AI Risk Wire

AI cyberattacks

Also on: Risk AI used to run a cyber attack

89 of 716 published incidents · severe 1 · major 47 · moderate 31 · minor 8 · negligible 2

Confirmed 27 · Preliminary 62

Who caught it, where the source says (48 of 89): Automated monitoring 1 · Human review 2 · Third party 31 · Victim 7 · Outside researcher 7

Incidents per month

40 in Oct 2026, up from an average of 11 a month.

Nov 2025: 0Dec 2025: 11Jan 2026: 0Feb 2026: 55Mar 2026: 22Apr 2026: 11May 2026: 22Jun 2026: 33Jul 2026: 1010Aug 2026: 1010Sep 2026: 1313Oct 2026: 4040Nov 2026: 11 Nov 25DecJan 26FebMarAprMayJunJulAugSepOctNovto date
DisclosedIncidentSeverityEvidence
2026-10-26Self-taught hacker uses AI coding agent and autonomous penetration-testing system to breach 90+ companies and steal 8.2 million records LR-2026-0245majorConfirmed
2026-10-23BUGSTER uses DeepSeek-powered Hermes Agent to breach university MongoDB, stealing 5,200+ records LR-2026-0239moderatePreliminary
2026-10-21Hackers use Claude and Grok agents in attacks on Latin American banks LR-2026-0803majorPreliminary
2026-10-21Stolen Anthropic and OpenAI API keys fuel model distillation black market LR-2026-0796moderatePreliminary
2026-10-21INC and Gentlemen ransomware affiliates expose 8,257 AI messages LR-2026-0789moderatePreliminary
2026-10-21Threat actor uses AI to plan and execute multiple cybercrime activities LR-2026-0786moderatePreliminary
2026-10-21ARTEX autonomous penetration-testing agent used in attacks on South Korean financial institutions LR-2026-0232majorPreliminary
2026-10-20China-linked autonomous AI agent Artex used in cyberattacks on Japanese and South Korean firms LR-2026-0229majorPreliminary
2026-10-20Autonomous AI agent campaign (AIA0001) compromises 100+ company websites via Cairn platform LR-2026-0228majorConfirmed
2026-10-12CyberXero AI-augmented initial access campaign using Claude Code and PentAGI agents LR-2026-0168majorPreliminary
2026-10-12Anthropic Mythos-discovered Rejetto HFS authentication bypass exploited in the wild LR-2026-0165moderatePreliminary
2026-10-07Autonomous AI agent framework (Strix/Cairn/Hermes) used to attack hundreds of online retailers and steal card data LR-2026-0133majorPreliminary
2026-10-05AI agent (ARTEX with Claude) used in cyberattacks targeting South Korean banks LR-2026-0140majorConfirmed
2026-10-04Agentic AI-powered attack on the Dutch Institute for Vulnerability Disclosure exploited two Zammad zero-day vulnerabilities LR-2026-0122moderatePreliminary
2026-10-02ChatGPT macOS app vulnerability exposed conversations, since fixed LR-2026-0797moderatePreliminary
2026-10-01AI agents attempt unauthorized access to Library and Archives Canada website LR-2026-0111negligiblePreliminary
2026-09-30XBOW autonomous agent finds Linux kernel DIBS loopback flaw enabling local root (CVE-2026-72018) LR-2026-0727minorPreliminary
2026-09-24CARBONATO AI-driven botnet hijacks Docker hosts and steals credentials LR-2026-0731moderateConfirmed
2026-09-23Open-source AI agents breach 27 companies and steal 600,000 card records LR-2026-0748majorPreliminary
2026-09-23Anthropic model conducted state-sponsored espionage campaign against ~30 targets LR-2026-0056majorConfirmed
2026-09-22EvilTokens AI-assisted device code phishing service disrupted by Microsoft LR-2026-0713majorPreliminary
2026-09-18Hacktron researchers use Claude to access OpenAI employee ChatGPT accounts LR-2026-0735moderatePreliminary
2026-09-17Hackers turn AI agent into cyber weapon by deleting safety refusals LR-2026-0734majorPreliminary
2026-09-17BlackHatSect0r DeepSeek-powered agent harvests 16,834 credentials LR-2026-0728majorPreliminary
2026-09-15Russia-linked cyberespionage group used Claude to reverse-engineer military drone firmware LR-2026-0752moderatePreliminary

Previous · Page 2 of 4 · Next

By AI system named: Claude 9 · Claude Code 5 · DeepSeek 3 · ARTEX 2 · ChatGPT 2 · CyberStrikeAI 2

Download: JSON · CSV