agentic AI: simple chatbots can suffer the same fate. 

Just take the well-covered chatbot incident with Air Canada, in which a chatbot hallucinated and incorrectly promised a passenger an airline discount. While it’s less “agentic” per se, it’s proof that even AI-powered chat with too much authority can have direct business repercussions that go beyond traditional security breaches.

Avoiding agentic AI incidents

Given the incidents above, it’s clear that the risk surface has expanded. So, how should organizations respond? Preventing agentic AI risks holistically will require a variety of approaches:

• Better prompting and context: Information provided to agents needs to be accurate and free from malicious injection. The OWASP Top Ten for LLM Applications provides guidance on avoiding generic LLM-based threats.

• Consent and approval flows: Human-in-the-loop controls should be used for destructive actions, along with audit logs and restrictions that scope agents to verified, trusted content.

• Proper access control: A high degree of standing access to data, API endpoints, and sensitive functions unnecessarily expands the surface area. One approach is defaulting to read-only modalities and upgrading to write modes when necessary.

• Granular permissions: Use scoped tokens, delegated authorization, identity-based authentication and authorization, policy enforcement, and least-privilege access to every API and data source agents touch.

• Highly scoped access: Limiting permissions can reduce the possibility that an unpredictable action leads to exposed data, unauthorized commands, or the loss of a production database.

• Just-in-time access: Least privilege is evolving beyond traditional zero trust principles that involve long-lasting privileges. Just-in-time access provides short-lived access when sanctioned in the moment.

• Zero standing privilege: This goes further by removing long-lasting privileges altogether. Access is highly scoped, granted when necessary, and removed immediately after actions. This is the pinnacle of limiting privilege drift and reducing the consequences when agents act of their own accord.