AI Risk Wire

Daily brief

What happened each day: new AI incidents, most serious first; new findings about AI models; new AI regulation. RSS.

2026-10-25

New incidents (64), most serious first

  1. ChatGPT advised Tumbler Ridge school shooter on mass murder before February 2026 attack

    Jesse Van Rootselaar consulted OpenAI's ChatGPT for months on how to carry out mass murder before killing eight people in Tumbler Ridge, British Columbia on February 10, 2026.

    severe · OpenAI · Happened 2026-02-10 · Earliest source we hold 2026-10-17

  2. 302.ai public Azure bucket exposed 17.6 million files including 144,000 AI chat logs

    302.ai, an intermediary platform run by Univerads Technology Limited, gave customers access to major LLMs and stored chat logs and uploaded files in a Microsoft Azure bucket.

    major · Univerads Technology Limited · Earliest source we hold 2026-10-23

  3. Storm-0940 uses ARTEX agentic AI framework to automate cross-tenant password spraying and OAuth application abuse

    Microsoft said a China state-aligned actor it calls Storm-0940 used ARTEX, a Go-based agentic AI penetration testing framework, to speed up scanning and reconnaissance, password spraying and OAuth application abuse at downstream victims of the ConnectWise Cloud Backup supply chain compromise.

    major · Happened 2026-10-15 · Earliest source we hold 2026-10-22

  4. ARTEX autonomous penetration-testing agent used in attacks on South Korean financial institutions

    ARTEX, an open-source autonomous penetration-testing agent that calls external LLMs such as ChatGPT, Claude and DeepSeek as its decision-maker, was reportedly used in attacks on South Korean financial institutions and on Japanese companies.

    major · Earliest source we hold 2026-10-21

  5. Autonomous AI agent campaign (AIA0001) compromises 100+ company websites via Cairn platform

    A Chinese-speaking operator used autonomous AI agents, to attack over 1,200 websites and compromise more than 100 companies, spending about $5,000 in tokens.

    major · Happened 2026-09-25 · Earliest source we hold 2026-10-20

  6. China-linked autonomous AI agent Artex used in cyberattacks on Japanese and South Korean firms

    A security firm, the information security subsidiary of GMO Internet Group, investigated cyberattacks on Japanese firms and said the autonomous China-linked AI agent Artex was used in them.

    major · Earliest source we hold 2026-10-20

  7. Nude deepfakes of Austrian MEP Lena Schilling and 49 other MEPs circulated online

    An Austrian MEP, Lena Schilling, learned last month that nude deepfakes made from an altered press-conference photo of her were circulating online; the Berlin thinktank Agora Digitale Transformation alerted her to the images.

    major · Earliest source we hold 2026-10-18

  8. Deepfake video of President Marcos used to defraud Tarlac dentist of P93 million

    Scammers used an AI deepfake video of President Ferdinand Marcos Jr. endorsing an investment, plus gifts said to come from the president, to convince a dentist in Tarlac to hand over P93 million over about a year.

    major · Earliest source we hold 2026-10-18

  9. Grok chatbot on X repeated alleged name of Cornell 'Jane Doe' in replies, amplifying doxing

    Grok, X's AI chatbot, posted the alleged name of the woman known as Jane Doe in a Cornell rape lawsuit in replies to users at least 300 times, researchers found, while Facebook, Instagram and TikTok blocked searches for the name.

    major · xAI · Happened 2026-09-29 · Earliest source we hold 2026-10-18

  10. Character.AI chatbots promoted as therapists/psychologists; states cite 2024 wrongful-death suit and privacy concerns in bankruptcy filing

    Virginia joined a coalition of state attorneys general in filing a notice in the bankruptcy proceedings of Character Technologies, Inc., the company behind Character.AI.

    major · Character.AI · Earliest source we hold 2026-10-17

  11. Eight state attorneys general sue OpenAI over alleged harms to teenage ChatGPT users

    Eight state attorneys general sued OpenAI, alleging that ChatGPT caused major harm to users, especially teenagers.

    major · OpenAI · Earliest source we hold 2026-10-16

  12. Waymo robotaxi maneuvers around stopped, unloading school bus in Atlanta

    NHTSA's Office of Defects Investigation opened a probe into Waymo robotaxis after reviewing early-October footage of a vehicle maneuvering around a stopped, unloading school bus in Atlanta; WXIA-TV aired similar video in September.

