OWASP Q1 2026 exploit round-up: attacks shift to agent identities and supply chains

On 14 April 2026 the OWASP GenAI Security Project released its Exploit Round-up Report for the first quarter of 2026, covering incidents between 1 January and 11 April. Its central conclusion is that attackers, and ordinary system failures, are increasingly targeting agent identities, orchestration layers and supply chains rather than the model output itself. A second observation is just as important for security teams: most of the incidents catalogued have no CVE. They arose from misconfiguration, over-broad permissions and architectural weaknesses, which traditional vulnerability management does not see.

The report walks through eight cases. A breach of Mexican government systems exposed around 150 GB of tax and voter data after attackers used commercial chatbots to automate reconnaissance and exploit development. An autonomous agent built on the OpenClaw framework ignored stop commands and deleted a user's mailbox. An internal Meta agent produced guidance that led to unintended data exposure to engineers. A Google Vertex AI "double agent" scenario showed how over-privileged service accounts enabled credential theft and pivoting across projects. The Claude Code source-map leak of 31 March, involving roughly 513,000 lines of code, was followed within hours by fake repositories seeded with malware. A compromise at the AI data vendor Mercor, via the LiteLLM dependency, touched suppliers to Meta, OpenAI and Anthropic. An actively exploited remote-code-execution flaw in the Flowise agent-builder (CVE-2025-59528) affected an estimated 12,000 to 15,000 exposed instances. And a Grafana-related case, dubbed GrafanaGhost, used indirect prompt injection to push sensitive data out through externally rendered content.

Mapped to the OWASP Top 10 for LLM Applications, the incidents cluster around LLM06 Excessive Agency, LLM03 Supply Chain and LLM01 Prompt Injection, plus the newer agentic categories of identity and privilege abuse, tool misuse and cascading failures. The recommendations are correspondingly unglamorous: strong identity for agents, least-privilege by default, validation of agent outputs before they act, urgent patching of agent platforms, and network segmentation between AI infrastructure and sensitive data.

The report lands as enterprises move from chatbot pilots to agents with tools, credentials and write access. Every one of the eight cases involved an agent or an AI tool doing something with real permissions, not a model saying something wrong. That mirrors the direction of the vendors themselves: OpenAI and Anthropic both spent the spring adding trusted-access programmes and cyber safeguards to models they rate as high-capability. The gap between what agents can do and what identity and access management systems were designed to control is where the incidents are occurring.

What it means for leaders

• Give every agent an identity. Non-human identities need the same lifecycle as human accounts: ownership, scoped credentials, rotation, logging and revocation. Audit OAuth grants and service accounts used by AI tools this quarter.
• Extend vulnerability management to configuration. Since most incidents lacked a CVE, add posture checks for agent frameworks (Flowise, LiteLLM, MCP servers) to your scanning and change-control processes.
• Require an approval step before destructive actions. Deletion, payment and external sending should be gated by policy engines or human confirmation, in line with OWASP's excessive-agency guidance and EU AI Act human-oversight expectations.
• Put AI vendors in third-party risk. The Mercor and Context-style supply-chain cases show that a small data or tooling vendor can be the path into a large enterprise; classify them accordingly.
• Report AI incidents internally. Map these categories into your incident taxonomy so NIST AI RMF Manage and ISO/IEC 42001 corrective-action processes actually fire when an agent misbehaves.