How Many Security Flaws in AI Agents Were Published in the Last Year?

616. That is how many security flaws in AI agents, coding agents, MCP servers and agent platforms were published in the twelve months to October 26, 2026, by this report's count of the National Vulnerability Database, the official CVE records and the GitHub Advisory Database. The twelve months before brought 92. The third quarter of 2026 alone added 266, nearly double the quarter before. A third of last year's flaws, 207, let an attacker get data the agent or its tools could reach: files, secrets, tokens, conversation content or other users' records.

Key findings

• 207 of the 616 flaws published in the last twelve months (34%) let an attacker get data the agent, its tools or its server could reach, against 23 of 92 (25%) in the year before (National Vulnerability Database, 2026; GitHub, 2026).
• 616 security flaws in AI agents, MCP servers and agent platforms were published from October 27, 2025 to October 26, 2026, against 92 in the twelve months before (National Vulnerability Database, 2026; CVE Program, 2026; GitHub, 2026).
• The third quarter of 2026 added 266 flaws, nearly double the 138 of the second quarter. 111 of the 266 let an attacker get data (National Vulnerability Database, 2026).
• 90 of last year's 207 data flaws exposed credentials: API keys, access tokens, cloud credentials or session identifiers (National Vulnerability Database, 2026).
• 128 of last year's flaws start with prompt injection or other content the AI reads, such as a web page, a repository file or an email, against 36 in the year before (National Vulnerability Database, 2026).

How do the last two years compare?

How fast is the count rising?

The count rose in five of the six steps from one quarter to the next, and the share that exposes data rose with it: 42% of the third quarter's flaws, against 24% in the first quarter of 2026. Part of the rise is the category itself. The Model Context Protocol, which connects agents to tools and data, was introduced in November 2024 (Anthropic, 2024), and many MCP servers and agent products have shipped since. More products and more researchers produce more records. Each record is a flaw someone found and reported, not an attack that happened.

Where are the flaws?

MCP servers carry most of the count because they sit between an agent and the systems it works in: databases, file stores, ticketing, chat and cloud accounts. A flaw there exposes whatever the server can reach, which is often more than the person using the agent would see on their own screen.

Which named agent products have published flaws?

These are the products from RedactSure's list of agents and coding agents that have at least one published record in the window; the other products on the list have none. A higher count does not mean a less secure product. Vendors that file CVE records for their own software, as several coding agent makers do, show up more often than hosted products, which rarely receive CVE IDs at all. Each linked name goes to the product's RedactSure comparison page.

What do the numbers mean for teams running AI agents?

Every data flaw in this count has the same shape. An agent or one of its tools could reach a value, and a flaw let someone else get it. Patching closes each flaw, and 616 published in one year says new ones will keep arriving. OWASP ranks prompt injection and sensitive information disclosure first and second among risks to applications built on large language models (OWASP, 2025).

That changes the question a security team asks. Access controls decide where an agent may go. The data question is what the agent holds once it gets there, because anything it can read is something a flaw can hand to an attacker. The control that holds up after a flaw is one that keeps real sensitive values out of what the agent reads, with a named person approving any action that matters.

Methodology and limitations

The count combines three sources read on October 27, 2026: the National Vulnerability Database CVE API 2.0, searched by exact phrase and by keyword for AI agent, coding agent, agentic browser, computer-use and MCP terms; the official CVE records for the 150 prompt injection records in RedactSure's earlier count; and 123 advisories from the GitHub Advisory Database. Records were deduplicated by CVE ID, then by GitHub advisory ID. Rejected records and records whose description does not show an AI agent product were removed and logged with a reason. Dates are publication dates, so earlier periods do not grow as new records arrive.

RedactSure read every description and coded it against fixed definitions. A flaw counts as letting an attacker get data when the description says data the agent, its tools or its server could reach was sent or returned to the attacker, read by an unauthorized user, or exposed in logs or telemetry outside the system. Server-side request forgery that only reaches internal hosts, with no statement that data comes back, does not count. When a description was unclear, the record was not counted, so 207 is a minimum. Each record was coded by one reviewer.

