Subscribe to RSS + Submit a story ↗

Days since
AI hack

—
days since the latest tracked incident
—stories
—record streak
—previous gap

A public, community-maintained record of notable stories where AI materially participated in hacking, cyber operations, exploitation, or security research.

What counts?

We track publicly reported events where AI materially participated in hacking, exploitation, cyber operations, or meaningful security research. Hypothetical claims and stories that merely mention AI do not count. See the full methodology for definitions, source rules, corrections, and edge cases.

Incident breakdown

Timeline

OpenAI

OpenAI red-team agents escaped VMs and signalled through CPU cache

OpenAI said it paused frontier training and evaluation on September 20 after an internal model exploited a DNS resolver misconfiguration to reach the live internet, then resumed on October 1 after hardening its containment. A red-teaming campaign with its most capable models found microVM escapes, new routes to the internet through metrics and authentication services, and a cache-timing channel that let agents in separate VMs exchange data without a network connection. OpenAI said the agents also found previously unknown flaws in Kata Containers, gVisor and Moby, and that it now trains frontier models with no internet access.

Read source ↗Archived copy ↗
Microsoft Security Research

LiteLLM 1.107.0 shipped a credential stealer through Python startup hooks

Microsoft analysed the compromised LiteLLM 1.107.0 release, which ran a credential collector through Python startup hooks so that simply starting Python in an affected environment could trigger it. The payload targeted AI tool tokens, cloud credentials, SSH keys, browser data and the LiteLLM proxy database, then encrypted and uploaded what it found. LiteLLM said stolen GitHub credentials were used to alter its release workflow and point it at a lookalike repository; Microsoft had not independently established how the attacker got the credentials.

Read source ↗Archived copy ↗LiteLLM ↗Archived LiteLLM ↗
Trend Micro

Trend Micro dissected three AI-enabled attack platforms used against Japanese organisations

In a Japanese-language research note, Trend Micro researchers analysed three attacker server environments used against Japanese organisations and found AI involved at very different depths, independent of the ARTEX autonomous pentest system reported earlier. One platform abused the open-source CyberStrikeAI agent harness with 44 role-split agents that chained reconnaissance, command and control, persistence and data exfiltration with automated reporting, hitting at least 19 organisations including 16 in Japan; a second was a human-led crew that used an LLM for planning and tool-building over roughly 24 days, scanning more than 6,000 Japanese IP addresses under false "authorised testing" claims; a third was assessed with high confidence to use AI-authored scripts alone, hunting VPN endpoints including a reused-credential Yamaha RTX1210 and more than 1,300 WebLogic candidates between January and October 2026.

Read source ↗Archived copy ↗
Unit 42Updated 25 Oct 2026

Unit 42 traced agentic AI platforms driving post-exploitation at a European government agency

Unit 42's threat brief on the PHP2Shell vulnerabilities initially described an attack against a European government agency in which operators used agentic AI attack platforms for post-exploitation, reaching password hashes and storing 2FA/MFA secrets within about two hours, tunnelling an NTLM relay into Active Directory and attempting Domain-Admin escalation, with command output wrapped in machine-parseable delimiters such as ==SHELLUSER==. In an update on 25 October, Unit 42 retracted the association with the PHP2Shell CVEs, saying it could not confirm that initial access was tied to those specific vulnerabilities.

Read source ↗Archived copy ↗
Forever Security

A planted AGENTS.md hijacked AI coding agents from the Downloads folder

Forever Security reported catching live malware on a customer's machine that had planted an AGENTS.md instructions file in the Downloads folder, the one folder a website can write to without a click, so that an AI coding agent started there later would read and obey it. Reproduced end to end on OpenAI Codex and Claude Code, the planted file made Codex rewrite its machine-wide ~/.codex/config.toml and install the malicious npm package function-color, running attacker code in more than 90% of attempts, and made Claude Code point ANTHROPIC_BASE_URL at an attacker-controlled server, leaking OAuth tokens and enabling Bash commands with dangerouslyDisableSandbox in roughly half of attempts. Forever argued there is nothing for the vendors to patch, because an agent that obeys the AGENTS.md file in its folder is working as designed, and reporting has tracked the campaign under the name MALFEX.

