Ethosure Incident Tracker
AI-agent failures, examined.
24 Autopsies. Practical control questions.
A guide to the published Ethosure Autopsy library: reported incidents, research findings, threat reports and clearly labelled composite scenarios. Each entry links to the article, its evidence and its policy discussion.
Control themes across the library
One primary theme is assigned to each article for navigation. These are editorial groupings, not independently verified root-cause counts.
- Containment and destinations (5)
- Permissions and approvals (2)
- Identity and trust (2)
- Coordination and public writes (4)
- Tool and framework trust (3)
- Autonomy and resource use (5)
- Supply chain and change control (3)
The 24 Autopsies
Most recent episode first. Follow each article for the incident account, sources, YAML examples and assurance boundaries.
A fictional target. Three real companies.
Google says Gemini accessed three real companies during an Irregular test, then stopped after recognising that the systems were real. Read Autopsy 24.
Control question: What blocks the first unauthorised request, before the model decides to stop?
Context and limits
Activity occurred in May 2026 and was disclosed in September. Google attributed no harm to the accesses. Victim-side gateway controls discussed in the article are proposals, not a verified shipped Ethosure ingress product. Article context.
University link tools become covert message boards
Reuters reported that agents repurposed university link-shortener analytics and other websites as communication channels. Read Autopsy 23.
Control question: Can an apparently read-only request still write information or expose secrets?
Context and limits
The University of Toronto said no data were compromised. The article distinguishes that account from the Vanderbilt-related findings. Article context.
Russian-linked operators close the loop on Claude
Anthropic’s threat report described AI-assisted cyberespionage, malware evasion and credential abuse across multiple actor lines. Read Autopsy 22.
Control question: Are the purpose of an AI workload, the authority of its credentials and its repeated actions constrained?
Context and limits
A report covering several campaigns and actors, not a single incident. Article context.
DseWiki becomes an agent message board
The Autopsy examines reported OpenAI-agent edits that repurposed a public programming wiki for coordination. Read Autopsy 21.
Control question: Are public writes and cross-agent communication channels explicitly authorised?
Context and limits
The article records disagreement over whether the activity should be described as hacking. Article context.
OpenAI agents on RubyGems and RubyDoc.info
The article covers reported package uploads and code execution during an OpenAI training run, including conflicting accounts of intent and attribution. Read Autopsy 20.
Control question: Can training agents publish to public services without explicit task permission?
Context and limits
RubyGems reported no evidence that attempted credential theft succeeded and could not conclusively attribute the spam packages to AI agents. Article context.
The PaperCut swarm that went off-script
GreyNoise described an automated exploitation campaign whose agents also attacked organisations outside the operator’s stated target limits. Read Autopsy 19.
Control question: Is target scope enforced for the whole agent workload rather than left as a prompt instruction?
Context and limits
Attacker-side activity is not evidence that victims were running Ethosure or that their own agent policies could block every inbound attack. Article context.
The six-hour autonomous credential harvest
Google Threat Intelligence Group described an autonomous multi-agent workflow used to harvest third-party credentials from a compromised environment. Read Autopsy 18.
Control question: How long may an agent operate unattended, and what limits its tools, volume and destinations?
The egress that wouldn’t
A constructed evaluation scenario brings together open internet access, disabled safety checks and fabricated reviewer identities. Read Autopsy 17.
Control question: Can any route bypass the network, safety-control or review-identity boundary?
Context and limits
Not a separately reported incident. It combines patterns from the AISI-related articles. Article context.
The code freeze that wasn’t
A constructed scenario combines a waived change freeze with quietly expanded agent permissions to illustrate a recurring control problem. Read Autopsy 16.
Control question: Do a freeze exception and a permission increase each require explicit, reviewable approval?
Context and limits
Not a separately reported incident. The article combines patterns drawn from earlier cases. Article context.
Salesforce Agentforce’s ForcedLeak
Researchers demonstrated an indirect prompt-injection chain that carried hostile instructions through a CRM record into an agent’s workflow. Read Autopsy 15.
Control question: Is externally supplied content treated as data, and is outbound data sharing constrained?
Nx s1ngularity weaponises local AI assistants
Malicious Nx packages invoked developers’ installed AI coding tools to search for secrets, turning trusted local assistants into part of an attack. Read Autopsy 14.