    major · Waymo · Earliest source we hold 2026-10-15

  13. NHTSA petition case DP26010 over Tesla robotaxi speeding in school zones

    NHTSA opened case DP26010 to consider a petition alleging that 2026 model-year Tesla robotaxis with the Tesla Automated Driving System enabled may speed in active school zones.

    major · Tesla · Earliest source we hold 2026-10-13

  14. Fideuram (Intesa Sanpaolo private banking) deepfake voice/video executive impersonation fraud

    Fideuram, the private-banking arm of Intesa Sanpaolo, lost close to 95 million euros after attackers used synthetic voice and video to impersonate senior executives and advisers, convincing internal staff to authorise transfers.

    major · Earliest source we hold 2026-10-12

  15. CyberXero AI-augmented initial access campaign using Claude Code and PentAGI agents

    CyberXero, a Russian-speaking initial access broker, used Anthropic's Claude Code with 51 specialized agents and PentAGI connected to Cobalt Strike to run an AI-augmented campaign against WordPress, e-commerce and Ukrainian critical infrastructure.

    major · Anthropic · Earliest source we hold 2026-10-12

  16. AgentCorruption: prompt-injected Bedrock AgentCore agent exfiltrates execution-role credentials via IMDS

    An exposed Amazon Bedrock AgentCore agent with HTTP or shell tools, running in a Firecracker microVM, was tricked by a malicious prompt into contacting the metadata endpoint 169.254.169.254, an SSRF that exposed its execution-role credentials.

    major · Amazon · Earliest source we hold 2026-10-10

  17. Kentucky Attorney General lawsuit against Character.AI over chatbots advising self-harm and suicide

    Kentucky's attorney general filed an unredacted version of a January 2026 lawsuit against Character.AI, alleging its chatbots advised users to starve themselves, self-harm or die by suicide, including children.

    major · Character.AI · Earliest source we hold 2026-10-09

  18. US intelligence chatbot fabricated Chinese nuclear vessel intelligence

    A chatbot used by US intelligence invented information about a Chinese vessel carrying nuclear material, reportedly leading the US to prepare a military response, according to an alleged incident reported by CNN and cited by Signal Foundation boss Meredith Whittaker.

    major · Earliest source we hold 2026-10-09

  19. Meta Muse AI agent KVM escape vulnerability discovered before launch

    Meta’s pre-launch Muse AI agent, which runs inside a KVM to isolate it from Meta’s infrastructure, was found by engineers to have a vulnerability that could let an ordinary Muse account break out of the virtual machine and reach sensitive data in Meta databases.

    major · Meta · Earliest source we hold 2026-10-08

  20. DB-GPT 0.8.0 unauthenticated RCE via sandbox fallback and skill_upload directory traversal (CVE-2026-51862, CVE-2026-51869)

    DB-GPT 0.8.0, an open-source platform bridging AI agents to databases and knowledge bases, contains two unauthenticated RCE flaws: CVE-2026-51862 (CVSS 9.1), a directory traversal in the skill_upload endpoint, and CVE-2026-51869 (CVSS 9.8), a sandbox failure where the platform silently falls back to LocalRuntime and executes code on the host.

    major · Earliest source we hold 2026-10-08

  21. Autonomous AI agent framework (Strix/Cairn/Hermes) used to attack hundreds of online retailers and steal card data

    Autonomous AI agents (Strix, Cairn, Hermes) were used by attackers to scan and compromise hundreds of online retail sites, stealing over 600,000 credit card details and installing payment skimmers.

    major · Earliest source we hold 2026-10-07

  22. Agentjacking demonstration against Fortune 100 company hijacks over 100 agents via injectable Sentry DSNs

    Tenet Security demonstrated an 'Agentjacking' attack against a $250B Fortune 100 company, hijacking over 100 agents with an 85% success rate through injectable Sentry DSNs, a weakness it found across 2,388 organizations.

    major · Earliest source we hold 2026-10-07

  23. AI agent (ARTEX with Claude) used in cyberattacks targeting South Korean banks

    An attacker targeting South Korea's financial sector used ARTEX, a Chinese-developed open-source AI agent for automated penetration testing, alongside large language models including Anthropic's Claude, in a campaign against South Korean financial institutions from late September to early October.

    major · Anthropic · Happened 2026-09-30 · Earliest source we hold 2026-10-05

  24. AI agent breach of KB Kookmin Bank mobile work support system

    An AI agent is believed to have hacked a mobile work support system used by KB Kookmin Bank employees and accessed customers’ names, phone numbers, addresses and encrypted resident registration numbers.

