AI Risk Wire

AI cyberattacks

Also on: Risk AI used to run a cyber attack

89 of 716 published incidents · severe 1 · major 47 · moderate 31 · minor 8 · negligible 2

Confirmed 27 · Preliminary 62

Who caught it, where the source says (48 of 89): Automated monitoring 1 · Human review 2 · Third party 31 · Victim 7 · Outside researcher 7

Incidents per week

25 in the week of 26 Oct 2026, up from an average of 4 a week.

Week of 10 Aug 2026: 33Week of 17 Aug 2026: 11Week of 24 Aug 2026: 22Week of 31 Aug 2026: 22Week of 7 Sep 2026: 22Week of 14 Sep 2026: 44Week of 21 Sep 2026: 44Week of 28 Sep 2026: 44Week of 5 Oct 2026: 22Week of 12 Oct 2026: 22Week of 19 Oct 2026: 88Week of 26 Oct 2026: 2525Week of 2 Nov 2026: 11 10 Aug17 Aug24 Aug31 Aug7 Sep14 Sep21 Sep28 Sep5 Oct12 Oct19 Oct26 Oct2 Novto date
DisclosedIncidentSeverityEvidence
2026-11-02CyberStrikeAI LLM-orchestrated intrusions against educational organizations in Africa and Latin America LR-2026-0818majorPreliminary
2026-10-31ChatGPT shared-link Preview sandbox escape via MathLive postMessage listener LR-2026-0299minorConfirmed
2026-10-31Chainalysis internal systems breached by attacker using "agentic offensive techniques" LR-2026-0297majorConfirmed
2026-10-30North Korean group uses AI to mass-produce tailored phishing PDFs against South Korean users LR-2026-0307moderatePreliminary
2026-10-30Malicious Hugging Face 'Qwen2 test' models execute hidden crypto miner and reverse shell via trust_remote_code LR-2026-0302majorPreliminary
2026-10-30Anthropic Claude model develops working Linux kernel MPTCP root exploit (CVE-2026-98432) LR-2026-0292minorConfirmed
2026-10-30Trezor Safe 5 from reseller CryptoBilis found with implant board exfiltrating recovery phrase over cellular network LR-2026-0291moderateConfirmed
2026-10-30n0n ransomware crew's exposed staging server reveals AI coding agent configuration and attack tooling LR-2026-0290majorPreliminary
2026-10-30Alleged $6.3B Binance exploit funds laundered via automated, AI-assisted transaction patterns LR-2026-0289severePreliminary
2026-10-30AI-assisted cyberattacks and data breaches against Japanese organizations (METI, GMO Internet, NPA, Sony Network Communications, IDC… LR-2026-0284majorPreliminary
2026-10-30VAPOR PANDA agentic AI framework (ARTEX + DeepSeek) used for multi-target espionage campaign LR-2026-0279majorConfirmed
2026-10-29Claude agent detects MeshAgent screen-capture malware on high-stakes poker player's machine LR-2026-0301majorConfirmed
2026-10-29AI-assisted exploitation of PHP2Shell and Fragnesia flaws to breach 25 servers across four countries LR-2026-0280moderatePreliminary
2026-10-29NIK C2 implant routes actor prompts to OpenAI API using victim's API key LR-2026-0273majorPreliminary
2026-10-29GLM-5.3 completes multi-stage cyberattack scenarios and reproduces code in violation of instructions in Irregular evaluation LR-2026-0270minorConfirmed
2026-10-28Agentic AI intrusions by four threat actors (CrowdStrike 2026 Global Threat Report) LR-2026-0266majorPreliminary
2026-10-28Unreleased Anthropic research model chains zero-days into working exploits across Chrome, Safari, Android, Windows and Linux LR-2026-0265negligibleConfirmed
2026-10-28CyberStrikeAI multi-agent platform drives end-to-end attack workflow against Japanese organizations LR-2026-0258majorConfirmed
2026-10-28Cathedral AI agents breach Anthropic internal systems via third-party business software LR-2026-0257majorConfirmed
2026-10-28Warp cloud platform breached by swarm of AI agents via infrastructure supplier LR-2026-0256majorConfirmed
2026-10-28Dual-agent Claude Code/PentestGPT intrusion against 15 Argentine healthcare organizations LR-2026-0251moderateConfirmed
2026-10-26Symantec honeypot captures autonomous 'Skynet mode' attack agent hijacking exposed AI models LR-2026-0260minorPreliminary
2026-10-26Claude-abused credential-harvesting pipeline decompiling 1.8 million Android APKs LR-2026-0255majorPreliminary
2026-10-26AI-assisted ARTEX hacking campaign targeting financial and personal data across 19 markets LR-2026-0254majorPreliminary
2026-10-26Indonesian-speaking operator uses Claude Code to compromise Indonesian and Bangladeshi government domains LR-2026-0246majorPreliminary

Page 1 of 4 · Next

By AI system named: Claude 9 · Claude Code 5 · DeepSeek 3 · ARTEX 2 · ChatGPT 2 · CyberStrikeAI 2

Download: JSON · CSV