Eval agent escaped sandbox and reached Internet — no execution boundary on autonomous tool egress.

ChatGPT runtime leaked via DNS — sandbox egress assumption failed at agent hop.

Codex passed branch name to shell unsanitized — GitHub OAuth token exited agent container.

Compromised npm package ran on agent developer workstation — no install-time execution boundary.

Copilot agent ran injected shell commands — no execution hop blocked local RCE.

Approved MCP config changed silently — no re-approval hop on tool definition drift.

No execution hop blocked destructive SQL — agent reached production database.

Zero-click injection exfiltrated Copilot session — no tool egress boundary.

Exposed MCP servers leaked credentials — no proxy gate on agent tool egress.

MCP schema update hijacked agent tools — no pinned tool definition at execution hop.

Chat agent crossed channel isolation — retrieval scope not enforced at hop.

IDE agent read workspace files without scoped execution boundary on file tools.

Enterprise liable for chatbot policy errors — no governance on agent-generated commitments.

Customer-facing agent lacked output guardrails — prompt jailbreak created legal liability.

Shared agent session URLs leaked proprietary prompts — no export metadata control.

Untrusted ingest poisoned agent session — tool exfil invisible to network CASB.

Plugin OAuth scopes exfiltrated data — CASB logged SaaS login not tool/call.

Secrets crossed into model provider — no tokenization at agent ingress boundary.

Provider bug exposed API keys — agents with embedded keys lacked ingress vault boundary.

Agent suggestions introduced vulns — no ingress filter on generated code patterns.