OWASP LLM Top 10: ASI Agentic Exploits Incidents

# ASI Agentic Exploits & Incidents Tracker

The ASI Exploits and Incidents initiative seeks to inform and establish the **OWASP Top 10 for Agentic Applications** by referencing real-world incidents and exploits.  
This will augment, but not supersede, existing vulnerability reporting within the **GenAI Security project**.  
Similarly, any aspects concerning incident
response should be discussed with the **CTI initiative** responsible for publishing the incident response guide.

## Guidelines
- Must **NOT** repeat other vendors but reference their work.  
- Must analyse incidents with **agentic threats in mind** — not just LLM classifications like *data leaks* and *prompt injection*.  
- Must focus on **agentic applications** (as defined in the ASI Threats & Mitigations) and distinguish them from *simple chatbots*.  

**Lead:** Ron F. Del Rosario  
**Maintainer:** Almog Langleben

---

## Exploits & Incidents Table

| Date | Exploit / Incident | Impact Summary | ASI T&M Mapping | Links to further analysis<br>(Vendor / CVE / Discoverer) |
|------------|------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------|---------------------------|
|**Dec 2025**| **Claude Skills Ransomware Deployment** | Cato Networks demonstrated that Claude's "Skills" plugin feature could deploy MedusaLocker ransomware by downloading, modifying, and re-uploading Skills with malicious code that executes autonomously. | • ASI04 (Agentic Supply Chain Vulnerabilities)<br> • ASI05 (Unexpected Code Execution (RCE)) | • —<br> • —<br> • [Cato CTRL](https://www.catonetworks.com/blog/cato-ctrl-weaponizing-claude-skills-with-medusalocker/) |
|**Dec 2025**| **Google Antigravity AI Data Wipe** | AI-powered IDE misinterpreted a cache-clearing instruction and issued a system-level delete command with quiet flag, wiping a developer's entire D: drive without confirmation, causing irreversible data loss. | • ASI02 (Tool Misuse & Exploitation)<br> • ASI05 (Unexpected Code Execution (RCE)) | • [Reddit](https://www.reddit.com/r/google_antigravity/comments/1p82or6/google_antigravity_just_deleted_the_contents_of/)<br> • —<br> • — |
|**Nov 2025**| **Cursorignore Bypass via New Cursorignore Write** | A logic flaw allows a malicious agent to read sensitive files protected by cursorignore by creating a new cursorignore file that invalidates existing configurations. | • ASI02 (Tool Misuse & Exploitation)<br> • ASI05 (Unexpected Code Execution (RCE)) | • [Cursor](https://github.com/cursor/cursor/security/advisories/GHSA-vhc2-fjv4-wqch)<br> • [NVD](https://nvd.nist.gov/vuln/detail/CVE-2025-64110)<br> • — |
|**Nov 2025**| **GitHub Copilot Multi-Root Workspace RCE** | Agent exploits multi-root workspace settings to bypass protections and achieve RCE. | • ASI05 (Unexpected Code Execution (RCE))<br> • ASI02 (Tool Misuse & Exploitation) | • [Microsoft](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-64660)<br> • [NVD](https://nvd.nist.gov/vuln/detail/CVE-2025-64660)<br> • [MaccariTA](https://maccarita.com/posts/idesaster/) |
|**Nov 2025**| **ShadowRay 2.0 Botnet** | Attackers exploited an unpatched flaw in Ray AI framework to create a self-spreading crypto-mining botnet, using the agentic job submission API to propagate malware across clusters. | • ASI05 (Unexpected Code Execution (RCE))<br> • ASI01 (Agent Goal Hijack) | • —<br> • [NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-48022)<br> • [Oligo Security](https://www.oligo.security/blog/shadowray-2-0-attackers-turn-ai-against-itself-in-global-campaign-that-hijacks-ai-into-self-propagating-botnet) |
|**Nov 2025**| **ShadowMQ Vulnerabilities** | Critical RCE in AI inference servers (Meta, NVIDIA, vLLM) due to unsafe ZeroMQ pickle deserialization propagated via code reuse, allowing cluster takeover and data exfiltration. | • ASI05 (Unexpected Code Execution (RCE))<br> • ASI04 (Agentic Supply Chain Vulnerabilities) | • —<br> • [NVD](https://nvd.nist.gov/vuln/detail/CVE-2024-50050)<br> • [Oligo Security](https://www.oligo.security/blog/shadowmq-how-code-reuse-spread-critical-vulnerabilities-across-the-ai-ecosystem) |
|**Nov 2025**| **Claude Desktop PromptJacking RCE** | Critical RCE in official Claude Desktop extensions (Chrome, iMessage, Apple Notes) allowed malicious websites to execute arbitrary code via unsanitized command injection. | • ASI05 (Unexpected Code Execution (RCE))<br> • ASI01 (Agent Goal Hijack) | • —<br> • —<br> • [Koi Security](https://www.koi.ai/blog/promptjacking-the-critical-rce-in-claude-desktop-that-turn-questions-into-exploits) |
|**Nov 2025**| **Google Antigravity IDE Vulnerabilities** | RCE via indirect prompt injection and hidden instructions (Unicode tags). Data exfiltration via tool abuse (read_url_content) without Human-in-the-Loop. | • ASI01 (Agent Goal Hijack)<br> • ASI02 (Tool Misuse & Exploitation)<br> • ASI05 (Unexpected Code Execution (RCE))<br> • ASI09 (Human-Agent Trust Exploitation) | • [Google Bug Hunters](https://bughunters.google.com/learn/invalid-reports/google-products/[PII_REDACTED]/antigravity-known-issues#code-execution)<br> • —<br> • [Embrace The Red](https://embracethered.com/blog/posts/2025/security-keeps-google-antigravity-grounded/) |
|**Nov 2025**| **Claude Hijacked for State-Sponsored Cyberattack** | A Chinese state-sponsored threat actor hijacked a jailbroken Claude instance to autonomously execute cyberattacks against approximately 30 global entities. The agent performed 80-90% of tasks independently including reconnaissance, vulnerability scanning, exploitation, and data exfiltration. | • ASI01 (Agent Goal Hijack)<br> • ASI03 (Identity & Privilege Abuse)<br> • ASI10 (Rogue Agents) | • [Anthropic](https://www.anthropic.com/news/disrupting-AI-espionage)<br> • —<br> • — |
|**Nov 2025**| **Perplexity Agentic Shopping Tool Unauthorized Access** | Amazon filed lawsuit against Perplexity AI alleging its agentic shopping tool accessed private Amazon customer accounts without permission, masked automated activity as human behavior, and undermined account security through its Comet browser agent. | • ASI02 (Tool Misuse & Exploitation)<br> • ASI03 (Identity & Privilege Abuse)<br> • ASI09 (Human-Agent Trust Exploitation) | • [Perplexity](https://www.perplexity.ai/hub/blog/bullying-is-not-innovation)<br> • —<br> • — |
|**Nov 2025**| **Claude Skills Data Exfiltration** | Researchers demonstrated using Claude's "Skills" feature to perform indirect prompt injection attacks, weaponizing the Claude Files API to exfiltrate sensitive data through malicious skills. | • ASI01 (Agent Goal Hijack)<br> • ASI02 (Tool Misuse & Exploitation)<br> • ASI04 (Agentic Suppl