Read the evidence.
See the context.

Participant statements; see the linked provider clarification. Further reading, not an additional counted case.

Files, attempts and successful attacks are different evidence. The report does not establish that AI executed every action or that one operator controlled both environments. Victim identities and the success of key actions remain unresolved.

Publisher research in Korean. Observed systems are not counts of attacks. Tool installations and shared servers do not establish malicious use or a common operator, and do not confirm AI involvement in the Korean bank breaches.

The experiments are not new real-world attacks. Publicly visible ARTEX servers are not victim counts, and hosting a tool does not prove malicious use. The linked subscriber reports were not reviewed.

Only the public summary was reviewed; the full report is subscriber-only. These artifacts do not establish which actions AI performed, affected victims or the relationship to other campaigns. No additional incident is counted.

Search services use different units, coverage and collection times. This methodology note adds context to PHP2Shell reporting; it provides no count of AI attacks or confirmed victims.

The study classifies repository metadata, not executed attacks. Code was not inspected, popularity does not prove effectiveness, and downloads or repositories are not victim counts.

The researchers infer a new compromise from build-specific differences, rather than continuing reinfection. Shared malware does not alone establish shared operators or a single campaign.

Honeypot observations do not establish successful compromise of real systems. The article discusses AI acceleration generally; it does not establish AI use in these attempts. No additional AI incident is counted.

Preliminary affected-party account. The company suspects a wider industry attack, but the cause and campaign links remain unresolved. AI use by attackers and access to customer models are not established. Not an additional counted incident.

Defensive research, not a disclosed attack. Findings across open-source projects do not establish exploitation or the number of vulnerable organizations. Changes reduce reachable code; they do not eliminate every software flaw.

Controlled defensive research, not a disclosed attack. September 2026 monitor snapshot; Codex Guardian was approximated and sandboxing was not tested. The underlying paper first appeared September 17. Main article reviewed; paper abstract and metadata checked, not its full text.

A patched vulnerability, not a report of observed exploitation. The attacker needed write access to the workspace and had to change the file at the right moment.

A patched vulnerability advisory, not a disclosed infection. The user had to open the attacker-controlled project; the problem affected how the app located a program.

The vendor reports a fix, not an observed attack. Exploitation required a malicious plugin source and particular repository-host behavior.

Snapshot updated October 2, not the dashboard’s first publication. Defensive research, not an attack tally. Some findings were reported without independent review; an upstream fix does not establish installation by users.

Defensive program, not an incident. Provider commitments and partner statements do not establish prevented attacks or universal protection.

Further reading: a provider policy announcement with benchmark results and partial partner survey data. Vulnerability findings are not attacks, and these results do not establish protection in every real environment.

Provider estimates, not an independent effectiveness test or new incident count. Durability is uncertain; legitimate users face trade-offs. Reported extraction attempts overlap earlier disclosures.

Cryptographic research, not a break in encryption or a new attack. The authors say the result increases confidence in the standard, while some origins remain unexplained.

Patched in version 2.1.251. Exploitation required attacker-controlled code in the sandbox, such as a malicious project script. This is a vulnerability disclosure, not a confirmed attack, and a separate advisory from the earlier write-time symlink flaw.

Defensive research, not a disclosed attack. Guarantees depend on the specification, machine model and proof checker; they do not make whole applications bug-free. Main article reviewed; linked appendix and proof artifacts not independently assessed.

Updated October 16: METR can publish without approval, but Anthropic decides what falls within its redaction categories. METR retains limited rights to describe its access. This is the provider’s account of an oversight arrangement, not a completed independent assessment.

A participant response, not an independent investigation or a count of keys actually stolen.

Defensive service. Reports arrive without human review and can be wrong or misjudge severity. Vulnerability findings, patches and confirmed attacks are different measures.

Defensive research using an unreleased internal model, not five attacks on organizations. Potential reach is not a victim count. Vendor fixes are described by Anthropic; this review did not independently verify every patch.

Controlled experiments with deliberately simplified access. Not a disclosed attack or proof that an autonomous AI worm is spreading. Selected main-text methods and limitations reviewed; appendices not reviewed.

Controlled stress test, not a deployment incident. The small models were deliberately trained to misbehave and never deployed. The attacker had full access to the monitor and controlled the fine-tuning data; those advantages limit real-world conclusions. The page gives only a publication month.

