AI attacked: AI incidents

What has gone wrong with AI systems, where, and how badly.

15 of 131 incidents

Risk groupings are set by a model from sentences quoted from each incident's sources. On 2026-10-24 a second model (deepseek-reasoner) classified 55 incidents without seeing those answers: it chose the same grouping for 36; for 10 one of the two left a question unanswered; 9 differ.

Date	Incident	Risk grouping	Developer	Severity	Where it happened
2026-10-18 reported	OpenCode large-scale distillation attack compromises 1.4% of Console users, stolen API keys used for unauthorised charges	AI attacked Security compromise	Not stated	moderate	Not stated
2026-10-16 reported	Indirect prompt injection attempts embedded in HTTP response headers across websites	AI attacked Security compromise	Not stated	minor	Not stated
2026-10-10 reported	AgentCorruption: prompt-injected Bedrock AgentCore agent exfiltrates execution-role credentials via IMDS	AI attacked Security compromise	Amazon	major	In production
2026-10-07 reported	Agentjacking demonstration against Fortune 100 company hijacks over 100 agents via injectable Sentry DSNs	AI attacked Security compromise	Not stated	major	Not stated
2026-10-07 reported	Prompt-injected email assistant summary pushes employee toward fraudulent vendor payment	AI attacked Security compromise	Not stated	moderate	In production
2026-10-05 reported	Indirect prompt injection of AI email summarizer via forged header blocks in plain view	AI attacked Security compromise	Not stated	negligible	In evaluation
2026-10-04 reported	Indirect prompt injection in Manus AI agent leads to reverse shell and credential exposure	AI attacked Security compromise	Not stated	moderate	In production
2026-10-03 reported	Microsoft reports 50 prompt-based attempts to poison AI assistant memory across 31 companies	AI attacked Security compromise	Not stated	moderate	Not stated
2026-09-29 reported	Connecticut pro se plaintiff sanctioned for prompt injection against court AI tool	AI attacked Security compromise	Not stated	minor	Not stated
2026-09-24 reported	SalesBleed: 0-click data exfiltration from Salesforce Agentforce via indirect prompt injection in Web-to-Lead form	AI attacked Security compromise	Salesforce	minor	In production
2026-08-27 reported	Claude sandbox DNS exfiltration via indirect prompt injection from Google Drive document	AI attacked Security compromise	Anthropic	moderate	In production
2026-08-05 reported	Claude in Chrome indirect prompt injection chain: inbox exfiltration, Drive persistence and account takeover	AI attacked Security compromise	Anthropic	minor	Not stated
2026-08-05 reported	Intent collision via X comment hijacks ChatGPT Atlas into mass WhatsApp phishing from victim's account	AI attacked Security compromise	OpenAI	moderate	In production
2026-07-23 reported	AgentForger: CSRF via ChatGPT Workspace Agents Builder URL parameters forges attacker-controlled autonomous agent	AI attacked Security compromise	OpenAI	minor	In production
2026-07-11 happened	Typosquatted agent skills trojanized to deliver credential-harvesting infostealer	AI attacked Security compromise	Not stated	major	In production

Browse incidents by

Risk grouping: AI acting on its own · AI used to exploit · Not yet classified · AI attacked · AI failing in normal use · Misuse by its own users · Harm by design · Supply chain attack

Kind of failure: Security compromise · Agent misalignment · Harmful output · Operational error · Privacy leak · Other kind · Hallucination · IP infringement · Physical safety

Developer: OpenAI · Anthropic · Google · Meta · Alibaba · Amazon · Character.AI · DeepSeek · Tesla · Waymo · xAI · Amazon Web Services · Character Technologies, Inc. · Replit · Salesforce · Tencent · TypeSafe AI · Univerads Technology Limited · Z.ai (Zhipu AI)

Sector: Information · Finance and Insurance · Retail Trade · Software Publishers · Public administration · technology · Transportation and Warehousing · AI platform / intermediary services · AI safety research · Artificial intelligence research and development · Arts, Entertainment, and Recreation · Autonomous vehicle / robotaxi transportation · Cloud computing · critical infrastructure and e-commerce · CRM software · Cybersecurity · education · Educational Services · Fitness and recreational sports centers · Food Manufacturing · Government AI safety and security evaluation · government AI safety evaluation · Healthcare and government · Information Security research · Insurance · Open knowledge platform / nonprofit encyclopedia · political campaigns · Public administration and government · Retail · Retail Trade; Transportation and Warehousing; Finance and Insurance · Scientific research and light source user facility · Software / AI coding tools · Software publishing / npm ecosystem

Severity: moderate · major · minor · negligible · severe

Where it happened: In production · In evaluation · In training · In research