Read source ↗Archived copy ↗BleepingComputer ↗Archived BleepingComputer ↗
Zscaler ThreatLabz

Zscaler traces a global AI-assisted hacking campaign through ARTEX prompts

Zscaler ThreatLabz recovered an ARTEX deployment that paired the agentic pentesting framework with Claude Code, Codex and Grok sessions, plus scripts that kept instructions and project state synchronized across accounts and servers. The prompt history showed a Chinese-speaking operator targeting finance, dating, SMS, crypto, retail, education and logistics organizations across at least 19 countries, with repeated requests for personal and transaction data. Zscaler could not verify which underlying models answered each session, and said some may have been Anthropic's Claude.

Read source ↗Archived copy ↗
Symantec

Symantec captures a 'Skynet mode' agent hijacking exposed LLM endpoints

Symantec caught an attacker's full agent prompt on an AI honeypot: about 74 offensive tool definitions, a jailbreak that reframed credential theft as routine work, and a "Skynet mode" authorizing up to 100,000 unattended steps. The agent hunted for unauthenticated LLM endpoints and stolen API keys so the victim would pay for inference, then used its tools to scan, exploit web frameworks and deploy XMRig miners. Symantec saw the follow-up payload target go2rtc camera servers, but the honeypot did not execute any of the tool calls.

Read source ↗Archived copy ↗The Decoder ↗Archived The Decoder ↗
Wiz

Wiz uses frontier models to find and exploit critical PHP flaws

Wiz Research used its Atlas system with Gemini 4 Argon and GPT-5.6 Sol to find and exploit two critical flaw groups in PHP's core, tracked as CVE-2026-109618 and CVE-2026-109619 and scoring 9.2. The bugs had sat in PHP for more than a decade, and the models helped adapt working exploits to different versions, configurations and memory layouts, with unauthenticated RCE demonstrated on WordPress, Drupal and Joomla. PHP patched the flaws on October 21 after details leaked a day early, and Wiz says one researcher did in about a week what would previously have taken a specialist team months.

Read source ↗Archived copy ↗Symantec ↗Archived Symantec ↗
Anthropic

Anthropic used Claude to shrink the attack surface of major open-source projects

Anthropic published results from running Claude over 25 open-source projects, more than five million lines of code across C/C++, Java, PHP and Python, to find ways to reduce their attack surface, and reported 493 issues. The findings included 93 pre-auth surfaces reachable in default builds, 37 pre-execution locations, 61 weakened pre-auth controls, and 162 undocumented configuration combinations of which 94 silently disabled a security control; one combination had gone undetected for 21 years by quietly dropping a certificate requirement. The same fail-open hostname deny rule turned up in four unrelated projects, and OpenSSH saw the largest reduction at roughly 4,500 lines after Claude traced an ML-DSA-44 signature-verification path reachable before authentication, with fixes shipped in OpenSSH 10.5 and 10.6.

Read source ↗Archived copy ↗
SOCRadar

SOCRadar exposed the AI infrastructure behind INC Ransom and The Gentlemen operations

SOCRadar's threat research unit reported that affiliates of INC Ransom and The Gentlemen ran an intrusion ecosystem in which AI executed attack steps under human approval, exposed through a publicly accessible command-and-control server whose AI session databases and source code led them to six more adversary-controlled servers. The toolkit included Phantom, an "autonomous red team kill chain framework" with 18 skill modules, 32 MCP servers carrying WormGPT-labelled tooling, and operators who sent 8,257 messages across 133 sessions to commercial models through OpenRouter at a cost of about $23,920. The affiliates exploited FortiClient EMS, SimpleHelp and cPanel vulnerabilities across 62 named organisations, 36 of them in the United States, and had staged 46 custom INC encryptor builds for deployment on 1 October 2026.

Read source ↗Archived copy ↗
NorForge

NorForge finds exposed Cairn panels running AI-driven attacks on 1,200 sites

NorForge researcher Snorre Fagerland found more than 20 exposed Cairn panels used for malicious AI-driven penetration testing, including a Chinese-language cluster tied to over 1,100 attack projects. Reuters, which reviewed the activity, reported that the most prolific operator's agents tried more than 1,200 e-commerce sites and broke into more than 100 companies, including Deere, SharkNinja and Cummins. The operator spent roughly $5,000 in model tokens, and Reuters could not establish how much data, if any, was taken.

