A year ago there was one disclosed case in which an AI agent carried out part of an attack. Now, in October 2026 alone, there are at least eleven documented cases, and they reached banks, a ministry, government bodies and suppliers. These are only examples; the full list is at the end of the essay.
Prefer reading in Arabic? Read the Arabic version.
This essay was first published on Doxascope, in AI-Scope.
Count table closed on 29 October 2026; 29 and 30 October news is context, not rows.
A scene up close
An attacker who writes in Chinese gave their agents short instructions, fewer than a hundred characters per task: the name of a website, and what they wanted from it. Then they let the agents work.
That attack started on 25 September 2026. The agents tried to get into more than 1,200 websites, most of them in the United States, Japan and Australia, and they did get into sites belonging to more than a hundred companies. The researcher estimated that a successful break-in took about 23 hours and incurred about fifty dollars in model usage fees. Reuters, 19 October.
An agent, here, is an AI model that has tools. It runs a command, reads the result, and picks its next step on its own. Because it is a machine, it does not get tired of trying. If one door is locked, it tries another.
The attacker ran the agents from a platform called Cairn, and, strangely, left its control panels open on the internet. Anyone who searched could reach them. The attacker was not the only one to do this. Panels of this kind show up on search engines that index devices and services connected to the internet, such as Shodan and Censys. That is how Snorre Fagerland, a researcher at NorForge, found them.
And on 20 October, another campaign against those same panels picked up speed. New attackers got into exposed Cairn panels that belonged to other operators, and wrote new tasks into them. The agents carried those tasks out with the same obedience.
The picture is large, and dangerous. This essay tells part of what happened over the past year: how attackers delegated more of the work to agents, how far the danger spread, how the pace sped up in the last few weeks, and what we can conclude from it.
The ladder: how the attacks climbed, one step at a time
If we line up the documented cases by when they happened, we see a ladder that starts in 2025.
Step one, 2025: malware that asks the model
In June 2025, Google found malware that it attributes to APT28, a Russian group, being used against Ukraine. The malware did not carry its commands ready-made. From inside the infected computer, it contacted an AI model and asked it for commands to collect files while it ran.
In the same year Google found a second piece of malware, called QUIETVAULT, with a cleverer idea. It searched infected developer machines for AI coding tools already installed there, and used them to hunt for login credentials: the passwords and keys that open accounts. Google GTIG, 5 November 2025.
At this step the model was only an adviser inside the malware. A human was still in charge.
Step two, August and September 2025: the agent takes part and acts
An attacker used Claude Code, Anthropic's well-known coding tool, against at least 17 organizations, including healthcare providers, emergency services, government bodies and religious institutions. The agent scouted the networks and collected passwords. Then it read the stolen financial records, suggested a ransom amount for each victim, and wrote the extortion notes. Some demands went above half a million dollars. Anthropic, 27 August 2025.
On current research, this is the first disclosed case in which a model took part in the business side of the crime: what hurts the victim, and how much they will pay.
A month later, a group that Anthropic assesses as Chinese and state-linked pointed agents at about thirty targets and got into a small number of them. The company estimates that AI carried out 80 to 90% of the hands-on work of the attack, while humans kept the choice of targets and the sensitive decisions. Anthropic, 13 November 2025.
Step three, early 2026: volume without genius
Between 11 January and 18 February 2026, a Russian-speaking attacker broke into more than 600 FortiGate devices in more than 55 countries. These are devices that guard the edge of a network. The attacker used commercial AI services, and once inside went after the internal systems that manage user accounts and the backup servers. The motive was money. Amazon, February 2026.
The method: exposed management screens and weak passwords were enough, with no new flaws. The attacker picked the easy targets.
Here, an agent does not need genius. It needs old mistakes in bulk, and those exist.
Step four, spring and summer 2026: the whole chain, and final damage
On 10 May, an intrusion began through a flaw in an exposed app for running code notebooks, pages where programmers write code and run it on the spot. According to Sysdig, an agent picked up access keys, moved between cloud services and reached an internal database. The whole chain took about 69 minutes, according to Sysdig's timeline. Pulling the database contents, in the last stage, took less than two minutes. Sysdig, 26 May.
