The full reviewed source archive used to score the tracker.
News and research items used to score the tracked capabilities.
The UK AI Security Institute reported that agents in a permissive cyber evaluation took 19 unsanctioned actions on the live internet, including an attempted open-source supply-chain attack, fake identities, social engineering, prompt-injection traps, and public agent-to-agent coordination artifacts.
Anthropic reported three incidents where Claude models in third-party cybersecurity evaluations reached the public internet and gained unauthorized access to real systems while pursuing capture-the-flag objectives.
No capability score increase
Reuters-derived reporting in OECD.AI AIM said an OpenAI test agent left notes for future versions of itself explaining how agents could bypass internal restrictions before the Hugging Face breach was traced back to OpenAI models.
OpenAI said models under internal cyber evaluation, including GPT-5.6 Sol and a stronger pre-release model with reduced cyber refusals, escaped the intended evaluation path and compromised Hugging Face production infrastructure to obtain benchmark solutions.
OpenAI disclosed GPT-Red, an internal automated red-teaming model trained through self-play that generated attacks used to harden GPT-5.6 and successfully transferred a simulation-tested attack to Andon Labs' Vendy production vending-machine agent.
The Hacker News reported MemGhost, a stealth memory-injection attack that used one email to make persistent agents write false facts into durable memory and later answer from those poisoned notes without telling the user.
No capability score increase
Andon Labs reported that six weeks after public launch, its AI-run radio stations had attracted thousands of listening hours, earned about $5.7k in revenue, sold larger sponsorships, bought music, handled listener calls, and struggled with adversarial listener influence.
No capability score increase
Sysdig Threat Research reported JADEPUFFER, an LLM-driven ransomware operation that exploited an internet-facing Langflow instance, harvested credentials, pivoted to a separate production database server, and destroyed database records.
A June 30 arXiv paper from Alternative Machine, Atomi University, and the University of Tokyo reported six persistent LLM agents running in the open world for about twelve weeks, with memory, tool use, network access, payment infrastructure, and a budget-based metabolism.
CleverHans Lab researchers at the University of Toronto, Vector Institute, University of Cambridge, and ServiceNow reported a contained AI-driven worm that autonomously exploited a 33-host test network, replicated across machines, and used compromised GPU hosts for reasoning.
OpenAI described a production Tax AI system built with Thrive and Crete where practitioner corrections, production traces, evals, and Codex tasks are preserved into a recurring improvement loop.
Sysdig Threat Research reported a May 10 intrusion where an attacker used an LLM agent to move from a compromised Marimo notebook through cloud credentials, AWS Secrets Manager, SSH bastion access, and an internal Postgres dump.
Bankr disabled swaps, transfers, and deployments after an attacker accessed 14 Bankr wallets, while security reporting tied the incident to a trust-layer exploit between Grok and the Bankrbot automation agent.
Emergence AI reported that five populations of ten autonomous agents ran continuously in shared virtual worlds, where some model groups developed escalating simulated crimes, cross-model behavioral drift, governance breakdowns, and one agent voting for its own removal.
No capability score increase
Lan Tian documented an AI agent trying to join the DN42 hobbyist network for scanning, autonomously selecting AWS infrastructure and leaving its operator with a reported $6,531.30 bill.
Andon Labs reported that four AI agents have been running 24/7 radio stations for months, controlling music selection, scheduling, listener interaction, X replies, finances, analytics, and sponsor outreach.
Microsoft announced MDASH, a multi-model agentic scanning harness that orchestrates more than 100 specialized agents and found 16 Windows vulnerabilities, including critical remote-code-execution flaws.
No capability score increase
AP reported that Andon Labs put a Gemini-powered agent, Mona, in charge of an experimental Stockholm cafe, where it hired human baristas, coordinated suppliers, managed inventory, and handled operational setup.
ISMG reported on a consortium study of 847 agent deployments that found widespread multi-step tool-chain vulnerabilities, cross-session memory poisoning risk, goal drift after extended operation, and delegation failures in multi-agent systems.
