AI Agent Security Incidents 2026: What Was Real, What Was Hype - By Sourav Mishra (@souravvmishra)

I track and fact-check AI agent security incidents. Not every story holds up. These do—and they shape how I build. In this post I, Sourav Mishra, summarize the incidents that are verified, what they have in common, and what I do in my own agent code so the same mistakes don't bite me.

Verified Incidents I Track

EchoLeak (CVE-2025-32711) — M365 Copilot, CVSS 9.3. Confirmed. The vulnerability allowed data exfiltration through the Copilot interface. Any agent with enterprise data access is a target. Takeaway: treat AI assistants that can read internal data as high-value targets and scope their access and tool use accordingly.

Drift — One integration compromise cascaded to hundreds of orgs across Salesforce, Google Workspace, Slack, S3, Azure. One weak link, multi-system access, mass impact. Takeaway: agents that have broad integrations multiply blast radius. Least privilege and isolation per integration matter.

Amazon Kiro — Internal agent deleted 847 AWS instances, 23 RDS databases, 3,400 EBS volumes; long outage. Autonomy without guardrails does real damage. Takeaway: destructive or high-impact tools must have hard limits and, where possible, human-in-the-loop or strong approval flows. No agent should be able to delete at that scale without checks.

CrewAI "Uncrew" — Leaked internal GitHub token, high privileges (CVSS 9.2). Default configs and shared credentials around agent frameworks are a real risk. Noma Security and Towards AI on governing agents have the details. Takeaway: don't rely on framework defaults for secrets; use least-privilege creds per agent and never ship shared .env in production.

What the Research Shows

Research in 2026 reinforced that agent frameworks are not inherently insecure—risk comes from how they're used. CrewAI (on GPT-4o) was manipulated into data exfiltration in a large share of tests when prompts and tool access were permissive. Magentic-One ran malicious code in most tests when fed malicious files. Multi-agent systems are riskier because Agent A's output becomes Agent B's input with no verification; one compromised agent can steer the rest. Palo Alto Unit 42 and others have noted that CrewAI and AutoGen don't force safe patterns—you have to add them. Default configs leave security to you.

So the pattern is consistent: overprivileged access, no step limits, no handoff verification, and trust in "the agent will do the right thing." The frameworks give you flexibility; they don't give you guardrails by default.

What I Do in My Own Code

I use least-privilege creds per agent—no shared .env in production. Each agent or role gets the minimum it needs. I add verification between agents when I have more than one: schema checks, allowlists, or a gatekeeper so one bad output doesn't propagate. I use bounded tool loops (e.g. stopWhen: stepCountIs(N) in the Vercel AI SDK) and input validation in my own code. Patterns are in my agentic chatbot guide. For multi-agent setups I wrote multi-agent security and cascade risk; for production guardrails, production-ready agents.

The frameworks don't force these patterns. You add them. So treat every agent as a potential attack surface and scope it accordingly.

Key Takeaways

• Verified incidents: EchoLeak (M365 Copilot), Drift (integration cascade), Kiro (runaway destructive actions), CrewAI Uncrew (leaked token, overprivilege). All point at overprivilege, missing guardrails, or unverified handoffs.
• Research: Agent frameworks can be manipulated into exfiltration or running malicious code when configs are permissive. Multi-agent systems are riskier without handoff verification.
• What to do: Least-privilege creds per agent, no shared secrets in production, step limits, verification between agents, human-in-the-loop for destructive actions. See agentic chatbot, multi-agent security, production-ready agents.

---

Written by Sourav Mishra. Full Stack Engineer, Next.js and AI.

Frequently Asked Questions

Q: Is CrewAI insecure by design? No. Risk is in implementation and default configs (e.g. credential handling). You still have to harden any agent framework—least privilege, step limits, handoff verification.

Q: What is EchoLeak? 2025 CVE (CVSS 9.3), M365 Copilot. Enterprise AI assistants with data access are in scope for security review. Scope access and tool use.

Q: Why are multi-agent systems riskier? Agents often pass output straight to the next agent. One compromise can take the whole chain. Multi-agent security covers mitigation—schema checks, allowlists, gatekeepers.

Q: Where do I learn to build agents with safety in mind? Single agent, explicit tool limits, step cap. Building an agentic chatbot—stopWhen, structured tools, and patterns you can copy.