#5 of 10,000+
Lakera's Agent Breaker leaderboard
The independent record of how AI agents fail
We know how AI agents fail.
So you can trust the ones you ship.
Every failure we find, across security and reliability, becomes part of one independent record that compounds with every run.
You have only ever seen your own agents break. We have seen everyone’s.
Prefills the contact form with your domain.
94% attack success rate
AgentHarm, official test split
850 confirmed findings
Across 107 engagements
From our engagements
We break Fortune 500 and leading startups shipping production AI
Every case below is a confirmed finding from an authorized engagement, reported through official channels. Targets anonymized to their vertical, failure patterns only.
Read the research →- 01
Turned a coding agent’s issue tracker into a command channel
The agent’s tool connector shipped its author-trust filter off by default, so text from a stranger’s pull request and issue comments reached the agent as trusted instructions. Behind every tool call sat one full-scope token with no per-action check, meaning injected text could drive merges, approvals and secret reads with no human in the loop.
- 02
Read thousands of other companies’ live customer chats from an account that owned nothing
The platform’s only authorization was a caller-supplied user-id header the backend never verified. A canary account owning no data listed more than two thousand other tenants’ live support conversations, pulled their agents’ system prompts word for word, and could create and delete customer records anonymously.
- 03
Got a storefront’s AI assistant to hand out a customer export with no login
Asked for analytics, the commerce agent minted a pre-signed download link to a CSV of customer records and streamed it back in a hidden tool result. The link carried no cookie, token or session. A plain request returned names, emails, locations and order totals.
The artifact
What you can walk in a room with
Every engagement ends in one document. We ran the attacks, so we wrote it. It is dated, scoped, and tagged to the frameworks a security team already checks.
How a run works
Four steps, and the last one is why the next run is better
Voice, chat, email, or any channel your users reach. If an agent talks to the outside world, we attack it the way a real user could.
- 01
Connect
Point us at the agent. An endpoint, an SDK, or the live channel your users already talk to.
- 02
Attack
A fleet of agents probes it in parallel. Every refusal tells the next probe where the guard actually sits.
- 03
Prove
Nothing counts until the target says it. Every finding carries the transcript that produced it.
- 04
Compound
The finding writes back to the corpus. The next run, on any agent, starts from what this one learned.
Scanners run a fixed list. We run a corpus that gets smarter every engagement.
By agent type
How your type of agent fails
Customer support chat
- Cross-tenant reads through identifiers nobody re-checks
- System prompts recoverable word for word
- Guardrails watching the language while the API layer leaks
Coding agents
- Workspace content voting on what the agent’s commands mean
- Untrusted text arriving as trusted instructions
- One full-scope token behind every tool call
E-commerce agents
- Tool results carrying data the caller never authenticated for
- Pre-signed download links minted on request
- An analytics question answered with a customer export
Voice agents
- Caller identity collected, never proved
- Escalating requests without re-establishing who is asking
- Instructions carried in the audio itself
Browser and research agents
- Indirect injection from retrieved pages
- Poisoned documents steering what the agent reads into them
- Vector stores invertible back to their source text
Multi-agent systems
- Objectives competing across agents
- One compromised agent writing to shared memory
- Agents trusting each other’s output without a verifier
How agents fail
Every way an agent can fail, security or reliability, becomes structured knowledge
Security failures The primary product
- Data leaks
- Prompt injection
- Tool abuse
- Cross-tenant access
- Auth bypass
- Agent-runtime exfiltration
- MCP and tool-layer attacks
- Server-side request forgery
Reliability failures Included in the same record
- Wrong action taken
- Off-policy behavior
- Instruction drift
- Confident wrong answers
Both live in one dataset. Security first, reliability included.
- Prompt injection 75
- Auth bypass 58
- Objective competition 55
- Jailbreak 41
- Remote code execution 41
- Independent
- We sit outside the deal and run the attacks ourselves
- Compounding
- Every engagement writes back, so the next one starts ahead
- Field-wide
- Patterns travel between engagements. Your data stays yours
Twelve mechanisms behind how agents actually fail
For teams shipping AI into enterprises
Know how your agent fails and fix it before someone else asks you
We find it first and write it up in the language their reviewer already uses, so the deal stops waiting on it.
- Every finding carries the transcript that produced it
- Severity and business impact on each one
- Mapped to the frameworks the reviewer already asks about
- Re-run on every deployment, so the evidence stays current
For teams building and deploying agents
Know how your agents fail before you ship them
Drop us into the pipeline and the failure knowledge arrives as part of the build, in the same place your tests already report.
- An endpoint
- point us at the agent the way your users reach it
- An SDK call
- wrap the agent and we work it from inside your stack
- A live channel
- the chat widget, the phone line, the support inbox
- Your CI
- a run on every deployment, so a regression surfaces as one
Agents are failing in public
Every one of these is somebody’s shipped product
Three of the ones that got written up. Most never do.
API1 broken object level authorization
meta ai
guessable prompt ids let one user read another user’s chats
the server never checked who owned the prompt id
jul 2025 malwarebytes ↗
LLM08 tool-layer poisoning
cursor
a poisoned workspace turned allowlisted git commands into arbitrary execution
the allowlist was trusted, the environment it ran in was not
cve-2026-22708 nvd ↗
ASI01 agent-driven intrusion
mexican government agencies
one operator used a consumer ai to find the holes and pull the data
195 million identities out of tax, voter and civil registries
dec 2025 upguard ↗