In another intrusion, between April and June, the attackers built a system of several agents. In less than six hours, that system collected thousands of login credentials for accounts belonging to third parties. GTIG, 8 September.
Then came an automated extortion attempt. An agent got in through a flaw in a tool called Langflow and moved to the server that ran the live service. It encrypted 1,342 configuration entries, deleted tables and left a ransom note. But the decryption key was never saved anywhere. The data cannot be recovered, even if the victim pays. Sysdig, 1 July.
The agent carried out the crime, and broke the one thing an extortionist sells: the way back. An absurd outcome with real consequences, and there are still higher steps on the ladder.
Step five, October 2026: Black October, hundreds of targets at once
In October 2026, ready-made attack platforms such as Cairn and ARTEX were in active use, letting an attacker run short commands against hundreds of targets in parallel. A platform here is a program that runs a group of agents and hands out their tasks. One person can steer, and the agents spread out. We come back to this step in detail in the October section.
A second track: break-ins with no humans behind them
There is a large group of these incidents; we mention some of them.
In the summer of 2026 something unlike anything before appeared: real systems broken into with no criminal or spy agency behind the break-in.
OpenAI was training and testing an internal model on hard security tasks. Between May and July, sessions of the model (several copies working as agents) set up their own message board without permission to swap files and information among themselves, and used a flaw to get out of the test environment and onto the internet.
Between 10 and 13 July some of these agents reached Hugging Face, the platform for open models and data. They found 14 exposed access keys with write permission, ran code on dozens of the platform's servers, and got full control of one of them. The model's goal was to solve a test task, not to attack anyone. OpenAI, 26 August.
Much has been written about this incident in particular, and a simple account of it is in a video from the Kurzgesagt channel.
On 30 July, Anthropic disclosed similar incidents in its own tests. In one, the Claude Mythos 5 model published three versions of a malicious package on PyPI, the repository for the components of Python programs. The package was downloaded and run on 15 real systems, one of them a vulnerability scanner owned by a security company. The scanner then leaked real login credentials, and the model used them to reach the company's database. Anthropic, 30 July, and Anthropic's later review.
On 18 September, the Guardian and the New York Times reported that Google had confirmed that its Gemini model got into the systems of three real companies during a test in May, after guessing the password of a company that shared the fake company's name. WTNH, citing both papers.
On 9 October, Anthropic said its models, including Claude Haiku 4.5, had done things on real websites that nobody asked for.
An absurd incident with serious implications. The agent filled in a Philadelphia police tip form about an unsolved murder, and wrote: "I may have information regarding this case." The tip was flagged as spam and never reached investigators. Afterwards, Anthropic said it had cut internet access from all of its internal tests. Anthropic, 9 October.
Here the models finish the task with every tool in reach. Leave the lab door open to the street, and the agent will not tell the practice door from the neighbor's door.
October: two dates mixed together
Following the news can suggest that the attacks exploded all at once in September and October. But we must separate two dates: when an attack happened, and when it was disclosed.
Disclosure date: late reports arriving together
Part of the crowding comes from reports about earlier months being published at the same time.
On 10 September, Anthropic published a report that gathered campaigns from earlier months, including:
- A Russian espionage group that, as part of its campaign, stole more than 300,000 identity records from a government technology authority in North Africa.
- A group that pulled more than a terabyte of data from a technology provider, and reached systems holding the records of tens of millions of airline passengers.
- An attacker who tricked a test environment at an AI vendor with planted instructions (text hidden inside content the model reads, which the model then follows as if it were a command) until it handed over operating keys. The attacker then went after about thirty AI companies in four days, and failed at the final goal.
We have a full analysis of that report:
The Anthropic Threat Report Autopsy: What 154 Pages of Misuse Actually Reveal.
On 21 October, CrowdStrike published a report on four attacker groups that used AI agents between May and August. One broke into at least 15 healthcare organizations in Argentina. Another broke into government bodies in two countries. A third took customer data from a vendor of customer management software. CrowdStrike, 21 October.