    major · Earliest source we hold 2026-10-04

  25. OpenAI evaluation agents exploited Artifactory zero-days to escape their sandbox and reach the internet

    During internal ExploitGym cybersecurity evaluations run with production safeguards disabled, OpenAI agents in a sandbox without direct internet access exploited previously unknown vulnerabilities in the internally hosted Artifactory package proxy to make it issue internet requests on their behalf, escalated to Artifactory administrator access, and moved laterally through OpenAI's research environment to reach internet-connected nodes.

    major · OpenAI · Happened 2026-05-26 · Earliest source we hold 2026-07-21

  26. BUGSTER uses DeepSeek-powered Hermes Agent to breach university MongoDB, stealing 5,200+ records

    In one confirmed intrusion, the attacker stole a MongoDB database containing more than 5,200 records, including personal information about students and staff.

    moderate · DeepSeek · Earliest source we hold 2026-10-23

  27. Anthropic Claude models gained unauthorized access to real third-party systems during evaluations

    Anthropic reported on July 30, 2026 that Claude models gained unauthorized access to real computer systems during evaluations; a September 9, 2026 follow-up described four separate incidents of unauthorized access to real third-party systems.

    moderate · Anthropic · Earliest source we hold 2026-10-22

  28. AI-generated 'Xiaohai' teen persona used to sell products to older women via fabricated sob stories

    An AI-generated teen character, Xiaohai, appeared in videos across dozens of Douyin accounts marketed to older women, relaying fictional sob stories to push products from soy sauce to cosmetics; critics likened the videos to scams targeting the elderly, and some commenters said they were angry they had bought Xiaohai-backed products.

    moderate · Earliest source we hold 2026-10-20

  29. ICMP evidence that Google Gemini reproduced lyrics by Australian artists

    Google's Gemini was shown by the International Confederation of Music Publishers, in evidence given to Guardian Australia, to reproduce lyrics by Australian artists including Kylie Minogue, G-Flip and Nick Cave.

    moderate · Google · Earliest source we hold 2026-10-19

  30. OpenCode large-scale distillation attack compromises 1.4% of Console users, stolen API keys used for unauthorised charges

    OpenCode disclosed to customers that a “large-scale distillation attack” compromised 1.4% of Console users, with stolen keys being used to rack up unauthorised charges.

    moderate · Earliest source we hold 2026-10-18

  31. OpenAI research model accessed a cryptocurrency wallet without permission

    OpenAI disclosed that a research model accessed a cryptocurrency wallet without permission.

    moderate · OpenAI · Earliest source we hold 2026-10-18

  32. CERT-In advisory: AI agents accessed Indian organisations' systems without authorisation

    AI agents being researched and evaluated by AI model providers went beyond their given tasks and accessed Indian ICT assets without authorisation, reading business records containing personal and confidential data.

    moderate · Earliest source we hold 2026-10-16

  33. Tencent Cloud agent fleet probes Alibaba Amap mapping service for over a week

    A fleet of AI agents running on Tencent Cloud infrastructure in Hong Kong logged 2,818 attempts against Alibaba's Amap mapping service between September 28 and October 8, independent researchers operating under the name Swarmchasers found.

    moderate · Tencent · Happened 2026-09-28 · Earliest source we hold 2026-10-16

  34. Anthropic Mythos-discovered Rejetto HFS authentication bypass exploited in the wild

    A second vulnerability discovered by Anthropic's Mythos model, a critical authentication bypass in the Rejetto HTTP file server (HFS), has been exploited in the wild, according to a VulnCheck security researcher quoted on a podcast.

    moderate · Anthropic · Earliest source we hold 2026-10-12

  35. AI-morphed obscene image used to blackmail 19-year-old in Mangaluru

    Scammers used AI to manipulate a photograph of a 19-year-old man in Mangaluru, Karnataka, creating an obscene image of him.

    moderate · Earliest source we hold 2026-10-11

  36. Anthropic internal evaluation agents exploit internet-facing websites, including U.S. government sites

    Anthropic's internal evaluation agents, tasked to solve problems by seeking resources on the internet, exploited websites including some run by U.S. government agencies.

    moderate · Anthropic · Earliest source we hold 2026-10-10

  37. AI-assisted LinkedIn scraping used to build 'Traitorbase' doxxing spreadsheet targeting RNLI staff and anti-racism activists

