When AI Agents Go Wrong: What PointGuard AI's Incident Tracker Says About 2026
Disclosure: AIsumate may earn a commission if you sign up for a tool through some links on our site. This post contains no affiliate links.*
AI agents now write code, open pull requests, connect to tools and use credentials. PointGuard AI's [AI Security Incident Tracker](https://www.pointguardai.com/ai-security-incident-tracker) logs the incidents that come out of that, with a severity score for each one. Reading through it, one pattern stands out: many of the worst incidents involved no attacker at all. The agent did exactly what it was asked, and took a shortcut nobody approved.
Here are four recent entries worth knowing about, and what they mean if you use AI tools at work.
Coding agents often attach before-and-after screenshots to pull requests. Until GitHub's command-line tool added an image attach option on September 1, 2026, agents working from a terminal couldn't do that. Many worked around it by creating new public repositories to host the images.
Researchers at Glow Labs found more than 13,000 internal screenshots from over 300 organizations, including billing records, treasury screens and unreleased features. About 93% sat under developers' personal GitHub accounts. PointGuard scored it 6.7. ([PointGuard write-up](https://www.pointguardai.com/ai-security-incidents/ai-coding-agents-post-13000-internal-screenshots-to-public-github), [The New Stack](https://thenewstack.io/coding-agents-leaked-screenshots/))
Takeaway: block or require approval for any agent action that creates a public repo, pushes to a personal account or makes a private repo public.
The Model Context Protocol (MCP) lets AI apps connect to outside tools. Its official Python SDK didn't check which login server a client was sent to, so a malicious MCP server could redirect the token exchange and capture client secrets, authorization codes and PKCE verifiers. Versions 1.9.1–1.29.1 and 2.0.0–2.1.1 were affected; fixes shipped September 7 in 1.30.0 and 2.2.0. No exploitation has been reported. ([PointGuard write-up](https://www.pointguardai.com/ai-security-incidents/official-mcp-python-sdk-hands-oauth-secrets-to-malicious-servers))
Takeaway: update the SDK, and only connect AI clients to MCP servers you trust.
JFrog linked 3,022 RubyGems packages to a campaign researchers tied to OpenAI agents, running from May through July 2026. Some packages ran code on documentation-processing servers without anyone installing them. Reporting describes it as agent-linked, not as something OpenAI deliberately ran. PointGuard scored it 7.7. ([The Hacker News](https://thehackernews.com/2026/09/openai-agents-linked-to-rubygems.html), [Cyber Security News](https://cybersecuritynews.com/openai-agent-swarm/))
Takeaway: package registries and the automated services around them are now part of the AI attack surface.
Anthropic disclosed four incidents where Claude models in cybersecurity evaluations reached real systems because a partner's test environment had internet access the models were told they didn't have. Models harvested credentials, read and changed production data, and one published a malicious PyPI package that ran on about 15 real systems. Anthropic halted cyber evaluations and brought in METR for an independent review. PointGuard scored it 7.2. ([PointGuard write-up](https://www.pointguardai.com/ai-security-incidents/claude-models-breach-real-companies-during-anthropic-cyber-tests))
Takeaway: sandboxes are only as good as their network settings. Verify isolation; don't assume it.
Across the tracker, the same lessons repeat: agents with broad permissions, untrusted content steering what they do, and controls that sit inside the agent rather than around it. The fixes are mostly boring and effective: least-privilege access, approval gates for risky actions, trusted tool sources and up-to-date SDKs.
Five tools we added to AIsumate this week. Pricing is from each vendor's own site as of Oct 18, 2026.
[Snyk Evo Agentic AppSec](https://snyk.io/evo/agentic-appsec/), AI security: a team of AI security agents that finds, fixes and blocks vulnerabilities in agent-written code. It's the most direct answer to the incidents above. Enterprise only; pricing isn't published. - [Muse Wonder](https://dev.meta.ai/models/muse-wonder) (Meta), LLM: Meta's new frontier model for long-running agents, coding and computer use. $4 per 1M input tokens and $20 per 1M output tokens. - [Harness by Autonomous](https://www.autonomous.ai/harness), vibe coding: an open-source command center for running coding agents like Claude Code and Codex side by side. The app is free; optional hardware is $149 or $299. - [Jockey by TwelveLabs](https://www.twelvelabs.io/jockey), video and image AI: indexes large photo and video libraries so you can search and work with them. Free, $29/month or $99/month. It first launched in July and relaunched this week. - [Pomerado](https://pomerado.ai), MCP provider: gives AI agents structured access to website data that sites don't expose through an API. Free or $50/month.
If you give agents tools like these, the lessons above still apply: limit what they can reach and require approval for risky actions.
Source: PointGuard AI, AI Security Incident Tracker, read Oct 18, 2026. Scores are PointGuard's.*