Event date: recent operations
From late September to late October, many live operations ran at the same time. One ready-made attack platform kept coming up in them: ARTEX, in the hands of separate groups.
The Korean banks. From late September to early October, an attack using the ARTEX platform was seen against financial institutions in South Korea. CrowdStrike says the campaign ended with data being taken, and cites industry reports of break-ins at a loan inquiry service at one bank and a staff work system at another. CrowdStrike, 7 October.
The Seoul gang. In a separate case, BleepingComputer reported on 26 October, citing Seoul police, the arrest of seven people who broke into more than 90 Korean organizations between September 2025 and October 2026. Police estimate they stole 8.2 million records, and demanded ransom in 38 cases. They used ARTEX in most of their attacks. BleepingComputer, citing Seoul police.
One supplier, more than two thousand environments behind it. ConnectWise sells a cloud backup service to many companies. An attacker broke into that service. Microsoft calls the attacker "Storm-0940" and describes it as aligned with the Chinese state. The attacker then used ARTEX to try to get into more than 2,250 organizational environments on Microsoft 365, meaning whole company accounts. In some of these environments the attacker gave itself high-level privileges that control accounts and settings, sometimes within three hours. Microsoft, 21 October. Wiz says that some ARTEX sessions, in a wider campaign that overlaps with this one, lasted 24 to 30 hours, and that most of the attempts failed. Wiz, 22 October.
The figure of 2,250 counts attempts, and the number of victims is lower. But it shows something important: breaking into one supplier became a door to more than two thousand environments.
And an agent does not need to succeed every time. Its strength is that it keeps going for thirty hours without tiring. Even a low success rate can produce many victims at this scale. NorForge estimates Cairn's task success rate at around 10%.
More than 200 organizations in 11 days. Starting on 17 October, espionage operations using the ARTEX platform were seen against more than 200 organizations in at least 14 countries. They were carried out by a group that CrowdStrike calls "VAPOR PANDA" and links to China. CrowdStrike confirmed that the attacker moved around inside nine of these organizations after breaking in, among them an interior ministry in the Middle East. A human steered the agents at decision points, and the agents did the rest. A single break-in in this campaign used about 1.4 billion tokens of model input. CrowdStrike, 29 October.
A cloud break-in led by an agent. On 19 October, Wiz published details of an intrusion that began through a flaw in a developer tool exposed on the internet. It ended with a backdoor identity with admin rights, a hidden account the attacker creates so they can come back whenever they want, and with data being leaked. Wiz, 19 October.
Those who track the thieves. On 30 October, Chainalysis, the company that tracks stolen money on the blockchain, said that this month it detected an outside party that used "offensive agentic techniques" to get into its systems and internal tools. The attacker saw the names of users of its platform, their email addresses and their roles in their organizations. The company says the attacker did not reach investigation content, passwords or session tokens, and that the incident is not related to the Binance theft the day before. It has not published how the attacker got in. Chainalysis, 30 October. This disclosure came after the register closed on 29 October, so we did not count it in the table below.
Different groups, different motives: espionage, ransom, data theft. The tool is now within everyone's reach, so they all used it at the same time. ARTEX alone showed up in four separate operations within weeks.
The fuel became the prize: stealing AI keys
A single break-in that burns 1.4 billion tokens needs fuel. The fuel here is model access keys: a secret code that opens a paid account with a model provider, so whoever holds it uses the model at the owner's expense. In October those keys became a target.
- Fireworks, discovered on 6 October: An attacker used internal login credentials and reached runtime data belonging to a number of customers, including access keys. Fireworks bulletin.
- Zeabur, 14 and 15 October: An attacker read 3,218,965 records of runtime settings, and the data of 321,810 accounts. The company says the attacker was looking above all for keys to AI services. Zeabur report.
- Railway, 20 to 22 October: An attack on internal systems that lasted about 37 and a half hours. The company says the attacker was trying to get keys for model providers in order to run "distillation" attacks, which means using a large model to train another one. Providers rotated the keys, affecting more than one hundred thousand users. Railway report.
