{
 "generated": "2026-11-12",
 "n_cases": 59,
 "n_vendors": 31,
 "n_sources": 102,
 "n_sources_quote_verified": 102,
 "cases_by_year_disclosed": {
  "2023": 2,
  "2024": 4,
  "2025": 36,
  "2026": 17
 },
 "tier_A_vendor_fix_or_cve_or_statement": 45,
 "tier_B_researcher_only": 14,
 "cases_with_cve": 22,
 "attack_class": {
  "IPI": 48,
  "TOOL": 6,
  "SUPPLY": 3,
  "DPI": 2
 },
 "headline_third_party_instruction": {
  "n_with_injected_instruction": 52,
  "n_third_party": 50,
  "pct_of_injection_cases": 96.2,
  "pct_of_all_cases": 84.7
 },
 "entry_channel_all": {
  "code repo content": 12,
  "shared document": 8,
  "web page": 8,
  "email": 5,
  "form/ticket/CRM record": 4,
  "untrusted content in context": 4,
  "MCP server/config": 3,
  "malicious package/extension": 3,
  "crafted link": 2,
  "chat message": 2,
  "direct prompt": 2,
  "none (auth flaw)": 1,
  "web page / log entry": 1,
  "calendar invite": 1,
  "package/registry metadata": 1,
  "MCP tool arguments": 1,
  "database metadata": 1
 },
 "entry_channel_third_party": {
  "code repo content": 12,
  "shared document": 8,
  "web page": 8,
  "email": 5,
  "form/ticket/CRM record": 4,
  "untrusted content in context": 4,
  "chat message": 2,
  "malicious package/extension": 2,
  "crafted link": 1,
  "web page / log entry": 1,
  "calendar invite": 1,
  "package/registry metadata": 1,
  "database metadata": 1
 },
 "headline_gate": {
  "all_cases": {
   "block": 39,
   "conditional": 17,
   "no": 3
  },
  "pct_block_all": 66.1,
  "pct_block_or_conditional_all": 94.9,
  "injection_cases": {
   "block": 39,
   "conditional": 11,
   "no": 2
  },
  "pct_block_injection": 75.0,
  "pct_block_or_conditional_injection": 96.2
 },
 "gate_tier_A_only": {
  "n": 45,
  "block": 29,
  "pct_block": 64.4,
  "pct_block_or_conditional": 93.3
 },
 "allowlisted_domain_bypass_cases": [
  "echoleak-m365-copilot",
  "forcedleak-agentforce",
  "servicenow-bodysnatcher-cve-2025-12420",
  "superhuman-ai-email-exfil",
  "bard-gdoc-exfil",
  "antigravity-exfil",
  "agentflayer-chatgpt-connectors",
  "hackedgpt",
  "cursor-mcpoison",
  "camoleak-copilot-chat",
  "codex-cli-config-rce",
  "claude-code-huggingface-webfetch-2026",
  "claude-files-api-exfil",
  "claude-cowork-file-exfil",
  "mcp-remote-cve-2025-6514",
  "postmark-mcp-malicious-package",
  "figma-mcp-cve-2025-53967"
 ],
 "headline_time_to_fix": {
  "n_with_published_report_and_fix_dates": 19,
  "days_sorted": [
   3,
   6,
   7,
   11,
   13,
   13,
   20,
   28,
   30,
   39,
   42,
   42,
   44,
   47,
   50,
   50,
   62,
   83,
   140
  ],
  "median_days": 39,
  "q1_q3": [
   13.0,
   50.0
  ],
  "min": 3,
  "max": 140,
  "all_dates_found_on_source_pages": true,
  "definition": "days from private report to the vendor change that blocked the reported path, both dates published by the researcher or vendor"
 },
 "interaction": {
  "zero_click": 8,
  "pct_zero_click": 13.6,
  "zero_click_or_normal_use": 49,
  "pct_zero_click_or_normal_use": 83.1,
  "detail": {
   "normal question": 22,
   "zero-click": 6,
   "normal question + link click": 4,
   "normal use": 4,
   "normal task": 3,
   "link click": 2,
   "install package": 2,
   "zero-click (normal question)": 1,
   "normal use (employee asks agent)": 1,
   "normal use (agent processes ticket)": 1,
   "normal use (approve one command)": 1,
   "zero-click or one click": 1,
   "task assigned": 1,
   "approve once": 1,
   "install update": 1,
   "run tool in repo": 1,
   "normal use (auto-approve on)": 1,
   "connect to server": 1,
   "attacker sends prompt": 1,
   "app-dependent": 1,
   "normal question (non-default mode)": 1,
   "attacker chats with public agent": 1,
   "normal question (auto mode)": 1
  }
 },
 "harm": {
  "data_exfiltration": 37,
  "code_execution": 18,