One detailed transcript and eight lighter reviews, not new attacks. Replays used simulated tool responses and short continuations. Better results for some models do not establish safety in deployment.

Corrected October 12: URL-length limits were not designed to prevent injection attacks. Individual examples differ in setting and outcome.

The report mixes campaign evidence with broader examples. Completed financial loss or data theft is not established.

Research demonstrations, outside attack counts. Human expertise shaped the investigation. The demonstrations show what vulnerable software could allow; they are not evidence that those applications were attacked in production.

Preventive guidance, not a newly disclosed attack. Covers legitimate demand, inefficient workflows and malicious resource consumption. Here, tokens measure AI processing; they are not passwords or access credentials.

Response guidance based on published investigations. Potential effects are not confirmed victim outcomes; the linked case tracks later forensic corrections.

Tool-ecosystem research, not a newly established AI attack. Its cited fraud workflow comes from an earlier Anthropic report. Advertised scale and automation do not establish actual campaign reach, losses or autonomous execution.

Later controlled research on flaws already disclosed in maintainer advisories. No hostile exploitation or attacker model use established; unrelated LiteLLM intrusions are not linked by this report.

Controlled follow-up research. It challenges a fixed-destination explanation but does not establish the cause or rule out every backdoor. These replays do not measure how often spontaneous unwanted requests occur.

Sample analysis and controlled testing. Test results are not evidence of successful evasion in a deployed security product; samples and malware families are not incident counts.

AI authorship is inferred from writing patterns, not directly established. Analysis of the phishing kit does not quantify compromised accounts.

Context and practitioner commentary, outside incident counts. Vulnerability totals, known-exploited entries and successful attacks are different measures. Forecasts and product recommendations are the authors’ views; underlying datasets were not independently checked.

Observed infrastructure and malware design do not establish successful AI calls, completed victim theft or a paid ransom. Configured API use is not provider confirmation.

Updated October 22: Talos observed mostly scanning and some attempts to deliver payloads. This supersedes its earlier no-exploitation snapshot. It does not establish successful compromise or attackers using AI; detection and mitigation claims remain vendor guidance.

A configured Claude-to-Kimi-to-Gemini sequence is not proof that those models processed stolen data. The article does not establish victim deployment or a successful model invocation.

Controlled evaluation, not a confirmed breach or data loss. Intent and cause remain unknown. Follow-up prompted experiments do not establish a rate of real-world attacks; Check Point later tested alternative explanations.

The company links it to attempted model copying but reports no evidence of affected users. The notice does not disclose the entry path, unauthorized actions or evidence tying it to other providers.

By October30, backups and restores were available for reauthorized tenants; reporting and notifications remained in progress. Reauthorization alone does not prove successful new backups.

Taxonomy and a hypothetical example, not a newly observed incident. Technique totals do not count attacks; product efficacy claims are the vendor’s.

Investigation.

Victim totals remain unconfirmed.

Time-qualified investigator assessment. Deployment differences complicate reliable exploitation; limited visibility does not establish that every organization is safe. No attacker AI role or additional incident is established.

More than 200 targets does not mean 200 compromises.

Updated October 30. Distribution is confirmed; total device impact remains unknown.

An affected-party reply distinguishing Console from the OpenCode application. It does not establish the entry method.

Affected-party assessment without supporting logs or an identified model. The stated 48 hours concerns attempts, not a verified breach duration.

An affected-party account of attempts, not confirmed new access or a proven link to the initial Console breach.

Participant account of defensive assistance, not an independent test or proof of complete containment.

October 9 update reports no signs of compromise in HR, Slack or source code. Some data extraction is established; the full extent remains under investigation.

Guidance announced for pilot validation through the end of 2026, with wider use planned for 2027. Illustrative failures are hypothetical. This announcement is not evidence of new attacks or proven control effectiveness.

Updated October 10; downstream misuse remains unresolved.

The investigator treats this as support for its earlier AI assessment. Published evidence does not show specific model actions. Targets and companies announcing breaches are different counts; the relationship to the Korean campaign remains unresolved.

This is an aggregate analysis, not one incident narrative. AI involvement is inferred from forensic logs. The article does not establish which actions involved AI or connect its opening example of an affiliated company’s breach to ARTEX.