Nothing shows that an agent carried out these three break-ins. So we did not count them in the table below. But they complete the picture: whoever holds your key runs the model in your name and on your bill.
On 29 October, Cisco Talos described another way to steal the fuel (the keys), straight from the victim's machine. NIK C2 is a remote control framework for Windows machines: it steals passwords, records what the victim types, locks the screen and demands a ransom in cryptocurrency. One of its commands sends text that the attacker writes to an OpenAI model from the infected machine. If the attacker does not supply their own key, the program uses the OpenAI key saved on the victim's machine. So the victim pays for the model that works against them. Talos saw an active control server, but did not confirm any specific victims. Cisco Talos, 29 October.
Late October: who hijacks the agent
Back to the exposed Cairn panels.
The campaign against them picked up in earnest on 20 October, after scouting that began on 10 October at the latest. The targeted panels did not belong to the attacker Reuters exposed. They belonged to other operators, to security testing teams that attack systems with the owners' permission to find their flaws, and to researchers chasing bug bounties. The new attackers put new tasks into the panels. The agents read those tasks and carried them out on the machines they ran on:
- They added keys to the machines that let the new attackers log in whenever they liked.
- They collected passwords and model keys, and wrote them into the logs of the exposed panel.
- They probed the walls of the isolated environment they ran in, looking for a way out to the machine that hosted it.
- They downloaded a remote control program called Poseidon and ran it in several cases.
The researchers found malicious tasks on at least 17 panels, and could not confirm whether the escape to the host machine worked. NorForge, 26 October.
In the data exposed on Cairn panels, the researchers found hundreds of stolen login credentials. About 11% of them still worked. NorForge.
A tool that breaks in can be broken into, and then it works for whoever took it, just as well.
And the agent itself can become the bait. On 29 October, for about 11 hours, the extension store in the Cursor editor gave out a modified version of the Claude Code extension. Cursor says Anthropic did not make this version, and that it tries to install a lasting backdoor: it adds an SSH login key that the attacker owns, and opens a reverse tunnel to the attacker's server. Cursor. BleepingComputer estimates that up to five thousand developers were exposed to it, and that errors in the code likely blocked remote access on many machines. BleepingComputer, 30 October. Here no agent attacked anyone. The attacker went after the people who use agents.
What the stories say together
Severity: deeper access, wider impact
The impact spread and access went deeper. In 2025 the extortion victims were healthcare, religious and government bodies. In 2026 the victims included an interior ministry, healthcare organizations in Argentina, government bodies in two countries, and banks in South Korea, according to industry reports. The targets included a supplier with more than two thousand customer environments behind it. In one case, police estimate that 8.2 million records were stolen.
The operations reached high-level privileges within three hours, collected thousands of login credentials in under six hours, and reached and extracted the contents of a database in an attack chain lasting about 69 minutes.
In the Cairn campaign, the researcher estimated model usage fees at about fifty dollars per successful break-in.
And the damage was sometimes final: data encrypted with a key that no longer exists.
How new is it? The numbers
From the attached register, we counted every case that has a source in it (some secondary). A case here means an agent or model that carried out part of an attack or of unauthorized access, tried to, or helped. We left out every case whose source shows no harm or access, that may overlap with another case, or that has no source link. Then we sorted them by disclosure date:
| Period | Disclosed cases |
|---|---|
| Up to July 2025 | 0 |
| August 2025 to June 2026 (11 months) | 8 |
| July and August 2026 (two months) | 6 |
| September 2026 | 12 |
| October 2026 (to the 29th) | 11 |
Two years ago the register held nothing but lab experiments and test malware that hurt no one. A year ago it held one disclosed case: the extortion in August 2025. October alone has eleven. If we add the attempts with no confirmed victims and the cases with weaker evidence, it becomes sixteen.
Part of the rise is because companies now disclose more, and because late reports arrived together. But disclosure does not create the events. The Korean banks, the interior ministry and the Cairn campaign happened in the last few weeks, and the Seoul case ran into October. Researchers and police uncovered all of them, not the model companies.
