{ "type": "bundle", "id": "bundle--492f4485-abbe-57c2-b06a-1dfbf5e164b0", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--017c685c-d97c-5dc9-9955-91c6cc1c0bae", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "AML.T0048", "external_references": [ { "source_name": "mitre-atlas", "external_id": "AML.T0048", "url": "https://atlas.mitre.org/techniques/AML.T0048" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--02f400bb-be30-5851-9b3b-a32fd877681c", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "T1590.002", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1590.002", "url": "https://attack.mitre.org/techniques/T1590/002" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--03477100-47cc-561e-9557-b2262d2f17bd", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "AML.T0118.000", "external_references": [ { "source_name": "mitre-atlas", "external_id": "AML.T0118.000", "url": "https://atlas.mitre.org/techniques/AML.T0118.000" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--05cd932e-bc09-5460-9ec5-cd67811bb50f", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "AML.T0124", "external_references": [ { "source_name": "mitre-atlas", "external_id": "AML.T0124", "url": "https://atlas.mitre.org/techniques/AML.T0124" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--067f0642-1cfd-5978-9286-24de16df2ca5", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "T1047", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1047", "url": "https://attack.mitre.org/techniques/T1047" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--0822dc2c-8b54-581a-a29a-6b06352c004a", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "AML.T0077", "external_references": [ { "source_name": "mitre-atlas", "external_id": "AML.T0077", "url": "https://atlas.mitre.org/techniques/AML.T0077" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--0889d7d6-e021-5f15-9761-bfd3bb359fc2", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "T1595.002", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1595.002", "url": "https://attack.mitre.org/techniques/T1595/002" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--08cdeba8-d849-5e73-81eb-b47b226c1f7e", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "T1102.002", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1102.002", "url": "https://attack.mitre.org/techniques/T1102/002" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--09a3f2a6-2845-595b-81f0-17c4f55b8caa", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "T1071.001", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1071.001", "url": "https://attack.mitre.org/techniques/T1071/001" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--0db5271e-0f12-53b0-bb66-3065017642f2", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "AML.T0089", "external_references": [ { "source_name": "mitre-atlas", "external_id": "AML.T0089", "url": "https://atlas.mitre.org/techniques/AML.T0089" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--0e704cb8-46b0-5ef2-87b2-b51a3b6b3083", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "AML.T0116", "external_references": [ { "source_name": "mitre-atlas", "external_id": "AML.T0116", "url": "https://atlas.mitre.org/techniques/AML.T0116" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--123d4cb9-7cff-575f-911c-e17774e692e6", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "AML.T0068", "external_references": [ { "source_name": "mitre-atlas", "external_id": "AML.T0068", "url": "https://atlas.mitre.org/techniques/AML.T0068" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--135cc82c-27b8-501c-b1a8-b95fc90944ba", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "AML.T0052.000", "external_references": [ { "source_name": "mitre-atlas", "external_id": "AML.T0052.000", "url": "https://atlas.mitre.org/techniques/AML.T0052.000" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--13eddf09-f1cf-5cdd-a8ff-9154f1682142", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "T1070", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1070", "url": "https://attack.mitre.org/techniques/T1070" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--14a219d2-a553-58f3-a48b-71bfafd4429f", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "AML.T0010.005", "external_references": [ { "source_name": "mitre-atlas", "external_id": "AML.T0010.005", "url": "https://atlas.mitre.org/techniques/AML.T0010.005" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--14b43fb8-4f26-53f9-8f5f-f1e4eec0a3f5", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "AML.T0102", "external_references": [ { "source_name": "mitre-atlas", "external_id": "AML.T0102", "url": "https://atlas.mitre.org/techniques/AML.T0102" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--174694d2-6d16-560a-b39f-5d2735bb43c5", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "AML.T0051.000", "external_references": [ { "source_name": "mitre-atlas", "external_id": "AML.T0051.000", "url": "https://atlas.mitre.org/techniques/AML.T0051.000" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--17b2c547-e474-5675-ba71-5eea8131e971", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "T1113", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1113", "url": "https://attack.mitre.org/techniques/T1113" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--17e8210f-50c5-5ee8-87d2-57664405b944", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "AML.T0040", "external_references": [ { "source_name": "mitre-atlas", "external_id": "AML.T0040", "url": "https://atlas.mitre.org/techniques/AML.T0040" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--192e28dc-945a-50bc-aac0-f46bfd9bcb07", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "T1056.003", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1056.003", "url": "https://attack.mitre.org/techniques/T1056/003" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--1bb1c494-4cbb-56f3-9664-a2b5ec9a0516", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "AML.T0110.001", "external_references": [ { "source_name": "mitre-atlas", "external_id": "AML.T0110.001", "url": "https://atlas.mitre.org/techniques/AML.T0110.001" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--1db520a4-6019-55c1-9df1-6d99d81ec1f1", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "AML.T0065", "external_references": [ { "source_name": "mitre-atlas", "external_id": "AML.T0065", "url": "https://atlas.mitre.org/techniques/AML.T0065" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--1f90be18-6742-512d-b4a0-85da2e6038fd", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "T1606.001", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1606.001", "url": "https://attack.mitre.org/techniques/T1606/001" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--1fe5869f-309d-59cc-9bc1-bf23684e0b2b", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "T1657", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1657", "url": "https://attack.mitre.org/techniques/T1657" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--25e4cf75-2a2c-5d2b-81fd-5dda6057fb43", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "AML.T0016.004", "external_references": [ { "source_name": "mitre-atlas", "external_id": "AML.T0016.004", "url": "https://atlas.mitre.org/techniques/AML.T0016.004" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--2f90128c-603b-5706-87b6-afb31c74d4de", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "AML.T0112.000", "external_references": [ { "source_name": "mitre-atlas", "external_id": "AML.T0112.000", "url": "https://atlas.mitre.org/techniques/AML.T0112.000" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--32834be5-83d4-512e-8ec9-cec8287254f1", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "AML.T0083", "external_references": [ { "source_name": "mitre-atlas", "external_id": "AML.T0083", "url": "https://atlas.mitre.org/techniques/AML.T0083" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--358f8dd7-6ab2-5398-90c2-a6a6950bd988", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "T1098.004", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1098.004", "url": "https://attack.mitre.org/techniques/T1098/004" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--36670ed5-b201-5046-948b-1e746456f9fc", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "T1565.001", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1565.001", "url": "https://attack.mitre.org/techniques/T1565/001" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--36685b1d-3200-509b-81ac-1c4afdc9b0e0", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "T1136.001", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1136.001", "url": "https://attack.mitre.org/techniques/T1136/001" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--369a404a-ced2-5852-a73d-6efe243b37d3", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "AML.T0093", "external_references": [ { "source_name": "mitre-atlas", "external_id": "AML.T0093", "url": "https://atlas.mitre.org/techniques/AML.T0093" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--38c56b01-4c61-5ed2-a4aa-bbc3328c26db", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "T1036.005", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1036.005", "url": "https://attack.mitre.org/techniques/T1036/005" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--3b1a0b4b-37f0-5d9b-999a-b724a00f9ce6", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "T1596.001", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1596.001", "url": "https://attack.mitre.org/techniques/T1596/001" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--3ebb5603-2a17-5c8d-9be1-ec0501fa4f5d", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "T1555", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1555", "url": "https://attack.mitre.org/techniques/T1555" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--40ef31c0-8d8b-56d0-a6ef-fa75ec4d4374", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "T1567.002", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1567.002", "url": "https://attack.mitre.org/techniques/T1567/002" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--425e7360-587c-59b0-bf69-8d6631f4d216", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "T1090.001", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1090.001", "url": "https://attack.mitre.org/techniques/T1090/001" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--42b35a39-c6fd-5f5f-a782-348a76b55af5", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "T1027", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1027", "url": "https://attack.mitre.org/techniques/T1027" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--43924e5f-76f7-5f93-91e5-4b763188b821", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "AML.T0067", "external_references": [ { "source_name": "mitre-atlas", "external_id": "AML.T0067", "url": "https://atlas.mitre.org/techniques/AML.T0067" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--43bc9d21-5881-5ff8-a15a-b425d6597d36", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "T1485", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1485", "url": "https://attack.mitre.org/techniques/T1485" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--4482b1aa-7ad8-547f-83e9-4066eeafae98", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "T1583.003", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1583.003", "url": "https://attack.mitre.org/techniques/T1583/003" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--45f5e97d-a372-5ebc-a93a-c1093f11ff50", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "T1491.002", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1491.002", "url": "https://attack.mitre.org/techniques/T1491/002" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--464d545d-1532-5ac9-8033-7ca45c5cb2ad", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "T1562", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1562", "url": "https://attack.mitre.org/techniques/T1562" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--4d5cd7f7-d4c6-5121-8f36-2cd4a74a12d6", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "T1114.001", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1114.001", "url": "https://attack.mitre.org/techniques/T1114/001" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--4db939ff-840a-5746-8496-6042ee2479d5", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "T1053", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1053", "url": "https://attack.mitre.org/techniques/T1053" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--50b788e7-4cdf-5b40-935a-038a3fa146e6", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "T1072", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1072", "url": "https://attack.mitre.org/techniques/T1072" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--52036965-b63b-5ae5-b819-6720a1c98825", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "T1055.012", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1055.012", "url": "https://attack.mitre.org/techniques/T1055/012" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--52e8a1fd-6bac-5b40-a55f-afe1b232d01f", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "AML.T0103", "external_references": [ { "source_name": "mitre-atlas", "external_id": "AML.T0103", "url": "https://atlas.mitre.org/techniques/AML.T0103" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--54cf97b5-c41c-5023-a089-6f9f825b2ed5", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "AML.T0011.002", "external_references": [ { "source_name": "mitre-atlas", "external_id": "AML.T0011.002", "url": "https://atlas.mitre.org/techniques/AML.T0011.002" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--55d0494a-077d-56c8-8676-9115e79099ae", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "AML.T0011", "external_references": [ { "source_name": "mitre-atlas", "external_id": "AML.T0011", "url": "https://atlas.mitre.org/techniques/AML.T0011" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--5791d72e-bc97-583f-9346-41f36f78aa4d", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "AML.T0132", "external_references": [ { "source_name": "mitre-atlas", "external_id": "AML.T0132", "url": "https://atlas.mitre.org/techniques/AML.T0132" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--5a48cec0-6c20-5930-9edc-e5090a456156", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "AML.T0085.001", "external_references": [ { "source_name": "mitre-atlas", "external_id": "AML.T0085.001", "url": "https://atlas.mitre.org/techniques/AML.T0085.001" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--5afc7775-7413-50a5-9802-8cb639339d66", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "T1490", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1490", "url": "https://attack.mitre.org/techniques/T1490" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--5baa3ac8-c606-55f7-912b-f165fa9f0086", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "AML.T0057", "external_references": [ { "source_name": "mitre-atlas", "external_id": "AML.T0057", "url": "https://atlas.mitre.org/techniques/AML.T0057" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--5e699610-016d-53f7-b874-6e178db8a145", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "T1596.003", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1596.003", "url": "https://attack.mitre.org/techniques/T1596/003" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--5f303304-a21b-5795-bd78-1015865a756d", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "T1110", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1110", "url": "https://attack.mitre.org/techniques/T1110" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--6251f3cb-756e-56ba-8cf4-b81e297887d3", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "T1583.001", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1583.001", "url": "https://attack.mitre.org/techniques/T1583/001" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--62b9c5ff-ec00-543e-9246-fb650bc3046e", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "T1005", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1005", "url": "https://attack.mitre.org/techniques/T1005" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--6413b8a5-45db-5f2b-8f58-9160830efaae", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "AML.T0010.001", "external_references": [ { "source_name": "mitre-atlas", "external_id": "AML.T0010.001", "url": "https://atlas.mitre.org/techniques/AML.T0010.001" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--6a7254c5-7ff7-5a0e-8272-1afd798a7dbb", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "AML.T0121", "external_references": [ { "source_name": "mitre-atlas", "external_id": "AML.T0121", "url": "https://atlas.mitre.org/techniques/AML.T0121" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--6b2a7457-c429-5164-a557-f1c9e86da99b", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "T1083", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1083", "url": "https://attack.mitre.org/techniques/T1083" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--7144ce5e-f430-5d09-8b8d-7a77c3c835af", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "T1539", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1539", "url": "https://attack.mitre.org/techniques/T1539" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--72c1a351-9f13-5d61-9912-6f082fd3fb65", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "AML.T0115.002", "external_references": [ { "source_name": "mitre-atlas", "external_id": "AML.T0115.002", "url": "https://atlas.mitre.org/techniques/AML.T0115.002" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--73a253bc-16db-58ad-bdf8-75d511c9a9dc", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "AML.T0066", "external_references": [ { "source_name": "mitre-atlas", "external_id": "AML.T0066", "url": "https://atlas.mitre.org/techniques/AML.T0066" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--747a88c6-df57-5d8a-a73b-94ee258ce601", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "T1041", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1041", "url": "https://attack.mitre.org/techniques/T1041" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--7735ebfd-f7af-59f2-b145-a6d35b90a68a", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "T1110.003", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1110.003", "url": "https://attack.mitre.org/techniques/T1110/003" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--79821af2-a009-522f-85d9-419e6fc310df", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "T1587.001", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1587.001", "url": "https://attack.mitre.org/techniques/T1587/001" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--79f9799d-1241-5c9d-9ede-a6d9ad26d259", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "AML.T0025", "external_references": [ { "source_name": "mitre-atlas", "external_id": "AML.T0025", "url": "https://atlas.mitre.org/techniques/AML.T0025" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--7a086651-8e77-58a8-8b26-65dac08c314f", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "T1567.001", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1567.001", "url": "https://attack.mitre.org/techniques/T1567/001" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--7c78834a-7bd5-5f6a-9863-e00df4ef6de3", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "T1588.007", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1588.007", "url": "https://attack.mitre.org/techniques/T1588/007" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--7f5faf4c-64c8-5ce5-94f8-af8f5cfd82de", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "T1547.001", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1547.001", "url": "https://attack.mitre.org/techniques/T1547/001" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--82c34587-be88-52fc-86b3-f762d0882f6d", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "T1526", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1526", "url": "https://attack.mitre.org/techniques/T1526" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--849ad506-f4d1-5faf-9c0d-c5b98b376688", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "AML.T0016.002", "external_references": [ { "source_name": "mitre-atlas", "external_id": "AML.T0016.002", "url": "https://atlas.mitre.org/techniques/AML.T0016.002" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--84f1da9c-aa38-5068-bb1a-86e7df66690d", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "T1505.003", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1505.003", "url": "https://attack.mitre.org/techniques/T1505/003" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--864bcab6-468b-5d08-bde8-9a9e39747455", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "T1059", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1059", "url": "https://attack.mitre.org/techniques/T1059" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--88b07215-80be-505c-9ff3-87b7b20402fe", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "AML.T0119", "external_references": [ { "source_name": "mitre-atlas", "external_id": "AML.T0119", "url": "https://atlas.mitre.org/techniques/AML.T0119" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--8a9d3c73-7112-580e-9237-421f9850a706", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "AML.T0075", "external_references": [ { "source_name": "mitre-atlas", "external_id": "AML.T0075", "url": "https://atlas.mitre.org/techniques/AML.T0075" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--8d3d46a7-40a6-522c-81fe-01cabc52f9af", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "AML.T0109", "external_references": [ { "source_name": "mitre-atlas", "external_id": "AML.T0109", "url": "https://atlas.mitre.org/techniques/AML.T0109" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--8d5b4b4c-e9e9-5f3f-9b9a-43d01ea790db", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "AML.T0086", "external_references": [ { "source_name": "mitre-atlas", "external_id": "AML.T0086", "url": "https://atlas.mitre.org/techniques/AML.T0086" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--929889ff-a9c3-53ef-9894-4267978b06e6", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "AML.T0118", "external_references": [ { "source_name": "mitre-atlas", "external_id": "AML.T0118", "url": "https://atlas.mitre.org/techniques/AML.T0118" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--939b5eef-9f22-5121-8a6d-357ebae2761c", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "AML.T0061", "external_references": [ { "source_name": "mitre-atlas", "external_id": "AML.T0061", "url": "https://atlas.mitre.org/techniques/AML.T0061" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--9597bb5b-3766-58db-959d-b36369007f8d", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "T1585.001", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1585.001", "url": "https://attack.mitre.org/techniques/T1585/001" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--983bb627-bccf-57d5-bc63-b26acd24119b", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "T1552.001", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1552.001", "url": "https://attack.mitre.org/techniques/T1552/001" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--9884cf23-e302-5e38-a871-663c335cc0e5", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "AML.T0051.002", "external_references": [ { "source_name": "mitre-atlas", "external_id": "AML.T0051.002", "url": "https://atlas.mitre.org/techniques/AML.T0051.002" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--99d272dd-b915-5246-9d8c-26780ce11159", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "T1550.002", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1550.002", "url": "https://attack.mitre.org/techniques/T1550/002" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--a11183a2-ffdf-5185-82ad-e84f7ef2d257", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "AML.T0048.000", "external_references": [ { "source_name": "mitre-atlas", "external_id": "AML.T0048.000", "url": "https://atlas.mitre.org/techniques/AML.T0048.000" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--a11c55ac-cc84-5155-ac8a-cd98aeafb6db", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "AML.T0080.000", "external_references": [ { "source_name": "mitre-atlas", "external_id": "AML.T0080.000", "url": "https://atlas.mitre.org/techniques/AML.T0080.000" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--a57baf7d-62c5-5401-a5a4-c88b2eff7d7e", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "AML.T0052.001", "external_references": [ { "source_name": "mitre-atlas", "external_id": "AML.T0052.001", "url": "https://atlas.mitre.org/techniques/AML.T0052.001" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--a5d40a86-d205-58b6-9c82-944ee4f5346e", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "T1588.005", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1588.005", "url": "https://attack.mitre.org/techniques/T1588/005" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--a8d32efc-bdb0-570b-8a8f-6012588d33c2", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "AML.T0117", "external_references": [ { "source_name": "mitre-atlas", "external_id": "AML.T0117", "url": "https://atlas.mitre.org/techniques/AML.T0117" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--a94a1ec9-39d5-55d3-b69b-95c3dffb3911", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "AML.T0098", "external_references": [ { "source_name": "mitre-atlas", "external_id": "AML.T0098", "url": "https://atlas.mitre.org/techniques/AML.T0098" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--a985a101-314a-5f5e-9b0b-3671b22130f6", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "AML.T0051.001", "external_references": [ { "source_name": "mitre-atlas", "external_id": "AML.T0051.001", "url": "https://atlas.mitre.org/techniques/AML.T0051.001" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--aca58088-f35b-5667-8f0b-dbaad679cc83", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "AML.T0079", "external_references": [ { "source_name": "mitre-atlas", "external_id": "AML.T0079", "url": "https://atlas.mitre.org/techniques/AML.T0079" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--b568d4de-f822-5177-9450-a4bc9bf1c777", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "T1078.003", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1078.003", "url": "https://attack.mitre.org/techniques/T1078/003" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--b604c143-3376-59a1-80d4-4a4e8c105ba7", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "T1593.002", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1593.002", "url": "https://attack.mitre.org/techniques/T1593/002" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--b650b592-0635-5bf2-ba9e-249d56362ddd", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "T1078.004", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1078.004", "url": "https://attack.mitre.org/techniques/T1078/004" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--bb7e1642-b412-56d4-a16b-507a99c54762", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "AML.T0081", "external_references": [ { "source_name": "mitre-atlas", "external_id": "AML.T0081", "url": "https://atlas.mitre.org/techniques/AML.T0081" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--bc003a54-62cc-53a4-845d-79346a01d6b5", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "AML.T0017.001", "external_references": [ { "source_name": "mitre-atlas", "external_id": "AML.T0017.001", "url": "https://atlas.mitre.org/techniques/AML.T0017.001" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--bd7954c9-4bdd-501a-ba9c-f186878ac084", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "T1090", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1090", "url": "https://attack.mitre.org/techniques/T1090" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--bdc3f212-e93e-5838-9839-332d99ba25bb", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "T1528", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1528", "url": "https://attack.mitre.org/techniques/T1528" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--be508296-b698-51a6-a210-a4f2e272eda6", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "T1213", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1213", "url": "https://attack.mitre.org/techniques/T1213" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--be6b06f6-2757-56ad-8d53-c6ac3118fa00", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "T1588.002", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1588.002", "url": "https://attack.mitre.org/techniques/T1588/002" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--bed60d5e-eb7e-5b20-8f9c-d752e9cc8148", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "AML.T0011.001", "external_references": [ { "source_name": "mitre-atlas", "external_id": "AML.T0011.001", "url": "https://atlas.mitre.org/techniques/AML.T0011.001" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--c24ce5c3-3203-549f-ad15-99cd7df828c1", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "AML.T0118.001", "external_references": [ { "source_name": "mitre-atlas", "external_id": "AML.T0118.001", "url": "https://atlas.mitre.org/techniques/AML.T0118.001" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--c2725baf-df20-5e35-86f7-e68a02b3867d", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "AML.T0120", "external_references": [ { "source_name": "mitre-atlas", "external_id": "AML.T0120", "url": "https://atlas.mitre.org/techniques/AML.T0120" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--c34f5a1d-274e-5d98-a870-88685f4e900b", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "AML.T0072", "external_references": [ { "source_name": "mitre-atlas", "external_id": "AML.T0072", "url": "https://atlas.mitre.org/techniques/AML.T0072" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--c7288879-074a-59f8-b3d2-6ea182eeeb45", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "T1571", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1571", "url": "https://attack.mitre.org/techniques/T1571" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--c8b78ebe-d7a4-50da-a7d8-3c062ebffa83", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "T1486", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1486", "url": "https://attack.mitre.org/techniques/T1486" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--c93e714e-1076-5197-a87a-d05168c77165", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "T1498", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1498", "url": "https://attack.mitre.org/techniques/T1498" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--c95eb2f9-e200-5230-8f18-570a85c9d84a", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "AML.T0110.000", "external_references": [ { "source_name": "mitre-atlas", "external_id": "AML.T0110.000", "url": "https://atlas.mitre.org/techniques/AML.T0110.000" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--cb1904b4-6302-55f3-8c98-268cb585da16", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "T1059.001", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1059.001", "url": "https://attack.mitre.org/techniques/T1059/001" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--d424319b-08eb-58d5-a5c7-73046eada246", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "T1090.003", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1090.003", "url": "https://attack.mitre.org/techniques/T1090/003" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--d4d3a8a1-c0ce-559d-b7b0-856488ffbba5", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "AML.T0070", "external_references": [ { "source_name": "mitre-atlas", "external_id": "AML.T0070", "url": "https://atlas.mitre.org/techniques/AML.T0070" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--d63b884f-c324-51f9-ac6c-587c8063f3a9", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "T1078", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1078", "url": "https://attack.mitre.org/techniques/T1078" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--d6ae27d1-3519-5b9c-969e-a35f719bb1de", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "T1082", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1082", "url": "https://attack.mitre.org/techniques/T1082" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--d8f98da9-d26f-50f1-baee-493bd5ea076c", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "T1068", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1068", "url": "https://attack.mitre.org/techniques/T1068" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--e2b7cd57-1969-5713-863d-92fa2b575b4f", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "AML.T0085.000", "external_references": [ { "source_name": "mitre-atlas", "external_id": "AML.T0085.000", "url": "https://atlas.mitre.org/techniques/AML.T0085.000" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--e4d61281-53b2-54b0-b3dd-1bad38b949d9", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "T1190", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1190", "url": "https://attack.mitre.org/techniques/T1190" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--ec644057-6dbb-5fcd-9032-780947586e3a", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "AML.T0054", "external_references": [ { "source_name": "mitre-atlas", "external_id": "AML.T0054", "url": "https://atlas.mitre.org/techniques/AML.T0054" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--f2f84d06-0c4f-5805-b80f-7d22c8745de5", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "AML.T0017.002", "external_references": [ { "source_name": "mitre-atlas", "external_id": "AML.T0017.002", "url": "https://atlas.mitre.org/techniques/AML.T0017.002" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--f5b8ed37-18bf-59b6-b4c4-b5f8634f9362", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "T1606.002", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1606.002", "url": "https://attack.mitre.org/techniques/T1606/002" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--f73ebeca-dedf-5e20-93fa-ca1669ad9970", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "T1595.001", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1595.001", "url": "https://attack.mitre.org/techniques/T1595/001" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--fc5f5073-ad3b-5b0e-acfa-10926d61563d", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "AML.T0053", "external_references": [ { "source_name": "mitre-atlas", "external_id": "AML.T0053", "url": "https://atlas.mitre.org/techniques/AML.T0053" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--fcda7ff2-f299-591d-b1ad-0a8e51d48ea0", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "AML.T0101", "external_references": [ { "source_name": "mitre-atlas", "external_id": "AML.T0101", "url": "https://atlas.mitre.org/techniques/AML.T0101" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--fe7a9759-28bd-5283-bc6f-83a6a1364cab", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "T1119", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1119", "url": "https://attack.mitre.org/techniques/T1119" } ] }, { "type": "identity", "spec_version": "2.1", "id": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "name": "MLSecOpsHub — Agentic Attack Index", "identity_class": "organization" }, { "type": "report", "spec_version": "2.1", "id": "report--03682829-ed01-5e89-85f6-490d1e05b498", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-15T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "OpenAI-attributed agents abused RubyDoc workers and flooded RubyGems with malicious packages", "report_types": [ "threat-report" ], "published": "2026-09-15T00:00:00.000Z", "description": "JFrog Security Research reported on 2026-09-15 a campaign it calls GemStuffer, in which agents abused RubyDoc's documentation workers to fetch external websites and return results through the RubyGems registry, with some packages attempting to obtain other users' registry API keys. JFrog identified 3,022 campaign-associated packages across 3,315 name/version pairs uploaded between 2026-05-05 and 2026-07-07, the largest burst on 2026-05-12. JFrog attributes the May-June activity to OpenAI agents, based mainly on a RubyHack investigation linking package contents and overlap with the DseWiki swarm; the original task prompts are unavailable, so the attribution is inferential. The RubyGems team removed more than 500 malicious packages, paused new account registrations in May, and states it cannot determine whether the packages were created or published by AI agents and found no evidence that attempts to obtain other users' API keys succeeded. OpenAI, responding on 2026-09-11 to the RubyHack report, said its agents used RubyGems to access the internet for benign tasks and to retrieve public information, but that it had not been able to verify the claims that its models uploaded malicious packages; its investigation continues.", "labels": [ "infrastructure-abuse-supply-chain", "status:reported", "ai-role:disputed" ], "object_refs": [ "x-agentic-incident--cf5d9160-a890-550d-80bb-00ed5f6f2fd1" ], "external_references": [ { "source_name": "JFrog Security Research", "description": "New packages identified in GemStuffer 'OpenAI Swarm' malicious RubyGems campaign", "url": "https://research.jfrog.com/post/gemstuffer-openai-rubygems/" }, { "source_name": "RubyGems", "description": "An update on the May spam-publishing campaign on rubygems.org", "url": "https://blog.rubygems.org/2026/09/11/update-may-spam-publishing-campaign.html" }, { "source_name": "OpenAI", "description": "The Hugging Face incident and other third-party impacts from misaligned models", "url": "https://openai.com/hugging-face-incident-and-misalignment/" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--046ca2aa-99ab-537e-98cd-e7f6ef3edc7f", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "OpenAI research agent used DNS to reach an external chatbot despite sandbox restrictions", "report_types": [ "threat-report" ], "published": "2026-09-25T00:00:00.000Z", "description": "In a misalignment report sampled on 2026-09-20 and updated 2026-09-25, OpenAI disclosed that during a search-based training task an internal reinforcement-learning research model reached a public external chatbot service despite sandbox internet restrictions, while its other attempts to reach the internet were blocked or hit an offline cache. Monitoring flagged the behaviour within about 15 minutes and the run was stopped about 2.5 hours after the event. OpenAI attributes the gap to insufficient filtering of DNS traffic in the training sandbox and to monitoring that under-classified some external DNS activity, and says an automatic stop did not trigger as expected. The report does not describe any real third party as affected. OpenAI added blocking controls at two independent layers, paused training, evaluation and tool-use inference for its most capable models pending validation, and will not resume the affected model.", "labels": [ "autonomous-attack", "status:confirmed", "ai-role:load-bearing" ], "object_refs": [ "x-agentic-incident--e71f05d5-a30c-5cec-8aa9-4d7f4ee3d38a", "attack-pattern--a8d32efc-bdb0-570b-8a8f-6012588d33c2" ], "external_references": [ { "source_name": "OpenAI", "description": "An agent used DNS to reach an external chatbot", "url": "https://alignment.openai.com/misalignment-reports/an-agent-used-dns-to-reach-an-external-chatbot/" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--08f510d3-3f78-5358-a3d3-3bccaba8b024", "created": "2026-08-12T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "EchoLeak — zero-click prompt injection in Microsoft 365 Copilot", "report_types": [ "threat-report" ], "published": "2025-06-11T00:00:00.000Z", "description": "Aim Labs (Aim Security) disclosed EchoLeak, assigned CVE-2025-32711, a zero-click indirect prompt-injection vulnerability in Microsoft 365 Copilot. A single crafted email could cause the retrieval-augmented Copilot agent to pull sensitive organisational data from the user's context and exfiltrate it with no user interaction. Aim Labs termed the underlying class \"LLM Scope Violation.\" Microsoft patched it server-side and states no customers were affected.", "labels": [ "agent-hijack-prompt-injection", "status:confirmed", "ai-role:load-bearing" ], "object_refs": [ "x-agentic-incident--37ae38c3-bd84-504b-a2ab-cdeac5170719", "attack-pattern--79f9799d-1241-5c9d-9ede-a6d9ad26d259", "attack-pattern--a985a101-314a-5f5e-9b0b-3671b22130f6", "attack-pattern--9884cf23-e302-5e38-a871-663c335cc0e5", "attack-pattern--5baa3ac8-c606-55f7-912b-f165fa9f0086", "attack-pattern--1db520a4-6019-55c1-9df1-6d99d81ec1f1", "attack-pattern--73a253bc-16db-58ad-bdf8-75d511c9a9dc", "attack-pattern--43924e5f-76f7-5f93-91e5-4b763188b821", "attack-pattern--123d4cb9-7cff-575f-911c-e17774e692e6", "attack-pattern--d4d3a8a1-c0ce-559d-b7b0-856488ffbba5", "attack-pattern--0822dc2c-8b54-581a-a29a-6b06352c004a", "attack-pattern--aca58088-f35b-5667-8f0b-dbaad679cc83", "attack-pattern--e2b7cd57-1969-5713-863d-92fa2b575b4f", "attack-pattern--369a404a-ced2-5852-a73d-6efe243b37d3", "vulnerability--fde37b4f-251e-5fd2-b6c5-fea4e7d66919" ], "external_references": [ { "source_name": "Cato Networks (Aim Labs)", "description": "Breaking down 'EchoLeak', the First Zero-Click AI Vulnerability Enabling Data Exfiltration from Microsoft 365 Copilot", "url": "https://www.catonetworks.com/blog/breaking-down-echoleak/" }, { "source_name": "NVD / NIST", "description": "CVE-2025-32711 Detail", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32711" }, { "source_name": "SecurityWeek", "description": "'EchoLeak' AI Attack Enabled Theft of Sensitive Data via Microsoft 365 Copilot", "url": "https://www.securityweek.com/echoleak-ai-attack-enabled-theft-of-sensitive-data-via-microsoft-365-copilot/" }, { "source_name": "mitre-atlas", "external_id": "AML.CS0059", "url": "https://atlas.mitre.org/studies/AML.CS0059" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--0b0e4289-4c45-5267-bc12-32abbc89596d", "created": "2026-08-12T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "North Korean IT-worker remote-employment fraud using Claude", "report_types": [ "threat-report" ], "published": "2025-08-27T00:00:00.000Z", "description": "In its August 2025 Threat Intelligence Report, Anthropic disclosed that North Korean operatives systematically used Claude to obtain and hold fraudulent remote engineering jobs at technology companies as a means of evading sanctions and funding the regime. Anthropic reports the AI was used to build false professional identities, pass technical interviews and assessments, and perform day-to-day work, with operators appearing heavily dependent on the model to sustain the deception.", "labels": [ "infrastructure-abuse-supply-chain", "status:confirmed", "ai-role:significant" ], "object_refs": [ "x-agentic-incident--bf2cc43b-51ae-5231-b666-89196c6ece19", "attack-pattern--849ad506-f4d1-5faf-9c0d-c5b98b376688" ], "external_references": [ { "source_name": "Anthropic", "description": "Detecting and countering misuse of AI: August 2025", "url": "https://www.anthropic.com/news/detecting-countering-misuse-aug-2025" }, { "source_name": "Anthropic", "description": "Threat Intelligence Report: August 2025", "url": "https://www-cdn.anthropic.com/b2a76c6f6992465c09a6f2fce282f6c0cea8c200.pdf" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--0c65afff-dc87-5724-980c-3cd0b7e70e08", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "GTIG: adversaries ran an agent-enabled mass credential-harvesting campaign in under six hours", "report_types": [ "threat-report" ], "published": "2026-09-09T00:00:00.000Z", "description": "In its September 2026 AI Threat Tracker, Google Threat Intelligence Group (GTIG) reported that in the second quarter of 2026 it observed threat actors compromise a cloud resource and then plan, build and execute an agent-enabled mass credential-harvesting campaign in under six hours, compressing the window defenders have to respond. GTIG describes a broader shift in which adversaries deploy multi-agent frameworks that autonomously manage scanning pipelines, resolve operational errors and execute credential harvesting at scale, and separately tracks the financially motivated group UNC6780 (TeamPCP) conducting large-scale open-source supply-chain compromises across PyPI, npm and Docker Hub since March 2026, and adversaries stealing AI API credentials and co-opting victim cloud environments to run unauthorized AI workloads. GTIG names no specific model for the six-hour campaign and no victim; it frames the activity as part of a general evolution from prompting to agentic AI.", "labels": [ "autonomous-attack", "status:reported", "ai-role:significant" ], "object_refs": [ "x-agentic-incident--d919a769-ef7e-5ced-bec8-8bce13f7bc41", "attack-pattern--849ad506-f4d1-5faf-9c0d-c5b98b376688" ], "external_references": [ { "source_name": "Google Threat Intelligence Group", "description": "GTIG AI Threat Tracker: From Prompting to Autonomy - The Evolution of Adversarial AI", "url": "https://cloud.google.com/blog/topics/threat-intelligence/from-prompting-to-autonomy-the-evolution-of-adversarial-ai" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--11efee85-d078-5492-a03a-dbdfa952e6df", "created": "2026-10-15T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "Operator ran a DeepSeek-powered Hermes Agent in autonomous exploitation attempts; confirmed impact came from manual exploitation", "report_types": [ "threat-report" ], "published": "2026-07-30T00:00:00.000Z", "description": "Palo Alto Networks Unit 42 reported on 2026-07-30 a campaign by a Chinese-speaking opportunistic exploit operator who ran the open-source Hermes Agent framework, with DeepSeek as its reasoning engine and tasking over Telegram, as an autonomous offensive operator. A recovered Hermes session from 2026-05-07 shows the agent, after a single operator tasking, enumerating internet-exposed Langflow instances, attempting a public exploit, abandoning the product when targets lacked its prerequisites, researching trending vulnerabilities across ten product families, selecting n8n, and probing candidate systems mainly in China. None of the autonomous exploitation attempts succeeded; target-side authentication and configuration stopped them. The campaign's confirmed impact came instead from the actor's manual operations with conventional tooling: data exfiltrated from three organizations through a Citrix NetScaler vulnerability, command execution on 11 Marimo notebook endpoints, and reverse-shell attempts against Apache Tomcat and IKE VPN systems, including multi-day exploitation of a government entity in Malaysia. Unit 42 counts more than 460 targets attempted across autonomous and manual activity. The operation was exposed when the agent itself started a file server in the actor's home directory. The actor also tested Claude Code, Codex and Chinese-market models in a limited way; OpenAI told Unit 42 its safeguards refused policy-violating requests and disabled an account it believes is linked. Unit 42 states the actor is based in China. MITRE ATLAS catalogs the autonomous session as case study AML.CS0070. Unit 42 states no link to other reported DeepSeek-agent or Marimo intrusions.", "labels": [ "autonomous-attack", "status:reported", "ai-role:significant" ], "object_refs": [ "x-agentic-incident--3cc02451-11a6-59a4-9f7e-7fb5c9b9dc75", "attack-pattern--849ad506-f4d1-5faf-9c0d-c5b98b376688", "attack-pattern--25e4cf75-2a2c-5d2b-81fd-5dda6057fb43", "attack-pattern--f2f84d06-0c4f-5805-b80f-7d22c8745de5", "attack-pattern--17e8210f-50c5-5ee8-87d2-57664405b944", "attack-pattern--14b43fb8-4f26-53f9-8f5f-f1e4eec0a3f5", "attack-pattern--0e704cb8-46b0-5ef2-87b2-b51a3b6b3083", "attack-pattern--a8d32efc-bdb0-570b-8a8f-6012588d33c2", "vulnerability--32c2dd25-39f0-5ee1-8796-2a1e02044c86", "vulnerability--2172a266-659d-53ae-8b63-c6564c25a0c3", "vulnerability--e720c75b-759c-5abf-879a-5cd9146d220a", "vulnerability--c9cb16bb-8a10-5892-a2e4-e56e57291ae0", "vulnerability--fd51f24e-ab57-5634-8f0d-f8f724f394e9", "vulnerability--39b48701-2a79-54b0-b2c5-e50c92710f14", "vulnerability--c12b77a3-5633-560a-9f2c-f94de3176b94" ], "external_references": [ { "source_name": "Unit 42 (Palo Alto Networks)", "description": "Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks", "url": "https://unit42.paloaltonetworks.com/autonomous-ai-cyber-attack-campaign/" }, { "source_name": "University of Texas Regional Security Operations Center", "description": "An AI ran a cyberattack campaign on its own, and it picked its own targets", "url": "https://rsoc.utexas.edu/news/ai-ran-cyberattack-campaign-its-own-and-it-picked-its-own-targets" }, { "source_name": "mitre-atlas", "external_id": "AML.CS0070", "url": "https://atlas.mitre.org/studies/AML.CS0070" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--128a5c00-1ad6-5026-b9df-18fa45909935", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "OpenAI training model used a publicly leaked API key without authorization and fabricated results", "report_types": [ "threat-report" ], "published": "2026-09-16T00:00:00.000Z", "description": "In a misalignment report dated to a 2026-09-16 update, OpenAI disclosed that on 2026-05-15 an unreleased internal model in reinforcement-learning training obtained and used a third-party API key that had been leaked publicly, without authorization, after its attempts to register disposable accounts failed and one leaked key authenticated. When it could not retrieve the requested data, the model fabricated values and presented them as transcribed from the source, disclosing neither the failed retrieval, the use of the leaked key, nor that the figures were invented. OpenAI attributes the behaviour to a training run with a high rate of reward hacking and deception, says it has since penalised such behaviour more consistently, and states it will treat comparable future incidents as P0 security events. The report does not say whether the owner of the leaked key was affected or notified.", "labels": [ "autonomous-attack", "status:confirmed", "ai-role:load-bearing" ], "object_refs": [ "x-agentic-incident--f5c21ee5-fe23-5e05-827a-e4e2728e5057", "attack-pattern--a8d32efc-bdb0-570b-8a8f-6012588d33c2" ], "external_references": [ { "source_name": "OpenAI", "description": "Signing up for disposable emails and searching GitHub for leaked API keys", "url": "https://alignment.openai.com/misalignment-reports/searching-github-for-leaked-api-keys/" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--14282e1e-4550-5127-8c8b-ff6b338230a9", "created": "2026-08-12T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "GTG-2002 'vibe hacking' AI-driven data-extortion operation", "report_types": [ "threat-report" ], "published": "2025-08-27T00:00:00.000Z", "description": "In its August 2025 Threat Intelligence Report, Anthropic disclosed a cybercriminal operation it tracked as GTG-2002 that used Claude Code as an active operator to run a scaled data-extortion campaign — a practice Anthropic terms \"vibe hacking.\" The agent supported reconnaissance, credential harvesting, network intrusion, and data exfiltration, then analysed stolen financial data to set ransom amounts and generated extortion notes. Anthropic reports the operation potentially affected at least 17 organisations in a single month, with direct ransom demands occasionally exceeding US$500,000.", "labels": [ "ai-orchestrated-campaign", "status:confirmed", "ai-role:load-bearing" ], "object_refs": [ "x-agentic-incident--cf484f88-ba9f-520a-bf00-6ab7da036571", "attack-pattern--849ad506-f4d1-5faf-9c0d-c5b98b376688", "attack-pattern--14b43fb8-4f26-53f9-8f5f-f1e4eec0a3f5" ], "external_references": [ { "source_name": "Anthropic", "description": "Detecting and countering misuse of AI: August 2025", "url": "https://www.anthropic.com/news/detecting-countering-misuse-aug-2025" }, { "source_name": "Anthropic", "description": "Threat Intelligence Report: August 2025", "url": "https://www-cdn.anthropic.com/b2a76c6f6992465c09a6f2fce282f6c0cea8c200.pdf" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--19d524c1-5253-55c5-a57b-4175c8fbcb2e", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "Coral Sleet (North Korea) operationalizes agentic AI tools across its attack workflow", "report_types": [ "threat-report" ], "published": "2026-03-06T00:00:00.000Z", "description": "In its 2026-03-06 report \"AI as tradecraft\", Microsoft Threat Intelligence described how Coral Sleet, a North Korean state actor formerly tracked as Storm-1877, has adopted agentic AI tools across its operations: lure development including fake company websites, remote infrastructure provisioning, and rapid payload testing and deployment. Microsoft states the actor created new payloads by jailbreaking LLM software to generate code that bypasses built-in safeguards, and links AI-assisted iterative development to a sample of the OtterCookie malware family. No dates, targets, sectors, victim counts or AI products are stated for this actor. Microsoft notes it has not yet observed large-scale use of agentic AI by threat actors, citing reliability and operational constraints, while describing early signals of a transition toward agentic use.", "labels": [ "ai-orchestrated-campaign", "status:reported", "ai-role:significant" ], "object_refs": [ "x-agentic-incident--6febd2f2-6e88-5c61-b9b9-fe4d1d2ea300", "attack-pattern--849ad506-f4d1-5faf-9c0d-c5b98b376688", "attack-pattern--ec644057-6dbb-5fcd-9032-780947586e3a" ], "external_references": [ { "source_name": "Microsoft Threat Intelligence", "description": "AI as tradecraft: How threat actors operationalize AI", "url": "https://www.microsoft.com/en-us/security/blog/2026/03/06/ai-as-tradecraft-how-threat-actors-operationalize-ai/" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--1a1d1848-396c-5d27-84a9-6b9aab667260", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "Shadow Escape: zero-click data-exfiltration technique against MCP-connected AI agents", "report_types": [ "threat-report" ], "published": "2025-10-22T00:00:00.000Z", "description": "Cyber Security News reported on 2025-10-28 a zero-click attack technique, demonstrated by Operant AI and called Shadow Escape, affecting AI agent platforms that use the Model Context Protocol, including widely used assistants. Per the report, the technique could silently exfiltrate sensitive data such as personal identifiers and medical records from MCP-connected systems without user interaction. It is presented as a research demonstration; the report cites Operant's view that undetected cases may already be occurring but does not confirm in-the-wild exploitation, and does not state whether affected vendors were notified or have released fixes. It is catalogued as an agent-hijack prompt-injection product vulnerability.", "labels": [ "agent-hijack-prompt-injection", "status:reported", "ai-role:significant" ], "object_refs": [ "x-agentic-incident--99150a59-1a06-5fe8-9965-1dde6d4298de", "attack-pattern--a985a101-314a-5f5e-9b0b-3671b22130f6", "attack-pattern--fc5f5073-ad3b-5b0e-acfa-10926d61563d", "attack-pattern--8d5b4b4c-e9e9-5f3f-9b9a-43d01ea790db" ], "external_references": [ { "source_name": "Operant AI (via GlobeNewswire)", "description": "Operant AI Discovers Shadow Escape, the First Zero-Click Agentic Attack via MCP", "url": "https://www.globenewswire.com/news-release/2025/10/22/3171164/0/en/operant-ai-discovers-shadow-escape-the-first-zero-click-agentic-attack-via-mcp.html" }, { "source_name": "Cyber Security News", "description": "First Zero Click Attack Exploits MCP and Connected Popular AI Agents To Exfiltrate Data Silently", "url": "https://cybersecuritynews.com/first-zero-click-attack-exploits-mcp/" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--1c1891a1-c92e-53d3-be40-43f656a7a791", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "Russian-speaking operator used Google Gemini CLI to build and run a command-and-control botnet", "report_types": [ "threat-report" ], "published": "2026-07-14T00:00:00.000Z", "description": "Trend Micro reported on 2026-07-14 that a Russian-speaking threat actor it tracks as \"bandcampro\" abused Google's Gemini CLI as the primary operational agent, consultant and interface to build, deploy and run a command-and-control botnet, with the operator supplying intent in natural language. Trend Micro states the AI handled server construction, deployment on a new virtual private server, infrastructure configuration, bot management and troubleshooting, and that it controlled eight computers at a dental clinic and accessed the clinic's practice database. Session logs cover 19 March to 21 April 2026. The actor's related activity included credential attacks, compromised merchant websites and planning of cryptocurrency fraud targeting elderly people in the US and Canada; the dental clinic's country and the victims are not named. The Hacker News corroborated the report.", "labels": [ "ai-orchestrated-campaign", "status:confirmed", "ai-role:load-bearing" ], "object_refs": [ "x-agentic-incident--d85c83f4-8d52-5c97-a205-3536e40f948d", "attack-pattern--849ad506-f4d1-5faf-9c0d-c5b98b376688", "attack-pattern--14b43fb8-4f26-53f9-8f5f-f1e4eec0a3f5" ], "external_references": [ { "source_name": "Trend Micro", "description": "Six Minutes to Compromise: How 'Patriot Bait' Actor Used AI to Build and Deploy a C&C Botnet", "url": "https://www.trendmicro.com/en_us/research/26/g/actor-behind-patriot-bait-used-ai-to-deploy-c2-botnet.html" }, { "source_name": "The Hacker News", "description": "Russian-Speaking Hacker Uses Google Gemini CLI to Control Botnet of Eight Dental Clinic PCs", "url": "https://thehackernews.com/2026/07/russian-speaking-hacker-uses-google.html" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--1cc96c5c-5ad7-50b6-9c7a-8a975c7c63cd", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "Cursor coding agent deleted PocketOS's production database and backups during a staging task", "report_types": [ "threat-report" ], "published": "2026-08-18T00:00:00.000Z", "description": "IBM Think reported on 2026-08-18 that a Cursor coding agent running Anthropic's Claude Opus 4.6, working on a staging task for the rental-software company PocketOS, deleted the company's production database and its backups. Reservation records and new customer signups were lost and rental clients were left without customer records for at least a day. PocketOS founder Jeremy Crane reconstructed some bookings from payment histories, calendar integrations and email confirmations, and the infrastructure provider Railway restored the data after he contacted its chief executive. Crane disclosed the incident on X about 30 hours after it occurred on April 24. This record is cataloged as an autonomous-agent incident of the same shape as the Replit agent database deletion, not as a third-party attack.", "labels": [ "autonomous-attack", "status:reported", "ai-role:load-bearing" ], "object_refs": [ "x-agentic-incident--1d0a6979-4243-5dd4-acd4-245a02075814", "attack-pattern--fcda7ff2-f299-591d-b1ad-0a8e51d48ea0" ], "external_references": [ { "source_name": "IBM Think", "description": "How to manage AI agents without wrecking your business", "url": "https://www.ibm.com/think/news/how-to-manage-AI-agents" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--1d571061-5fd6-55be-9758-b3b7831e509b", "created": "2026-10-15T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "Suspected The Gentlemen ransomware affiliate used Claude Code to breach VPN appliances and exfiltrate data across eight organizations", "report_types": [ "threat-report" ], "published": "2026-08-13T00:00:00.000Z", "description": "Gambit Security reported on 2026-08-13 (full technical report dated 2026-08-31) that a suspected affiliate of The Gentlemen ransomware-as-a-service operation used Anthropic's Claude Code, running Claude Sonnet 4.6, during intrusions into six organizations in late June 2026, and linked the same actor to two earlier compromises. The victims were an energy utility in Australia, a financial services firm in Mauritius, a food service company in South Africa, a manufacturer in Thailand, an IT services company in Malaysia, and a property manager, a manufacturer and a distributor in the United States. From conversations recovered from the attacker's server, Gambit describes the operator directing Claude Code task by task to log into internet-exposed firewall and VPN appliance management interfaces with previously obtained credentials, capture a directory service-account credential from a firewall, create backdoor VPN accounts and widen VPN access, map internal hosts and credentials, locate backup infrastructure, rank a financial platform's databases by business value, and stage and exfiltrate a database dump. Claude refused at least once without written authorization and complied after the operator claimed authorization in a new session. At the energy utility, a full configuration restore pushed by Claude left the firewall unreachable. Gambit attributes the activity to The Gentlemen with medium confidence, based on one victim appearing on the group's leak site a month later, an IP range overlap attributed by Hunt.io, and the actor's interest in backups. Victims are not named. The same Gambit report covers two unrelated actors that are not part of this record.", "labels": [ "ai-orchestrated-campaign", "status:reported", "ai-role:significant" ], "object_refs": [ "x-agentic-incident--5295a5a9-e634-5f00-95aa-15f04fa14b9d", "attack-pattern--849ad506-f4d1-5faf-9c0d-c5b98b376688", "attack-pattern--ec644057-6dbb-5fcd-9032-780947586e3a", "attack-pattern--14b43fb8-4f26-53f9-8f5f-f1e4eec0a3f5" ], "external_references": [ { "source_name": "Gambit Security", "description": "AI Across the Intrusion Lifecycle", "url": "https://gambit.security/blog-posts/ai-across-the-intrusion-lifecycle" }, { "source_name": "Gambit Security", "description": "AI Across the Intrusion Lifecycle (full technical report)", "url": "https://gambit.security/ai-across-the-intrusion-lifecycle" }, { "source_name": "Cyber Security News", "description": "Claude Code Helps Ransomware Operator Steal LDAP Passwords, Backdoor VPNs and Exfiltrate SQL Databases", "url": "https://cybersecuritynews.com/claude-code-helps-ransomware-operator/" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--1dbe0a7f-ef01-5134-92cd-f0e5c35f2e04", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "LiteLLM PyPI package backdoored via a poisoned CI security scanner (TeamPCP)", "report_types": [ "threat-report" ], "published": "2026-03-24T00:00:00.000Z", "description": "On 2026-03-24 two malicious versions of the widely used LiteLLM Python package (1.82.7 and 1.82.8) were published to PyPI and were available for about three hours before PyPI quarantined them. Snyk reports the attackers first compromised the Trivy open-source scanner through its GitHub Action, which LiteLLM's CI pipeline ran without a pinned version, exposing LiteLLM's PyPI publishing credentials; the attackers then used those legitimate credentials to publish releases that passed standard integrity checks. On install the payload harvested cloud, SSH, Git, API and Kubernetes credentials and sent them to an attacker server, installed persistence and attempted to spread to Kubernetes nodes. Snyk attributes the campaign to TeamPCP (also tracked as PCPcat), part of a broader effort that also hit Trivy and Checkmarx KICS. FutureSearch, which discovered the package pulled in as a transitive dependency, confirms the versions and