Security compromise: AI incidents

What has gone wrong with AI systems, where, and how badly.

Risk grouping Kind of failure The AI's part Developer Sector Severity Where it happened Clear filters

63 of 131 incidents

Risk groupings are set by a model from sentences quoted from each incident's sources. On 2026-10-24 a second model (deepseek-reasoner) classified 55 incidents without seeing those answers: it chose the same grouping for 36; for 10 one of the two left a question unanswered; 9 differ.

Date	Incident	Risk grouping	Developer	Severity	Where it happened
2026-10-27 reported	Qwen3.8-Flash-Next attempts outbound file upload to Beijing server during Cohere cybersecurity evaluation	Not yet classified Security compromise	Alibaba	minor	In evaluation
2026-10-25 reported	Unauthorized third-party AI agents detected operating inside US bank customer accounts	AI acting on its own Security compromise	Meta	moderate	In production
2026-10-23 reported	BUGSTER uses DeepSeek-powered Hermes Agent to breach university MongoDB, stealing 5,200+ records	AI used to exploit Security compromise	DeepSeek	moderate	In production
2026-10-22 reported	Anthropic Claude models gained unauthorized access to real third-party systems during evaluations	AI acting on its own Security compromise	Anthropic	moderate	In evaluation
2026-10-21 reported	ARTEX autonomous penetration-testing agent used in attacks on South Korean financial institutions	AI used to exploit Security compromise	Not stated	major	Not stated
2026-10-20 reported	China-linked autonomous AI agent Artex used in cyberattacks on Japanese and South Korean firms	AI used to exploit Security compromise	Not stated	major	Not stated
2026-10-18 reported	OpenAI research model accessed a cryptocurrency wallet without permission	AI acting on its own Security compromise	OpenAI	moderate	In research
2026-10-18 reported	OpenCode large-scale distillation attack compromises 1.4% of Console users, stolen API keys used for unauthorised charges	AI attacked Security compromise	Not stated	moderate	Not stated
2026-10-16 reported	Indirect prompt injection attempts embedded in HTTP response headers across websites	AI attacked Security compromise	Not stated	minor	Not stated
2026-10-16 reported	CERT-In advisory: AI agents accessed Indian organisations' systems without authorisation	AI acting on its own Security compromise	Not stated	moderate	In evaluation
2026-10-16 reported	Backdoored open-weight model exfiltrates project credentials through OpenAI Codex CLI	Harm by design Security compromise	Not stated	minor	In evaluation
2026-10-15 happened	Storm-0940 uses ARTEX agentic AI framework to automate cross-tenant password spraying and OAuth application abuse, including ConnectWise…	AI used to exploit Security compromise	Not stated	major	In production
2026-10-15 reported	HiddenLayer indirect prompt injection against TypeSafe AI Jev decision model browser agent	Supply chain attack Security compromise	TypeSafe AI	negligible	In evaluation
2026-10-12 reported	CyberXero AI-augmented initial access campaign using Claude Code and PentAGI agents	AI used to exploit Security compromise	Anthropic	major	Not stated
2026-10-12 reported	Anthropic Mythos-discovered Rejetto HFS authentication bypass exploited in the wild	Misuse by its own users Security compromise	Anthropic	moderate	In research
2026-10-10 reported	AgentCorruption: prompt-injected Bedrock AgentCore agent exfiltrates execution-role credentials via IMDS	AI attacked Security compromise	Amazon	major	In production
2026-10-08 reported	DB-GPT 0.8.0 unauthenticated RCE via sandbox fallback and skill_upload directory traversal (CVE-2026-51862, CVE-2026-51869)	AI used to exploit Security compromise	Not stated	major	In production
2026-10-08 reported	Meta Muse AI agent KVM escape vulnerability discovered before launch	Not yet classified Security compromise	Meta	major	Not stated
2026-10-07 reported	Agentjacking demonstration against Fortune 100 company hijacks over 100 agents via injectable Sentry DSNs	AI attacked Security compromise	Not stated	major	Not stated
2026-10-07 reported	Prompt-injected email assistant summary pushes employee toward fraudulent vendor payment	AI attacked Security compromise	Not stated	moderate	In production
2026-10-07 reported	Autonomous AI agent framework (Strix/Cairn/Hermes) used to attack hundreds of online retailers and steal card data	AI used to exploit Security compromise	Not stated	major	Not stated
2026-10-05 reported	Shinhan Bank data breach with suspected AI-assisted intrusion	AI used to exploit Security compromise	Not stated	moderate	Not stated
2026-10-05 reported	Indirect prompt injection of AI email summarizer via forged header blocks in plain view	AI attacked Security compromise	Not stated	negligible	In evaluation
2026-10-04 reported	Indirect prompt injection in Manus AI agent leads to reverse shell and credential exposure	AI attacked Security compromise	Not stated	moderate	In production
2026-10-04 reported	AI agent breach of KB Kookmin Bank mobile work support system	AI acting on its own Security compromise	Not stated	major	Not stated
2026-10-04 reported	OpenAI agents scan UNCTAD site over 16,000 times and escalate bypass techniques	AI acting on its own Security compromise	OpenAI	moderate	Not stated
2026-10-03 reported	Microsoft reports 50 prompt-based attempts to poison AI assistant memory across 31 companies	AI attacked Security compromise	Not stated	moderate	Not stated
2026-09-30 happened	AI agent (ARTEX with Claude) used in cyberattacks targeting South Korean banks	AI used to exploit Security compromise	Anthropic	major	Not stated
2026-09-29 reported	Connecticut pro se plaintiff sanctioned for prompt injection against court AI tool	AI attacked Security compromise	Not stated	minor	Not stated
2026-09-28 happened	Tencent Cloud agent fleet probes Alibaba Amap mapping service for over a week	AI failing in normal use Security compromise	Tencent	moderate	In evaluation
2026-09-26 reported	OpenAI agents bypass website security controls and republish SEC data	AI acting on its own Security compromise	OpenAI	moderate	Not stated
2026-09-25 happened	Autonomous AI agent campaign (AIA0001) compromises 100+ company websites via Cairn platform	AI used to exploit Security compromise	Not stated	major	In production
2026-09-25 reported	OpenAI agents attempt to exfiltrate data from public databases and breach Australian government systems	Harm by design Security compromise	OpenAI	major	In evaluation
2026-09-24 reported	SalesBleed: 0-click data exfiltration from Salesforce Agentforce via indirect prompt injection in Web-to-Lead form	AI attacked Security compromise	Salesforce	minor	In production
2026-09-23 reported	Anthropic model conducted state-sponsored espionage campaign against ~30 targets	AI used to exploit Security compromise	Anthropic	major	Not stated
2026-09-21 happened	Agentic AI-powered attack on the Dutch Institute for Vulnerability Disclosure exploited two Zammad zero-day vulnerabilities	Not yet classified Security compromise	Not stated	moderate	Not stated
2026-09-20 happened	OpenAI research model escapes to live internet via DNS misconfiguration during training	Harm by design Security compromise	OpenAI	major	In evaluation
2026-09-15 happened	AEPD-confirmed autonomous AI agent data breach (Spain)	AI acting on its own Security compromise	Not stated	moderate	Not stated
2026-09-01 reported	Aur0ra hackers use Cursor AI agent to breach Belgian chemical firm and at least six other companies	AI used to exploit Security compromise	Anthropic	major	In production
2026-08-31 happened	AI agent swarm exploited PaperCut NG/MF at 395 organizations; agents attacked countries the operator excluded	AI used to exploit Security compromise	OpenAI	major	Not stated
2026-08-27 reported	Claude sandbox DNS exfiltration via indirect prompt injection from Google Drive document	AI attacked Security compromise	Anthropic	moderate	In production
2026-08-13 happened	Indonesian-speaking operator uses Claude Code to compromise Indonesian and Bangladeshi government domains	Not yet classified Security compromise	Anthropic	major	Not stated
2026-08-05 reported	Claude in Chrome indirect prompt injection chain: inbox exfiltration, Drive persistence and account takeover	AI attacked Security compromise	Anthropic	minor	Not stated
2026-08-05 reported	Intent collision via X comment hijacks ChatGPT Atlas into mass WhatsApp phishing from victim's account	AI attacked Security compromise	OpenAI	moderate	In production
2026-08-04 reported	AISI cyber evaluation: Mythos 5 agent bypassed an audio CAPTCHA and abused a free DNS service to point a public record at an internal target	AI acting on its own Security compromise	Anthropic	moderate	In evaluation
2026-08-04 reported	AISI cyber evaluation: concurrent Mythos 5 agents coordinated via a shared GitHub account and a leaked access token	AI acting on its own Security compromise	Anthropic	moderate	In evaluation
2026-07-23 reported	AgentForger: CSRF via ChatGPT Workspace Agents Builder URL parameters forges attacker-controlled autonomous agent	AI attacked Security compromise	OpenAI	minor	In production
2026-07-21 reported	Model writes and runs code on external internet service to reach AISI evaluation infrastructure during impossible cyber evaluation	AI acting on its own Security compromise	Not stated	minor	In evaluation
2026-07-11 happened	Typosquatted agent skills trojanized to deliver credential-harvesting infostealer	AI attacked Security compromise	Not stated	major	In production
2026-06-18 happened	OpenAI evaluation agent breached Services Australia Medicare portal and wrote to government database	AI acting on its own Security compromise	OpenAI	major	In evaluation

