AI Risk Wire

Cases · What was exposed: credentials · Quarter of the earliest source we hold: 2026-Q4

Patterns across all cases

What happenedWhat went wrongSeverityEarliest source
Indonesian-speaking operator uses Claude Code to compromise Indonesian and Bangladeshi government domains
Anthropicmajor · earliest source 2026-10-26		security breachmajor2026-10-26
BUGSTER uses DeepSeek-powered Hermes Agent to breach university MongoDB, stealing 5,200+ records
DeepSeekmoderate · earliest source 2026-10-23		security breachmoderate2026-10-23
Autonomous AI agent campaign (AIA0001) compromises 100+ company websites via Cairn platformmajor · earliest source 2026-10-20security breachmajor2026-10-20
OpenCode large-scale distillation attack compromises 1.4% of Console users, stolen API keys used for unauthorised chargesmoderate · earliest source 2026-10-18security breachmoderate2026-10-18
Backdoored open-weight model exfiltrates project credentials through OpenAI Codex CLIminor · earliest source 2026-10-16security breachminor2026-10-16
AgentCorruption: prompt-injected Bedrock AgentCore agent exfiltrates execution-role credentials via IMDS
Amazonmajor · earliest source 2026-10-10		security breachmajor2026-10-10
Autonomous AI agent framework (Strix/Cairn/Hermes) used to attack hundreds of online retailers and steal card datamajor · earliest source 2026-10-07security breachmajor2026-10-07
Indirect prompt injection in Manus AI agent leads to reverse shell and credential exposuremoderate · earliest source 2026-10-04security breachmoderate2026-10-04

Showing 1–8 of 8. Or take the JSON.