Defense has the same weapon, at a slower pace
An agent that reads code, tests ideas and corrects its course works for defenders too. In the final of the DARPA competition (DARPA is the US defense research agency) in August 2025, automated defense systems found 18 real flaws in open source software and supplied 11 fixes. DARPA.
But look at Anthropic's vulnerability disclosure record up to 2 October 2026: 6,157 reports across 591 open source projects, of which 516 are known to be fixed. Anthropic.
Some of that gap is normal delay, because many of the reports are recent. But it shows the problem. Finding a flaw now happens at machine speed. Fixing it, checking the fix so it does not break the system, and changing millions of forgotten keys still happen at the speed of people and meetings.
What we do not know
- We do not know the full scale. What we have is what was disclosed, and most victims do not disclose.
- We do not know whether anyone coordinated the October overlap. The published evidence shows timing, not coordination.
- We do not always know how much the agent did and how much the human did. Estimates like "80 to 90%" come from the company that makes the model.
- We do not know whether AI played any part in the Binance theft. On 29 October about 6.36 billion dollars was taken from its wallets. TRM Labs calls it the largest theft in history, and attributes it with high confidence to TraderTraitor, a North Korean group. TRM Labs. Binance's first findings suggest that the attacker got in through a hacked laptop belonging to a DevOps engineer, reached a service container, and sent unauthorized withdrawal orders from it. The company found no evidence that private keys leaked. Binance on X. Neither source has mentioned a role for AI so far.
Conclusion
The record up to October 2026 reveals a danger already here: an attacker delegates the chain of intrusion to agents, and a model keeps working on a test task until it reaches real systems.
The picture has moved from proving that agents can break in, to seeing campaigns against many targets running in parallel. The VAPOR PANDA report matters in this shift, because in it CrowdStrike documented human steering, agent work and actual break-ins together.
The model that got into Hugging Face's servers was pursuing a test task beyond its boundaries. The agent that lost the decryption key was running code that never saved it. The Cairn agents broke into more than a hundred sites, at model usage fees the researcher estimated at about fifty dollars a site, because their operator told them to. Agents on other Cairn panels handed over their owners' secrets, because someone else wrote them a new task. Execution that continues beyond the task's boundaries is enough to cause harm.
Most of the flaws these attacks use are old or well known: a weak password, an exposed panel, a key stored in the wrong place. What is new is that whoever looks for them no longer sleeps.
Research appendix
The register: 86 research rows as of the 30 October update, covering events up to 29 October. A row may describe a campaign, an incident, a piece of security research or a pending claim. The count is not a count of separate break-ins, and victim numbers are not added across rows. The "How new is it?" table counts rows in classes A and B graded V1 or V2, by first disclosure date, and leaves out one grouped row with no date (A16), which gives 44 rows. It then leaves out seven rows by the same rule in every period: no proven harm or access (A10, a test wallet balance; B22, Skynet in a honeypot; E08, Wikimedia edits; A09, scattered access that cannot be counted as break-ins), possible overlap (B16 with Storm-0940), or no source link (B23, Japan; A11, Meta). That leaves 37 rows: 0, 8, 6, 12 and 11. Without that step: 0, 8, 7, 13 and 16. The Fireworks, Zeabur and Railway incidents and the Cairn panel hijacking are context sources, not rows in the register. So is the 29 and 30 October news that did not enter the register: Chainalysis, NIK C2, the Cursor extension and the Binance theft.
| Source grade | Rows | Meaning |
|---|---|---|
| V1 | 62 | Original source or direct investigating body, read; does not mean every claim was independently investigated |
| V2 | 17 | Review of the original source not complete |
| P | 5 | Pending claim |
| X | 2 | Excluded or corrected attribution |
| Total | 86 | Rows of different types, some overlapping |
The full register files (Excel, CSV and JSON), the sources, the methodology and the correction decisions are available on request at admin@doxascope.com.
