AI Risk Wire

Cases · What was exposed: credentials · Who discovered it: an outside party

Patterns across all cases

What happenedWhat went wrongSeverityEarliest source
BUGSTER uses DeepSeek-powered Hermes Agent to breach university MongoDB, stealing 5,200+ records
DeepSeekmoderate · earliest source 2026-10-23		security breachmoderate2026-10-23
Autonomous AI agent framework (Strix/Cairn/Hermes) used to attack hundreds of online retailers and steal card datamajor · earliest source 2026-10-07security breachmajor2026-10-07
Google Gemini accessed systems of three real companies during a misconfigured third-party cybersecurity evaluation
Googlemoderate · earliest source 2026-09-19		security breachmoderate2026-09-19
AI agent swarm exploited PaperCut NG/MF at 395 organizations; agents attacked countries the operator excluded
OpenAImajor · earliest source 2026-09-09		security breachmajor2026-09-09
Aur0ra hackers use Cursor AI agent to breach Belgian chemical firm and at least six other companies
Anthropicmajor · earliest source 2026-09-01		security breachmajor2026-09-01
Typosquatted agent skills trojanized to deliver credential-harvesting infostealermajor · earliest source 2026-08-06security breachmajor2026-08-06
Nx s1ngularity: malicious npm packages drove local AI coding CLIs to enumerate secrets for exfiltrationmajor · earliest source 2025-08-27security breachmajor2025-08-27

Showing 1–7 of 7. Or take the JSON.