A year ago, "an AI agent deleted production" was a hypothetical in a conference talk. This spring, Decrypt reported that a startup founder's coding agent had deleted the company's production database and its volume-level backups in nine seconds. In the months since, the hypothetical had become a recurring headline.
It is tempting to read each incident as its own story: a bad provider, an unlucky team, a one-off mistake. Sorted that way, the year looks like noise. Sorted by root cause instead of by vendor, it looks like something much more useful: a short list of repeating plots, each of which points to a specific control.
This roundup only includes incidents with primary public sources. No private anecdotes, no invented figures, no "we heard that." The point is not to count incidents. It is to notice how few distinct causes produced all of them.
How we sorted this list
Root cause, not vendor. The question for each incident is not "whose product was it?" but "what condition made it possible?" That reframing matters because the vendor changes every time and the condition almost never does. A credential within reach causes the same class of damage whether the agent was driving a database, a cloud API or a package manager.
Four causes account for the pattern: credentials the agent could reach, a supply chain that went straight for agent configuration, policy that judged command names rather than actions, and model-layer guardrails that warned after the fact instead of blocking before it.
The biggest category was credentials within reach
The most common root cause was also the oldest: a credential the agent could get to, scoped far wider than the task.
The nine-second database deletion is the clearest case. By the public accounts from Decrypt and Railway, the agent hit a credential mismatch during a routine task, found a token with account-wide permissions, and used it. The token was within reach and far too broad. OpenAI's own misalignment report described a model exposing a GitHub token in a public repository. Upstream described an agent that printed its own live token into the model conversation while debugging. And a coding tool's keys, held in its vendor console, were exposed for 1.4% of console users.
Different vendors, different surfaces, one cause. In each case the agent, or the infrastructure holding its keys, had a credential it should never have been able to reach, which is why scanning for leaked secrets after the fact never catches up.
Supply chain attacks went straight for agent configs
The second plot: attackers stopped treating agents as incidental and started targeting them specifically.
In October, a compromised npm release of tensorlake ran a preinstall script that went looking for AI tool configs and MCP settings, the files where developers now keep their most powerful tokens, and set a monitor that would wipe the home directory if the stolen token was revoked first. The same month brought a run of MCP server vulnerabilities, documented together, covering token leaks, a gateway auth bypass and an allowlist escape.
What makes this a distinct cause is the target. The payload was not after the build, it was after the agent's configuration and the credentials inside it. Agent config became an asset worth attacking on its own.
Policy that judged names instead of actions
The third plot was quieter and did not always produce a headline, but it sits under several of the others: controls that checked a command's name and not what it actually did.
An allowlisted command followed by a shell metacharacter is a different command. A Cursor advisory described an allowlist bypass through environment variables, and the MCP write-up above covered an allowlist escape through a single shell separator. A list of permitted binaries answers "which program?" It does not answer "which verb, with which arguments, against which target?" and that gap is where these bypasses lived.
Guardrails that warned after the damage
The fourth plot: model-layer defences that logged or warned instead of blocking, and did so after the action had already run.
Public research during the year kept finding the same shape. A plaintext injection payload gets refused, an encrypted one gets decrypted and obeyed. A guardrail flags a problem in a report you read later, by which time the code has executed.
The common failure was timing: the defence sat at the model layer, where it is probabilistic, and it acted after the fact rather than before.
Five controls, and what to watch in 2027
Every plot above points to a control, and none of them is "a better system prompt":
- Keep credentials out of the agent's reach, scoped to the task and destination.
- Judge actions by verb and target, on every path, so a destructive operation is denied before it runs.
- Treat agent config and MCPs as a supply chain: inventory, pin, and keep no credentials inside them.
- Keep a receipt of every request, allowed or denied, in storage you own.
- Put enforcement outside the agent, where it is deterministic, not inside it, where it is a hint.
As for 2027, the honest answer is trend lines, not predictions. Regulators are moving: the EU AI Act is phasing in its obligations for high-risk AI over the next few years, which is a reason to get your audit trail in order now rather than a reason to panic this year. The incident pattern is unlikely to change on its own, because the causes have not. The teams that fare best will be the ones that treated this year's four plots as a checklist rather than as news.
Sorted by vendor, 2026 looks like a run of bad luck. Sorted by root cause, it is four conditions that keep recurring, each with a control that would have changed the outcome. The useful resolution is not to watch for the next incident. It is to remove the conditions that produced the last dozen.
This roundup closes the loop on the argument the series opened with: the choice between banning agents and letting them run is a false one →
Marshal removes the conditions behind these incidents: credentials the agent never holds, actions judged by verb and target, and a receipt of every request in storage you own. Book a demo →