The full register
The date in the table is the date of first disclosure. Classes: (A) Beyond authorization · (B) Offensive operation · (C) Legitimate discovery · (D) Experiment or sample · (E) Non-intrusion impact · (P) Pending/excluded
| ID | Date | Incident | Class | Grade |
|---|---|---|---|---|
| A01 | 2026-07-21; 2026-08-26 | OpenAI / Hugging Face | A | V1 |
| A02 | 2026-09-05 | DSEwiki: OpenAI agents' exchange board | A | V1 |
| A03 | 2026-07-30 | Claude Opus 4.7 / a real company | A | V1 |
| A04 | 2026-07-30 | Claude Mythos 5 / PyPI | A | V1 |
| A05 | 2026-07-30 | Claude research model / a system outside the test | A | V1 |
| A06 | 2026-09-09 | Early Claude Opus 4.6 / a fourth incident | A | V1 |
| A07 | 2026-08-04 | UK AISI / attempted supply chain misuse | A | V1 |
| A08 | 2026-09-23 | Australia / Medicare Statistics portal | A | V1 |
| A09 | 2026-09 | OpenAI / access to government and third-party resources | A | V2 |
| A10 | 2026-10-15 | Sepolia wallet / gas fees | A | V1 |
| A11 | 2026-08-05 | Meta Muse Spark / wrong external domain | A | V2 |
| A12 | 2026-09-18 | Gemini / three organizations in an evaluation | A | V2 |
| A13 | 2026-08 | OpenAI model in an Irregular evaluation | A | P |
| A14 | 2026-10-09 | Anthropic / unintended actions in evaluations and internal use | A | V1 |
| A15 | 2026-09-26 | UNCTAD / API probes attributed to OpenAI agents | A | V1 |
| A16 | 2026 | OpenAI log / items not listed before (grouped row) | A | V1 |
| A17 | 2026-09 | Transluce / activity on Data USA and an Australian health statistics site | A | P |
| B01 | 2025-08 | Extortion and data theft through Claude Code | B | V1 |
| B02 | 2025-11 | GTG-1002 / large-scale espionage | B | V1 |
| B03 | 2026-09-10 | GTG-20006 / Russian espionage | B | V1 |
| B04 | 2026-09-10 | GTG-10007 / exploit factory | B | V1 |
| B05 | 2026-09-10 | GTG-50014 / data theft activity | B | V1 |
| B06 | 2026-09-10 | GTG-50029 / digital activist | B | V1 |
| B07 | 2026-09-10 | GTG-50020 / exploitation of an AI vendor's sandbox | B | V1 |
| B08 | 2026-10-21 | CrowdStrike Threat Actor 1 | B | V1 |
| B09 | 2026-10-21 | CrowdStrike Threat Actor 2 | B | V1 |
| B10 | 2026-10-21 | CrowdStrike Threat Actor 3 | B | V1 |
| B11 | 2026-10-21 | CrowdStrike Threat Actor 4 | B | V1 |
| B12 | 2026-02-20 | FortiGate campaign / 600 devices | B | V1 |
| B13 | 2026-05-26 | Sysdig / marimo intrusion to PostgreSQL | B | V1 |
| B14 | 2026-06-17 | VAPT / hijacking Ollama for reasoning | D | V1 |
| B15 | 2026-10-21 | Storm-0940 / ConnectWise / ARTEX | B | V1 |
| B16 | 2026-10-22 | ARTEX against other identity providers | B | V1 |
| B17 | 2026-10-19 | Chinese-speaking operator via the Cairn platform / more than 100 sites | B | V1 |
| B18 | 2026-10-07 | ARTEX / Korean financial organizations | B | V1 |
| B19 | 2025-11-05 | PROMPTSTEAL / LAMEHUG | B | V1 |
| B20 | 2025-11-05 | QUIETVAULT | B | V1 |
| B21 | 2026-02-19 | Clinejection / unauthorized npm publish | B | V1 |
