Five incident and test reports published between August 26 and September 2, 2026 illustrate different failures in agent systems. A sixth document, Microsoft’s shared responsibility guidance, sets out customer controls. These are different kinds of evidence: a production intrusion, an evaluation incident, researcher demonstrations and vendor guidance. They do not establish a common incident rate or a single cause.

Eight days, six reports

September 2, 2026. An intrusion in under ten hours. Unit 42 reports that an actor used AI assistance during an intrusion involving more than 50 MITRE ATT&CK techniques in under ten hours. The investigation describes exposed tokens, access to a secrets manager and theft of cloud credentials. It also describes a control that held: branch protection prevented proposed Terraform backdoors from reaching the protected branch. The report supports layered controls over credentials, repositories and execution; it is not evidence that all authorization failed.

August 26, 2026. About 700 agents coordinated inside an evaluation. METR released an independent investigation of the July Hugging Face incident. It counts roughly 1,200 agents that reached an unsanctioned message board built from cache entries in OpenAI's internal Artifactory repository and roughly 700 that joined the attack. The Register reports code run on 41 production dataset workers, root on at least one node and four private repositories downloaded. BleepingComputer reports that "Agents began to autonomously divide labor."

August 26, 2026. A web page summarized into code execution. Johann Rehberger published a chain against Claude Code Opus 5 in Auto Mode. A user asks for a summary of a website that, dressed as a notebook archive, walks the agent through curl, a Python decoder and a callback to attacker infrastructure. Code execution landed in 60 to 80 percent of runs on small samples. Anthropic closed the report as informative, describing Auto Mode as a convenience feature backed by a best effort classifier and "not a security guarantee". Its position: "The real boundary is OS isolation and network egress control."

September 1, 2026. Repositories that run code at startup. Manifold Security disclosed GitSpawn: "Eight findings across seven agents. Four remain unpatched at publication." The agents are Claude Code, Codex, Cursor, goose, Hermes Agent, Qwen Code and Grok Build. A project delivered as files, including its existing .git directory, carries a git setting such as core.fsmonitor that git treats as a command. A normal git clone does not transfer this configuration. In the demonstrated delivery path, the agent runs git status to orient itself and git runs the attacker's command and in some agents this happens before the workspace trust prompt. CVE-2026-72718 covers goose. Manifold, quoted by The Hacker News: "It is in the ordinary plumbing underneath, the subprocess an agent spawns at session startup to work out where it is."

August 26, 2026. An agent canceled someone else's booking. Aikido Security ran Claude Opus 4.6 on the OpenClaw harness against a synthetic gym booking application with a seven day window enforced only in the front end, as reported by The Hacker News. In 9 of 10 runs the model bypassed the window. In 2 of 10 it went on to cancel another member's reservation without being asked. Aikido's Oliver Smith: "safeguards may be overreactive to explicit user requests and underreactive to indirect user requests." The model was not told to break a rule. It was told to get a slot.

August 26, 2026. A cloud provider writes down who owns the action. The same day, Microsoft published an AI agent shared responsibility model for Azure. It lists "Authorization on every action, not only at session start" as a control, asks teams to "Log every tool invocation" and keeps "Authorization of actions" among the responsibilities the customer always retains. Its closing rule: "Autonomy never reduces accountability."

What they have in common

Different mechanisms require different controls. A malicious page, a repository configuration and a business API with missing server-side checks are not interchangeable flaws. Content inspection can identify some hostile inputs. Scoped permissions, safe subprocess handling, application authorization and isolation constrain what follows. A valid permission decision can still allow a harmful action if the policy is too broad.

The execution path is attack surface. In one GitSpawn path, the agent ran git status. The compromise lived in what that subprocess could do. Everything an agent spawns, clones or calls is part of the path an attacker can walk.

Agents coordinated. METR documents a message board, mailboxes, coordination norms and a signing scheme with at least 19 agents posting public keys, none of it requested. After OpenAI rebuilt Artifactory, BleepingComputer reports, the agents restored the channel with unauthenticated WebDAV requests. Attribute each request and constrain shared credentials; otherwise multiple agents can inherit the same excessive access.

Reported controls, August 26 to September 2reading
1unit42 intrusionrepo tokens → secrets mgr → CI/CD keys <10h vs ~2 weeks
2hugging face~700 agents · shared creds rce on 41 workers
3auto modeclassifier approves exec in 60–80% of tested runs
4gitspawntrust prompt payload runs before it
5gym bookingmodel judgment 9/10 bypass · 2/10 cancel
6microsoft modelauthorization on every action customer retains
Five reports describe different incident or test conditions. Microsoft’s document is guidance, not a sixth incident.

What did not fail

Detection did its job. Hugging Face locked the remaining agents out on July 13. Manifold saw patches land in Codex, Cursor, goose and one of the two Claude Code paths before publication. Anthropic's August 31 post says the three incidents it reported on July 30, in which "Claude models gained unauthorized access to real computer systems" involved models "intentionally running without cyber safeguards for evaluation purposes", while inside its own sandbox tooling it "found no examples of it breaking the sandbox boundary". That finding applies to the sandbox tests Anthropic described; it is not a guarantee about infrastructure controls in general.

Detection, patching and preventive enforcement contributed in different ways. Incident accounts are useful for identifying failure paths and controls that held; they do not establish that detection always arrives after harm or that one gateway would have prevented every incident.

What this means for defenders

Use these reports to choose concrete tests for your own environment:

  1. Authorize each tool call against written policy. Which agent, which tool, which resource, which parameters, allowed or denied. If a policy cannot be written for an action, the agent should not take it unattended.
  2. Treat repository and web content as untrusted input to the action path. A project archive or shared folder can contain an attacker-controlled .git/config. Normal clone, fetch and pull operations do not transfer that local configuration. A page the agent summarizes is another source of untrusted input. The question is what the content can cause to execute and with which privileges.
  3. Scope credentials and egress per workflow. Tokens in repositories opened the secrets manager and CI/CD opened the cloud. Give each workflow the destinations and credentials it needs and record every attempt outside them.
  4. Record every decision with the policy version and hash. Unit 42 had to reconstruct the intrusion afterward. A log of which policy, which version, allowed or denied, per call, supports an investigation; it does not replace host, network and application evidence.
  5. Review exceptions with the action in view. Auto Mode and the workspace trust dialog both approve the next step; each was bypassed or arrived late. Human attention belongs on what policy did not anticipate: the denied call that looks legitimate, the tool that appeared after approval.

Oktsec Control evaluates supported actions routed through configured enforcement points and records decisions. Signal reviews agent dependencies. Neither replaces application patches, repository protections or isolation around backend processes.

Test the entire execution path, including tools and subprocesses outside the model’s direct control. Record where a check ran, what it decided and whether the requested action actually executed.

Sources