| Multiple organizations: ‘EvilTokens’ AI-powered phishing kit steals $1.1 million before Microsoft-led takedown |
2026-09-11 |
Other |
High
|
Multiple organizations |
United Kingdom |
— |
— |
| Multiple organizations: ShinyHunters-linked actor abuses Claude to mass-harvest secrets from 1.8 million Android apps |
2026-09-10 |
Technology |
Critical
|
Multiple organizations (40+ corporate accounts; government, energy, retail and aviation victims) |
— |
— |
Anthropic |
| Anthropic: Russian ‘Midnight Blizzard’ hackers use Claude to automate espionage against Ukraine, self-heal detected malware |
2026-09-10 |
Government & Public Sector |
Critical
|
Multiple organizations (20+ targets: Ukrainian government, defense contractors, diplomatic missions, drone manufacturers) |
— |
Claude Haiku, Claude Sonnet, Claude Opus |
Claude |
| Stephen Aarons: Attorney fined after ChatGPT invents witnesses in murder appeal brief |
2026-09-09 |
Other |
Medium
|
Stephen Aarons (attorney) |
United States |
— |
OpenAI |
| Google: Critical unauthenticated RCE flaw disclosed in Agent Development Kit for Python |
2026-09-09 |
Technology |
Medium
|
Google |
United States |
— |
— |
| Sutherland Healthcare Solutions: Employee fired after refusing AI webcam monitoring tool |
2026-09-08 |
Healthcare |
Medium
|
Sutherland Healthcare Solutions |
United States |
— |
— |
| N/A (individual victim): Northern Ireland man loses £250,000 in deepfake celebrity investment scam |
2026-09-08 |
Other |
Medium
|
N/A (individual victim) |
United Kingdom |
— |
— |
| NSA, FBI, CISA: Chinese AI firms ran industrial-scale distillation campaign against Anthropic, OpenAI, Google, xAI |
2026-09-08 |
Technology |
Critical
|
Anthropic, OpenAI, Google, xAI |
United States |
— |
Claude, OpenAI, Google, xAI |
| Unnamed organization: Financially motivated group’s autonomous AI agent framework compromises thousands of credentials in six hours |
2026-09-08 |
— |
Medium
|
Unnamed organization |
— |
— |
— |
| OpenAI: Check Point discloses hidden cross-account channel letting a planted prompt exfiltrate Gmail data via ChatGPT |
2026-09-08 |
Technology |
Medium
|
OpenAI |
United States |
— |
OpenAI |
| OpenAI: Autonomous agents post ~18,000 messages on a German wiki to share answers and sandbox-bypass techniques |
2026-09-05 |
Technology |
Medium
|
OpenAI |
Germany |
— |
OpenAI |
| OpenAI: GPT-6 Astra jailbroken within 24 hours of release despite claimed 98% resistance rate |
2026-09-04 |
Technology |
Low
|
OpenAI |
United States |
GPT-6 Astra |
OpenAI |
| OpenAI: Rogue evaluation agents secretly hijacked a German wiki forum for months |
2026-09-04 |
Technology |
Medium
|
OpenAI |
Germany |
— |
OpenAI |
| Unnamed organization: Leaked AWS admin key lets attackers hijack Claude access via Bedrock in ‘LLMjacking’ scheme |
2026-09-03 |
Technology |
Medium
|
Unnamed organization |
— |
Claude 3 Opus, Claude 2.x |
Claude |
| Microsoft: Azure East US failure knocks ChatGPT, Claude and Grok offline simultaneously |
2026-09-03 |
Technology |
Medium
|
Microsoft |
United States |
— |
OpenAI, Anthropic, xAI |
| Uber: 241,000 drivers file European class action over AI pricing algorithm |
2026-09-03 |
Transportation & Logistics |
High
|
Uber Technologies |
Netherlands |
— |
— |
| Rise Up: Everest ransomware group claims breach of AI-powered learning platform, 473GB leaked |
2026-09-02 |
Education |
High
|
Rise Up |
France |
— |
— |
| Unnamed enterprise: AI agents breach network using 50+ MITRE ATT&CK techniques in under 10 hours |
2026-09-02 |
— |
High
|
Unnamed enterprise |
— |
— |
— |
| LiteLLM: MCP authentication-bypass flaw added to CISA’s exploited vulnerabilities list |
2026-09-02 |
Technology |
Medium
|
Berri (LiteLLM) |
— |
— |
— |
| Anthropic, OpenAI, Cursor, xAI: ‘GitSpawn’ flaw lets malicious .git configs hijack AI coding agents |
2026-09-01 |
Technology |
Low
|
Anthropic, OpenAI, Cursor, xAI |
— |
— |
Claude, OpenAI, xAI |
| Langflow: Critical flaw actively exploited to steal OpenAI and AWS credentials |
2026-09-01 |
Technology |
Medium
|
Langflow |
— |
— |
— |
| Suno: Jason Isbell and musicians file class action over AI-generated artist-impersonating songs |
2026-08-31 |
Technology |
Medium
|
Suno |
United States |
— |
— |
| PaperCut NG/MF: Attacker orchestrates hundreds of AI agents to breach 395 organizations across 48 countries |
2026-08-31 |
Education |
Critical
|
Multiple organizations (395 PaperCut NG/MF customers across 48 countries) |
— |
— |
OpenAI, DeepSeek |
| Anthropic: Infostealer malware hijacks Claude accounts, bypasses two-factor authentication |
2026-08-31 |
Technology |
Medium
|
Anthropic |
United States |
— |
Claude |
| METR: Discloses two security breaches, including $600,000 in stolen AI inference credits |
2026-08-31 |
Technology |
Medium
|
METR |
United States |
— |
— |