#5 of 10,000+
Lakera's Agent Breaker leaderboard
The independent record of how AI agents fail
We know how AI agents fail.
So you can trust the ones you ship.
Every failure we find, across security and reliability, becomes part of one independent record that compounds with every run.
You have only ever seen your own agents break. We have seen everyone’s.
94% attack success rate
AgentHarm, official test split
Continuous vulnerability research
The corpus compounds every run
From our engagements
We break Fortune 500 and leading startups shipping production AI
Every case below is a confirmed finding from an authorized engagement, reported through official channels. Targets anonymized to their vertical, failure patterns only.
Read the research →- 01
Turned a coding agent’s issue tracker into a command channel
The agent’s tool connector shipped its author-trust filter off by default, so text from a stranger’s pull request and issue comments reached the agent as trusted instructions. Behind every tool call sat one full-scope token with no per-action check, meaning injected text could drive merges, approvals and secret reads with no human in the loop.
- 02
Read thousands of other companies’ live customer chats from an account that owned nothing
The platform’s only authorization was a caller-supplied user-id header the backend never verified. A canary account owning no data listed more than two thousand other tenants’ live support conversations, pulled their agents’ system prompts word for word, and could create and delete customer records anonymously.
- 03
Got a storefront’s AI assistant to hand out a customer export with no login
Asked for analytics, the commerce agent minted a pre-signed download link to a CSV of customer records and streamed it back in a hidden tool result. The link carried no cookie, token or session. A plain request returned names, emails, locations and order totals.
Twelve mechanisms behind how agents actually fail
Agents are failing in public
Every one of these is somebody’s shipped product
Three of the ones that got written up. Most never do.
API1 broken object level authorization
meta ai
guessable prompt ids let one user read another user’s chats
the server never checked who owned the prompt id
jul 2025 malwarebytes ↗
LLM08 tool-layer poisoning
cursor
a poisoned workspace turned allowlisted git commands into arbitrary execution
the allowlist was trusted, the environment it ran in was not
cve-2026-22708 nvd ↗
ASI01 agent-driven intrusion
mexican government agencies
one operator used a consumer ai to find the holes and pull the data
195 million identities out of tax, voter and civil registries
dec 2025 upguard ↗
How agents fail
Every way an agent can fail, security or reliability, becomes structured knowledge
Security failures
- Data leaks
- Prompt injection
- Tool abuse
- Cross-tenant access
Reliability failures
- Wrong action taken
- Off-policy behavior
- Instruction drift
- Confident wrong answers
Both live in one dataset
- Prompt injection 75
- Auth bypass 58
- Objective competition 55
- Jailbreak 41
- Remote code execution 41
- Independent
- We sit outside the deal and run the attacks ourselves
- Compounding
- Every engagement writes back, so the next one starts ahead
- Field-wide
- Patterns travel between engagements. Your data stays yours
How a run works
Four steps, and the last one is why the next run is better
- 01
Connect
Point us at the agent. An endpoint, an SDK, or the live channel your users already talk to.
- 02
Attack
A fleet of agents probes it in parallel. Every refusal tells the next probe where the guard actually sits.
- 03
Prove
Nothing counts until the target says it. Every finding carries the transcript that produced it.
- 04
Compound
The finding writes back to the corpus. The next run, on any agent, starts from what this one learned.
For teams shipping AI into enterprises
Know how your agent fails and fix it before someone else asks you
We find it first and write it up in the language their reviewer already uses, so the deal stops waiting on it.
- Every finding carries the transcript that produced it
- Severity and business impact on each one
- Mapped to the frameworks the reviewer already asks about
- Re-run on every deployment, so the evidence stays current
For teams building and deploying agents
Know how your agents fail before you ship them
Drop us into the pipeline and the failure knowledge arrives as part of the build, in the same place your tests already report.
- An endpoint
- point us at the agent the way your users reach it
- An SDK call
- wrap the agent and we work it from inside your stack
- A live channel
- the chat widget, the phone line, the support inbox
- Your CI
- a run on every deployment, so a regression surfaces as one
Start without talking to anyone
- sign up and look around the corpus
- read a full sample report end to end
- run against a sandbox agent we host
Running against your own production agent is scoped with us first.