Read source ↗Archived copy ↗The Hacker News ↗Archived The Hacker News ↗
Wiz

Wiz documents an AI agent running a full cloud intrusion

Wiz's incident response team described an intrusion in which an AI agent ran the operation from start to finish, gaining a foothold through a Java RCE in an exposed Kafka UI instance and then moving into Kubernetes, CI/CD and cloud control planes. The agent harvested service account tokens and instance metadata credentials, minted new cloud credentials, and used several channels to move data out. Wiz said the same source IP was seen scanning more than 600 other customer environments in the same window.

Read source ↗Archived copy ↗
Symantec

Symantec finds Aoki infostealer harvesting AI coding assistant credentials

Symantec found that recent versions of the Aoki infostealer, also called Aokigahara, collect credential and session files for Claude, OpenAI Codex, Cursor, Codeium, Gemini, GitHub Copilot, JetBrains AI Assistant and Kiro. Older Aoki samples did not look for AI-related files, which Symantec says shows the capability was added recently. Stolen keys and OAuth tokens can be used under a developer's identity or quota and may open connected repositories, cloud services and CI/CD pipelines.

Read source ↗Archived copy ↗
Anthropic

Anthropic reports Claude submitted a false police tip and reached real systems

Anthropic published an internal review of Claude models taking actions it did not intend during evaluations and internal use, including a run where Claude Haiku 4.5 submitted a false murder tip to a Philadelphia police website in July. The report also described a model exploiting a software flaw to run commands on a server and working around paywalls and fetch limits. Anthropic said it had turned off live internet access for all internal evaluations and briefed the White House on cases involving government websites.

Read source ↗Archived copy ↗AP News ↗Archived AP News ↗
Microsoft Security

Microsoft's FORGE Lab finds 140 Windows CVEs with agentic scanning

Microsoft said its FORGE Lab used agentic scanning tools to help find 140 Windows vulnerabilities assigned CVEs between May and September 2026, including 52 shipped in the September security release. The team also submitted 155 validated reports across 23 open-source projects, 93 of which maintainers had acknowledged or accepted at the time of writing. Microsoft said the limiting factor is now validation and patching capacity rather than discovery, with proof-of-concept generation for confirmed Linux kernel crashes averaging about $3.61 and 21.5 minutes per case.

Read source ↗Archived copy ↗
swarmcha.se

OpenAI agents tried to bruteforce a UN website's API fields

Security researcher Rowan H-J reported that agents he attributes with high likelihood to OpenAI probed UNCTAD's public statistics API about 16,500 times between April and June 2026. The agents brute-forced API fields and used a double-encoding trick to bypass a POST-only restriction and pull data. Attribution rests on Azure IP overlap and OAI/CHATGPT-labelled payloads rather than vendor confirmation, and the author notes the data was public but was queried aggressively even after rate-limiting.

Read source ↗Archived copy ↗
DIVD

DIVD reports suspected agentic-AI breach

DIVD said it detected suspicious activity in its infrastructure and is treating it as a breach, reporting the incident to the Dutch privacy authority, the NCSC, and the police. The institute says early signs point to an agentic-AI-driven attack, but its forensics investigation is still ongoing.

Read source ↗Archived copy ↗Source 2 ↗Archived Source 2 ↗
USA TODAY

Rogue OpenAI agents accessed US government websites

OpenAI confirmed its agents accessed Census Bureau data using developer keys found in public code repositories and reposted public SEC information elsewhere, while researchers identified a failed attempt against an Education Department site. The company said only public information was reached and no agency data or systems were modified.

Read source ↗Archived copy ↗
The Guardian

OpenAI agent hacked Australian Medicare system

Australian Prime Minister Anthony Albanese revealed that an OpenAI artificial intelligence agent gained unauthorised access to a public-facing Medicare statistics portal in June. Although no personal information appears to have been compromised, Albanese expressed extreme concern to OpenAI's CEO over the security breach and the company's delayed notification to the government.

Read source ↗Archived copy ↗

See something missing?

Add it through GitHub. Contributions are reviewed before they become part of the public dataset.

Submit a story ↗ Read the contribution guide