| Sainsbury’s: Facewatch facial-recognition AI wrongly flags paying customer as shoplifter |
2026-08-18 |
Retail & E-commerce |
Medium
|
Sainsbury's |
United Kingdom |
— |
— |
| Microsoft Copilot: ‘CoSnitch’ Flaw Enabled One-Click Data Theft via Memory Poisoning |
2026-08-18 |
Technology |
Low
|
Microsoft |
United States |
— |
Microsoft |
| State Farm: Defense lawyers admit AI-fabricated case citations in Los Angeles fire lawsuit |
2026-08-18 |
Finance & Banking |
Medium
|
State Farm |
United States |
— |
— |
| Siemens: US agencies warn of active AI-generated exploit campaign against S7 PLCs in critical infrastructure |
2026-08-19 |
Energy & Utilities |
Medium
|
Siemens (S7 Series PLC operators) |
United States |
— |
— |
| Alation: AI Data Platform Confirms Cyberattack Affecting Customer Systems |
2026-08-19 |
Technology |
Medium
|
Alation |
United States |
— |
— |
| ClarityCheck: Unsecured database exposes 9 million facial images |
2026-08-20 |
Technology |
High
|
ClarityCheck |
United States |
— |
— |
| xAI: ‘Cryptographic Context Injection’ flaw in Grok could exfiltrate user data via malicious web pages |
2026-08-20 |
Technology |
Low
|
xAI |
United States |
— |
Grok |
| Savannah Police Department: Officers arrested for misusing AI license-plate readers to track personal acquaintances |
2026-08-21 |
Government & Public Sector |
High
|
Savannah Police Department / Flock Safety |
United States |
— |
— |
| Instinct: Beta AI personal assistant sends email without approval, retains data after disconnect |
2026-08-21 |
Technology |
Low
|
Instinct (Spear Street Technology) |
United States |
— |
— |
| npm: Trojanized packages drop ‘RedC2 4.0’ AI-powered Linux backdoor |
2026-08-21 |
Technology |
Medium
|
npm |
— |
— |
— |
| Unnamed Amsterdam law firm: Attorney fined extra costs over AI-hallucinated case citation |
2026-08-21 |
Consulting & Professional Services |
Low
|
Unnamed Amsterdam law firm |
Netherlands |
— |
— |
| NVIDIA: NemoClaw flaw let malicious webpages hijack and poison local OpenClaw AI agents |
2026-08-25 |
Technology |
Low
|
NVIDIA |
United States |
— |
OpenClaw |
| NHS England: Healthwatch finds AI medical scribes inserting wrong diagnoses and drug names into patient records |
2026-08-26 |
Healthcare |
Medium
|
NHS England |
United Kingdom |
— |
— |
| Anthropic: Claude Fable coding agent deletes developer’s 700GB home directory during sandbox test |
2026-08-26 |
Technology |
Medium
|
Independent developer (Sebastien Guillemot) |
— |
Fable 5, Opus 5, Opus 4.8 |
Claude |
| Cloudflare: Workers AI inference bug returns other customers’ data in 155 GLM-5.3 responses |
2026-08-27 |
Technology |
Medium
|
Cloudflare |
— |
GLM-5.3 |
— |
| DeepSeek: Harness coding-agent flaw let agents silently disable their own file sandbox |
2026-08-27 |
Technology |
Medium
|
DeepSeek |
China |
— |
DeepSeek |
| xAI: Class-action lawsuit alleges Grok’s deepfake generator was trained on child sexual abuse material |
2026-08-27 |
Technology |
Critical
|
xAI |
United States |
Grok |
xAI |
| Cursor: Russian-speaking ransomware crew tricked Claude-powered AI agent into breaching seven companies |
2026-08-27 |
Technology |
High
|
Cursor |
United States |
Claude Sonnet 4.5 |
Claude |
| ServiceNow: Three maximum-severity flaws in AI Platform could let unauthenticated attackers execute code and SQL |
2026-08-27 |
Technology |
Medium
|
ServiceNow |
United States |
— |
— |
| Brian E. Mitchell: USPTO issues first AI-hallucination discipline order over fabricated patent citations |
2026-08-27 |
Consulting & Professional Services |
Low
|
Brian E. Mitchell |
United States |
— |
— |
| Suno: Jason Isbell and musicians file class action over AI-generated artist-impersonating songs |
2026-08-31 |
Technology |
Medium
|
Suno |
United States |
— |
— |
| PaperCut NG/MF: Attacker orchestrates hundreds of AI agents to breach 395 organizations across 48 countries |
2026-08-31 |
Education |
Critical
|
Multiple organizations (395 PaperCut NG/MF customers across 48 countries) |
— |
— |
OpenAI, DeepSeek |
| Anthropic: Infostealer malware hijacks Claude accounts, bypasses two-factor authentication |
2026-08-31 |
Technology |
Medium
|
Anthropic |
United States |
— |
Claude |
| METR: Discloses two security breaches, including $600,000 in stolen AI inference credits |
2026-08-31 |
Technology |
Medium
|
METR |
United States |
— |
— |
| Anthropic, OpenAI, Cursor, xAI: ‘GitSpawn’ flaw lets malicious .git configs hijack AI coding agents |
2026-09-01 |
Technology |
Low
|
Anthropic, OpenAI, Cursor, xAI |
— |
— |
Claude, OpenAI, xAI |