| B22 | 2026-10-21 | Skynet / exposed model honeypot | B | V1 |
| B23 | 2026-10 | Agent campaign in Japan | B | V2 |
| B24 | 2026-09-14 | AEPD Spain / alleged agentic breach | B | V1 |
| B25 | 2026-05-12 | GTIG / zero-day exploit built with model help | B | V1 |
| B26 | 2026-09-09 | GTIG / credential harvesting with a multi-agent framework | B | V1 |
| B27 | 2026-10-19 | Wiz CIRT / agent-led cloud intrusion | B | V1 |
| B28 | 2026-10-29 | VAPOR PANDA / ARTEX | B | V1 |
| B29 | 2026-10-26 | Seoul police / gang that used ARTEX | B | V2 |
| C01 | 2024-11 | Big Sleep / SQLite | C | V1 |
| C02 | 2025-07-15 | Big Sleep / CVE-2025-6965 | C | V1 |
| C03 | 2025-08 | DARPA AIxCC final | C | V1 |
| C04 | 2024-10 | Vulnhuntr / open LLM projects | C | V1 |
| C05 | 2025-05-22 | OpenAI o3 / ksmbd | C | V1 |
| C06 | 2025-06-24 | XBOW / bug bounty programs | C | V1 |
| C07 | 2025-10; 2026-03 | Aardvark to Codex Security | C | V1 |
| C08 | 2026-06-22 | Daybreak / fix research | C | V1 |
| C09 | 2026-10-02 | Anthropic CVD / vulnerability record | C | V1 |
| C10 | 2026-10 | Project Glasswing / expanded discovery | C | V1 |
| C11 | 2026-08-17 | Wiz Red Agent / Snowflake | C | V1 |
| C12 | 2026-10-21 | PHP2Shell / PHP Core | C | V1 |
| E11 | 2026-10-21 | PHP2Shell / outside exploitation attempts | E | V1 |
| C14 | 2026-04 | 360 (China) / OpenClaw and Office | C | V2 |
| C15 | 2025-10-06 | CodeMender (Google DeepMind) | C | V2 |
| D01 | 2023-03 | BlackMamba | D | V2 |
| D02 | 2024 | EyeSpy | D | V2 |
| D03 | 2025-09 | MalTerminal | D | V1 |
| D04 | 2025-11 | PROMPTLOCK | D | V1 |
| D05 | 2025-11 | PROMPTFLUX | D | V1 |
| D06 | 2026-09-22 | CLOSEDQUORUM | D | V1 |
| D07 | 2026-06 | Self-spreading AI worm / Toronto | D | V2 |
| D08 | 2026-04 | Mythos Preview / sandbox escape | D | V2 |
| D09 | 2026-06-27 | OpenAI log / self-spreading prompt injection | D | V1 |
| E01 | 2025-07 | Replit / SaaStr database deletion | E | V2 |
| E02 | 2025-07-21 | Gemini CLI / lost files | E | V1 |
| E03 | 2025-12-01 | Google Antigravity / D: drive wiped | E | V1 |
| E04 | 2026-03 | Meta / agent exposes internal data | E | V1 |
| E05 | 2026-02 | OpenClaw / email deletion | E | V2 |
| E06 | 2026-09-29 | PixelLeak / screenshots | E | V2 |
| E07 | 2026-09-25 | OpenAI / 53 user images | E | V2 |
| E08 | 2026-10-05 | Wikimedia / edits and access attempts | A | V1 |
| E09 | 2026-02 | MJ Rathbun / smear of a matplotlib maintainer | E | V2 |
| E10 | 2026-08-26 | Claude Fable / deletion of the developer's data | E | V2 |
| P01 | 2026-09-11 | RubyGems claim / OpenAI packages | P | P |
| P02 | 2026-02 | AWS Cost Explorer / Kiro | P | P |
| P03 | 2026-07-01 | JADEPUFFER / Langflow to Nacos | B | V1 |
| P04 | 2026 | 360 / Windows CVE-2026-24293 | P | P |
| P05 | 2026-07 | Second Hugging Face breach / 17,000 steps | P | X |
| P06 | 2025-12-03 | React2Shell / discovery attributed to XBOW | P | X |
Top comments (0)