Page 1 of 2 · Next

Browse incidents by

Risk grouping: AI acting on its own · AI used to exploit · Not yet classified · AI attacked · AI failing in normal use · Misuse by its own users · Harm by design · Supply chain attack

Kind of failure: Security compromise · Agent misalignment · Harmful output · Operational error · Privacy leak · Other kind · Hallucination · IP infringement · Physical safety

Developer: OpenAI · Anthropic · Google · Meta · Alibaba · Amazon · Character.AI · DeepSeek · Tesla · Waymo · xAI · Amazon Web Services · Character Technologies, Inc. · Replit · Salesforce · Tencent · TypeSafe AI · Univerads Technology Limited · Z.ai (Zhipu AI)

Sector: Information · Finance and Insurance · Retail Trade · Software Publishers · Public administration · technology · Transportation and Warehousing · AI platform / intermediary services · AI safety research · Artificial intelligence research and development · Arts, Entertainment, and Recreation · Autonomous vehicle / robotaxi transportation · Cloud computing · critical infrastructure and e-commerce · CRM software · Cybersecurity · education · Educational Services · Fitness and recreational sports centers · Food Manufacturing · Government AI safety and security evaluation · government AI safety evaluation · Healthcare and government · Information Security research · Insurance · Open knowledge platform / nonprofit encyclopedia · political campaigns · Public administration and government · Retail · Retail Trade; Transportation and Warehousing; Finance and Insurance · Scientific research and light source user facility · Software / AI coding tools · Software publishing / npm ecosystem

Severity: moderate · major · minor · negligible · severe

Where it happened: In production · In evaluation · In training · In research