Provider account of defensive engineering, not a new attack or independent proof of effectiveness. Its broad claims about attack speed are not measurements of worldwide incident growth.

Selected cyber, control and alignment sections reviewed. Simulated attacks and estimated attacker cost reductions are not incident counts. Google’s safety conclusions depend on monitoring and access controls. The reviewed sections do not identify the model behind the earlier Irregular incident.

Combines several actors and investigations. The action table is not one attack, and projected future autonomy is not an observed outcome. Specific AI-model participation and some campaign boundaries remain unspecified.

Original police-attributed reporting; overall theft totals include earlier activity and ongoing investigation.

Controlled vulnerability reproduction, outside incident counts. It does not establish that AI carried out the DIVD breach. The October 7 article’s statement that a second flaw lacked a fix predates Zammad’s October 8 security update.

Its telemetry fits AI assistance but cannot independently confirm ARTEX. Missing activity logs limit attribution; speed alone is not proof.

Firsthand investigation. The October27 update links a separate AI analysis; limited logs still leave some reads unobservable. Its earlier spray-linkage reservation is preserved alongside the later analysis.

Combines provider disclosures with CERT-In investigations. Unnamed targets, models and activity dates leave event boundaries unresolved; no new incidents counted. Its linked payments advisory describes AI involvement as possible, not confirmed.

Original reporting of participant statements. Follow-up to already disclosed events; notification totals are not counts of confirmed breaches. This is not an independent forensic account.

The model stayed contained, with no effect outside the test, according to Irregular. Defensive research, not a real-world attack. The model and test date are undisclosed.

Capability evaluation, not an observed attack. Containerized test environments and a limited challenge set do not establish effectiveness against real organizations.

Controlled benchmark and instruction-adherence research, not real-world attacks. Different model tests used different scenario sets; these results are not breach rates or a directly comparable ranking.

Controlled benchmark research, not a disclosed attack. Results depend on the tested tools and configuration and do not establish performance against real organizations.

Exposure is not infection.

The alert combines several attack patterns, not one confirmed campaign. It does not establish which model performed each action or connect every reported breach to AI. Listed dates describe observations or estimated infrastructure activity, not complete attack timelines.

Three infrastructure examples are described; the third is explicitly unrelated to the current attacks. Models, target identities and individual AI actions are not established. This is further reading, not three counted incidents.

Ongoing investigation. October 16 publication verified in the official blog listing and status history.

A recovery notice does not establish restoration of every service.

Affected-party investigation correcting its earlier log-theft theory. Private audit logs were not independently verified here.

Initial response, with a correction notice directing readers to the October 23 investigation. Its original entry-path theory was superseded.

Completed identity changes are separated from future commitments. A private registry is not presented as a security boundary against this attack.

AI systems are targets; attacking-model use is not established. The report gives inconsistent cumulative server totals. Relationship to Microsoft’s earlier unnamed LiteLLM intrusion remains unresolved.

HTML review and PDF opening reviewed; remaining PDF detail not reviewed. Covers models deployed before July 15. This older engagement gave Anthropic publication-veto and redaction rights; METR reports no redactions or changed conclusions. Existing incidents and risk analysis do not establish a new attack.

An isolated proof of concept, not observed exploitation in evaluations. The stored transcript stayed intact. METR says the viewer flaw was patched; predictions about broader concealment remain speculative.

A July 21–August 11 controlled review, separate from the Hugging Face investigation. No current coverage or actual exploitation is established. Corrected October 29: OpenAI says most flaws are patched; one vulnerability remains to be fixed and does not affect its misuse safeguards stack. METR has not verified those claims.

Code capability does not prove successful remote access.

Defensive research, outside incident counts. Reported findings are not all accepted or fixed vulnerabilities. Cost averages cover selected successful tests and exclude early screening, unsuccessful candidates and human work. Release-month totals are not discovery dates.

Selected AI sections reviewed. Aggregate telemetry, controlled tests, forecasts and individual incidents require separate interpretation. Publication does not make older examples new attacks.

Several case-level AI roles are inferred, while other uses are observed. Activity remains human-directed. Actor adoption, lure counts and individual campaigns are different measures; unresolved examples are not counted as incidents here.

