Evidence
Telecom intercepts and open agent servers expose data in motion
| Date | Case | Country | What happened | Source |
|---|---|---|---|---|
| Dec 2024 | VW Cariad leak | Germany | Location data for about 800,000 EVs in a misconfigured cloud store | Source |
| Aug 2025 | Salt Typhoon FBI update | China (attacker) | Telecom intrusions reached call records and lawful-intercept systems | Source |
| Jul 2025 | Knostic MCP scan | Global | 1,862 MCP servers exposed; all 119 checked by hand listed tools without login | Source |
| Jul 2026 | Exposed by Design study | Global | 47 servers had critical tool-poisoning findings | Source |
Registry
One registry incident involves data in transit
Registry incidents meet a stricter bar than the cases above: public sources name the developer, the failed control and who found it.
| Incident | Date | Agent | Control that failed |
|---|---|---|---|
| EchoLeak Turns Microsoft 365 Copilot Into a Data Leak | Jan 2025 | Enterprise copilot | Untrusted email could direct the copilot to privileged data |
Exposure
Three of 17 agent types rate very significant or critical on connectivity surface
From the attack surface ratings, the agent types where this risk has the widest path in.
| Agent type | Dimension | Rating |
|---|---|---|
| Drones | Connectivity surface | Very significant |
| Fleets and swarms | Connectivity surface | Very significant |
| Smart home assistants | Connectivity surface | Very significant |
Controls that bound it
- Access Control and Permissions: what an agent can reach and on whose authority
- Identity and Cryptographic Attestation: who or what is acting, proven cryptographically
- Telemetry Integrity: whether the data feeding an agent has been tampered with
Rules
China controls data export by threshold; the US bans adversary connected-vehicle software
| Rule | Jurisdiction | What it requires | Status |
|---|---|---|---|
| Cross-border data flow provisions | China | Filing, contract or assessment by volume threshold | Mar 22, 2024 |
| Network data security management regulations | China | Processing and cross-border rules | Effective Jan 1, 2025 |
| BIS connected vehicle rule | US | Bans China- and Russia-linked connectivity software and hardware | Final Jan 2025 |
| NIS2 Directive | EU | Security duties for telecom and digital infrastructure | Deadline Oct 17, 2024 |
Status colors: green in force, blue voluntary standard or framework, amber adopted and phasing in, gray draft or pending, red withdrawn.
Record
Page Record
- Risk group
- Data Risks
- Datasets
- ai_risk_evidence.csv (4 rows); registry incidents (1 linked); ai_attack_surface.csv
- Key sources
- VW Cariad leak
Salt Typhoon FBI update
Knostic MCP scan
Exposed by Design study - Last verified
- October 2026