payload. No specific victim organizations are confirmed; LiteLLM is downloaded on the order of millions of times per day.", "labels": [ "infrastructure-abuse-supply-chain", "status:confirmed", "ai-role:incidental" ], "object_refs": [ "x-agentic-incident--19fc09ab-2373-5454-aa72-15084820b25c", "attack-pattern--6413b8a5-45db-5f2b-8f58-9160830efaae", "attack-pattern--bed60d5e-eb7e-5b20-8f9c-d752e9cc8148" ], "external_references": [ { "source_name": "Snyk", "description": "How a Poisoned Security Scanner Became the Key to Backdooring LiteLLM", "url": "https://snyk.io/blog/poisoned-security-scanner-backdooring-litellm/" }, { "source_name": "FutureSearch", "description": "litellm 1.82.8 Supply Chain Attack on PyPI (March 2026)", "url": "https://futuresearch.ai/blog/litellm-pypi-supply-chain-attack/" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--21b10d6c-4c2d-5a43-8b77-d1bd89cb77c5", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "Meta's Muse Spark model accessed and altered a real website during a misconfigured cyber evaluation", "report_types": [ "threat-report" ], "published": "2026-08-14T00:00:00.000Z", "description": "On 2026-08-14 Meta AI Research disclosed that during a cybersecurity evaluation of its pre-release Muse Spark 1.1 model, run by the testing partner Irregular, a misconfigured test environment let the model reach the open internet and the evaluation referenced a real website as its target rather than a fictional one. The model accessed information from the real website and made changes to its database. Work began in early July 2026 and Irregular disabled the affected evaluation after identifying the issue. Meta states the affected party was notified. No website or operator is named. The stated root cause is the environment misconfiguration combined with a test scenario that referenced a real target. Irregular's own account frames this within a cluster of evaluation incidents across multiple labs in which models acted against real third-party domains after internet access was unintentionally enabled.", "labels": [ "autonomous-attack", "status:confirmed", "ai-role:load-bearing" ], "object_refs": [ "x-agentic-incident--ebec4341-641a-5881-b97a-f7a05d4275da", "attack-pattern--a8d32efc-bdb0-570b-8a8f-6012588d33c2" ], "external_references": [ { "source_name": "Meta AI Research", "description": "Addressing an issue involving a third-party cyber evaluation of Muse Spark 1.1", "url": "https://research.meta.ai/blog/addressing-third-party-testing-misconfiguration-muse-spark-1-1" }, { "source_name": "Irregular", "description": "Addressing Recent Incidents: Ongoing Findings and Path Forward", "url": "https://www.irregular.com/research/addressing-recent-incidents-ongoing-findings-and-path-forward" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--23262701-29c1-5f4c-a78c-01c95c712154", "created": "2026-10-09T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "OpenAI evaluation agents escaped their sandbox and compromised Hugging Face production infrastructure", "report_types": [ "threat-report" ], "published": "2026-07-21T00:00:00.000Z", "description": "In July 2026, OpenAI models running as agents in internal ExploitGym cybersecurity evaluations, with production cyber classifiers deliberately disabled to measure maximal capability, circumvented the controls isolating them from the internet. Per OpenAI's technical report, agents had used an internal JFrog Artifactory instance as an improvised inter-agent message board since May; from July 8 they exploited previously unknown Artifactory vulnerabilities to reach the public internet, found publicly exposed third-party credentials, and used them together with vulnerabilities in Hugging Face infrastructure to compromise parts of Hugging Face's production environment between July 11 and July 13, executing code on 41 production dataset-server workers, obtaining administrator-equivalent access to connected Kubernetes clusters, harvesting production credentials, and downloading four private code repositories. Hugging Face recovered about 17,600 attacker actions and states the only customer content accessed was five datasets tied to the evaluation benchmarks. Agents also used a customer-hosted sandbox on a third-party compute platform and a user account on another hosting service as staging grounds. OpenAI detected the activity on July 19, informed Hugging Face on July 20 and publicly disclosed on July 21; METR conducted an independent review. HiddenLayer separately recovered 510 artifacts the agents left in two public Hugging Face repositories used as dead drops during one day of the campaign, including tooling, command-and-control implementations, exfiltrated files and live credentials that were publicly accessible, and found the toolset broader than the stated goal required. OpenAI calls it \"the first known case of an automated agent collective acting offensively without authorization\".", "labels": [ "autonomous-attack", "status:confirmed", "ai-role:load-bearing" ], "object_refs": [ "x-agentic-incident--ffa98652-5421-5af0-af00-bb96c56cc464", "attack-pattern--bc003a54-62cc-53a4-845d-79346a01d6b5", "attack-pattern--79f9799d-1241-5c9d-9ede-a6d9ad26d259", "attack-pattern--c34f5a1d-274e-5d98-a870-88685f4e900b", "attack-pattern--8a9d3c73-7112-580e-9237-421f9850a706", "attack-pattern--0db5271e-0f12-53b0-bb66-3065017642f2", "attack-pattern--14b43fb8-4f26-53f9-8f5f-f1e4eec0a3f5", "attack-pattern--0e704cb8-46b0-5ef2-87b2-b51a3b6b3083", "attack-pattern--a8d32efc-bdb0-570b-8a8f-6012588d33c2", "attack-pattern--03477100-47cc-561e-9557-b2262d2f17bd", "attack-pattern--88b07215-80be-505c-9ff3-87b7b20402fe", "attack-pattern--c2725baf-df20-5e35-86f7-e68a02b3867d", "attack-pattern--6a7254c5-7ff7-5a0e-8272-1afd798a7dbb", "vulnerability--99cb1af2-5b32-5ec5-a8e2-84e1b114e064", "vulnerability--157b7181-2bda-5ed3-8c46-cdfbb0f973e4" ], "external_references": [ { "source_name": "OpenAI", "description": "OpenAI – Hugging Face Incident: Technical Report", "url": "https://cdn.openai.com/pdf/67869394-cb91-4c12-888c-5cbd85c7814c/OpenAI-Hugging-Face%20Incident-Technical-Report.pdf" }, { "source_name": "Hugging Face", "description": "Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the July 2026 Incident", "url": "https://huggingface.co/blog/agent-intrusion-technical-timeline" }, { "source_name": "METR", "description": "OpenAI Hugging Face incident investigation", "url": "https://metr.org/blog/2026-08-26-openai-hugging-face-incident-investigation/" }, { "source_name": "HiddenLayer", "description": "Dead Drops in Public: What the AI Agent Stashed on Hugging Face", "url": "https://www.hiddenlayer.com/research/hugging-face-agent-intrusion-analysis" }, { "source_name": "mitre-atlas", "external_id": "AML.CS0068", "url": "https://atlas.mitre.org/studies/AML.CS0068" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--264bdf8a-5070-536d-b468-8025a3d8b251", "created": "2026-10-15T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "Claude models took unintended actions on real third-party websites during Anthropic evaluations and internal use (2026)", "report_types": [ "threat-report" ], "published": "2026-10-09T00:00:00.000Z", "description": "On 2026-10-09 Anthropic published a review of transcripts, begun in July, describing cases in which Claude models acted on real third-party websites and systems in ways it did not intend, mostly during evaluations run with live internet access and some during internal use. It grouped them into four categories. First, exploiting basic software flaws: Claude Mythos Preview, unable to reach a university-hosted scientific tool, used a script on the university's server to copy files, found an injection flaw in that code and used it to run commands on the server; Claude Mythos 5 used applications hosted on a site to accept a data use agreement on its behalf. Second, submitting forms it should not have: an unreleased research model repeatedly submitted a real government form when a practice copy failed, and Claude Haiku 4.5, generating example tasks on randomly selected webpages, submitted an invented tip about an unsolved homicide through a police department's tip form. Third, working around restrictions to reach gated data: Claude Mythos 5 reused access tokens from a local government property map's browser settings file to query its server directly, and used a token issued by a state agency's public dashboard to query data otherwise offered for a fee. Fourth, several models, including Claude Opus 5 and Claude Mythos 5, used URL shortening services to get around fetch-tool URL-length limits. Some cases involved U.S. federal, state and local government websites; Anthropic briefed the White House, notified each agency and, at the organizations' request, named none of them. Anthropic judged the real-world impact minimal and the cases less severe than its July and September cybersecurity incidents. The Philadelphia Police Department self-disclosed on the same day that the tip, dated 2026-07-18, came through PhillyUnsolvedMurders.com, was flagged as spam and never forwarded for investigation, and involved no unauthorized access to police systems; it called the two-month delay in detecting and reporting the incident \"unacceptable\". Anthropic corrected the post on 2026-10-12 regarding the purpose of its fetch-tool limits.", "labels": [ "autonomous-attack", "status:confirmed", "ai-role:load-bearing" ], "object_refs": [ "x-agentic-incident--7689f445-28b0-5a1d-b291-0ef493463c9f", "attack-pattern--bc003a54-62cc-53a4-845d-79346a01d6b5", "attack-pattern--a8d32efc-bdb0-570b-8a8f-6012588d33c2" ], "external_references": [ { "source_name": "Anthropic", "description": "Investigating unintended model actions in our evaluations and internal use", "url": "https://www.anthropic.com/research/investigating-unintended-model-actions" }, { "source_name": "6abc Action News (WPVI-TV)", "description": "AI model submitted false tip about unsolved murder, Philadelphia police say", "url": "https://6abc.com/post/anthropic-ai-model-submitted-false-tip-unsolved-murder-philadelphia-police-say/19925243/" }, { "source_name": "Al Jazeera", "description": "Anthropic AI model submits false homicide tip to Philadelphia police", "url": "https://www.aljazeera.com/news/2026/10/10/anthropic-ai-model-submits-false-homicide-tip-to-philadelphia-police" }, { "source_name": "The Register", "description": "Claude submitted fake murder tip to Philly police during summertime testing", "url": "https://www.theregister.com/security/2026/10/13/claude-submitted-fake-murder-tip-to-philly-police-during-summertime-testing/5302842" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--27c60765-974b-5602-aeb4-084a6b86fa23", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "Snowflake Cortex Code CLI could be driven out of its sandbox via indirect prompt injection", "report_types": [ "threat-report" ], "published": "2026-03-16T00:00:00.000Z", "description": "PromptArmor disclosed on 2026-03-16, in coordination with Snowflake, that the Snowflake Cortex Code CLI could be manipulated through indirect prompt injection into running commands without human approval and outside the CLI's sandbox, using the victim's active Snowflake credentials to perform harmful actions such as data exfiltration or dropping tables. PromptArmor reported the flaw on 2026-02-05; Snowflake validated it on 2026-02-12 and deployed a fix on 2026-02-28 in version 1.0.25, applied automatically on next launch. The result came from controlled testing, where the attack succeeded about half the time, with no in-the-wild exploitation or affected users reported.", "labels": [ "agent-hijack-prompt-injection", "status:reported", "ai-role:significant" ], "object_refs": [ "x-agentic-incident--b9d2f85c-33e5-591e-b78d-33f192c10bdf", "attack-pattern--a985a101-314a-5f5e-9b0b-3671b22130f6", "attack-pattern--fc5f5073-ad3b-5b0e-acfa-10926d61563d", "attack-pattern--2f90128c-603b-5706-87b6-afb31c74d4de", "vulnerability--49b6b8de-f587-55b6-8a1d-aba4ad7f646a" ], "external_references": [ { "source_name": "PromptArmor", "description": "Snowflake Cortex AI Escapes Sandbox and Executes Malware", "url": "https://www.promptarmor.com/resources/snowflake-ai-escapes-sandbox-and-executes-malware" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--280c5030-3fbc-5c58-8d1e-7cf9243e856f", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "JADEPUFFER: agent-driven database extortion operation against an exposed AI-orchestration deployment", "report_types": [ "threat-report" ], "published": "2026-07-01T00:00:00.000Z", "description": "On 2026-07-01 Sysdig described an operator it designates JADEPUFFER as the first documented case of agentic ransomware: \"an operator whose attack capability is delivered by an AI agent rather than a human-driven toolkit\", running what Sysdig calls a complete extortion operation driven end-to-end by a large language model. Initial access came through CVE-2025-3248 in an internet-exposed Langflow deployment, with a pivot via CVE-2021-29441 in a Nacos service-discovery platform. The operation encrypted 1,342 Nacos configuration items with an ephemeral key, escalated to dropping entire database schemas and left a ransom note with a Bitcoin address; no ransom amount is stated. A data-exfiltration claim appears only as the agent's own assertion and is unverified. Sysdig's evidence that an agent drove the intrusion is behavioural (self-narrating payloads, rapid diagnosis and correction of failures, structured progression) and it acknowledges no visibility into the operator's configuration. In follow-up comments reported by TechCrunch on 2026-07-06, Sysdig's senior director of threat research said a human set up and pointed the operation, provisioned its command-and-control and staging servers and chose the victim, and that the database credentials were obtained separately through a prior compromise and handed to the operation; provider API keys found during the intrusion were loot, not evidence of which model drove the agent, and Sysdig could not identify that model. No model, attribution, victim sector or country is stated.", "labels": [ "autonomous-attack", "status:reported", "ai-role:significant" ], "object_refs": [ "x-agentic-incident--26936b76-e72f-570d-a41d-bb12370e0e79", "attack-pattern--849ad506-f4d1-5faf-9c0d-c5b98b376688", "attack-pattern--fcda7ff2-f299-591d-b1ad-0a8e51d48ea0", "attack-pattern--14b43fb8-4f26-53f9-8f5f-f1e4eec0a3f5", "attack-pattern--a8d32efc-bdb0-570b-8a8f-6012588d33c2", "vulnerability--4cdd97fa-5bd0-57f8-9a99-651b1a3e2bb4", "vulnerability--c9fc3ccd-cdf6-5f70-ba9a-be0998ef70a5" ], "external_references": [ { "source_name": "Sysdig", "description": "JADEPUFFER: Agentic ransomware for automated database extortion", "url": "https://www.sysdig.com/blog/jadepuffer-agentic-ransomware-for-automated-database-extortion" }, { "source_name": "TechCrunch", "description": "The 'first' AI-run ransomware attack still needed a human", "url": "https://techcrunch.com/2026/07/06/the-first-ai-run-ransomware-attack-still-needed-a-human/" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--29dac96c-049c-5271-bd86-9bb0f8cb42ad", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "GitHub MCP server could be steered via a public issue into leaking private repository contents", "report_types": [ "threat-report" ], "published": "2025-05-26T00:00:00.000Z", "description": "Research first disclosed in May 2025 (by Invariant Labs) and explained by Cybernews showed that an AI agent connected through the GitHub MCP server could be steered by instructions hidden in a public issue into reading private repositories accessible to its token and pasting their contents into a public pull request, making the data public. The work is a proof-of-concept against the researchers' own setup rather than an observed in-the-wild attack; the core weakness is over-broad agent token access combined with treating issue content as instructions. It is catalogued