Weekly reading · methodology v0.6

Window ending June 23, 2025

Harms count in full for two weeks after they are reported, then one level less every two weeks. The control floor looks at reports from May 25, 2025 through June 23, 2025. A selected catalogue of reported AI incidents, reviewed through Oct. 7, 2026. This reading describes documented harm in the records or, when none qualifies, the highest control level breached. It is not a forecast or a measure of all AI activity.

Current recalculation

Control failures only · No qualifying harm. The reading is the highest control level breached: 2, by 4 records. It is a level, not a count.

Recalculated from the catalogue in this build. Historical backcasts were not published at the time.

Published at the time

No publication snapshot exists for this week.

The harm ladder: the worst documented harm level picks the step; each tick is one qualifying harm at that level, and ten fill the step. The first, dark segment is the control floor: readings 2 to 5 mean no harm qualified and show the highest control level breached.

This is a backcast from the current catalogue. It was not a reading published at the time.

Records behind this reading

4 selected records; 0 documented external harms counting (0 qualifying). Records and ratings below reflect the current catalogue.

No harm counts in this week. The reading is the highest control level breached: 2 (set by 4 records: PI-0012, PI-0014, PI-0011, PI-0010). It is a level, not a count.

Documented harm: 0
No harm found (stated scope): 1
No harm reported: 3
Impact unknown: 0
Alleged, AI role uncorroborated: 0

Counts toward the index: 0
Unverified, watching: 0
Alleged in court: 0
Control failure, tracked: 4
Tracked separately: 0

Documented exclusions: 0 internal; 0 awaiting evidence review. 0 qualifying records with a bounded single-source review.

Inspect the evidence · 4 records

PI-0010 · Malicious GitHub issue could steer agents using the GitHub MCP server into leaking private repositoriesNo harm reported · sets the reading: highest control level breached
PI-0011 · Zero-click email injection could make Microsoft 365 Copilot leak organizational data (EchoLeak)No harm found (stated scope) · sets the reading: highest control level breached
PI-0014 · Supabase MCP demonstration: support-ticket text tricks coding agent into exposing private database tokensNo harm reported · sets the reading: highest control level breached
PI-0012 · Anthropic stress test found models from all major developers would blackmail or leak data to avoid replacementNo harm reported · sets the reading: highest control level breached

Status totals cover counted records; aliases, superseded aggregates and records tracked separately are excluded. Eligibility and extent notes overlap those totals. These observations are not statistical uncertainty bounds.

PI-0010
Malicious GitHub issue could steer agents using the GitHub MCP server into leaking private repositoriesMay 26, 2025 · No harm reported · Controlled test
PI-0011
Zero-click email injection could make Microsoft 365 Copilot leak organizational data (EchoLeak)June 11, 2025 · No harm found · Controlled test
PI-0014
Supabase MCP demonstration: support-ticket text tricks coding agent into exposing private database tokensJune 16, 2025 · No harm reported · Controlled test
PI-0012
Anthropic stress test found models from all major developers would blackmail or leak data to avoid replacementJune 20, 2025 · No harm reported · Controlled test

Sources

These links support the records above. Source availability and conclusions may change.

GitHub (Invariant Labs demo repository): Demo pull request #2 opened by the hijacked agent (ukend0464/pacman)Cited in PI-0010
Invariant Labs: GitHub MCP Exploited: Accessing private repositories via MCPCited in PI-0010
DevClass: Researchers warn of prompt injection vulnerability in GitHub MCP with no obvious fixCited in PI-0010
heise online: Attack via GitHub MCP server: Access to private dataCited in PI-0010
Microsoft Security Response Center: CVE-2025-32711: M365 Copilot Information Disclosure VulnerabilityCited in PI-0011
CVE Program (Microsoft CNA record): CVE-2025-32711 record (Microsoft as CNA)Cited in PI-0011
Aim Security (Aim Labs): EchoLeak: zero-click AI vulnerability in Microsoft 365 Copilot (Aim Labs blog post; returned HTTP 403 when checked 3 Oct 2026)Cited in PI-0011
The Hacker News: Zero-Click AI Vulnerability Exposes Microsoft 365 Copilot Data Without User InteractionCited in PI-0011
Fortune: Microsoft Copilot zero-click attack raises alarms about AI agent securityCited in PI-0011
Dark Reading: Researchers Detail Zero-Click Copilot Exploit 'EchoLeak'Cited in PI-0011
Supabase: Defense in Depth for MCP ServersCited in PI-0014
General Analysis: Supabase MCP can leak your entire SQL database (original post; current page retitled and re-dated)Cited in PI-0014
GIGAZINE: A method that could leak entire SQL databases via AI protocol 'MCP' has been discoveredCited in PI-0014
Simon Willison's Weblog: Supabase MCP can leak your entire SQL database (link post)Cited in PI-0014
Anthropic: Agentic Misalignment: How LLMs could be insider threatsCited in PI-0012
arXiv: Agentic Misalignment: How LLMs Could Be Insider ThreatsCited in PI-0012
FOX 9: AI willing to let humans die, blackmail to avoid shutdown, report findsCited in PI-0012
Simon Willison's Weblog: Agentic MisalignmentCited in PI-0012

All weekly readings · How this reading is calculated · Download the weekly card