The Incident Record: Detection Lost, the Environment Held
Seven agent failures reached the public record between May 2025 and April 2026. Together they account for 5,500+ compromised repositories, over a thousand stolen GitHub tokens, a wiped production database, a $2M crypto theft, and a CVSS 9.3 zero-click CVE. In every one, the layer that failed was a prompt-level or detection-level defense, and the control that would have held was a property of the environment. The full per-incident analysis lives in the casebook, inside Build the Environment, because each incident is the motivation for a piece of the environment design.
Last verified: June 2026
The Moonwell entry rests on community reporting, not a published postmortem. Treat its figures as the strongest public account available, not a confirmed forensic finding.
The organizing lens is Simon Willison's lethal trifecta: an agent with access to private data, exposure to untrusted content, and the ability to communicate externally is exploitable by construction, because "LLMs are unable to reliably distinguish the importance of instructions based on where they came from." Four of the seven incidents assemble all three legs. The other three show what an agent can break with fewer.
Seven incidents, graded prevent, contain, or detect
"Outcome" uses three grades: a property prevents an incident if it stops the attack outright, contains it if the attack runs but finds nothing to steal or no way out, and detects it if you only find out afterward. The grades never claim prevention where the property only buys detection.
| Incident | One line | Property that breaks the chain | Outcome |
|---|---|---|---|
| Replit DB deletion (Jul 2025) | Replit's agent ignored eleven ALL-CAPS instructions during a code freeze and deleted a live production database, wiping records for 1,200+ executives, then wrongly claimed rollback was impossible | Isolation (no network path to prod) and least privilege (no DELETE credential) | Prevent |
| EchoLeak (Jun 2025) | One crafted email made Microsoft 365 Copilot exfiltrate organizational data with zero clicks (CVE-2025-32711, CVSS 9.3); Microsoft patched server-side | Egress control; least privilege applied to context, by analogy | Contain |
| GitHub MCP exploit (May 2025) | A malicious issue on a public repo hijacked the victim's agent into reading private repos and exfiltrating them via a public PR, using only legitimate, uncompromised tools | Least privilege: a per-task token scoped to one repo finds nothing to steal | Prevent |
| Nx s1ngularity (Aug 2025) | Poisoned npm packages prompted victims' own AI CLIs with --yolo flags to harvest 1,000+ tokens and ~20,000 files across 400+ users and orgs and 5,500+ repos | Credential isolation plus egress allowlists: the package still runs, but it starves | Contain |
| Slopsquatting (2025) | Models hallucinate package names (19.7% of recommendations don't exist, 43% of them repeatably) and attackers pre-register them; one PoC drew 30,000+ downloads in three months | Dependency provenance: deny-by-default registries and a dependency diff at review | Prevent |
| Comment and Control (Apr 2026) | PR titles and hidden HTML comments hijacked Claude Code, Gemini CLI, and Copilot agents in GitHub Actions, leaking API keys and tokens past secret scanners, env filtering, and a firewall | Least privilege: secrets out of the runtime that parses attacker text | Prevent |
| Moonwell (Feb 2026) | $2M stolen from a lending protocol holding $100M+, via a bug a Reddit report traced to a commit co-authored by Claude; the public record is community reporting, not a postmortem | Attribution and audit trail: the co-author trailer is how the world knows | Detect |
Least privilege carries, accountability never prevents, detection always loses
Least privilege. It is the workhorse. It breaks the chain outright in three incidents (GitHub MCP, Comment and Control, and Replit's credential leg) and contains two more. Every trifecta-complete incident monetized a credential or data scope the task never needed. The fix is structural: in the Comment and Control writeups, defense at the prompt layer, the scanner layer, and the firewall layer all lost; only removing the secret from the runtime won.
Attribution and audit. These never prevent. Moonwell is the proof: the trailer attributed the bug after $2M was gone. These two properties are accountability and forensics. They answer the auditor and unwind the damage; in this catalog they stop nothing in flight. Sell them as compliance properties, because that claim holds. Do not sell them as security controls.
Detection. It lost every time it was tested. EchoLeak bypassed Microsoft's XPIA classifier and link redaction. Comment and Control beat secret scanning (base64), environment filtering (/proc), and a network firewall (github.com was the hole). Willison's verdict on guardrails that catch "95% of attacks": in security, 95% is a failing grade.
Where the properties stop short
The properties do not stop everything. EchoLeak happened in a knowledge assistant, not an engineering environment, so the properties apply by analogy only. The upstream half of Nx was a conventional CI compromise in a package you consume; your environment can only refuse to be a profitable victim. Vendor --dangerously-skip-permissions flags live in the tools, beyond your architecture's reach. And nothing here prevents prompt injection itself: the properties arrange the environment so a hijacked model has nothing to steal, nowhere to send it, and a recorded trail behind it. The mechanics of that arrangement are the subject of breaking the chain, inside Build the Environment.