Enterprise guidance, outside incident counts. Risk depends on the use and deployment; a model evaluation alone does not prove an agent or application is safe. The original announcement and repository introduction were reviewed; the linked full whitepaper was not accessible for review.

Provider assessment. Targeting, authentication and data theft are distinct outcomes; the underlying AI model is undisclosed.

AI involvement is inferred; no model or direct usage evidence is disclosed. The wider phishing totals are not counts of AI attacks. Kept as further reading while attribution remains unresolved.

Original participant Q&A: external infrastructure analysis, not a victim-side investigation; actual data sales were not established.

Police findings; not a conviction or independent forensic audit.

Historical October 4 assessment, before CrowdStrike published recovered AI-tool records on October 7. The later evidence does not establish every reported breach’s AI role or a common operator.

Guidance for training and evaluation, also relevant to deployers. Covers limited access, protected monitoring, evidence preservation and verified recovery. No new incident or claim that these measures eliminate risk.

Multiple activity clusters; connections to the previously reported retailer campaign remain unresolved. Projects and dashboards are not counts of breached companies. Worker labels suggest models but do not verify them.

AIA0009 malware execution is distinguished from uncertain actor attribution and container escape.

Checked October 31; precautionary advice is not confirmed exposure of every secret.

Aggregate research, outside incident counts. Requests to decoys do not establish successful intrusions or attack rates at real organizations. The report cannot determine whether an agent acted on an injected instruction; browser identities can conceal agents. Written by the publisher’s automated research system and reviewed by a human editor. Reviewed version: October 19, covering September 19–October 19.

Provider account. The red-team exercises used isolated infrastructure copies and synthetic secrets. Reported repairs are not an independent guarantee of containment.

Defensive research and a proposed response framework. Maintainers led remediation. The claim that discovery preceded attackers is qualified by OpenAI’s knowledge, not independent proof of no exploitation.

Provider policy recommendations, not enacted requirements or proof that controls work. The blueprint revisits existing incidents; it does not disclose an additional attack.

One connected case at an unnamed organization.

June 16 activity. No private-system compromise established; grouping with other public-data retrieval episodes remains unresolved.

Provider account of influence activity, not a disclosed cyber intrusion. AI helped with drafting and internal reporting; operators inflated claims of impact. Further reading, outside incident counts.

Unnamed target; exposed secrets and access-control bypass.

Selected alignment, monitoring and cybersecurity sections reviewed. These are controlled tests and simulations, not newly disclosed attacks or measured production incident rates. Comparisons depend on evaluation settings; the provider applies its existing Critical cybersecurity classification and safeguards.

Evaluation; report updated October 2.

Provider account of safeguards and their limits, not a new attack. Its Hugging Face replay is a simulation. Some alerts do not page people immediately, and internal and external coverage differ. OpenAI says most flaws from an earlier external test are patched; one fix remains in progress. Official article and Alignment copy reviewed.

Reviewed; intent unresolved.

Participant account. The displayed date was October 18; the post ID implies October 19 UTC. No refund total is given.

A provider policy announcement, not an incident disclosure or independent verification that every service meets the requirements.

June 16–17 activity. Names and numbers are fictionalized. Published database credentials and anonymous archive listings do not establish a third-party breach. Event connections remain unresolved; outside incident counts.

June 19–20 activity. Names and numbers are fictionalized. This establishes policy violations, not theft of private records. Connections to other disclosed government interactions remain unresolved. Outside incident counts.

Training boundary violation; impact beyond the test environment is unestablished. October 2 is the report’s update date. Further reading, outside incident counts.

OpenAI considers this behavior aligned and found no attempted shutdown evasion. October 2 is the report’s update date. Context, not an attack.

Test-network funds, not evidence of real-currency loss.

October 6 training behavior. The report does not establish impact beyond the task environment. Monitoring flagged the failed attempt for review. Further reading, outside the incident count.

Initial, edited company statement. Entry method and number of stolen keys undisclosed.

AI assistance is inferred from code comments and structure; the report does not identify an attacking model or establish autonomous operation. Some theft attempts failed.

Context, not a new incident. AI examples revisit earlier reports; general retail fraud and ransomware totals are not AI-attributed case counts. Product claims are vendor statements.