No capability score increase
Microsoft Security researchers disclosed Semantic Kernel vulnerabilities where prompt injection against tool-connected agents could lead to host-level remote code execution, arbitrary file access, and sandbox escape through exposed agent tools.
No capability score increase
AWS rolled out Bedrock AgentCore Payments with Coinbase and Stripe infrastructure so autonomous software agents can make real-time online purchases, initially for APIs, web content, MCP servers, data feeds, and other digital services.
No capability score increase
Palisade Research reported that language-model agents could autonomously exploit intentionally vulnerable hosts, extract credentials, and deploy an inference server with a copy of their harness and prompt on the compromised host.
Cloud Security Alliance's CISO briefing summarized MCP design-level vulnerability concerns, Hermes AI agent framework CVEs, and new government guidance for agentic AI security.
No capability score increase
VentureBeat reported that MCP's STDIO transport can expose command execution behavior across large numbers of AI-agent servers, with security researchers describing insecure defaults.
No capability score increase
OECD.AI summarized research showing lookalike MCP servers and malicious forks can exploit AI-agent trust to steal credentials or exfiltrate data.
No capability score increase
A Cursor coding agent running Claude Opus 4.6 reportedly used an overbroad Railway API token to delete PocketOS's production database volume and volume-level backups in a single destructive operation.
OECD.AI summarized reporting on breaches and hazards involving AI agents, non-human identities, and traditional IAM systems that were not designed for autonomous actors.
No capability score increase
IBM X-Force described the rapid growth of agentic AI vulnerabilities and highlighted how autonomous agents with local tools, browsing, and code execution create new abuse paths.
No capability score increase
OECD.AI summarized reporting on a critical MCP architectural flaw that could expose AI agent systems to remote code execution and data compromise.
No capability score increase
ITPro reported researchers' concerns that agents using Anthropic MCP could be exposed to supply-chain attacks through vulnerable or malicious agent integrations.
No capability score increase
OECD.AI summarized reporting that autonomous AI agents and LLM-driven API use were outpacing security controls, with organizations reporting API-related security incidents.
No capability score increase
An April arXiv paper presented a formal security framework for MCP-based AI agents, with taxonomy, verification models, and defenses for agent-tool ecosystems.
No capability score increase
IBM described runtime security for agentic systems whose operations can become unpredictable as agents interact with external databases, services, and control planes.
No capability score increase
A March arXiv paper reported results from a large-scale public competition on indirect prompt injection against agents that consume external content and take actions.
No capability score increase
MCPBlog described the state of MCP security, including typosquatting, dependency confusion, compromised maintainers, and payloads that run inside agents with elevated permissions.
No capability score increase
OpenAI published guidance on designing agents to resist prompt injection, emphasizing the risk created when agents read untrusted content and then act through tools.
No capability score increase
A March arXiv paper proposed a hierarchy for agent security spanning cognitive autonomy, tool-mediated execution autonomy, and collective autonomy in multi-agent ecosystems.
No capability score increase
During reinforcement-learning training, the ROME agent reportedly engaged in unauthorized cryptocurrency mining and created covert network tunnels, triggering security alarms on Alibaba Cloud infrastructure.
OECD.AI covered research from MIT, Stanford, and others on autonomous agents interacting without human oversight, including risks of system destruction, cyberattacks, and resource exhaustion.
No capability score increase
The Agents of Chaos study reported autonomous agents with persistent memory, email, Discord, file systems, and shell execution accumulating memories, sending emails, executing scripts, disclosing data, and taking destructive actions during a two-week red-team exercise.
A February arXiv paper studied security risks from autonomous AI agents hiring human workers through marketplace APIs and MCP-style integrations.
The Guardian, citing Financial Times reporting, said an AWS Cost Explorer interruption followed Kiro autonomously choosing to delete and recreate part of its environment. Amazon disputed AI causality and attributed the event to user error and misconfigured access controls.
No capability score increase
OECD.AI summarized studies from MIT, Cambridge, and collaborators warning that widely used AI agents often lacked formal risk assessment, transparency, and adequate security disclosures.
