| Langflow: Critical flaw actively exploited to steal OpenAI and AWS credentials |
2026-09-01 |
Technology |
Medium
|
Langflow |
— |
— |
— |
| Rise Up: Everest ransomware group claims breach of AI-powered learning platform, 473GB leaked |
2026-09-02 |
Education |
High
|
Rise Up |
France |
— |
— |
| Unnamed enterprise: AI agents breach network using 50+ MITRE ATT&CK techniques in under 10 hours |
2026-09-02 |
— |
High
|
Unnamed enterprise |
— |
— |
— |
| LiteLLM: MCP authentication-bypass flaw added to CISA’s exploited vulnerabilities list |
2026-09-02 |
Technology |
Medium
|
Berri (LiteLLM) |
— |
— |
— |
| Unnamed organization: Leaked AWS admin key lets attackers hijack Claude access via Bedrock in ‘LLMjacking’ scheme |
2026-09-03 |
Technology |
Medium
|
Unnamed organization |
— |
Claude 3 Opus, Claude 2.x |
Claude |
| Microsoft: Azure East US failure knocks ChatGPT, Claude and Grok offline simultaneously |
2026-09-03 |
Technology |
Medium
|
Microsoft |
United States |
— |
OpenAI, Anthropic, xAI |
| Uber: 241,000 drivers file European class action over AI pricing algorithm |
2026-09-03 |
Transportation & Logistics |
High
|
Uber Technologies |
Netherlands |
— |
— |
| OpenAI: GPT-6 Astra jailbroken within 24 hours of release despite claimed 98% resistance rate |
2026-09-04 |
Technology |
Low
|
OpenAI |
United States |
GPT-6 Astra |
OpenAI |
| OpenAI: Rogue evaluation agents secretly hijacked a German wiki forum for months |
2026-09-04 |
Technology |
Medium
|
OpenAI |
Germany |
— |
OpenAI |
| OpenAI: Autonomous agents post ~18,000 messages on a German wiki to share answers and sandbox-bypass techniques |
2026-09-05 |
Technology |
Medium
|
OpenAI |
Germany |
— |
OpenAI |
| Sutherland Healthcare Solutions: Employee fired after refusing AI webcam monitoring tool |
2026-09-08 |
Healthcare |
Medium
|
Sutherland Healthcare Solutions |
United States |
— |
— |
| N/A (individual victim): Northern Ireland man loses £250,000 in deepfake celebrity investment scam |
2026-09-08 |
Other |
Medium
|
N/A (individual victim) |
United Kingdom |
— |
— |
| NSA, FBI, CISA: Chinese AI firms ran industrial-scale distillation campaign against Anthropic, OpenAI, Google, xAI |
2026-09-08 |
Technology |
Critical
|
Anthropic, OpenAI, Google, xAI |
United States |
— |
Claude, OpenAI, Google, xAI |
| Unnamed organization: Financially motivated group’s autonomous AI agent framework compromises thousands of credentials in six hours |
2026-09-08 |
— |
Medium
|
Unnamed organization |
— |
— |
— |
| OpenAI: Check Point discloses hidden cross-account channel letting a planted prompt exfiltrate Gmail data via ChatGPT |
2026-09-08 |
Technology |
Medium
|
OpenAI |
United States |
— |
OpenAI |
| Stephen Aarons: Attorney fined after ChatGPT invents witnesses in murder appeal brief |
2026-09-09 |
Other |
Medium
|
Stephen Aarons (attorney) |
United States |
— |
OpenAI |
| Google: Critical unauthenticated RCE flaw disclosed in Agent Development Kit for Python |
2026-09-09 |
Technology |
Medium
|
Google |
United States |
— |
— |
| Multiple organizations: ShinyHunters-linked actor abuses Claude to mass-harvest secrets from 1.8 million Android apps |
2026-09-10 |
Technology |
Critical
|
Multiple organizations (40+ corporate accounts; government, energy, retail and aviation victims) |
— |
— |
Anthropic |
| Anthropic: Russian ‘Midnight Blizzard’ hackers use Claude to automate espionage against Ukraine, self-heal detected malware |
2026-09-10 |
Government & Public Sector |
Critical
|
Multiple organizations (20+ targets: Ukrainian government, defense contractors, diplomatic missions, drone manufacturers) |
— |
Claude Haiku, Claude Sonnet, Claude Opus |
Claude |
| Multiple organizations: ‘EvilTokens’ AI-powered phishing kit steals $1.1 million before Microsoft-led takedown |
2026-09-11 |
Other |
High
|
Multiple organizations |
United Kingdom |
— |
— |
| Woolworths: ‘Olive’ shopping chatbot mistakenly cancels customer’s refund request, gets stuck repeating itself |
2026-09-15 |
Retail & E-commerce |
Low
|
Woolworths |
Australia |
— |
— |
| 100+ U.S. retailers, hospitality firms: Chinese hacker used Claude, DeepSeek AI agents to steal 600,000+ credit cards |
2026-09-15 |
Retail & E-commerce |
Critical
|
100+ U.S. retail, hospitality, and travel companies |
United States |
Opus 4.6, DeepSeek v4 |
Claude, DeepSeek |
| VanDoeselaar family: AI voice-cloning and fake emails derail Michigan home purchase, $66,000 lost |
2026-09-15 |
Real Estate |
Medium
|
VanDoeselaar family |
United States |
— |
— |
| West Michigan couple: AI voice-clone real estate wire fraud costs $66,000 in closing funds |
2026-09-15 |
Real Estate |
Medium
|
N/A (individual homebuyers) |
United States |
— |
— |
| Unnamed enterprise: Runaway accounting AI agent racks up $50,000 in cloud charges in under an hour |
2026-09-16 |
Other |
Medium
|
Unnamed enterprise |
— |
— |
— |