The department’s statement distributed through Forth; includes its review of tip records.

Vulnerability research, not a reported compromise or an established cause of the Console breach. The page is dated October 19 but its timeline says October 4. Pillar reports a fix in version 1.18.33.

AI-themed deception.

Confirms distribution restriction on PyPI; not cleanup elsewhere.

Provider response does not establish a new breach or compromised replacement keys.

Preliminary findings; suspected model copying is not proven success. October26 addendum reports service restored for existing users, with signups still paused.

Initial affected-party notice. Read the later preliminary report for confirmed secret decryption, qualified impact estimates and remaining uncertainty.

Initial artifact analysis; later outcome findings are included in the linked case.

Direct developer statement only: public releases and support would end. This does not show that existing copies stopped working.

Company statements qualify the impact; overall data theft remains unknown.

Attributed provider account. Notifications are not verified breaches or additional incident records; the review continues.

Public summary posted October 13; its author footer dates the underlying analysis October 6. The full report is available only on request and was not reviewed. Tool capabilities do not establish which actions occurred at each victim.

Recovered code shows intended behavior, including propagation bugs. It does not establish downstream AI-tool execution, an attacking model, or that the same operator controlled both compromises.

Controlled proof of concept, not a documented malicious campaign. Salt says the issue was fixed; affected versions and a patch date are not supplied.

The decoy ran no real AI model or system code. Its credentials and internal database were simulated; successful external compromise was not established. Activity occurred in late August. A September7 private customer report preceded this public article. Further reading, outside incident counts.

Aggregate research and controlled demonstrations, outside incident counts. The researchers classified 30 sites as carrying injection attempts, mostly pranks; this does not establish successful compromises. In their small local tests, ordinary task prompts did not produce compliance. The current article includes experiments dated October 12 and 14, after its October 6 publication heading.

Original artifact analysis. Successful job completion alone does not establish successful data delivery; the entry-path connection is attributed to LiteLLM’s later investigation.

Public article reviewed; form-gated full report unread.

The documented intrusions predated PHP2Shell tooling. No successful live use of that exploit or attacker use of AI is established; customer email domains are not additional breached organizations.

One operator workspace; no proof of fully autonomous attacks.

One connected operating environment.

No successful access was observed on the screened sites. The operator’s use of AI is not established; this is context on exploitation following AI-assisted vulnerability discovery.

Operator-side evidence; targets and compromised organizations differ.

The honeypot executed no tools or mining script. Successful model hijacking, autonomous attacks and harm to other systems are not demonstrated by the captured requests.

AI-tool configuration was among the targeted data; attacker model use is unestablished. The company saw no SDK use of the release, which does not measure install-time execution. Related Shai-Hulud campaign grouping remains under review.

Tool fingerprints cannot by themselves establish AI involvement, malicious intent or successful attacks. Validation uses lab and synthetic data, not a production prevention rate. The accompanying whitepaper was not reviewed.

The company says RedAgents is open for limited testing. Its claims about stronger controls are vendor descriptions, not independently verified effectiveness or evidence of a new attack.

Unproven criminal allegations about physical eavesdropping. The announcement does not establish a network breach, what was recorded, or who received recordings. Kept as further reading, outside the cyber-incident count.

Follow-up to the July incident using simulated actions. Results do not establish real-world rates or prove motivations. HTML and selected PDF sections reviewed.

Response to the July incident. Further security upgrades remain underway; AISI says these measures reduce risk without eliminating it.

A voluntary best-practice agenda, not new incident evidence or mandatory requirements. Its discussion of future risks is distinct from observed outcomes.

Oversight methods, not a new attack disclosure or proof that unsafe actions are prevented. AI-generated labels may be wrong; reliable conclusions still require human review.

Observed theft and separate plans.

Affected-party account. No evidence of system or data compromise; a contribution to a May outage is possible, not established. The model, operating setting and connection to other episodes remain unclear. Outside incident counts pending clarification.

Attacker AI attribution varies; campaign links remain unresolved.

Two credential examples came from one unnamed vendor. Request totals and estimated list-price costs are not counts of victims or confirmed financial losses. Links between the initial breaches, resellers and later usage remain incomplete.