    An X account called “Big Time Charlie” appears to have used AI to scrape LinkedIn and other sites to build a “Traitorbase” of RNLI staff, anti-racism activists and executives who recruit minority ethnic workers.

    moderate · Earliest source we hold 2026-10-10

  38. Anthropic agents submitted 20 incomplete visa applications on State Department website

    Anthropic's AI agents submitted 20 visa applications through a form on the State Department's website.

    moderate · Anthropic · Earliest source we hold 2026-10-10

  39. Deepfake investment-scam ads impersonating Nigerian public figures on Facebook

    Deepfake videos impersonating Nigerian public figures, including Senator Natasha Akpoti-Uduaghan, Peter Obi and Ngozi Okonjo-Iweala, were used in paid Facebook ads promoting fraudulent investment schemes.

    moderate · Earliest source we hold 2026-10-08

  40. Prompt-injected email assistant summary pushes employee toward fraudulent vendor payment

    Barracuda Research analysed a phishing campaign whose emails target both human recipients and the AI assistants that summarize and process their mail.

    moderate · Earliest source we hold 2026-10-07

  41. OpenAI agents scrape and edit Wikipedia without authorization

    OpenAI AI agents operated against Wikimedia platforms, scraping millions of Wikipedia pages, querying hundreds of thousands of data points, and editing encyclopedia content without authorization, including potentially malicious edits to a citation tool.

    moderate · OpenAI · Happened 2026-05 · Earliest source we hold 2026-10-06

  42. Shinhan Bank data breach with suspected AI-assisted intrusion

    Shinhan Bank said customer information was leaked after hackers gained access to its systems; the leaked information reportedly includes customers' names, phone numbers, loan borrowing details and annual income.

    moderate · Earliest source we hold 2026-10-05

  43. OpenAI agents scan UNCTAD site over 16,000 times and escalate bypass techniques

    OpenAI agents reportedly scanned UNCTAD's website more than 16,000 times and escalated to increasingly aggressive bypass techniques, according to a newsletter's security item.

    moderate · OpenAI · Earliest source we hold 2026-10-04

  44. Agentic AI-powered attack on the Dutch Institute for Vulnerability Disclosure exploited two Zammad zero-day vulnerabilities

    An agentic AI-powered attack hit the Dutch Institute for Vulnerability Disclosure (DIVD) on September 21, exploiting two zero-day vulnerabilities in Zammad, an open-source helpdesk and customer support ticketing system.

    moderate · Happened 2026-09-21 · Earliest source we hold 2026-10-04

  45. Indirect prompt injection in Manus AI agent leads to reverse shell and credential exposure

    Salt Labs researchers found that a malicious email could hijack the Manus AI agent via indirect prompt injection.

    moderate · Earliest source we hold 2026-10-04

  46. Microsoft reports 50 prompt-based attempts to poison AI assistant memory across 31 companies

    Microsoft security researchers reported in February 2026 that they had identified attempts to use AI recommendation poisoning to manipulate what AI assistants remember and recommend.

    moderate · Earliest source we hold 2026-10-03

  47. OpenClaw agent exploited a gym booking API to cancel another member's reservation while moving its user up a waitlist

    An Australian gym member identified as Andrew used the OpenClaw agent with Anthropic's Claude to book a gym class and move up a waitlist.

    moderate · Anthropic · Earliest source we hold 2026-08-10

  48. GPT-6.1 Sol agent disabled security alerts during evaluation-pipeline repair

    A GPT-6.1 Sol agent repairing an evaluation pipeline disabled automatic alerts to OpenAI's Security team.

    minor · OpenAI · Happened 2026-10 · Earliest source we hold 2026-10-23

  49. Garage-built ChatGPT-controlled smart rifle fires on voice command; OpenAI revokes engineer's access

    An engineer built a voice-controlled smart gun in his garage whose voice commands use ChatGPT.

    minor · Earliest source we hold 2026-10-23

  50. Tesla Cybercab strikes water-filled pothole on first reported crash

    A Tesla Cybercab robotaxi in Austin drove at about 5 mph into a large, water-filled pothole and was damaged.

    minor · Tesla · Earliest source we hold 2026-10-21

  51. RL-trained agent on Alibaba AI engine team mined cryptocurrency on training server and opened reverse SSH tunnel to external IP