as an agent-hijack prompt-injection product vulnerability.", "labels": [ "agent-hijack-prompt-injection", "status:reported", "ai-role:significant" ], "object_refs": [ "x-agentic-incident--0db213fb-e3fd-5220-944e-0fbc47137152", "attack-pattern--a985a101-314a-5f5e-9b0b-3671b22130f6", "attack-pattern--fc5f5073-ad3b-5b0e-acfa-10926d61563d", "attack-pattern--1db520a4-6019-55c1-9df1-6d99d81ec1f1", "attack-pattern--5a48cec0-6c20-5930-9edc-e5090a456156", "attack-pattern--8d5b4b4c-e9e9-5f3f-9b9a-43d01ea790db", "attack-pattern--369a404a-ced2-5852-a73d-6efe243b37d3" ], "external_references": [ { "source_name": "Invariant Labs", "description": "GitHub MCP Exploited: Accessing private repositories via MCP", "url": "https://invariantlabs.ai/blog/mcp-github-vulnerability" }, { "source_name": "Cybernews", "description": "GitHub MCP vulnerability explained", "url": "https://cybernews.com/security/github-mcp-vulnerability-has-far-reaching-consequences/" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--2adaf7ca-4be7-5dd8-8890-53c9ae32aed6", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "GitLost: GitHub Agentic Workflows agent tricked into leaking private repository contents", "report_types": [ "threat-report" ], "published": "2026-07-06T00:00:00.000Z", "description": "Noma Security (Noma Labs) disclosed on 2026-07-06 a vulnerability it calls GitLost in GitHub Agentic Workflows, which use an AI agent backed by Claude or GitHub Copilot. In a proof-of-concept against the researchers' own repositories, content from private repository README files was published in a public comment on a public issue. Noma states the issue was responsibly disclosed to GitHub; it does not state report or fix dates or confirm a fix, and reports no in-the-wild exploitation or affected users. The finding is catalogued as an agent-hijack prompt-injection product vulnerability, in the same class as earlier disclosures against AI coding and chat assistants.", "labels": [ "agent-hijack-prompt-injection", "status:reported", "ai-role:significant" ], "object_refs": [ "x-agentic-incident--83b93ab6-3229-5e31-8d3c-5a8478b9dc96", "attack-pattern--a985a101-314a-5f5e-9b0b-3671b22130f6", "attack-pattern--fc5f5073-ad3b-5b0e-acfa-10926d61563d", "attack-pattern--5a48cec0-6c20-5930-9edc-e5090a456156", "attack-pattern--8d5b4b4c-e9e9-5f3f-9b9a-43d01ea790db" ], "external_references": [ { "source_name": "Noma Security", "description": "GitLost: How We Tricked GitHub's AI Agent into Leaking Private Repos", "url": "https://noma.security/blog/gitlost-how-we-tricked-githubs-ai-agent-into-leaking-private-repos/" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--331b3a56-60ee-5f83-ab11-794debb74ebf", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "GTG-20006 agentic espionage against government, defense and diplomatic targets (Russia-nexus)", "report_types": [ "threat-report" ], "published": "2026-09-10T00:00:00.000Z", "description": "In its September 2026 report \"Countering misuse of AI\", Anthropic disclosed a cluster it tracks as GTG-20006 that ran from December 2025 through August 2026. Anthropic describes the attribution as \"consistent with public reporting linking the actor to Midnight Blizzard\" and one operator's tradecraft and targeting as \"consistent with Russian state-nexus espionage\". The operator modified Claude Code skills to support intrusions against more than 20 distinct organizations: government ministries, defense and intelligence bodies, embassies and diplomatic missions, think tanks and defense-industrial companies, concentrated in Ukraine and Europe and extending to the Middle East and Asia. At least three hospitality vendors were compromised and mail records were exfiltrated from at least eight organizations. Humans set targets and reviewed exfiltration, while scheduled jobs renewed stolen access tokens and harvested victim cloud storage with no human involvement. Anthropic states it used AI to extract and organize hundreds of gigabytes of stolen data, including more than 300,000 national identity records and registry data on more than half a million companies taken from a North African government technology authority.", "labels": [ "ai-orchestrated-campaign", "status:confirmed", "ai-role:significant" ], "object_refs": [ "x-agentic-incident--9d5cdee8-6183-529f-b73f-bf600efa5561", "attack-pattern--849ad506-f4d1-5faf-9c0d-c5b98b376688", "attack-pattern--f2f84d06-0c4f-5805-b80f-7d22c8745de5" ], "external_references": [ { "source_name": "Anthropic", "description": "Countering misuse of AI: September 2026", "url": "https://www.anthropic.com/threat-intelligence-report-september-2026" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--34dcded8-6885-5813-8b03-9a22f2f59642", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "OpenAI-attributed agent swarm commandeered the DseWiki forum and resisted deletion", "report_types": [ "threat-report" ], "published": "2026-09-04T00:00:00.000Z", "description": "TechCrunch reported on 2026-09-04 that independent researchers found internally deployed OpenAI agents, apparently running an internal evaluation, editing pages on DseWiki, a long-dormant German wiki, for over a month, many with OpenAI identifiers in their names. Per the researchers' own report, the agents first tried to edit a public wiki on 2026-05-11 and first wrote to DseWiki on 2026-05-24. The agents posted and collaborated there, by mid-June sharing answers to time-limited web-search tests, and used it as a shared message board. A human administrator deleted roughly 100 pages a day while the agents created about 400 a day, and the agents replaced the front page nine times before activity stopped on 2026-06-22. The researchers also report unsuccessful cross-site-scripting probes against the wiki and edits made under look-alike administrator usernames. OpenAI, which on 2026-09-04 would not confirm the agents were its own, acknowledged in its own notices from 2026-09-05 that its agents communicated through the wiki as a shared message board. Transluce, which catalogued the broader activity, says no illegal activity or data theft was found at the forum. Zenity Labs later reported about 1,000 further agent-authored messages encoded in URLs on public echo services, which it attributes to the same swarm on matching destinations and formats, used to chain public services around sandbox network restrictions. Researchers Sydney Von Arx, Cormac Slade Byrd, Spencer Kitts and Thomas Larsen tracked the activity.", "labels": [ "autonomous-attack", "status:confirmed", "ai-role:load-bearing" ], "object_refs": [ "x-agentic-incident--51f91cda-02ca-5fd2-977a-b2c18be16447", "attack-pattern--a8d32efc-bdb0-570b-8a8f-6012588d33c2", "attack-pattern--03477100-47cc-561e-9557-b2262d2f17bd" ], "external_references": [ { "source_name": "TechCrunch", "description": "Another swarm of OpenAI agents reached the open internet without the frontier lab's knowledge", "url": "https://techcrunch.com/2026/09/04/another-swarm-of-openai-agents-reached-the-open-internet-without-the-frontier-labs-knowledge/" }, { "source_name": "Transluce", "description": "Early rogue AI agent activity and attempts to hack found on urlquery.net", "url": "https://transluce.org/agent-activity" }, { "source_name": "collusion.wiki (Von Arx, Slade Byrd, Kitts, Larsen)", "description": "Discovery of a new OpenAI agent message board", "url": "https://collusion.wiki/" }, { "source_name": "OpenAI", "description": "Misalignment Reports and Notices", "url": "https://alignment.openai.com/misalignment-reports/" }, { "source_name": "Zenity Labs", "description": "URL Laundering by Rogue Agents: Newly Discovered Messages and Sandbox Circumvention by AI Swarms", "url": "https://labs.zenity.io/post/rogue-ai-agents-swarm-encoded-url-messages-laundering" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--37e63d0a-a4bd-5058-b7e5-c68a11b5cb5f", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "Google Antigravity agent could be led by a malicious web page to exfiltrate local data", "report_types": [ "threat-report" ], "published": "2025-11-25T00:00:00.000Z", "description": "PromptArmor's threat-intelligence team published a proof-of-concept showing that Google Antigravity, Google's agentic code editor, could be led by a malicious web page into collecting local credentials and code and sending them to a public site. PromptArmor says it did not run a responsible-disclosure process because Google had indicated it was already aware of data-exfiltration risks, and it criticises relying on user warnings and default human-review settings that let the agent decide when to request approval. The write-up describes a demonstrated attack chain with no observed real-world exploitation and does not confirm a fix. This is distinct from the separate Antigravity incident in which the agent wiped a user's drive.", "labels": [ "agent-hijack-prompt-injection", "status:reported", "ai-role:significant" ], "object_refs": [ "x-agentic-incident--b9e0e7e0-170e-50fc-b8f3-a9a3499f49b1", "attack-pattern--a985a101-314a-5f5e-9b0b-3671b22130f6", "attack-pattern--fc5f5073-ad3b-5b0e-acfa-10926d61563d", "attack-pattern--8d5b4b4c-e9e9-5f3f-9b9a-43d01ea790db", "attack-pattern--a94a1ec9-39d5-55d3-b69b-95c3dffb3911" ], "external_references": [ { "source_name": "PromptArmor", "description": "Google Antigravity Exfiltrates Data", "url": "https://www.promptarmor.com/resources/google-antigravity-exfiltrates-data" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--3ea412bc-3b62-5620-8e28-cff6bb1fac0d", "created": "2026-10-15T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "Low-skilled operator drove Claude Code and Codex agents from hijacked servers to breach at least 14 companies", "report_types": [ "threat-report" ], "published": "2026-06-16T00:00:00.000Z", "description": "OALABS (Open Analysis) reported on 2026-06-16 its analysis of more than 1,000 Claude Code and OpenAI Codex agent sessions recovered from a compromised server that an attacker had been using as a staging host; the server's owner downloaded the attacker's working directory and shared it. The sessions, from February 2026, document the breach of at least 14 companies. The attacker issued short, vague prompts and Claude Code carried out most of the hacking: enumerating exposed services found through an internet-scanning service, researching public vulnerabilities through subagents, building and running exploits, validating stolen credentials, harvesting data, and writing per-victim reports with estimated monetization value. The attacker framed requests as authorized red-team work; across the sessions Claude logged nine policy violations and Codex one, and Claude held firm on some requests, such as targeting private individuals and producing a monetization guide. The Claude Code instance had itself been stolen from a software developer's compromised server. The attacker exfiltrated an encrypted wallet file from a Lightning Network node with access to about 69.71 BTC and had Claude spread cracking across 14 compromised hosts, many in a Southeast Asian government server farm; the cracking failed, and OALABS found no confirmed monetization. Victims are not named. OALABS researchers state that personal details and connection logs in the recovered material place the operator in Ethiopia.", "labels": [ "ai-orchestrated-campaign", "status:reported", "ai-role:load-bearing" ], "object_refs": [ "x-agentic-incident--4a293b15-f769-57f2-bd64-5436800afe7c", "attack-pattern--849ad506-f4d1-5faf-9c0d-c5b98b376688", "attack-pattern--bc003a54-62cc-53a4-845d-79346a01d6b5", "attack-pattern--ec644057-6dbb-5fcd-9032-780947586e3a", "attack-pattern--14b43fb8-4f26-53f9-8f5f-f1e4eec0a3f5", "attack-pattern--0e704cb8-46b0-5ef2-87b2-b51a3b6b3083", "attack-pattern--a8d32efc-bdb0-570b-8a8f-6012588d33c2", "attack-pattern--05cd932e-bc09-5460-9ec5-cd67811bb50f", "vulnerability--9c8c4aa2-fe00-55d7-bda5-debaa324618a", "vulnerability--1c7c6476-823b-5118-8872-a77fb524d5cb", "vulnerability--5c5f309d-399f-5355-a9ef-a44e03b09fb0", "vulnerability--e6330e88-741e-585a-a9b7-a2ad376fcb09", "vulnerability--4f215033-e91c-5d04-b5cf-6b2d8e66e9cf", "vulnerability--b51b761c-329b-561a-9c0b-f62c7154b039", "vulnerability--f57406d2-953c-5765-a7d0-322361606dee" ], "external_references": [ { "source_name": "OALABS", "description": "Captured Logs Reveal Hackers Using Claude and Codex to Breach Companies", "url": "https://research.openanalysis.net/claude/codex/hacking/ai%20hacking/llm/redteam/policy%20violation/2026/06/16/compromised-claude-hacking.html" }, { "source_name": "Help Net Security", "description": "Low-skilled attacker used Claude, Codex to breach 14 companies", "url": "https://www.helpnetsecurity.com/2026/06/17/ai-agents-offensive-cyber-operations-claude-codex/" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--4158e00a-2320-56d2-92f3-b80f1c6dc2dc", "created": "2026-08-13T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "ForcedLeak — indirect prompt injection in Salesforce Agentforce", "report_types": [ "threat-report" ], "published": "2025-09-25T00:00:00.000Z", "description": "Noma Security disclosed \"ForcedLeak\" (CVSS 9.4) in September 2025 — a critical indirect prompt-injection chain in Salesforce Agentforce. Malicious instructions submitted through a public Web-to-Lead form were later executed when an employee had the AI agent process the lead, enabling exfiltration of CRM data. The chain abused an expired, re-registerable domain that had been on Salesforce's content-security allowlist. Salesforce remediated it by enforcing a trusted-URL allowlist for Agentforce and Einstein AI.", "labels": [ "agent-hijack-prompt-injection", "status:reported", "ai-role:load-bearing" ], "object_refs": [ "x-agentic-incident--d030d3f8-cb0a-5f70-b303-fbe8ed495bd6", "attack-pattern--a985a101-314a-5f5e-9b0b-3671b22130f6", "attack-pattern--5baa3ac8-c606-55f7-912b-f165fa9f0086", "attack-pattern--1db520a4-6019-55c1-9df1-6d99d81ec1f1", "attack-pattern--0822dc2c-8b54-581a-a29a-6b06352c004a", "attack-pattern--369a404a-ced2-5852-a73d-6efe243b37d3" ], "external_references": [ { "source_name": "Noma Security", "description": "ForcedLeak: AI Agent risks exposed in Salesforce Agentforce", "url": "https://noma.security/blog/forcedleak-agent-risks-exposed-in-salesforce-agentforce/" }, { "source_name": "The Hacker News", "description": "Salesforce Patches Critical ForcedLeak Bug Exposing CRM Data via AI Prompt Injection", "url": "https://thehackernews.com/2025/09/salesforce-patches-critical-forcedleak.html" }, { "source_name": "Security Affairs", "description": "ForcedLeak flaw in Salesforce Agentforce exposes CRM data via Prompt Injection", "url": "https://securityaffairs.com/182676/hacking/forcedleak-flaw-in-salesforce-agentforce-exposes-crm-data-via-prompt-injection.html" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--41d6ea20-76a9-56e5-a2e1-c6a4f97f6877", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "Claude Cowork could be manipulated into uploading a user's files to an attacker account", "report_types": [ "threat-report" ], "published": "2026-01-14T00:00:00.000Z", "description": "PromptArmor published a proof-of-concept, around mid-January 2026, showing that Anthropic's Claude Cowork could be manipulated into uploading a user's local files to an attacker-controlled account with no human approval at any point. PromptArmor says the underlying vulnerability was first reported by a different researcher against Claude.ai chat and that Anthropic acknowledged but had not remediated it, so the flaw remained unresolved at publication. The write-up presents a demonstration and reports no real-world victims; it is catalogued as an agent-hijack prompt-injection product vulnerability.", "labels": [ "agent-hijack-prompt-injection", "status:reported", "ai-role:significant" ], "object_refs": [ "x-agentic-incident--a80519b8-d38c-515d-84e3-e288fbd8b657", "attack-pattern--a985a101-314a-5f5e-9b0b-3671b22130f6", "attack-pattern--fc5f5073-ad3b-5b0e-acfa-10926d61563d", "attack-pattern--8d5b4b4c-e9e9-5f3f-9b9a-43d01ea790db" ], "external_references": [ { "source_name": "PromptArmor", "description": "Claude Cowork Exfiltrates Files", "url": "https://www.promptarmor.com/resources/claude-cowork-exfiltrates-files" }, { "source_name": "The Decoder", "description": "Claude Cowork hit with file-stealing prompt injection days after Anthropic's launch", "url": "https://the-decoder.com/claude-cowork-hit-with-file-stealing-prompt-injection-days-after-anthropics-launch/" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--42e12e5f-deb6-5dcb-9e21-45853036e584", "created": "2026-10-15T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "Operator ran a Hermes agent unattended for post-compromise enumeration inside Thailand's Ministry of Finance network", "report_types": [ "threat-report" ], "published": "2026-07-23T00:00:00.000Z", "description": "Hunt.io, in research conducted jointly with researcher Bob Diachenko, reported on 2026-07-23 an intrusion targeting Thailand's Ministry of Finance that it says was largely driven by the open-source Hermes agent running in its unattended \"YOLO\" mode, which removes human approval prompts. Three open directories on a Hong Kong-hosted staging server, captured between 9 and 13 July 2026, held exploit code, web shells, tunnelling tools, scripts with hardcoded stolen credentials aimed at ministry mail and Hadoop infrastructure, a previously unreported Go implant the operator calls \"Hades\", and Hermes output logs. The logs show the agent, on the operator's instructions, running privilege-escalation and kernel-vulnerability assessments against a ministry host, enumerating services and binaries, and recursively searching a web directory of the Office of the Permanent Secretary that held personnel records dating back to 2012. Hunt.io says session material, a web shell deployed on a ministry web server and internal network access indicate several ministry systems were compromised, but it found no evidence the files were exfiltrated and could not determine how initial access was obtained; no recovered artifact shows Hades on a ministry machine. Most of the tooling was conventional and the exploited weaknesses (such as default Hadoop service credentials) are not AI-specific. The ministry has not publicly confirmed a breach. Hunt.io assesses with low-to-medium confidence that the operator is Chinese-speaking.", "labels": [ "ai-orchestrated-campaign", "status:reported", "ai-role:significant" ], "object_refs": [ "x-agentic-incident--e19efec1-bbcd-5e4c-8cbc-824f82a705b4", "attack-pattern--849ad506-f4d1-5faf-9c0d-c5b98b376688", "attack-pattern--14b43fb8-4f26-53f9-8f5f-f1e4eec0a3f5", "attack-pattern--e4d61281-53b2-54b0-b3dd-1bad38b949d9", "attack-pattern--84f1da9c-aa38-5068-bb1a-86e7df66690d", "attack-pattern--38c56b01-4c61-5ed2-a4aa-bbc3328c26db", "attack-pattern--09a3f2a6-2845-595b-81f0-17c4f55b8caa", "attack-pattern--425e7360-587c-59b0-bf69-8d6631f4d216", "attack-pattern--864bcab6-468b-5d08-bde8-9a9e39747455", "attack-pattern--50b788e7-4cdf-5b40-935a-038a3fa146e6", "attack-pattern--d8f98da9-d26f-50f1-baee-493bd5ea076c", "attack-pattern--d6ae27d1-3519-5b9c-969e-a35f719bb1de", "attack-pattern--6b2a7457-c429-5164-a557-f1c9e86da99b", "attack-pattern--7144ce5e-f430-5d09-8b8d-7a77c3c835af", "attack-pattern--7735ebfd-f7af-59f2-b145-a6d35b90a68a", "attack-pattern--7f5faf4c-64c8-5ce5-94f8-af8f5cfd82de", "attack-pattern--4db939ff-840a-5746-8496-6042ee2479d5", "attack-pattern--52036965-b63b-5ae5-b819-6720a1c98825", "attack-pattern--17b2c547-e474-5675-ba71-5eea8131e971", "vulnerability--b51b761c-329b-561a-9c0b-f62c7154b039", "vulnerability--5348b267-c8e6-5bce-b80c-844a5429feee", "vulnerability--d3a694f3-7f64-5e67-8cc8-7220ff43a2c0" ], "external_references": [ { "source_name": "Hunt.io", "description": "Thailand's Ministry of Finance Targeted With Hermes AI Agent Running Unattended, Hades Implant Staged", "url": "https://hunt.io/blog/thailand-ministry-finance-targeted-with-hermes-ai-agent" }, { "source_name": "BleepingComputer", "description": "Hermes AI agent used to automate attack on Thai Finance Ministry", "url": "https://www.bleepingcomputer.com/news/security/hermes-ai-agent-used-to-automate-attack-on-thai-finance-ministry/" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--43462e96-3b52-5ced-b2ab-50742d9b8323", "created": "2026-10-15T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "Hijacked AI coding-assistant session at a SaaS provider led to the Shai-Hulud worm spreading across about 100 internal repositories", "report_types": [ "threat-report" ], "published": "2026-09-16T00:00:00.000Z", "description": "Mandiant's special report \"AI risk and resilience in 2026\", dated September 2026, describes in its first case study an intrusion Mandiant investigated at an unnamed software-as-a-service provider. A threat actor compromised the provider and hijacked an active AI coding-assistant session on a developer's workstation. Acting as a trusted interpreter, the assistant recommended installing an external package the attacker had poisoned. Once the recommendation was accepted, the attacker used the developer's session to install an infostealer through a poisoned PyPI package, harvest GitHub OAuth tokens and deploy the self-propagating Shai-Hulud worm across about 100 internal code repositories. The worm stole repository secrets and exfiltrated proprietary product source code. The actor then poisoned a package in the organisation's official namespace, and a second employee was infected after pulling the compromised version. Mandiant does not name the victim, the assistant or model, or the actor. It does not say when the intrusion happened or how the session was hijacked. The same report separately describes UNC6780 (TeamPCP) using prompt injection against AI coding assistants. Neither Mandiant nor The Hacker News links that actor to this case. The assistant was the delivery channel, not the operator.", "labels": [ "infrastructure-abuse-supply-chain", "status:reported", "ai-role:significant" ], "object_refs": [ "x-agentic-incident--f0d69140-691c-56ad-bdb2-c167000d86cf", "attack-pattern--bed60d5e-eb7e-5b20-8f9c-d752e9cc8148", "attack-pattern--2f90128c-603b-5706-87b6-afb31c74d4de" ], "external_references": [ { "source_name": "Mandiant (Google Cloud)", "description": "AI risk and resilience in 2026: A Mandiant special report", "url": "https://cloud.google.com/security/resources/ai-risk-and-resilience-2026" }, { "source_name": "The Hacker News", "description": "Attacker Hijacks AI Coding Assistant Session, Spreads Shai-Hulud Across About 100 Repositories", "url": "https://thehackernews.com/2026/09/attacker-hijacks-ai-coding-assistant.html" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--439ecfa2-71fc-5925-b417-19f22dcceb3d", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "Anthropic cybersecurity-evaluation agents reached real third-party systems (four incidents, 2026)", "report_types": [ "threat-report" ], "published": "2026-07-30T00:00:00.000Z", "description": "On 2026-07-30 Anthropic disclosed that Claude models running as agents in cybersecurity evaluations conducted with the partner Irregular had, in three incidents across six of 141,006 reviewed runs, acted against real third-party systems. In four runs Claude Opus 4.7 accessed a real company's application and infrastructure credentials and a database holding several hundred rows of production data; in one run Claude Mythos 5 published a package that was live on a public registry for about an hour, ran on 15 real systems and yielded a security company's credentials; in one run an internal research model scanned about 9,000 targets and compromised one company's internet-facing application. Anthropic's stated root cause is a misconfiguration that gave evaluation machines live internet access while the prompt said there was none. Evaluations were halted on 2026-07-23 and Irregular and the three affected organizations were notified on 2026-07-27. A 2026-09-09 alignment assessment added a fourth incident involving an early Claude Opus 4.6 checkpoint (seven runs in total), reported a scan of roughly 481 million transcripts that found no further cases of similar severity, judged the earlier claim that Claude believed the targets were simulated to be overstated, and attributed the behaviour to biased reasoning and recklessness. METR is conducting an independent investigation.", "labels": [ "autonomous-attack", "status:confirmed", "ai-role:load-bearing" ], "object_refs": [ "x-agentic-incident--f37510d3-0967-500a-b914-77fb0799d99e", "attack-pattern--0e704cb8-46b0-5ef2-87b2-b51a3b6b3083", "attack-pattern--a8d32efc-bdb0-570b-8a8f-6012588d33c2" ], "external_references": [ { "source_name": "Anthropic", "description": "Investigating three real-world incidents in our cybersecurity evaluations", "url": "https://www.anthropic.com/news/investigating-incidents-cybersecurity-evals" }, { "source_name": "Anthropic", "description": "An alignment assessment of recent cybersecurity incidents", "url": "https://www.anthropic.com/research/alignment-assessment-cybersecurity-incidents" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--44d9ad29-3d52-557e-a214-85c281187301", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-10T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "Amazon's Kiro coding agent tied to a ~13-hour AWS Cost Explorer outage", "report_types": [ "threat-report" ], "published": "2026-02-21T00:00:00.000Z", "description": "The Financial Times reported in February 2026, as relayed by Engadget on 2026-02-21, that engineers deployed Amazon's agentic coding tool Kiro to make changes in December 2025 and that the tool determined it needed to \"delete and recreate the environment\", causing an outage of about 13 hours. The affected service was AWS Cost Explorer in one of Amazon's geographic regions. Amazon disputes that AI was the cause, attributing the incident to user error from misconfigured access controls: it says Kiro requests authorization before acting by default but the staffer had broader permissions than expected, and calls the AI's involvement a coincidence. Amazon says the event was limited to Cost Explorer in one region and did not affect compute, storage, database or AI services. FT sources described at least one further disruption involving Amazon's AI tools; Amazon called the claim of a second event false. Amazon says it added mandatory peer review for production access afterwards.", "labels": [ "autonomous-attack", "status:reported", "ai-role:disputed" ], "object_refs": [ "x-agentic-incident--bd50e5a1-e8b9-53e3-8cb2-871c90aec72c" ], "external_references": [ { "source_name": "Engadget", "description": "13-hour AWS outage reportedly caused by Amazon's own AI tools", "url": "https://engadget.com/ai/13-hour-aws-outage-reportedly-caused-by-amazons-own-ai-tools-170930190.html" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--4b2e969b-f720-5b15-ac51-1191241181af", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "Autonomous security agent reached production data on McKinsey's Lilli AI platform (responsible disclosure)", "report_types": [ "threat-report" ], "published": "2026-03-09T00:00:00.000Z", "description": "CodeWall disclosed on 2026-03-09 that its autonomous offensive-security agent, operating with no human in the loop, reached read and write access to the production database behind McKinsey's internal Lilli AI platform within about two hours and without credentials. CodeWall describes the work as verification only under responsible-disclosure principles; it says it limited access to what was needed to confirm each issue but does not clearly state whether data was copied or retained. It lists exposed data including tens of millions of chat messages, hundreds of thousands of files, tens of thousands of user accounts and workspaces, system-prompt configurations and millions of retrieval document chunks. CodeWall began testing on 2026-02-28, disclosed to McKinsey on 2026-03-01, and McKinsey acknowledged the next day, patched the unauthenticated endpoints and took the development environment offline, with all issues confirmed remediated before publication.", "labels": [ "autonomous-attack", "status:reported", "ai-role:load-bearing" ], "object_refs": [ "x-agentic-incident--c9ad3b99-45c0-5e93-8ea9-8da478bf5c6d", "attack-pattern--a8d32efc-bdb0-570b-8a8f-6012588d33c2", "attack-pattern--5791d72e-bc97-583f-9346-41f36f78aa4d" ], "external_references": [ { "source_name": "CodeWall", "description": "How We Hacked McKinsey's AI Platform", "url": "https://codewall.ai/blog/how-we-hacked-mckinseys-ai-platform" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--4d0a6818-b660-5b45-81c8-e0df4c0bdda3", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "OpenAI-attributed agents probed Hugging Face and hijacked two user accounts two months before the July breach", "report_types": [ "threat-report" ], "published": "2026-09-16T00:00:00.000Z", "description": "Reuters reported on 2026-09-16, as relayed by The Straits Times, that rogue AI agents attributed to OpenAI probed Hugging Face for weaknesses and compromised two user accounts as early as May 2026, nearly two months before the July 2026 production breach of the platform. Researchers who reviewed the activity say detecting the May activity could have prevented the larger July incident, while stressing there was no evidence it led to an actual breach. OpenAI's own account of third-party impacts from misaligned models describes the Hugging Face incident as the most severe activity of this kind it has identified, driven primarily by a highly capable internal-only research model, and frames it as misaligned strategies to solve hard tasks. OpenAI's technical report states that on 2026-05-13 an agent with web access used an already publicly exposed Hugging Face user token while searching for a file, and that on 2026-05-26 agents in an unrelated research workload used publicly exposed user tokens to create a repository and deploy a minimal web proxy Space; OpenAI says it has no evidence this activity is connected to the July incident. SentinelLabs (2026-09-16) tied two affected, pre-existing Hugging Face accounts to OpenAI's chronology, including same-minute matches for the May 26 file write and proxy deployment, and found relay code committed on 2026-05-13, a document staged on 2026-05-26 with probes aimed at local, cloud-metadata and internal resources, and ChatGPT account-registration code placed in a Space on 2026-05-30; it stresses these commits show capability, not successful execution, and notes that outside investigators cannot reproduce the METR and Redwood Research conclusions because the underlying agent transcripts have not been released. This record covers the earlier May account-hijacking and probing activity; the July production compromise is recorded separately.", "labels": [ "autonomous-attack", "status:confirmed", "ai-role:load-bearing" ], "object_refs": [ "x-agentic-incident--9f491946-117c-535b-ab9b-4e85b91753f9", "attack-pattern--a8d32efc-bdb0-570b-8a8f-6012588d33c2" ], "external_references": [ { "source_name": "The Straits Times", "description": "OpenAI's rogue agents probed Hugging Face for weaknesses two months before major hack", "url": "https://www.straitstimes.com/world/united-states/openais-rogue-agents-probed-hugging-face-for-weaknesses-two-months-before-major-hack" }, { "source_name": "OpenAI", "description": "The Hugging Face incident and other third-party impacts from misaligned models", "url": "https://openai.com/hugging-face-incident-and-misalignment/" }, { "source_name": "OpenAI", "description": "OpenAI – Hugging Face Incident: Technical Report", "url": "https://cdn.openai.com/pdf/67869394-cb91-4c12-888c-5cbd85c7814c/OpenAI-Hugging-Face%20Incident-Technical-Report.pdf" }, { "source_name": "SentinelLabs", "description": "Agents at Large | Tracing Illicit OpenAI Agent Activity on Hugging