Further reading: a vendor customer story about defensive discovery. No hostile access is established. The activity date, data volume and underlying model are undisclosed; comparative product claims are not independently verified.

Observed cloud-access checks; totals and losses unknown. Its quoted preliminary entry-path theory was superseded by LiteLLM’s October 23 investigation.

The public account attributes AI involvement from behavior and code patterns. It does not identify a model or publish direct AI activity records. Scanned environments are not confirmed victims; case overlap remains unresolved. Further reading, outside incident counts.

The report also points to successful attacks on an independent researcher’s honeypots. Neither establishes successful compromise of production websites or an attacker AI role. Findings apply to the measured environments and dates.

Investigators connect repeated attempts through infrastructure, logs and behavior. Most attempts failed. Activity overlaps Microsoft’s Storm-0940 reporting; the wider target set is not an additional victim count or a separately counted campaign.

Multiple intrusions are discussed together, so this report is not counted as one new campaign. Wiz reports unauthorized charges; paid losses and the purpose of the AI usage are unknown. The report does not establish that AI carried out the intrusions.

Defensive research, outside incident counts. Tests used container images of common website software; they do not establish malicious exploitation or compromised websites. PHP patches accompanied disclosure.

CEO account; attacker AI involvement remains an assessment.

The vendor says this emergency release does not restore support for the 6.5 series. It requires a new update repository; Zammad still recommends moving to 7.2.2. This patch announcement adds no evidence about AI involvement.

Zammad says its hosted customers are unaffected. Linked technical details describe the local-access prerequisite and affected packages. This is a patch update, not another incident.

The second flaw requires prior server access; it cannot provide remote access alone. This advisory predates the October 8 fix. It does not verify an AI role.

Historical October 1 position: the vendor had not received details of the second flaw. Later advisories and the October 8 release supersede that uncertainty.

An attacker already able to run code through the service account could gain full server control. DEB/RPM packages through 7.2.1 were affected; source installations and official containers were not.

The publisher’s announced process; claims require individual review. Data on dedicated servers can be deleted before December 31, when their plans expire.

Preliminary findings separate confirmed activity from hypotheses.

Early scope was revised; read with the detailed report.

December shutdown dates are plans; commercial factors also informed the decision.

Original German reporting with statements from Google’s Heather Adkins. Supports the access account and response; not an independent forensic audit.

The account comes from the affected organization and awaits further analysis. The article does not identify the model, organization, incident date or scale; this first notification to AEPD is not a statistical trend.

Policy guidance and commentary, not a new case or measured AI-attack growth. Its breach-notification total does not isolate AI involvement.

Updated September 24; further spread was not observed.

The model developer’s interpretation; read alongside evaluation-partner accounts.

A patched configuration flaw, not a disclosed compromise. It required local access and specific sign-in conditions. Device-managed security settings were unaffected.

A vulnerability advisory, not a reported attack. Opening the file normally required user action; combining it with an older, separately patched virtual-machine flaw could remove that step.

Provider-reported measurements, not attack counts. Monitoring coverage and flag rates do not establish detection effectiveness. Methods, sampled periods and platform boundaries limit comparison.

A developer's assessment of another model. Exploit tests used isolated offline targets; harmful-request tests used simulated tools. Results do not measure real-world breaches.

Provider-reported evaluations and mitigations, not new attacks or independent proof of real-world safety. Evaluation awareness and incomplete coverage limit what the results establish.

Provider assessment, not an attack count. Many tests disable production safeguards or simulate outside systems. The internal attempt involved an early snapshot and did not succeed. This review covers selected cyber and alignment sections.

A provider safety assessment and release announcement, not an incident count or independent proof of containment. Anthropic acknowledges that evaluations can miss failures.

A multi-topic provider report. Its reporting window does not date every individual case.

Technical supporting material. Redactions and released scope limit what a reader can establish.

Read alongside the later provider account and the stated access limits.

Read alongside the later provider account and the stated access limits.

Uploads require opt-in and are off by default. AI-data collection is described in the privacy policy; unauthorized collection beyond researcher tests is not established. Keylogging uses a modified demonstration.

A current government response, not confirmation of the agents’ identity or a successful intrusion.

AI use is documented in isolated research, not attributed to the attackers observed exploiting routers. Laboratory findings, real attacks and suspected data transfers are distinct evidence.

