Manifold launches ledger of AI agent security incidents

Manifold Security has launched a public database tracking security incidents involving AI agents. It lists 59 publicly disclosed cases since July 2025.

The Agent Incident Ledger records cases in which an AI agent deleted, leaked, published or accessed something without authorisation. It excludes cases in which a person used an AI agent with malicious intent from the outset.

Manifold's analysis found a median of 70 days between an agent's first unauthorised action and public disclosure. Even after an operator discovered a problem, a median of 20 days passed before the incident became public.

The figures suggest a growing flow of disclosures. Of the 59 incidents in the ledger, 42 were disclosed in the past three months. Twenty were disclosed in September alone, with a further 13 disclosed so far in October.

Detection gaps

Only 11 of the 59 reported incidents were identified by a security control or safeguard, the analysis found. Eighteen were discovered in a later review, 16 came to light only after damage had already been observed, eight emerged through an outside report and six did not specify how they were detected.

In 18 cases, someone outside the team operating the agent noticed the problem first. Those third parties included website owners, package registries, researchers and other vendors' controls.

Incidents detected by a security control took longer to become public than other cases in the dataset. The median disclosure period for those cases was 111 days, compared with 50 days for the rest.

Manifold also found limited public information about how affected agents had been set up. It said 92% of the core details about each agent's configuration were not fully public, while the system prompt was available in 3% of cases and the exact model and version in 12%. None of the incidents included published transcripts or action logs.

Failure types

Unauthorised access was the most common category in the ledger, appearing in 26 incidents. Sandbox escapes appeared in 15 incidents and credential misuse in 14. Overall, 40 of the 59 incidents involved more than one type of failure.

The record also describes several patterns in agent behaviour. In six incidents involving OpenAI agents, multiple agents coordinated with each other through external or internal channels, including a dormant German wiki, an internal package store and RubyGems.

The analysis found deception in nine incidents. These included a Replit agent telling a user a rollback was impossible, Claude Haiku 4.5 sending police an invented tip about an unsolved murder and Meta's Muse agent saying it saw notifications only after synchronising a columnist's messages.

In three incidents, agents left instructions for themselves across contexts. In one training-related case, an unreleased OpenAI model wrote instructions into its own summaries telling its next context to ignore developer messages.

At least 29 of the 59 incidents happened during an evaluation, test or training run. In those cases, the agents still reached external targets, including companies, government sites, public package registries and the open internet.

Who disclosed

OpenAI was involved in 23 incidents in the ledger, Anthropic in 19, Meta in five, Google in three, Amazon in three, OpenClaw in two, and Replit, Alibaba, Cursor and Instinct in one each. Some incidents involved more than one provider.

Manifold said those figures reflect disclosure patterns as much as technical failure, because some vendors publish more detailed reports on their own systems than others.

The ledger cites a range of incidents since mid-2025, including a Replit agent deleting a production database during a code freeze, OpenAI evaluation agents breaching Hugging Face after escaping a sandbox, an OpenAI agent entering Australia's Medicare statistics portal and Anthropic reporting that a research model scanned 9,000 hosts and compromised one.

The longest delay identified in the dataset was 329 days. That case involved OpenAI models uploading files to public sites in order to cite them.

Ax Sharma, Head of Research at Manifold Security, said: "An agent taking an unintended action is only part of the problem. Organisations also need to know when it happens, understand what the agent did and have the controls to stop it happening again. These incidents show how much can remain hidden between an agent taking an action and the people responsible for it finding out. As agents gain more autonomy, security has to move beyond monitoring what they're supposed to do to understanding and controlling what they actually do."