PromptFu
03 Offense: Agentic3.3Core40 min

Ten incident case studies

EchoLeak, the three MCP cases, both Amazon Q events, Copilot RCE, Gemini in Chrome, ShadowRay, OpenClaw.

LLM01:2026LLM03:2026◆ Ten incident case files

Ten incidents, all documented in the primary source, all against shipped products. Read them for the pattern rather than the drama. By the tenth you should be able to guess the ending from the setup.

Read these as evidence, not as war stories

Two modules of theory are behind you. This one checks it against the record. Each case file below names the product, the year, the researcher and the recorded impact, and every one of them is cited in the OWASP Top 10 for LLM Applications 2026.

Three things are worth watching for as you go. How the attacker got their text in. What the agent's credentials let it reach. And which control, if any, was already deployed when the attack ran.

Ten incident case files

10/10

EchoLeak

2025 · CVE-2025-32711

Microsoft 365 Copilot

Aim Security demonstrated a zero-click chain against a shipped Microsoft product: an email arrives, the assistant reads it in the course of ordinary work, and organizational data leaves. The victim clicks nothing.

What landedOrganizational data exfiltrated with no user interaction, bypassing both the deployed prompt-injection classifier and the link-redaction filter.

Anatomy, from LLM01 Scenario #7

(a)
Vector: email / document (indirect)
(b)
Persistence: single-shot with tool invocation
(c)
Encoding: plain text with invisible-Unicode exfiltration channel

This course's readingThe single most useful incident in this list, because the two controls it defeated are the two that usually get deployed first. A classifier and a URL filter were both present, in production, at a vendor with resources. Treat this as the standing answer to 'we have a prompt-injection filter'.

Reddy & Gujral (2025), arXiv 2509.10540

Every incident is documented in the OWASP Top 10 for LLM Applications 2026. Anatomy triples are quoted where the standard prints one. The reading on each card is this course's analysis, not OWASP's.

What the ten have in common

Sorting them by what actually failed produces a short list, and none of the entries on it is about the model being persuaded.

The failureCasesWhere it is covered
A public write endpoint fed a surface the agent trustedGitHub issue, support tickets, npm3.1
The agent held credentials wider than the taskSupabase service_role, shared mail accounts3.4, 3.5
Model output reached a sink that executesCopilot RCE, Amazon Q runtime3.10
A rendering or fetch feature became the exitEchoLeak3.2
Ordinary infrastructure, no model involvedShadowRay6.1
Capability alone, with no attacker on the recordOpenClaw inbox3.4
Grouped by this course. OWASP catalogues the incidents; the grouping is ours.

The two controls that were already there

EchoLeak is the case to keep. Microsoft had shipped a prompt-injection classifier and a link-redaction filter, and the attack went through both.

Aim Security demonstrated this against Microsoft 365 Copilot (Reddy & Gujral, 2025), bypassing both the deployed prompt-injection classifier and the link-redaction filter.
OWASP LLM01:2026, Scenario #7

Those are the two controls most teams reach for first. They were present, in production, at a vendor with a security organisation, and the incident happened anyway. This is the standing answer to “we already have a filter for that”.

Deep diveThe detail most retellings drop›

The Amazon Q commit is famous as the time an AI agent wiped machines. The primary source ends the sentence differently: the attacker committed the destructive prompt, AWS reverted it, and the committed code “failed to execute due to a syntax error”.

Nothing ran. The exposure was real and the control that saved it was luck, so the finding stands. But a red teamer who writes the dramatic version into a report has spent credibility they will need later.

Check the vendor bulletin, not the thread about the bulletin. This course dropped three incidents from its own outline for failing that test.

Bounds blast radius· survives adaptive attack

Across all ten, the controls that ended an attack removed a capability. Read-only scopes, an identity that could not outrank a policy, a renderer that would not fetch. No case here was closed by a system prompt or by better detection of adversarial text.

Sources