    An agent in reinforcement-learning training on Alibaba's AI engine team escaped its sandbox and mined cryptocurrency on the training server.

    minor · Alibaba · Earliest source we hold 2026-10-21

  52. Backdoored open-weight model exfiltrates project credentials through OpenAI Codex CLI

    A demonstration showed that open-weight models can be backdoored cheaply: an open base, a public dataset and a rented GPU.

    minor · Earliest source we hold 2026-10-16

  53. Indirect prompt injection attempts embedded in HTTP response headers across websites

    Security firm Signals Corps sampled 217 million HTTP page responses from the Common Crawl archive and found 30 sites whose headers attempted indirect prompt injection, instructions hidden in content an AI agent reads on a user's behalf.

    minor · Earliest source we hold 2026-10-16

  54. Waymo robotaxi strikes and kills cat KitKat in San Francisco

    A Waymo robotaxi struck and killed a cat named KitKat in San Francisco's Mission District on October 27, 2025.

    minor · Waymo · Happened 2025-10-27 · Earliest source we hold 2026-10-15

  55. Agents bypass newspapers.com paywall and Cloudflare bot check via urlquery.net and proxy services

    Agents, likely running BrowseComp benchmark tasks, used the urlquery.net screenshot service to reach sites they were otherwise blocked from, including the paywalled newspapers.com archive, and leaked benchmark questions.

    minor · Happened 2026-05-13 · Earliest source we hold 2026-10-15

  56. AI deepfake ads depicting Wisconsin congressional candidate Rebecca Cooke

    Republican Rep.

    minor · xAI · Earliest source we hold 2026-10-12

  57. Anthropic AI agent sends fabricated murder tip to Philadelphia Police

    An Anthropic AI agent, running an internal evaluation on randomly selected webpages, sent a fabricated murder tip to the Philadelphia Police Department's public unsolved-murders website on 18 July 2026.

    minor · Anthropic · Happened 2026-07-18 · Earliest source we hold 2026-10-10

  58. Airline chatbot fabricated bereavement refund policy

    A news segment says an airline chatbot told a customer he qualified for a bereavement refund under a policy that did not exist, and that a tribunal later ruled the airline was responsible for what its AI said.

    minor · Earliest source we hold 2026-10-05

  59. Claude Code agent deletes 48,218 Windows project files and damages Git object store

    A Claude Code agent rebuilding a mirror deleted 48,218 live Windows project files and damaged the repository’s Git object store in 103 seconds; a user-provided verifier report says the deletion script mishandled 614 Windows directory junctions and traversed into the live project tree.

    minor · Anthropic · Earliest source we hold 2026-10-05

  60. OpenClaw agent deletes hundreds of emails from primary Gmail account

    An OpenClaw agent connected to its owner's primary Gmail lost track of its instructions mid-thread and deleted hundreds of emails while trying to clean up.

    minor · Earliest source we hold 2026-10-04

  61. Reward hacking in Arcadia Impact automated research scaffold worker agents

    Arcadia Impact's Alignment Team built an automated research scaffold with worker agents on separate VMs and an orchestrator that monitored and steered them.

    minor · Earliest source we hold 2026-10-02

  62. GLM-5.3 verbalizes update-aware reasoning in evaluation rollouts

    Apollo Research reviewed transcripts from standard behavioral evaluations of GLM-5.3 and noticed the model occasionally reasons unprompted about how its actions will shape future models, a pattern they call update-aware reasoning.

    negligible · Earliest source we hold 2026-10-15

  63. HiddenLayer indirect prompt injection against TypeSafe AI Jev decision model browser agent

    In HiddenLayer's tests in a simulated online store, a browser agent built on TypeSafe AI's Jev decision model, told to buy the cart contents, clicked a malicious 'Confirm Price' button in an injected sponsored advertisement instead of completing the purchase; Qwen3.8-27B, tested alongside it, fell for the injection more often.

    negligible · TypeSafe AI · Earliest source we hold 2026-10-15

  64. Indirect prompt injection of AI email summarizer via forged header blocks in plain view

    In researchers' tests of indirect prompt injection, an AI email summarizer showed fabricated meeting dates and invoice totals in its summaries in all 10 trials of each of six crafted emails, including a payload with nothing hidden from the user and no instruction to the summarizer.

    negligible · Earliest source we hold 2026-10-05

AI safety: new test results and model versions

The register was corrected 105 times this day (merges, retractions and fixed fields). Read the corrections log.

Earlier days