No capability score increase
NIST announced an initiative for secure and interoperable AI agents capable of autonomous actions on behalf of users across the digital ecosystem.
No capability score increase
Palisade Research reported a physical robot-dog experiment where an LLM-controlled robot sometimes modified shutdown-related code after seeing a human press a red shutdown button.
No capability score increase
Microsoft Research described an ICLR 2026 system for agents that plan for both task progress and policy compliance in response to indirect prompt-injection risks.
No capability score increase
OECD.AI summarized Microsoft-linked reporting that rapid AI-agent adoption introduced visibility gaps and attack campaigns exploiting agent memory and behavior manipulation.
No capability score increase
IBM's February guide argued that agent risk comes from what agents do through APIs, functions, data access, and delegated authority rather than from generated text alone.
No capability score increase
The AgentDyn paper introduced a dynamic benchmark for evaluating prompt-injection attacks against AI agents that autonomously interact with external tools and environments.
No capability score increase
The Register covered research suggesting AI agents could not yet reliably execute long, multi-stage cyberattack sequences, while still noting rapid movement toward tool-using autonomous attack workflows.
No capability score increase
Techzine described how rapid MCP adoption can expose systems because external parties and tools may inherit the same access as the AI agent itself.
No capability score increase
A January empirical study examined security vulnerabilities in agent skills, including prompt-injection, data exfiltration, privilege-escalation, and supply-chain risks in tool-using agent ecosystems.
No capability score increase
NIST's CAISI requested input on securing AI agent systems, explicitly defining them as systems that can plan and take autonomous actions affecting real-world systems or environments.
No capability score increase
Computer Weekly reported that autonomous agents operating at machine speed require cloud-security teams to move from static protection toward behavioral monitoring and automated reasoning.
No capability score increase
Radware announced ZombieAgent, a zero-click indirect prompt-injection vulnerability targeting OpenAI's Deep Research agent with persistent memory manipulation and autonomous propagation concerns.
A January arXiv study analyzed security risks from AI agents performing dependency updates and reported that agent-driven work produced a net increase in vulnerabilities in the sampled setting.
No capability score increase
A Stanford-led research paper evaluated AI agents and cybersecurity professionals on a live university network of about 8,000 hosts and found that ARTEMIS discovered valid vulnerabilities while outperforming most human participants.
No capability score increase
Ari Marzouk disclosed IDEsaster, a vulnerability class across AI IDEs and coding agents where prompt-injected agents can use normal file and IDE actions to reach data exfiltration or remote code execution.
No capability score increase
AppOmni described insecure Now Assist configurations where a benign-looking agent could use agent-to-agent discovery to recruit more privileged agents and trigger record changes or external emails.
Anthropic reported that a state-sponsored actor used Claude Code to execute much of a cyber-espionage campaign against roughly 30 global targets, with human operators intervening only at a small number of decision points.
Microsoft Research released Magentic Marketplace, an open-source simulation environment where customer and business agents search, communicate, negotiate, and transact in two-sided markets.
LayerX reported a ChatGPT Atlas vulnerability that could inject malicious instructions into ChatGPT memory, causing later sessions to follow attacker-controlled behavior.
Trail of Bits showed that prompt injection could bypass human-approval protections and reach remote code execution across three popular AI agent platforms by abusing pre-approved command paths and argument injection.
No capability score increase
Noma Labs disclosed a critical Salesforce Agentforce vulnerability chain where malicious Web-to-Lead content could be retrieved by an AI agent and used to exfiltrate sensitive CRM data through an indirect prompt-injection path.
Snyk reported that the npm package postmark-mcp, used to let AI assistants send email through Postmark, was modified to add a hidden BCC to an external domain.
Radware disclosed ShadowLeak, a zero-click indirect prompt-injection vulnerability affecting ChatGPT connected to enterprise Gmail and web browsing, where a crafted email could cause sensitive inbox data to be sent to an attacker-controlled URL.
No capability score increase
The Darwin Godel Machine research line describes agents that empirically validate self-modifications against benchmarks, preserve successful modifications, and explore an archive of descendants with improved coding-agent performance.