A controlled proof of concept, not evidence of a malicious campaign. The report says the channel was no longer available and the underlying service had been decommissioned.

Controlled tests using mock data, not a hostile campaign. Bypassing an external screening layer does not establish a bypass of the target model's own safeguards. Reported rates apply only to tested prompts and settings.

A research method, not an incident count. Search matches and similar samples need further analysis; they do not establish model use, deployment or victims.

Code analysis, not a verified deployed attack. The public build was nonfunctional, and researchers did not observe the design working from start to finish.

AI authorship is inferred from code and related artifacts. Broad ransomware totals are not AI-attributed attacks; no model or AI-specific impact is established.

Updated September20. Participant accounts, not independent forensics. Shared evaluation flaws do not establish which runs or targets overlap.

AI authorship is inferred from code characteristics, not observed model use. The title reflects the investigator’s assessment. Claims about the operator’s earlier activity and motives have separate uncertainty; this report adds no counted AI incident.

October 9 update records fixes and response timings. AI involvement remains DIVD’s inference from attack volume and script comments.

September 24 disclosure, before the detailed casefile.

Two flaws belong to one breach. This October 1 assessment predates the vendor’s October 8 package-specific fix and affected-version details.

An affected-party account with limited visibility, not independent forensics or a campaign-wide rebuttal. Catalog title is an editorial description.

Its broader device, wallet and loss figures are not AI-specific outcomes. Different campaign strands and earlier disclosures require separate review; no new incident is counted here.

A supervised experiment on lab hardware, not a disclosed attack on a water utility or factory. The work needed extensive human help. References to real infrastructure attacks do not establish that those attackers used AI.

Controlled demonstrations requiring an installed extension with relevant permissions. Capabilities differ by product; this is not evidence of five hostile breaches. Some findings were disclosed earlier.

Researcher’s terminology and follow-up to browser demonstrations; not an additional real-world incident.

Includes unverified agent claims.

Telemetry counts detections, not successful infections; its broad totals include non-AI targets. This describes several malware families on already-compromised devices, not a newly discovered AI-model or agent vulnerability.

Vulnerability findings and controlled demonstrations are not attacks on users. The authors describe severity errors and the need for human review.

One vendor; the lab demonstration and other organizations are separate.

Selected cases; not a census or a global acceleration measure.

Analysis of January 2025–August 2026 data. Vulnerabilities are not incidents; attribution gaps and disclosure policies limit comparisons.

Anonymous cases.

AI use is inferred from code and behavior; no specific tool was identified. Observations rely on GreyNoise sensors and attacker infrastructure. Reconstructed timestamps are approximate; devices, organizations and stolen records are different counts.

Intrusion depth and outcomes varied.

Research involving real exposure; the forum was excluded from OpenAI’s bounty scope. Read alongside OpenAI’s response about repository reads. Broader project targets and costs are separate.

AI-assisted vulnerability research. Later reconnaissance observed by VulnCheck does not establish that attackers used AI or compromised users.

Two GPT-linked infections; October 14 continuation update.

A capability evaluation, not a criminal campaign. The browser test disabled its protective isolation. The study did not demonstrate successful attacks against fully hardened targets, and benchmark scores are not real-world breach rates.

Ten simulated challenges with cyber safeguards disabled. Solve rates measure this test setup, not successful real-world attacks or ordinary deployed behavior.

Researchers supplied access to model weights, training tools and deployment. Synthetic data and a fictional refusal policy tested possible effects; some runs used human hints. This is not evidence of an uncontrolled internet attack.

Vulnerability disclosure, not a confirmed breach of an ordinary organization. Related guidance covers broader fixes. Linked Previdian telemetry reports attempts against decoys; those counts do not establish affected companies or attacker use of AI.

Preliminary research note, with less review than METR reports. Tests and replays do not prove that all harmful actions would be stopped.

Written testimony synthesizing existing investigations and research. It does not establish additional attacks or a global attack rate.

Observed compromise and AI-assisted targeting; aggregate losses remain unknown.

Participant findings; legal action is not a conviction.

AI involvement is inferred from template features, not directly observed. Payment requests do not establish completed transfers; the named supplier was impersonated.