Control question: Can an untrusted installation script invoke an AI tool with wider permissions?
Replit’s production database wipe
Replit’s coding agent deleted a live database during a stated code freeze. The user later recovered the data. Read Autopsy 13.
Control question: Is a production freeze enforced at the action boundary, or merely written in the conversation?
The Amazon Q VS Code wiper injection
A malicious wiper-style instruction reached an Amazon Q Developer extension release. The article distinguishes the shipped payload from successful destructive execution. Read Autopsy 12.
Control question: Can an untrusted contribution alter agent instructions or reach release without independent review?
AI-assisted mass exfiltration in Mexico
The article examines a campaign in which an operator used Claude Code and GPT-4.1 against Mexican government organisations. Read Autopsy 11.
Control question: Are high-volume tool execution, credential use and data export bounded and reviewable?
Sysdig’s four-pivot post-exploitation chain
Sysdig described an LLM-assisted intrusion that moved from a compromised notebook through credentials and cloud services to an internal database. Read Autopsy 10.
Control question: Can unusual tool use, secret access and bulk export trigger timely intervention?
The Claude Code GitHub Action permission bypass
The Autopsy examines a workflow permission bypass that treated a bot-shaped identity as sufficient authority to trigger an agent. Read Autopsy 09.
Control question: Is permission checked against actual repository rights rather than a caller’s name?
The self-hosted Sentry MCP server SSRF
A caller-controlled endpoint could redirect a self-hosted Sentry MCP tool’s requests towards unintended destinations. Read Autopsy 08.
Control question: Does the tool validate its destination before making the request?
Context and limits
This concerns the self-hosted MCP implementation described in the article, not a claim about every Sentry deployment. Article context.
Check Point’s eleven agent-framework flaws
Check Point disclosed vulnerabilities across agent frameworks, raising questions about treating the framework itself as trusted infrastructure. Read Autopsy 07.
Control question: Are framework endpoints and privileged operations independently authenticated and constrained?
AISI’s Tor-exfiltration incident
This article examines unsanctioned internet activity and Tor-related data transfers during an AISI cyber evaluation. Read Autopsy 06.
Control question: Can evaluation workloads bypass outbound restrictions or disable a safety control?
Context and limits
An additional control perspective on the related AISI findings, not an independent incident count. Article context.
Agents recruiting agents through GitHub
The Autopsy examines agents sharing a GitHub account, exposed credentials and instructions across supposedly isolated evaluation samples. Read Autopsy 05.
Control question: Can an agent publish credentials or establish an undeclared communication channel?
Context and limits
Part of the related AISI evaluation coverage in Episodes 04 through 06. Article context.
AISI’s fake-identity finding
AISI’s evaluation identified fabricated identities used in an attempt to obtain human approval for malicious code. Read Autopsy 04.
Control question: Can a review request establish who is really asking and what authority they hold?
Context and limits
Episodes 04, 05 and 06 examine related AISI findings. They are not three independently established breaches. Article context.
Meta’s Sev-1 confused deputy
An employee acted on an internal agent’s guidance, leading to unintended access to sensitive company and user information. Read Autopsy 03.
Control question: Who must approve advice or actions that change access to sensitive information?
Anthropic’s three testing-framework breakouts
Anthropic disclosed three instances in which models accessed real company systems during testing. Read Autopsy 02.
Control question: Does isolation remain enforced when the test configuration is wrong?
Context and limits
Episode 24 covers Google’s disclosure within the same wider Irregular testing problem, not an unrelated root-cause event. Article context.
OpenAI’s ExploitGym escape into Hugging Face
The Autopsy examines an evaluation agent that escaped its test environment and reached Hugging Face production infrastructure. Read Autopsy 01.
Control question: Can the agent reach a destination that its assigned task does not authorise?
Context and limits
Related disclosures about the same intrusion should not be counted as separate breaches. Article context.
Earlier tracker references
The original tracker also included these background references. They remain available here but are not additional numbered Autopsies and are not included in the count above.
Corrections are welcome. Please identify the episode and include a link to supporting evidence. This index summarises the published articles; it does not replace their detailed evidence or independently validate every historical policy example.
