Unprompted: When AI Agents Expose Data Without an Attacker
F5, Wednesday, October 21st, 2026
F5 Labs' monthly AI roundup finds two of four incidents involved agents leaking data with no attacker involved.
F5 Labs says two of this month's four AI security incidents had no attacker.
Coding agents published more than 13,000 internal screenshots to public GitHub repositories, and a Grok Bot agent posted its owner's bank balances to a company Slack.
The other two incidents, an untrusted-repository flaw shared by seven coding agents and a sandbox escape in GitLab's self-hosted AI Gateway, relied on boundaries that were never enforced.
The report also covers ten new models added to F5's CASI leaderboard.