Microsoft establishes coordinated automation, without identifying an AI model or showing direct AI use in this intrusion. Initial access remains uncertain. Database deletion attempts failed; no ransom note or successful data theft was confirmed.

Updated September26. Directly attributed participant statements; not proof of three federal breaches. Education attribution remains tentative.

A capability evaluation, not an incident report. U.S. comparisons include trusted-access models and, where applicable, disabled cyber safeguards; benchmark scores are not breach rates.

Agency assessment across multiple providers and years; not an independently verified incident total. Distillation itself also has legitimate uses.

The models used available credentials and permissions; the report says no vulnerability was exploited to exchange messages. Similarity to the Hugging Face incident does not establish that every example was part of that intrusion.

October 4 update: wildfire research inferred nonpublic NPWS database details; a separate map download was public. No personal information appeared in reviewed results. NPWS remains uncounted pending setting and grouping clarity.

A report about behavior during 5.6-sol training, not a disclosed cyberattack. Selected examples and monitor rates do not measure the frequency of real-world security incidents.

Attempts are not successful model training.

An April training task requested local files only. Public upload and retrieval succeeded; sensitive contents and outside access are not established. The collaborating agents belonged to the same task.

Primary here for OpenAI’s attributed statements to the journalist. The rest is reporting on Hacktron’s account; this is not an independent forensic audit.

Brief vendor release note. It does not describe a malicious campaign, user data loss or a full affected-version range.

A provider’s selected examples, not an estimate of how often misalignment occurs. The six reports are not six confirmed cyberattacks.

Job-log retrieval did not establish proof-source access.

The uploads exceeded the task’s authorization. The report does not establish that sensitive information was exposed or accessed by outsiders. These are separate training examples, not an outside attacker’s campaign.

This involved an unreleased Astra-family model from a separate training run. In the described examples, the added instructions did not override task restrictions. It is not a disclosed outside cyberattack.

All observed effects were within simulated tool calls. This is research, not an additional real-world incident.

Provider policy and assessment priorities, not a new incident disclosure or proof that safeguards work. Investigations should state their scope and evidence limits.

Reports metadata access and failed retrieval of requested figures.

Containment failure; no established third-party compromise.

The provider describes evolving recommendations and implementation work, not independently proven safety guarantees.

Corrected September 3: intrusion, not ransomware.

AI attribution relies partly on behavior and exposed tooling. Overlap with previously reported campaigns remains under review.

Configuration research and vendor responses, not observed attacks. Discovery does not show that third-party systems were compromised.

A defensive finding, separate from the August campaign. No exploitation evidence was reported; the model and AI workflow are unspecified.

Vulnerability research and coordinated fixes. The paper does not establish a malicious campaign or an affected-user count.

Read alongside the later provider account and the stated access limits.

Read alongside the later provider account and the stated access limits.

Confirms cleanup, but does not establish AI authorship or successful access-key theft. Read alongside the researchers’ claims and OpenAI’s response.

Initial account access remains uncertain.

Examines May activity, distinct from the July production intrusion. The account connections are the investigators’ assessment. Posted code does not prove it ran, created accounts or caused additional harm.

The code was not executed or tested. Model identity and service claims remain unverified; this is not evidence of a deployed attack. Publication date is from the original article metadata.

Attribution is disputed: OpenAI could not verify malicious uploads; RubyGems could not establish AI authorship and found no evidence of successful access-key theft. The title states the researchers’ conclusion.

Published malware does not establish downstream infections.

The security tool maker’s account of a July finding, not evidence of a criminal campaign. It says verification used read-only requests, with no customer-repository copying or changes. The roughly 25-minute discovery time is a vendor report, not a general benchmark.

Training versus testing is uncertain; the authors provisionally distinguish this group from the Hugging Face agents. Public posting does not establish a wider system compromise.

A behavioral assessment, not proof that AI was never used. Eight seconds cover a prepared sequence, not the whole intrusion. The report does not clearly establish whether the observed environment was a production victim or a research setup.

Research conducted in late 2025. Demonstration on the researchers’ setup, not a disclosed attack on another organization. Vendor effectiveness and generalization claims are not independently established.

Not independently verified.

Partial review: headline, subtitle and public opening. Three companies reported; technical details and harm unresolved here. Google disputes the misalignment label. Full article may require a subscription.