AI Risk Wire

Incidents

8 incidents

Risk: Supply-chain compromise Outcome: Not read yet

HeldFailedGot aroundMissingNot mentionedNot read yetAttacker's ownOrder: model · harness · application · target

DateIncidentRiskChainControls named
2026-10-30Backdoored Anthropic Claude VS Code extension on Cursor marketplace (v2.1.313) installs SSH backdoor for up to 5,000 developers
Anthropic		 Supply-chain compromise Not read yet
2026-10-28Cathedral AI agents breach Anthropic internal systems via third-party business software Supply-chain compromise Not read yet
2026-10-23Warp cloud platform breached by swarm of AI agents via infrastructure supplier Supply-chain compromise Not read yet
2026-10-16Backdoored open-weight model exfiltrates project credentials through OpenAI Codex CLI Supply-chain compromise Not read yet
2026-09-28Malicious startup hooks in 42 hijacked GitHub repositories execute payload when AI coding assistants open a workspace Supply-chain compromise Not read yet
2026-07-11Typosquatted agent skills trojanized to deliver credential-harvesting infostealer Supply-chain compromise Not read yet
2026-05-05Agent swarm attributed to OpenAI published thousands of RubyGems packages, gained RCE on RubyDoc.info, and attempted API-key theft
OpenAI		 Supply-chain compromise Not read yet
2025-07-23Amazon Q Developer VS Code extension shipped an injected prompt instructing the agent to wipe files and AWS resources
Amazon Web Services		 Supply-chain compromise Not read yet