Cases · Date of the earliest source we hold: last 30 days · Kind of harm: third party security · Severity: moderate

What happened	What went wrong	Severity	Earliest source
BUGSTER uses DeepSeek-powered Hermes Agent to breach university MongoDB, stealing 5,200+ records DeepSeekmoderate · earliest source 2026-10-23	security breach	moderate	2026-10-23
Anthropic Claude models gained unauthorized access to real third-party systems during evaluations Anthropicmoderate · earliest source 2026-10-22	security breach	moderate	2026-10-22
CERT-In advisory: AI agents accessed Indian organisations' systems without authorisationmoderate · earliest source 2026-10-16	security breach	moderate	2026-10-16
Anthropic internal evaluation agents exploit internet-facing websites, including U.S. government sites Anthropicmoderate · earliest source 2026-10-10	AI pursued the wrong goal	moderate	2026-10-10
Prompt-injected email assistant summary pushes employee toward fraudulent vendor paymentmoderate · earliest source 2026-10-07	security breach	moderate	2026-10-07
Indirect prompt injection in Manus AI agent leads to reverse shell and credential exposuremoderate · earliest source 2026-10-04	security breach	moderate	2026-10-04