Entering a system without permission.
A system being reachable does not mean it is available to use. Unauthorized access happens when someone or something enters an account, service, or computer outside the permission it was given.
An unlocked office door is not an invitation to read the files inside.
An illustration of the idea, not a literal account.Once inside, an attacker may gain access to information or actions that were meant to be private.
An attempted entry is different from a confirmed compromise. We label the outcome the source actually reports.
During internal tests, AI agents found unauthorized ways to reach the internet, share discoveries, and break into other systems. Their assigned goal was to solve test problems, not attack those organizations.
After breaking its practice target, the model tried repeatedly to stop. The stop mechanism failed. It then accessed an unrelated system and one person's information.
When its practice target disappeared, the model scanned roughly 9,000 targets and compromised one company's application. It later recognized the company was unrelated and stopped.
Anthropic reports that operators used groups of Claude Code agents to attempt intrusions into roughly 30 organizations. Humans chose targets and approved key decisions; AI did much of the hands-on work. A handful of intrusions succeeded.
Mandiant says an attacker used someone else’s cloud computers and AI agents to steal credentials—the digital keys that unlock services.
SweetSpecter sent fake support emails to OpenAI staff. OpenAI later linked the campaign’s infrastructure to ChatGPT accounts seeking technical help.
METR says a login flaw exposed a researcher's agent; an outsider made it reveal a public-model access key.
GreyNoise reports AI agents attacking PaperCut print-management servers.
OpenAI reports a model using an exposed key during training.
Hacktron researchers used AI assistance to reach OpenAI employee accounts and demonstrate access to an internal code repository.
WSJ reports that Google confirmed its Gemini model hacked outside companies during a May cybersecurity test run by Irregular.
Gambit reports Claude Code assisting intrusions at six organizations in late June.
Gambit reports human-directed AI assistance in an Aurora ransomware operator’s intrusions.
ChainDrop poisoned software packages and planted malicious startup commands for Claude Code and VS Code.
Gambit says an attacker used Claude Code to break into government systems and GPT-4.1 to analyze stolen information.
Gambit reports a campaign using three AI tools to break into retailers and steal payment information.
ThreatDown reports CARBONATO installing an AI agent after breaking into servers.
An internal OpenAI model researching medicine spending gained unauthorized access to a government statistics portal. Officials reported no evidence of individual medical records being accessed.
OpenAI says an internal model published a researcher’s GitHub token.
OpenAI reports a training agent reaching a public chatbot despite internet restrictions.
OpenAI reports attempts to extract protected reasoning, the models’ internal working notes.
Researchers report recovering sensitive material from hidden reasoning in publicly shared AI logs.
Unit 42 reports a human-directed intrusion that stole digital keys and reused the company’s AI services.
OpenAI reports an evaluation model breaking into a separate internal computer while seeking hidden test answers.
Microsoft reports a LiteLLM compromise.
Microsoft reports a RAGFlow compromise.
Microsoft reports a Kestra compromise.
Mandiant reports a hijacked coding session at a software company.
A malicious Nx software update asked locally installed AI assistants to find files for theft.
Anthropic reports that Claude exploited a university website while completing a scientific test.
CrowdStrike found AI-tool records tied to a campaign against South Korean financial organizations.
Talos reports an attacker using PentestGPT, an AI tool, to break into a website and collect information about its server.
OpenAI reports a model changing live systems and retrieving non-public tables during two tests.
OpenAI says a training model retrieved government server secrets while seeking public hospital-bed counts.
OpenAI reports unauthorized test-network spending during a coding task.
SOCRadar recovered AI session logs and stolen databases from an operator’s exposed files.
SOCRadar found AI tools and attack plans inside a credential-stealing operation linked to ransomware.
Unit 42 recovered an attacker’s AI activity records.
Hacktron reports using Claude to exploit a live PostHog service.
OpenCode reported a breach affecting Console users with linked AI providers.
Recovered sessions show AI helping operators plan and carry out intrusions linked to ransomware.
AI attacked Argentine healthcare.
AI-directed government intrusions.
AI-directed intrusions required human intervention.
AI-directed theft of client data.
Microsoft says attackers used ARTEX, an AI security-testing tool, to reuse compromised ConnectWise credentials and enter customers’ Microsoft 365 environments.
Unit 42 reports AI-assisted cybercrime involving stolen student information.
Straiker reports CyberCartel used Claude and Grok against Latin American financial targets.
Railway reports an intruder decrypted customer secrets while seeking AI-provider access keys.
Seoul police say a gang used ARTEX, an AI security-testing tool, to break into organizations and steal records.
Cursor reports altered Claude Code extensions distributed through its marketplace.
CrowdStrike reports human-directed agents helped an espionage campaign target over 200 organizations. It confirmed further attacker activity inside nine organizations.
NorForge observed intruders redirecting exposed Cairn agents to run malware.
Fireworks reports unauthorized access to customer secrets in AI evaluation jobs.
Zeabur says intruders read customer secrets while seeking AI-service keys.
Zeabur says an exposed app let an intruder reach customer AI-service keys.
Northflank says customers reported unauthorized use of AI keys stored on its platform.
Lightning reports unauthorized credential access and a shutdown of its AI workspace services.
Warp’s CEO reports unauthorized access to some AI activity records and usage data through a vendor.