---
title: "Threats: attack classes on AI agents, with incidents and sources"
canonical: https://pharosone.ai/knowledge/threats
publisher: PharosOne (Agentic Mind, Inc.)
updated: 2026-10-23
license: "Open for reuse: crawling, copying, quoting, summarising and model training permitted without asking; citation of the title and canonical URL requested (see https://pharosone.ai/terms#reuse)"
cite_as: "\"Threats: attack classes on AI agents, with incidents and sources\". PharosOne, 2026-10-23. https://pharosone.ai/knowledge/threats"
---

# Threats: attack classes on AI agents, with incidents and sources

> Indirect prompt injection, poisoned tools and memory, data exfiltration through images and URLs, and attempt versus execution, each with public incidents and primary sources.

URL: https://pharosone.ai/knowledge/threats · Threats: 4 articles

The attack classes that reach AI agents in production. Each article defines the attack, lists the public incidents with their primary sources, and shows how PharosOne tests for it before release and how Pharos Radar watches for it after.

- [Indirect prompt injection: why system prompts and filters fall short.](https://pharosone.ai/knowledge/indirect-prompt-injection.md), 8 min read, updated 23 Oct 2026: Instructions in documents, email and tool results hijack agents. Where they hide, why a system prompt cannot close the channel, and how to test your agent.
- [MCP tool poisoning: how it works, real CVEs and how to defend agents.](https://pharosone.ai/knowledge/poisoned-tool-descriptions-and-memory.md), 7 min read, updated 23 Oct 2026: Poisoned tool descriptions, rug pulls after approval and memory poisoning, with MCPTox and CVE-2025-54136 evidence, the controls that help and how to test.
- [Markdown image exfiltration: 7 incidents, their fixes and 5 controls.](https://pharosone.ai/knowledge/data-exfiltration-through-images-and-urls.md), 7 min read, updated 23 Oct 2026: ChatGPT, Bing, Bard, Copilot, GitLab Duo, M365 Copilot: how rendered images leaked data, what each vendor fixed, and five renderer controls to copy.
- [Prompt injection alerts: separate the attempt from the execution.](https://pharosone.ai/knowledge/attempt-versus-execution.md), 7 min read, updated 23 Oct 2026: An injected instruction reaching an agent and the agent acting on it are different events. What we measured, why one alert fails, and how to route each.

Source: PharosOne, "Threats: attack classes on AI agents, with incidents and sources", https://pharosone.ai/knowledge/threats, updated 2026-10-23.

---

PharosOne is a product of Agentic Mind, Inc., an independent AI agent security company. Site map for agents: https://pharosone.ai/llms.txt