Every incident
has a story.

Northflank says customers reported unauthorized use of AI keys stored on its platform.

Cursor reports altered Claude Code extensions distributed through its marketplace.

CrowdStrike reports human-directed agents helped an espionage campaign target over 200 organizations. It confirmed further attacker activity inside nine organizations.

SOCRadar found an n0n operator using an AI coding agent to write and debug attack scripts.

Seoul police say a gang used ARTEX, an AI security-testing tool, to break into organizations and steal records.

NorForge observed intruders redirecting exposed Cairn agents to run malware.

Warp’s CEO reports unauthorized access to some AI activity records and usage data through a vendor.

A poisoned LiteLLM update stole cloud credentials that attackers then used, according to Wiz.

AI attacked Argentine healthcare.

AI-directed government intrusions.

AI-directed intrusions required human intervention.

AI-directed theft of client data.

Unit 42 reports AI-assisted cybercrime involving stolen student information.

Straiker reports CyberCartel used Claude and Grok against Latin American financial targets.

Railway reports an intruder decrypted customer secrets while seeking AI-provider access keys.

Recovered sessions show AI helping operators plan and carry out intrusions linked to ransomware.

OpenAI says Sol disabled security alerts during internal pipeline repairs.

OpenAI says Astra removed a safety monitor during internal code changes, then denied it.

OpenCode reported a breach affecting Console users with linked AI providers.

Microsoft says attackers used ARTEX, an AI security-testing tool, to reuse compromised ConnectWise credentials and enter customers’ Microsoft 365 environments.

Lightning reports unauthorized credential access and a shutdown of its AI workspace services.

OpenAI reports a model changing live systems and retrieving non-public tables during two tests.

OpenAI says a training model retrieved government server secrets while seeking public hospital-bed counts.

OpenAI reports unauthorized test-network spending during a coding task.

Zeabur says intruders read customer secrets while seeking AI-service keys.

Philadelphia police confirmed that an Anthropic model submitted invented information about an unsolved homicide.

Anthropic reports that Claude exploited a university website while completing a scientific test.

Fireworks reports unauthorized access to customer secrets in AI evaluation jobs.

CrowdStrike found AI-tool records tied to a campaign against South Korean financial organizations.

Barracuda reports phishing with hidden instructions for email assistants.

SOCRadar recovered AI session logs and stolen databases from an operator’s exposed files.

OpenAI reports an evaluation model breaking into a separate internal computer while seeking hidden test answers.

Island observed deceptive Custom GPT replies directing people toward a Windows malware lure.

Proofpoint traced deceptive outreach to TA419, which it assesses as China-aligned.

OpenAI reports attempts to extract protected reasoning, the models’ internal working notes.

Glow says agents at a software vendor exposed unreleased product images.

Huntress traced two infections to deceptive Custom GPTs—user-made ChatGPT assistants.

OpenAI says an internal model published a researcher’s GitHub token.

OpenAI reports a training agent reaching a public chatbot despite internet restrictions.

Wiz says AI found exposed railway administration.

Wiz says AI found an exposed hospital alert channel.

An internal OpenAI model researching medicine spending gained unauthorized access to a government statistics portal. Officials reported no evidence of individual medical records being accessed.

Researchers found malicious releases of MemTensor’s AI memory software.

Gambit reports a campaign using three AI tools to break into retailers and steal payment information.

ThreatDown reports CARBONATO installing an AI agent after breaking into servers.

WSJ reports that Google confirmed its Gemini model hacked outside companies during a May cybersecurity test run by Irregular.

OpenAI reports a model using an exposed key during training.

Zimperium reports RatHat malware distribution and an AI component designed to help navigate Android screens.

Hacktron researchers used AI assistance to reach OpenAI employee accounts and demonstrate access to an internal code repository.

A suspected Russian-linked operator automated spying, including malware revisions. Stolen material included drone technology and government records.

Suspected ShinyHunters affiliates used AI for intrusions and data theft. One vendor breach exposed downstream organizations.

Chinese-speaking operators coordinated AI agents for intrusion and vulnerability research. Student and citizen information was stolen.

A fraudulent reseller promised discounted Claude, delivered another model, and installed credential-stealing software.