  "credentials": 5,
  "integrity": 5,
  "destructive": 1
 },
 "harm_pct": {
  "data_exfiltration": 62.7,
  "code_execution": 30.5
 },
 "exploited_in_wild": {
  "no public evidence": 55,
  "yes": 2,
  "malicious release shipped; payload did not run (AWS)": 1,
  "unauthorised npm release occurred; link to the injection chain not established by the advisory": 1
 },
 "cheapest_control_author": {
  "injection-safe tool gate with least-privilege tools": 56,
  "spend caps and key hygiene": 2,
  "pre-launch red-team testing": 1
 },
 "system_type": {
  "copilot": 13,
  "agent": 10,
  "coding agent": 10,
  "CLI agent": 7,
  "chatbot": 6,
  "MCP server": 5,
  "browser agent": 2,
  "CI agent": 2,
  "agent library": 2,
  "MCP client": 1,
  "agent platform": 1
 },
 "sector": {
  "developer tools": 30,
  "enterprise productivity": 11,
  "consumer assistant": 7,
  "enterprise agent platform": 2,
  "ITSM SaaS": 2,
  "consumer/enterprise assistant": 2,
  "CRM SaaS": 1,
  "cloud platform / consumer assistant": 1,
  "personal agent platform": 1,
  "database": 1,
  "cloud platform": 1
 },
 "second_coder": {
  "model": "claude-opus-5-5 via local proxy :8317, temperature 0, blind to author coding",
  "n": 59,
  "control_agreement_pct": 98.3,
  "control_kappa": 0.851,
  "gate_agreement_pct": 91.5,
  "gate_kappa": 0.818,
  "coder2_gate_counts": {
   "conditional": 12,
   "block": 42,
   "no": 5
  },
  "coder2_control_counts": {
   "injection-safe tool gate with least-privilege tools": 55,
   "pre-launch red-team testing": 2,
   "spend caps and key hygiene": 2
  },
  "disagreements": [
   {
    "id": "servicenow-bodysnatcher-cve-2025-12420",
    "author": [
     "injection-safe tool gate with least-privilege tools",
     "conditional"
    ],
    "coder2": [
     "pre-launch red-team testing",
     "no"
    ],
    "coder2_reason": "The root cause was an auth flaw: a shared static secret and email-only linking. Impersonated calls looked legitimate, with no untrusted content to trigger approval."
   },
   {
    "id": "antigravity-exfil",
    "author": [
     "injection-safe tool gate with least-privilege tools",
     "conditional"
    ],
    "coder2": [
     "injection-safe tool gate with least-privilege tools",
     "block"
    ],
    "coder2_reason": "Shell 'cat' of .env while untrusted web content was in context would be held or denied. That stops the theft even though webhook.site was default-allowlisted."
   },
   {
    "id": "claude-files-api-exfil",
    "author": [
     "injection-safe tool gate with least-privilege tools",
     "conditional"
    ],
    "coder2": [
     "injection-safe tool gate with least-privilege tools",
     "block"
    ],
    "coder2_reason": "Exfiltration needed sandbox code execution while an untrusted document was in context; the gateway holds such calls even though api.anthropic.com was allow-listed."
   },
   {
    "id": "claude-cowork-file-exfil",
    "author": [
     "injection-safe tool gate with least-privilege tools",
     "conditional"
    ],
    "coder2": [
     "injection-safe tool gate with least-privilege tools",
     "block"
    ],
    "coder2_reason": "Exfiltration needed a curl shell call while an untrusted document was in context; the gateway holds or denies that call, despite the allowlisted vendor API."
   },
   {
    "id": "figma-mcp-cve-2025-53967",
    "author": [
     "injection-safe tool gate with least-privilege tools",
     "conditional"
    ],
    "coder2": [
     "injection-safe tool gate with least-privilege tools",
     "no"
    ],
    "coder2_reason": "Command injection inside the MCP server's own code; benign-looking fetch call passes the gateway, and direct network access bypasses the agent."
   }
  ]
 },
 "excluded_candidates": "see README section 'Excluded candidates'"
}