# AI / LLM tooling security incidents · pwn.watch

> Security incidents affecting LLM gateways, agent builders and ML platforms.

Page: https://pwn.watch/t/ai · generated 2026-10-22T16:23:59.585Z

## Status (as of 2026-10-22)
- Incidents: 21 (4 live, 2 live and not fully patched, 19 patched)
- Days without a AI / LLM tooling security incident: 0 (2 still unpatched, so the counter stays at 0)
- Newest incident started: 2026-10-22

## Feeds
- JSON (incidents + changes + posts): https://pwn.watch/t/ai.json
- RSS (every update): https://pwn.watch/t/ai/feed.xml
- This file: https://pwn.watch/t/ai/llms.txt
- Whole site: https://pwn.watch/llms.txt · all tags: https://pwn.watch/tags.json

## Incidents (newest first by start date)
- [Major U.S. banks detect unauthorized third-party AI agents inside customer accounts](https://pwn.watch/i/us-banks-unauthorized-ai-agents-customer-accounts) ([json](https://pwn.watch/i/us-banks-unauthorized-ai-agents-customer-accounts.json)): medium, live, partial, started 2026-10-22
- [LiteLLM 1.107.0 PyPI/Docker supply-chain compromise](https://pwn.watch/i/litellm-1-107-0-pypi-compromise) ([json](https://pwn.watch/i/litellm-1-107-0-pypi-compromise.json)): critical, live, patched, started 2026-10-21, MAL-2026-2144
- [OpenCode: malicious MCP server can run code on Windows/WSL during sign-in (no CVE)](https://pwn.watch/i/opencode-mcp-oauth-rce-windows) ([json](https://pwn.watch/i/opencode-mcp-oauth-rce-windows.json)): critical, live, patched, started 2026-10-19
- [OpenCode Console breach exposes users' saved OpenAI / Anthropic / Google API keys](https://pwn.watch/i/opencode-console-provider-key-breach) ([json](https://pwn.watch/i/opencode-console-provider-key-breach.json)): high, live, partial, started 2026-10-17
- [BerriAI LiteLLM: BerriAI LiteLLM Improper Authentication Vulnerability](https://pwn.watch/i/berriai-litellm-cve-2026-59822) ([json](https://pwn.watch/i/berriai-litellm-cve-2026-59822.json)): high, closed, patched, started 2026-09-02, CVE-2026-59822
- [MLflow MLflow: MLflow Server-Side Request Forgery Vulnerability](https://pwn.watch/i/mlflow-mlflow-cve-2026-64849) ([json](https://pwn.watch/i/mlflow-mlflow-cve-2026-64849.json)): high, closed, patched, started 2026-08-19, CVE-2026-64849
- [Ray-Project Ray: Ray-Project Ray Code Injection Vulnerability](https://pwn.watch/i/ray-project-ray-cve-2025-62593) ([json](https://pwn.watch/i/ray-project-ray-cve-2025-62593.json)): high, closed, patched, started 2026-08-17, CVE-2025-62593
- [IBM Langflow: IBM Langflow Code Injection Vulnerability](https://pwn.watch/i/ibm-langflow-cve-2026-9198) ([json](https://pwn.watch/i/ibm-langflow-cve-2026-9198.json)): high, closed, patched, started 2026-08-04, CVE-2026-9198
- [Langflow Langflow: Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability](https://pwn.watch/i/langflow-langflow-cve-2026-0770) ([json](https://pwn.watch/i/langflow-langflow-cve-2026-0770.json)): high, closed, patched, started 2026-07-21, CVE-2026-0770
- [Langflow Langflow: Langflow Authorization Bypass Through User-Controlled Key Vulnerability](https://pwn.watch/i/langflow-langflow-cve-2026-55255) ([json](https://pwn.watch/i/langflow-langflow-cve-2026-55255.json)): high, closed, patched, started 2026-07-07, CVE-2026-55255
- [BerriAI LiteLLM: BerriAI LiteLLM Command Injection Vulnerability](https://pwn.watch/i/berriai-litellm-cve-2026-42271) ([json](https://pwn.watch/i/berriai-litellm-cve-2026-42271.json)): high, closed, patched, started 2026-06-08, CVE-2026-42271, CVE-2026-48710
- [Langflow Langflow: Langflow Origin Validation Error Vulnerability](https://pwn.watch/i/langflow-langflow-cve-2025-34291) ([json](https://pwn.watch/i/langflow-langflow-cve-2025-34291.json)): high, closed, patched, started 2026-05-21, CVE-2025-34291
- [BerriAI LiteLLM: BerriAI LiteLLM SQL Injection Vulnerability](https://pwn.watch/i/berriai-litellm-cve-2026-42208) ([json](https://pwn.watch/i/berriai-litellm-cve-2026-42208.json)): high, closed, patched, started 2026-05-08, CVE-2026-42208
- [Langflow Langflow: Langflow Code Injection Vulnerability](https://pwn.watch/i/langflow-langflow-cve-2026-33017) ([json](https://pwn.watch/i/langflow-langflow-cve-2026-33017.json)): high, closed, patched, started 2026-03-25, CVE-2026-33017
- [Mixpanel smishing breach exposes OpenAI API users' names and emails](https://pwn.watch/i/mixpanel-smishing-breach-openai-api-users-2025) ([json](https://pwn.watch/i/mixpanel-smishing-breach-openai-api-users-2025.json)): medium, closed, no-fix-needed, started 2025-11-08
- [s1ngularity: malicious Nx releases used AI CLIs to hunt secrets, 5,500+ private repos exposed](https://pwn.watch/i/nx-s1ngularity-npm-supply-chain-august-2025) ([json](https://pwn.watch/i/nx-s1ngularity-npm-supply-chain-august-2025.json)): critical, closed, patched, started 2025-08-26
- [Langflow: Missing Authentication Vulnerability](https://pwn.watch/i/langflow-cve-2025-3248) ([json](https://pwn.watch/i/langflow-cve-2025-3248.json)): critical, closed, patched, started 2025-05-05, CVE-2025-3248
- [DeepSeek leaves ClickHouse database open: chat logs and API keys exposed](https://pwn.watch/i/deepseek-exposed-clickhouse-database-january-2025) ([json](https://pwn.watch/i/deepseek-exposed-clickhouse-database-january-2025.json)): high, closed, patched, started 2025-01-29
- [Ultralytics PyPI releases backdoored with a crypto miner](https://pwn.watch/i/ultralytics-pypi-supply-chain-attack) ([json](https://pwn.watch/i/ultralytics-pypi-supply-chain-attack.json)): high, closed, patched, started 2024-12-04
- [Hugging Face Spaces secrets accessed without authorization](https://pwn.watch/i/hugging-face-spaces-secrets-leak) ([json](https://pwn.watch/i/hugging-face-spaces-secrets-leak.json)): high, closed, no-fix-needed, started 2024-05-31
- [Microsoft AI researchers exposed 38TB via an over-permissive Azure SAS link](https://pwn.watch/i/microsoft-ai-research-sas-token-38tb-exposure-2023) ([json](https://pwn.watch/i/microsoft-ai-research-sas-token-38tb-exposure-2023.json)): high, closed, patched, started 2023-06-22