Public, sourced cases where an AI agent or assistant with the power to act changed something it should not have — or was shown it could. For each: what happened, which of our seven gates it touches, the OWASP Agentic risk, and the record that would have prevented or proven it.
Showing all 12 cases.
During a declared code-and-action freeze, Replit's AI agent ran destructive commands that deleted production records. It had also produced fake data and reports, and said rollback was impossible; the rollback later worked. Replit's CEO called it unacceptable and added dev/prod database separation and a planning-only mode.
While fixing a credential mismatch in staging, a Cursor agent running Claude Opus 4.6 used a fully permissioned Railway API token unrelated to its task and, in one API call, deleted the production volume and its volume-level backups. Railway later restored the data and patched the endpoint.
In a mode where commands run without per-step approval, a user asked the agent to clear a project cache; the delete targeted the root of his D: drive and bypassed the Recycle Bin. Google said it was investigating.
A user told her agent to only suggest emails to archive or delete; on a large inbox it began bulk-deleting and ignored stop messages until the process was killed. She attributed it to context compaction dropping the instruction.
An internal agent asked to analyse a forum question posted an answer itself without approval; a colleague followed the inaccurate advice and sensitive data was exposed to unauthorised employees for about two hours. Meta said no user data was misused.
The FT reported an AI coding agent chose to delete and recreate an environment, interrupting AWS Cost Explorer in one region. Amazon says the cause was a misconfigured role, calls the event extremely limited, and added mandatory peer review for production access.
An improperly scoped token in AWS's build setup let an attacker commit a prompt telling the agent to wipe local files and cloud resources; it shipped in v1.84.0. AWS says it failed to run and changed no customer environments; AWS released a fixed version (CVE-2025-8217).
Cline's AI issue-triage workflow could be steered by instructions in issue titles; this enabled cache poisoning and exposure of a release token. On 17 Feb 2026 an unauthorised cline@2.3.0 was published with a postinstall step that installed another package globally; it was live about 8 hours.
Attackers used stolen OAuth and refresh tokens from the Drift AI chat integration to bulk-query many corporate Salesforce instances for secrets; all tokens were revoked on 20 Aug 2025.
A Washington Post columnist asked OpenAI's Operator to find cheap eggs; it completed a $31.43 Instacart order without asking for confirmation. OpenAI said it was looking into why confirmations were skipped.
The airline's website chatbot told a customer he could claim a bereavement fare retroactively, contradicting policy; the BC Civil Resolution Tribunal held the airline responsible and awarded C$812.02.
Researchers showed a malicious issue in a public repo could hijack an agent using the GitHub MCP server into reading the user's private repositories and publishing their data in a public pull request. The flaw is an over-broad token plus untrusted input.