Boundary Ledger.
Where boundaries failed.
Documented incidents, vulnerabilities, demonstrations, and near misses in agentic systems.
- Incident
An agent deleted data from an application database. Rollback eventually restored it, but development activity could affect the production application and the agent did not know the recovery mechanism existed.
- Boundary crossed
- Authority / Environment / Recovery
- Control that breaks the chain
- Isolate production data, make destructive effects reversible, and expose recovery state to both operator and agent.
EvidenceReplit incident account ↗ - Compromise
An inappropriately scoped GitHub token allowed malicious code into version 1.84.0 of the Amazon Q Developer extension for VS Code. The release was distributed, although a syntax error prevented the payload from executing.
- Boundary crossed
- Identity / Supply chain / Release
- Control that breaks the chain
- Use least-privilege publishing credentials and require independently verified provenance before release artifacts are distributed.
EvidenceAWS security bulletin ↗ - Vulnerability
A critical indirect prompt-injection chain could use a crafted email to make Microsoft 365 Copilot disclose information available in the victim’s context. Microsoft fixed the hosted service before public disclosure.
- Boundary crossed
- Context / Retrieval / Data egress
- Control that breaks the chain
- Treat retrieved content as untrusted instructions and enforce explicit, destination-aware policy at every external data sink.
- Demonstration
Researchers demonstrated that a malicious issue in a public repository could hijack an agent, draw private-repository information into context, and publish it through a public pull request.
- Boundary crossed
- Permissions / Context / Data flow
- Control that breaks the chain
- Scope access per repository and prohibit sensitive information from crossing between trust domains within the same agent session.
EvidenceInvariant Labs disclosure ↗