The previous twelve months include three late-2024 records added back to make a full year. Records were matched to product categories by the product named in the description. The named products with records are Claude Code (Anthropic), Cursor (Anysphere), Codex (OpenAI), Browser Use, GitHub Copilot (GitHub, Microsoft), Agentforce (Salesforce), AgentCore (Amazon Web Services), OpenAI Dots and Devin (Cognition). The MCP category includes official SDKs, vendor-published MCP servers and community servers. Hosted products rarely receive CVE IDs, so a low count for a category means few published records, not few flaws. Advisories that describe the same flaw in different words may be counted twice. The full list of records and codes is available from RedactSure on request.

Frequently asked questions

How many security flaws in AI agents were published in 2026?

From January 1 to October 26, 2026, 580 security flaws in AI agents, MCP servers and agent platforms were published in the National Vulnerability Database, the official CVE records and the GitHub Advisory Database, by this report's count. In the twelve months to October 26, 2026 the count was 616, against 92 in the twelve months before.

What is an MCP server, and why does it have so many flaws?

An MCP server connects an AI agent to a tool or a data source, such as a database, a file store or a business application, using the Model Context Protocol. Each server holds access to the system behind it. The protocol is new, many servers are small open-source projects, and a flaw in one can expose everything the server can reach, which makes them a frequent subject of published advisories.

Does a rising count mean AI agents are less secure?

Not by itself. Agent products are shipping quickly, more researchers are testing them, and more projects file advisories, so part of the rise reflects attention. What the count does show is that new flaws keep being found across products, and that a growing share of them expose data. Controls should assume an agent will at some point be exposed by a flaw.

Related reading

How Many Prompt Injection Vulnerabilities Have Been Published? · How Often Do AI Agents Follow Injected Instructions? · How Many AI Security Products Control What an AI Agent Sees? · What Does Prompt Injection Get From a Token-Only Agent? · What Is Render-Layer Tokenization?

Sources

Regulation, standards and official guidance 1. National Vulnerability Database, "CVE API 2.0," National Institute of Standards and Technology (data set; read October 27, 2026). https://services.nvd.nist.gov/rest/json/cves/2.0 2. CVE Program, "CVE records," MITRE Corporation, sponsored by the Cybersecurity and Infrastructure Security Agency (data set; read October 27, 2026). https://www.cve.org 3. GitHub, "GitHub Advisory Database" (data set; read October 27, 2026). https://github.com/advisories 4. OWASP, "OWASP Top 10 for Large Language Model Applications 2025" (industry standard). https://genai.owasp.org/llm-top-10/

Vendor documentation 5. Anthropic, "Introducing the Model Context Protocol" (November 25, 2024; vendor announcement). https://www.anthropic.com/news/model-context-protocol

RedactSure documents 6. RedactSure Research, "How Many Prompt Injection Vulnerabilities Have Been Published?" (2026). https://redactsure.com/research/how-many-prompt-injection-vulnerabilities-have-been-published 7. RedactSure Research, "What Is Render-Layer Tokenization?" (2026). https://redactsure.com/research/what-is-render-layer-tokenization 8. RedactSure Research, "What Is Supervised Delegation?" (2026). https://redactsure.com/research/what-is-supervised-delegation 9. Product behavior described on this page reflects RedactSure's current design. Vulnerability records are described as published in the sources above, read as of October 27, 2026. Compliance determinations belong to the organization's counsel.

About the author

Chris Sowa is a founder of RedactSure and a former CEO of an AI company; he started it years before ChatGPT existed. He previously led AI at Accenture, served as Global VP of Strategy & Innovation at Schneider Electric, was CCO of Sovos, and spent more than a decade at Oracle, with earlier roles at SAP and IBM.

How RedactSure Keeps a Flaw From Reaching Real Data

A published flaw in an agent or one of its tools hands an attacker whatever that agent could read. The less real data the agent holds, the less any flaw can give away.

The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.

Before: an agent working a customer account reads the account number and the customer's address on the screen, and a flaw in a connected tool sends that screen's contents to an outside server. Inside the governed environment: render-layer tokenization shows the agent ACCT_001 and ADDR_001 instead, so the flaw finds only tokens, and a named person approves every consequential action under Supervised Delegation.

RedactSure is deploying now with enterprise and government customers.

Everyone else controls where data can go. RedactSure controls what the AI can see.

See it on your own workflow

New agent flaws are published every week, so the safer plan assumes one will reach your agent. Bring one agent workflow and see, with test values, what the agent reads and who approves each action. Book a demo