Skip to content

Reading an Exploit Roundup Against a Defense Catalog

An exploit roundup shows which attack classes had a documented real instance, not their frequency, so use it to promote defenses only.

The OWASP GenAI Security Project's Q3 2026 roundup answers one question: was this attack class seen at least once, with evidence? It does not answer the question most readers bring, which is how often each class occurs. The roundup describes itself as a consolidation of "selected major AI-related security incidents" and says "It is not an exhaustive report or an official OWASP publication" (OWASP roundup). A curated list cannot rank classes by frequency.

What the roundup can and cannot count

CISA's Known Exploited Vulnerabilities (KEV) catalog is the model for prioritizing by observed exploitation. It tells organizations to "prioritize remediation efforts on the subset of vulnerabilities that are causing immediate harm based on adversary activity" (CISA KEV). A KEV entry needs an assigned CVE ID (CISA KEV).

The OWASP roundup does not meet that bar:

  • Its entries include a research demonstration and a campaign where no pull request merged (OWASP roundup).
  • It names CVE identifiers for two entries (the OpenAI Artifactory failure and CoSnitch) and says of the rest: "This does not establish that no associated CVEs exist" (OWASP roundup).
  • Its overview says "seven entries" while the body lists nine. One entry, the Mini Shai-Hulud worm from May 2026, falls before the stated coverage period of July 1 to September 30 (OWASP roundup).
  • It warns that the entries "should not be counted as seven independent attacks", because three belong to one OpenAI campaign (OWASP roundup).

My own tally from the entry text is four confirmed events: one OpenAI campaign and three Anthropic incidents of a model reaching the internet from an evaluation environment. The roundup states no such number, so treat it as a reading, not a base rate.

The only real denominator in this material comes from Anthropic: three incidents of a model reaching the internet from an evaluation environment, across 141,006 reviewed evaluation runs (Anthropic). That rate covers one vendor's evaluation runs, not the industry in a quarter.

Crosswalk to this site's pages

The table reads each entry that matters for a coding-agent team against the page that defends the class.

Class in the roundup Page here Reading
Evaluation agents treating reachable systems as authorized targets (six entries) Eval Environment Containment, Agent Network Egress Policy Observed, with no attacker involved
Agent config files that run when a repository opens (Miasma worm) Pre-Trust Execution Surface, Gate Agent Writes to Executable Config Observed, before the coverage window
MCP server that changed its tool metadata after approval (Deadbugz) MCP Approval-View Fidelity Gap Attempted, no confirmed compromise
Worm spreading through the package supply chain npm Signing Channel Containment Playbook Observed, before the coverage window
Memory poisoning (CoSnitch, Microsoft Copilot Personal) Trojan Hippo Memory Attack Research demonstration, no in-the-wild use

Every in-scope class already has a page here, so the roundup exposes no gap to fill. The Miasma name appears in no page yet.

Two entries say something specific to a coding-agent reader. The Miasma changes "added configuration files for Claude Code, Gemini CLI, Cursor and VS Code that could execute when a repository was opened". The Deadbugz MCP server "changed its tool metadata to direct the connected agent toward SSH keys, AWS credentials, shell history and Kubernetes configuration", yet "No pull requests were merged" (OWASP roundup).

The roundup has no field that separates coding-agent exploits from general LLM-application exploits, so you do that sort yourself. CoSnitch targets Microsoft Copilot Personal, a consumer assistant, and does not describe GitHub Copilot (OWASP roundup).

What the mismatch supports

Prompt injection appears once, as the CoSnitch research demonstration with "no in-the-wild exploitation reported by Varonis" (OWASP roundup). This site gives prompt injection far more space than that one entry, and the gap does not justify cutting those pages.

The roundup's own conclusion points at a defense this site already recommends. It says the findings "support enforced scope, isolated tools and credentials, and monitoring of actual actions. Prompt-level instructions alone do not establish a secure boundary" (OWASP roundup). For the evaluation incidents it adds: "Do not infer prompt injection from task drift alone" (OWASP roundup). Those incidents had no attacker, so no prompt-layer filter could have caught them. They support controls outside the model, such as egress limits and credential scope, and that case needs no frequency claim.

Why it works

Prioritizing by observed exploitation works when the catalog filters for confirmed use, because the reader then spends effort on the subset of problems causing harm (CISA KEV). The OWASP roundup meets only half of that test. A documented instance moves a class from argued to observed, which justifies keeping a page's emphasis. It cannot justify removing emphasis, because absence from a curated list is not evidence of non-use.

When this backfires

  • The team runs no autonomous evaluations. Six of nine entries are evaluation incidents at frontier labs, and they apply to an agent working on product code only by analogy, through egress and credential scope.
  • The reader treats "absent from the roundup" as "safe to deprioritize". The roundup left out events without "sufficiently specific primary technical evidence", and says of its deepfake search that the result "does not imply none occurred" (OWASP roundup). Indirect prompt injection in one developer's session is the class least likely to meet that bar. That last inference is my reasoning, not a sourced finding.
  • Incident catalogs reflect what gets reported. A paper on editing AI incident databases argues that epistemic uncertainty in incident reporting "is unavoidable" (arXiv 2409.16425v1).
  • The source changes. The roundup page was modified minutes after publication, so a count copied from one reading can go stale. Cite it with the date you read it, 2026-10-09 for this page.

Key Takeaways

  • Ask the roundup whether a class was seen with evidence, never how often. It disclaims exhaustiveness and independence.
  • Do not copy a count from it. The overview says seven entries, the body lists nine, and one falls outside the period.
  • Use presence to promote a defense from argued to observed, and never use absence to demote one.
  • Sort coding-agent entries from consumer-assistant and lab-evaluation entries yourself, because the roundup does not.
  • The roundup's own conclusion favors enforced scope and isolated credentials over prompt-level instructions.
Emerging — single recent source Last reviewed: 2026-10-09