Category · 10 advisories
Models & APIs
Foundation models and their APIs: prompt injection, jailbreaks and data leakage.
Mistral2Timeline · advisories per quarter
12024 Q2
12024 Q3
22024 Q4
22025 Q1
22025 Q3
22026 Q4
All advisories, worst first
01. OpenCode Console breach exposed saved provider API keysOpenCode said a breach of its hosted OpenCode Console affected 1.4% of Console users who had linked external providers. Their saved OpenAI and Anthropic keys may have been exposed, and Anthropic revoked Claude keys it believed were affected. 
OpenCode 
Anthropic Claude 
OpenAI +1 more 2026-10-17 02. CVE-2026-95182: DeepSeek Harness can be tricked into running a planted fake npxDeepSeek Harness (dsh), DeepSeek's developer-preview agent harness, launches MCP servers by bare command name. Injected content can get the model to drop a fake executable into node_modules/.bin, which then runs every time that MCP server starts. 
DeepSeek 
MCP SDKs & servers 2026-10-16 03. DeepSeek left a database open with chat history and secretsWiz found a publicly accessible DeepSeek database that allowed full control over database operations, exposing over a million lines of logs with chat history and other sensitive data. DeepSeek 2025-01-29 04. Gemini Trifecta: three injection flaws in Google’s Gemini suiteTenable found three now-fixed vulnerabilities in Gemini Cloud Assist, the Search Personalization model and the Browsing tool that exposed users to privacy risks, including search-injection. 
Google Gemini 2025-09-30 05. OWASP LLM01:2025: prompt injection is the top LLM app riskOWASP ranks prompt injection first in its Top 10 for LLM Applications 2025. Any app that feeds untrusted text to a model with tools or data access is exposed. OpenAI Anthropic Claude Google Gemini +4 more 2024-11-18 06. SpAIware: prompt injection writes into ChatGPT’s long-term memoryEmbrace The Red showed untrusted content planting persistent instructions in ChatGPT’s memory on the macOS app, so later chats kept sending data to the attacker. OpenAI 2024-09-20 07. Grok 4 jailbroken within 48 hours of launchNeuralTrust combined its Echo Chamber and Crescendo multi-turn techniques to jailbreak Grok 4 two days after release. 
xAI Grok 2025-07-11 08. DeepSeek R1 failed every harmful-prompt test in Cisco’s evaluationCisco ran algorithmic jailbreak testing against DeepSeek and other frontier reasoning models and published the results on 31 January 2025. DeepSeek 2025-01-31 09. CVE-2024-50050: Llama Stack used pickle over socketsMeta’s Llama Stack used Python pickle to deserialise socket messages, which could allow remote code execution. It switched to JSON. 
Meta Llama 2024-10-23 10. Many-shot jailbreaking: long context windows weaken refusalsAnthropic published research showing that filling a long prompt with many fake dialogue examples can push models into answering requests they would normally refuse. Anthropic Claude OpenAI Google Gemini +2 more 2024-04-02
OpenCode Anthropic Claude OpenAI +1 more 2026-10-17 02. CVE-2026-95182: DeepSeek Harness can be tricked into running a planted fake npxDeepSeek Harness (dsh), DeepSeek's developer-preview agent harness, launches MCP servers by bare command name. Injected content can get the model to drop a fake executable into node_modules/.bin, which then runs every time that MCP server starts. DeepSeek MCP SDKs & servers 2026-10-16 03. DeepSeek left a database open with chat history and secretsWiz found a publicly accessible DeepSeek database that allowed full control over database operations, exposing over a million lines of logs with chat history and other sensitive data. DeepSeek 2025-01-29 04. Gemini Trifecta: three injection flaws in Google’s Gemini suiteTenable found three now-fixed vulnerabilities in Gemini Cloud Assist, the Search Personalization model and the Browsing tool that exposed users to privacy risks, including search-injection. Google Gemini 2025-09-30 05. OWASP LLM01:2025: prompt injection is the top LLM app riskOWASP ranks prompt injection first in its Top 10 for LLM Applications 2025. Any app that feeds untrusted text to a model with tools or data access is exposed. OpenAI Anthropic Claude Google Gemini +4 more 2024-11-18 06. SpAIware: prompt injection writes into ChatGPT’s long-term memoryEmbrace The Red showed untrusted content planting persistent instructions in ChatGPT’s memory on the macOS app, so later chats kept sending data to the attacker. OpenAI 2024-09-20 07. Grok 4 jailbroken within 48 hours of launchNeuralTrust combined its Echo Chamber and Crescendo multi-turn techniques to jailbreak Grok 4 two days after release. xAI Grok 2025-07-11 08. DeepSeek R1 failed every harmful-prompt test in Cisco’s evaluationCisco ran algorithmic jailbreak testing against DeepSeek and other frontier reasoning models and published the results on 31 January 2025. DeepSeek 2025-01-31 09. CVE-2024-50050: Llama Stack used pickle over socketsMeta’s Llama Stack used Python pickle to deserialise socket messages, which could allow remote code execution. It switched to JSON. Meta Llama 2024-10-23 10. Many-shot jailbreaking: long context windows weaken refusalsAnthropic published research showing that filling a long prompt with many fake dialogue examples can push models into answering requests they would normally refuse. Anthropic Claude OpenAI Google Gemini +2 more 2024-04-02