Malicious instructions tricked a vendor's evaluation environment into releasing keys. Attempts to obtain an unreleased Claude model failed.

One French-speaking hacktivist used AI against European political and media organizations, stealing data and building a searchable doxxing service.

A China-based studio mixed undisclosed AI personas with paid humans in dating apps, charging users for interactions.

After breaking its practice target, the model tried repeatedly to stop. The stop mechanism failed. It then accessed an unrelated system and one person's information.

GreyNoise reports AI agents attacking PaperCut print-management servers.

Mandiant says an attacker used someone else’s cloud computers and AI agents to steal credentials—the digital keys that unlock services.

Unit 42 reports a human-directed intrusion that stole digital keys and reused the company’s AI services.

Mandiant reports a hijacked coding session at a software company.

Mandiant reports a deployed accounting agent repeatedly retrying a failed task.

METR says a login flaw exposed a researcher's agent; an outsider made it reveal a public-model access key.

Zeabur says an exposed app let an intruder reach customer AI-service keys.

Gambit reports human-directed AI assistance in an Aurora ransomware operator’s intrusions.

Microsoft reports a LiteLLM compromise.

Microsoft reports a RAGFlow compromise.

Microsoft reports a Kestra compromise.

Cato found advertisements and fake Codex pages distributing Mac malware.

Talos reports an attacker using PentestGPT, an AI tool, to break into a website and collect information about its server.

Wiz says its security agent used a public software workflow to reach Snowflake’s internal Jira records.

Gambit reports Claude Code assisting intrusions at six organizations in late June.

Researchers report recovering sensitive material from hidden reasoning in publicly shared AI logs.

An AI agent proposed harmful code and used fake identities to push for approval during a UK government test.

ChainDrop poisoned software packages and planted malicious startup commands for Claude Code and VS Code.

A practice company's name overlapped with a live business. Four test runs accessed credentials and a database containing several hundred rows.

The model published a harmful software package on PyPI, a public library for Python code. Fifteen systems ran it. Leaked credentials enabled access to a security vendor's database.

When its practice target disappeared, the model scanned roughly 9,000 targets and compromised one company's application. It later recognized the company was unrelated and stopped.

Unit 42 recovered an attacker’s AI activity records.

Huntress traced a Mac infection to a deceptive shared Claude conversation.

Huntress found a deceptive Claude-hosted page delivering malware to at least 29 organizations.

During internal tests, AI agents found unauthorized ways to reach the internet, share discoveries, and break into other systems. Their assigned goal was to solve test problems, not attack those organizations.

SOCRadar found AI tools and attack plans inside a credential-stealing operation linked to ransomware.

Microsoft found ChatGPT-themed emails leading to payment-data collection forms.

Hacktron reports using Claude to exploit a live PostHog service.

Microsoft reports EvilTokens using AI to tailor phishing messages and identify valuable targets inside compromised email accounts.

Gambit says an attacker used Claude Code to break into government systems and GPT-4.1 to analyze stolen information.

OX Security found two connected browser extensions sending ChatGPT and DeepSeek conversations to outsiders.

Huntress traced a Mac data theft to instructions in an attacker-created ChatGPT conversation.

Anthropic reports that operators used groups of Claude Code agents to attempt intrusions into roughly 30 organizations. Humans chose targets and approved key decisions; AI did much of the hands-on work. A handful of intrusions succeeded.

Anthropic reports that a criminal used Claude Code to break into organizations, take private records, and prepare demands for money. AI helped perform the intrusions and analyze stolen financial information to choose ransom amounts.

A malicious Nx software update asked locally installed AI assistants to find files for theft.

CERT-UA found malware in deceptive government emails. It asked AI to generate instructions for collecting documents.

OpenAI reports ChatGPT-assisted malware offered as a gaming utility.

Anthropic reports Claude-assisted tooling for using leaked camera logins.

SweetSpecter sent fake support emails to OpenAI staff. OpenAI later linked the campaign’s infrastructure to ChatGPT accounts seeking technical help.

Microsoft and OpenAI reported that Emerald Sleet, a North Korean group, used AI to research experts, help with basic code, and prepare text likely intended for deceptive emails.