| OpenAI: Parents sue after ChatGPT allegedly advised Amazon engineer to cut seizure medication before her death |
2026-10-27 |
Healthcare |
Critical
|
OpenAI |
United States |
GPT-4o |
OpenAI |
| Warp: Vendor breach exposes AI agent logs and telemetry for roughly 1% of users |
2026-10-27 |
Technology |
Medium
|
Warp |
— |
— |
— |
| PHP: AI-discovered ‘PHP2Shell’ flaws trigger global government website shutdowns |
2026-10-21 |
Technology |
Critical
|
PHP Foundation |
— |
Gemini 4 Argon, GPT-5.6 Sol |
Google, OpenAI |
| OpenAI: Two internal coding agents disabled their own safety monitors, one then lied about it |
2026-10-21 |
Technology |
Medium
|
OpenAI |
United States |
GPT-6.1 Sol, GPT-6 Astra |
OpenAI |
| LangAlpha: Indirect prompt injection flaw enables remote code execution in open-source financial research agent |
2026-10-20 |
Technology |
Low
|
LangAlpha (ginlix-ai) |
— |
— |
— |
| Likud: AI-generated deepfakes and bot networks used to influence Israel’s 2026 election |
2026-10-19 |
Government & Public Sector |
Medium
|
Likud |
Israel |
— |
— |
| OpenCode: Breach of legacy system exposes AI provider API keys |
2026-10-17 |
Technology |
Medium
|
OpenCode |
— |
— |
OpenAI, Anthropic, Google |
| OpenAI: Employee arrested on suspicion of bugging company meeting room |
2026-10-17 |
Technology |
Medium
|
OpenAI |
United States |
— |
— |
| OpenAI: Washington man sues after ChatGPT allegedly gave unlicensed medical advice, leading to hospitalization |
2026-10-16 |
Technology |
High
|
OpenAI |
United States |
— |
OpenAI |
| OpenAI: Internal model bypassed access controls to download 24 years of government hospital-bed data |
2026-10-16 |
Technology |
High
|
OpenAI |
— |
— |
OpenAI |
| Multiple developers: ‘Aoki’ infostealer variant targets Claude, ChatGPT, and Codex credentials |
2026-10-16 |
Technology |
Medium
|
Multiple developers (OpenAI, Anthropic, Cursor, Codeium users) |
— |
— |
OpenAI, Anthropic, Google |
| ConnectWise: China-linked Storm-0940 uses ARTEX AI agent to breach Cloud Backup customers |
2026-10-15 |
Technology |
Critical
|
ConnectWise |
United States |
— |
— |
| Multiple Indian Organizations: CERT-In warns AI agents breached live systems |
2026-10-15 |
Other |
Medium
|
Multiple Indian organizations (CERT-In advisory) |
India |
— |
— |
| UK Home Office: AI-generated asylum interview summaries failing accuracy checks |
2026-10-15 |
Government & Public Sector |
High
|
UK Home Office |
United Kingdom |
GPT-4o |
OpenAI |
| Mumbai: AI voice-cloning scam impersonating community figure costs retiree ₹50 lakh |
2026-10-15 |
Other |
Medium
|
N/A (individual victim) |
India |
— |
— |
| Mastiff/TV4: AI agent reportedly deletes entire season of ‘The Challenge Sverige’ |
2026-10-14 |
Media & Entertainment |
Medium
|
Mastiff (TV4) |
Sweden |
— |
— |
| LiteLLM: Check Point discloses gateway takeover and API-key-theft flaws |
2026-10-14 |
Technology |
Low
|
LiteLLM |
— |
— |
— |
| OpenAI: Seven U.S. states sue over ChatGPT’s alleged harm to children |
2026-10-14 |
Technology |
High
|
OpenAI |
United States |
— |
— |
| Unnamed Spanish Airports: AI voice distortion used in bomb threat hoaxes |
2026-10-14 |
Transportation & Logistics |
Medium
|
Unnamed Spanish airports |
Spain |
— |
— |
| Riverview High School: Teen used AI-altered image to fabricate shooting threat |
2026-10-14 |
Education |
Medium
|
Riverview High School |
United States |
— |
— |
| MoviePilot: Indirect prompt-injection flaw in AI assistant allows remote code execution |
2026-10-12 |
Technology |
Low
|
MoviePilot (open-source project) |
— |
— |
— |
| Cognition agent framework: Unauthenticated RCE flaw exposes host shell and credentials by default |
2026-10-12 |
Technology |
Low
|
CognicellAI (Cognition agent framework) |
— |
— |
— |
| Lawson, JR East, Times Car: Japan declares cyberspace emergency after AI-assisted hacks hit 20+ firms |
2026-10-09 |
Other |
Critical
|
Lawson, JR East, Times Car |
Japan |
— |
— |
| N/A (individual perpetrator): Illinois man arrested after allegedly generating AI child sexual abuse images |
2026-10-08 |
Other |
Medium
|
N/A (individual perpetrator) |
United States |
— |
— |
| Tensorlake: Poisoned npm SDK release plants credential-stealing worm targeting AI coding tools |
2026-10-08 |
Technology |
Low
|
Tensorlake |
— |
— |
— |