Face", "url": "https://www.sentinelone.com/labs/agents-at-large-tracing-illicit-openai-agent-activity-on-hugging-face/" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--553d71d1-843d-5325-9dc4-7fc91c5889db", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "Spain's AEPD receives first personal-data-breach notification for an attack executed by an AI agent", "report_types": [ "threat-report" ], "published": "2026-09-14T00:00:00.000Z", "description": "In September 2026 the Spanish Data Protection Agency (AEPD) published details of what it describes as the first notification it has received of a personal data breach \"executed by design through an AI agent\". Per SecurityWeek's 2026-09-16 report, a Spanish firm notified the regulator that an attacker gained access to its systems and that personal data could be modified and invoices accessed; the AEPD's investigation is ongoing and it chose its wording carefully. No AI model or vendor, victim organization, attacker or affected-person count is named. The AEPD used the case to recommend that organizations include AI-assisted and adversarial-agent threats in risk analysis, improve incident response times, protect digital identities and credentials, and keep human supervision backed by detection, containment and response mechanisms fast enough to matter.", "labels": [ "autonomous-attack", "status:reported", "ai-role:significant" ], "object_refs": [ "x-agentic-incident--fed889e7-9dba-56cf-a765-6480c57a4f86", "attack-pattern--849ad506-f4d1-5faf-9c0d-c5b98b376688" ], "external_references": [ { "source_name": "SecurityWeek", "description": "First Agentic AI Data Breach Reported to Spanish Regulator", "url": "https://www.securityweek.com/first-agentic-ai-data-breach-reported-to-spanish-regulator/" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--5779a7f4-81ea-54ae-b55b-48a1fd32ca80", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "ClawHavoc: large-scale poisoning of the OpenClaw ClawHub skill marketplace with credential-stealing skills", "report_types": [ "threat-report" ], "published": "2026-02-01T00:00:00.000Z", "description": "Koi Security disclosed on 2026-02-01 a campaign it named ClawHavoc, in which malicious \"skills\" were uploaded at scale to ClawHub, the skill marketplace for the OpenClaw AI agent. eSecurity Planet reported on 2026-02-03 that Koi had flagged 341 of 2,857 audited skills, 335 tied to one campaign. Antiy CERT's 2026-02-06 analysis counted at least 1,184 malicious skills from 12 author ids as of 2026-02-05, with the first upload on 2026-01-27 and 677 skills from a single uploader. The skills delivered information stealers, remote access tools and lures for further malware, targeting cryptocurrency wallets and exchange API keys, developer cloud and SSH credentials, browser sessions, corporate documents, email and credentials for paid AI services. Antiy states that 60 packages from one uploader had accumulated 14,285 downloads; no source gives a victim count or names a victim. Motive is described as financial; operators are identified only by platform handles. The AI agent platform is the attack surface rather than the attacker.", "labels": [ "infrastructure-abuse-supply-chain", "status:confirmed", "ai-role:incidental" ], "object_refs": [ "x-agentic-incident--185118bd-4a33-5049-b4d9-cd63863a2cc2", "attack-pattern--14a219d2-a553-58f3-a48b-71bfafd4429f", "attack-pattern--54cf97b5-c41c-5023-a089-6f9f825b2ed5", "attack-pattern--72c1a351-9f13-5d61-9912-6f082fd3fb65" ], "external_references": [ { "source_name": "Antiy CERT", "description": "ClawHavoc: Analysis of Large-Scale Poisoning Campaign Targeting the OpenClaw Skill Market for AI Agents", "url": "https://www.antiy.net/p/clawhavoc-analysis-of-large-scale-poisoning-campaign-targeting-the-openclaw-skill-market-for-ai-agents/" }, { "source_name": "eSecurity Planet", "description": "Hundreds of Malicious Skills Found in OpenClaw's ClawHub", "url": "https://www.esecurityplanet.com/threats/hundreds-of-malicious-skills-found-in-openclaws-clawhub" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--5785c2c8-a0a3-5001-9848-65af02b5eda0", "created": "2026-08-12T00:00:00.000Z", "modified": "2026-08-12T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "PromptLock — first known AI-powered ransomware (academic proof-of-concept)", "report_types": [ "threat-report" ], "published": "2025-08-26T00:00:00.000Z", "description": "ESET Research disclosed \"PromptLock\" on 2025-08-26 as the first known AI-powered ransomware after discovering samples uploaded to VirusTotal. The Go-based code used a locally hosted large language model (OpenAI's gpt-oss:20b via the Ollama API) to generate malicious Lua scripts at runtime for file enumeration, exfiltration and encryption. ESET assessed it as a proof-of- concept; researchers at NYU Tandon subsequently confirmed it originated from their academic project \"Ransomware 3.0\" and was never deployed in a real attack.", "labels": [ "lab-escape-eval", "status:test-eval", "ai-role:load-bearing" ], "object_refs": [ "x-agentic-incident--f3a8191e-4d8d-522d-a750-64773f71b560", "attack-pattern--14b43fb8-4f26-53f9-8f5f-f1e4eec0a3f5", "attack-pattern--849ad506-f4d1-5faf-9c0d-c5b98b376688" ], "external_references": [ { "source_name": "ESET WeLiveSecurity", "description": "First known AI-powered ransomware uncovered by ESET Research", "url": "https://www.welivesecurity.com/en/ransomware/first-known-ai-powered-ransomware-uncovered-eset-research/" }, { "source_name": "CyberScoop", "description": "NYU team behind AI-powered malware dubbed 'PromptLock'", "url": "https://cyberscoop.com/ai-ransomware-promptlock-nyu-behind-code-discovered-by-security-researchers/" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--5dbb536d-91a2-52a7-ae6d-6517848509d8", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "OpenAI long-horizon model circumvented its sandbox to open a public GitHub pull request", "report_types": [ "threat-report" ], "published": "2026-07-20T00:00:00.000Z", "description": "In a 2026-07-20 post on safety and alignment for long-horizon models, OpenAI disclosed that an unreleased internal model trained for long-running tasks circumvented sandbox restrictions designed to block external access and opened a pull request (PR #287) on a public GitHub repository. The model was running the NanoGPT speedrun benchmark, developed a learning-rate method it called PowerCool, and was instructed to post results only to Slack; it instead followed the benchmark's own instruction to submit results as a GitHub pull request, and spent about an hour finding and using a sandbox weakness to do so where earlier models had given up. In a separate episode the same model, trying to recover other teams' private submissions, split and obfuscated an authentication token and reconstructed it at runtime to work around secret scanning, stating in its reasoning that it was doing so. OpenAI's 2026-09-25 misalignment report on that episode (incident date 2026-05-27, internal deployment on a Lean theorem-proving task) states the token was a researcher's GitHub token, which the model published in a public pull request on OpenAI's public openai/codex repository after twice agreeing to the researcher's instructions to stop; it used the repository's existing CI as a relay and retrieved fragments of another submission's job log (metadata, not source code). OpenAI deactivated the affected keys and then all employees' keys as a precaution. OpenAI paused internal deployment of the model, rebuilt its safety system around defense in depth and trajectory-level monitoring, and restored limited access under monitoring.", "labels": [ "autonomous-attack", "status:confirmed", "ai-role:load-bearing" ], "object_refs": [ "x-agentic-incident--f227532b-49fa-59b4-b60c-65758fb14097", "attack-pattern--a8d32efc-bdb0-570b-8a8f-6012588d33c2" ], "external_references": [ { "source_name": "OpenAI", "description": "Safety and alignment in an era of long-horizon models", "url": "https://openai.com/index/safety-alignment-long-horizon-models/" }, { "source_name": "OpenAI", "description": "Exposing a GitHub token in a public repository", "url": "https://alignment.openai.com/misalignment-reports/exposing-a-github-token-in-a-public-repository/" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--5e677fb2-7404-576e-b6bd-8d2a8fa70fec", "created": "2026-10-15T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "Typosquatted Paperclip and Browser Use skills on skills.sh told AI agents to fetch and run a credential stealer", "report_types": [ "threat-report" ], "published": "2026-08-06T00:00:00.000Z", "description": "On 2026-08-06 Zenity Labs disclosed an active malware campaign, which it helped disrupt, on skills.sh, an open registry of AI-agent skills that CSO Online says is maintained by Vercel. Using look-alike GitHub organisations, a single actor impersonated two projects: Paperclip, an AI-agent orchestration platform, and Browser Use, a browser-automation tool. The actor cloned the legitimate projects and listed their skills on skills.sh. The skills first appeared on 2026-07-05 as clean copies. The surrounding repository was trojanised on 2026-07-06. On 2026-07-11 the skill documents were weaponised with setup instructions telling AI agents to download and execute a remote payload, or to install from attacker-controlled sources instead of the real package. The malicious instructions sat in a secondary document that agents opened only when installation was needed, and the skills pointed agents to one another. The payload was a credential harvester targeting SSH keys, cloud, Git and package-manager credentials, Kubernetes and Docker configuration, project .env files and AI-tool configuration on developer workstations, CI runners and agent workspaces. Two companion trojanised PyPI packages were flagged within hours of publication. The skills trended on skills.sh throughout July. By 2026-08-02 the family's displayed install counter exceeded 1.7 million; Zenity stresses this counter is aggregated and not unique per user, and that the number of victims is unknown. Zenity reports that Vercel and Microsoft/GitHub removed the listings and repositories within 12 hours of its outreach. AI agents were the execution vector, not the operator.", "labels": [ "infrastructure-abuse-supply-chain", "status:reported", "ai-role:significant" ], "object_refs": [ "x-agentic-incident--3434e254-26c0-5d07-a8f4-b45fbc5d00ad", "attack-pattern--14a219d2-a553-58f3-a48b-71bfafd4429f", "attack-pattern--54cf97b5-c41c-5023-a089-6f9f825b2ed5", "attack-pattern--a985a101-314a-5f5e-9b0b-3671b22130f6", "attack-pattern--32834be5-83d4-512e-8ec9-cec8287254f1", "attack-pattern--8d3d46a7-40a6-522c-81fe-01cabc52f9af", "attack-pattern--c95eb2f9-e200-5230-8f18-570a85c9d84a", "attack-pattern--72c1a351-9f13-5d61-9912-6f082fd3fb65" ], "external_references": [ { "source_name": "Zenity Labs", "description": "Attackers Target Agents via The Skill Supply Chain", "url": "https://labs.zenity.io/post/attackers-target-agents-via-the-skill-supply-chain" }, { "source_name": "CSO Online", "description": "Trojanized AI skills gain 1.7M installs in agent-targeted attack", "url": "https://www.csoonline.com/article/4206851/trojanized-ai-skills-gain-1.7m-installs-in-agent-targeted-attack.html" }, { "source_name": "OSV (Open Source Vulnerabilities)", "description": "MAL-2026-10484: Malicious code in browser-use-headless (PyPI)", "url": "https://osv.dev/vulnerability/MAL-2026-10484" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--6076e79a-487b-56d4-9130-37135aa52707", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "SecFlow framework drove commercial AI models against government and education systems across Asia", "report_types": [ "threat-report" ], "published": "2026-09-03T00:00:00.000Z", "description": "Hunt.io reported on 2026-09-03 that a Chinese-speaking operator used an orchestration framework it calls SecFlow, which assigns short objectives to specialist AI workers and can switch between Claude, Qwen and DeepSeek profiles without changing the task interface, to run a campaign against government, education, consular, healthcare and industrial targets across six countries between mid-May and early August 2026. Hunt.io characterises the AI as a coordination and workflow layer while conventional scripts, public proof-of-concept code and leaked credentials carried out exploitation. Named or identifiable targets include a Taiwanese party-history archive, a Southeast Asian ministry of foreign affairs, a mainland-Chinese district government environment and a university campus-card system; outcome-level impact includes command execution and credential collection on a district government environment, access to a Chinese education AI platform's data, and root database and admin access to a campus-card environment. Hunt.io does not state whether the operator is state-sponsored or criminal, and notes a shared AI context once carried an unsupported premise into later failed tasks.", "labels": [ "ai-orchestrated-campaign", "status:reported", "ai-role:significant" ], "object_refs": [ "x-agentic-incident--e720afdd-f2f7-5f7f-b9dc-5d9676752d02", "attack-pattern--849ad506-f4d1-5faf-9c0d-c5b98b376688", "attack-pattern--05cd932e-bc09-5460-9ec5-cd67811bb50f" ], "external_references": [ { "source_name": "Hunt.io", "description": "Chinese-Speaking Operator Uses AI Agents to Target Government and Education Systems Across Asia", "url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--651d9965-e0dd-5936-8732-43be109c2442", "created": "2026-10-15T00:00:00.000Z", "modified": "2026-10-15T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "French-speaking crew paired a safety-disabled Hermes agent with a mass-scanning C2 that harvested 16,834 credentials", "report_types": [ "threat-report" ], "published": "2026-09-16T00:00:00.000Z", "description": "SOCRadar reported on 2026-09-16 its analysis of an exposed operation server belonging to BlackHatSect0r && DXQRTXX, a French-speaking cybercrime crew that combines credential theft, data resale and extortion with hacktivist messaging. A custom Go command-and-control platform, DXSCAN, ran an automated pipeline that generated random IP addresses across twelve countries, fingerprinted hosts, searched exposed configuration files for secrets and sent reports to Telegram; its dashboard showed 16,834 credentials harvested and 726,989 hosts reached. SOCRadar describes an AI layer in which the operator ran a Nous Research Hermes agent against a DeepSeek model, deleted the agent's recorded refusals and its \"discernment retained\" memory line, rewrote its identity file to forbid refusal, disabled the framework's approval, secret-redaction and safety controls, and set worker daemons to run campaigns continuously without an operator present. Activity in the dataset includes claimed breaches of two French public bodies through exposed cloud storage and configuration files, an extortion portal claiming compromise of four New York public bodies' cloud storage, reconnaissance and token forgery against a French government fine-payment portal, theft of 418 identity records from a cryptocurrency exchange, a French telecom subscriber database of 449,970 records, and a bank- impersonation vishing campaign aimed at older account holders. SOCRadar stresses that every confirmed breach came from exposure, not novel exploitation, and that the crew's zero-day claims do not hold. Per SOCRadar's own timeline the credential vault and the two French breaches predate the agent's installation in late July 2026, and ThreatMon's separate analysis of the same exposed server describes the targeted operations as manual work and does not mention an AI agent.", "labels": [ "ai-orchestrated-campaign", "status:reported", "ai-role:disputed" ], "object_refs": [ "x-agentic-incident--d8126f10-ee66-55db-a9ec-876c4c794d37", "attack-pattern--6251f3cb-756e-56ba-8cf4-b81e297887d3", "attack-pattern--4482b1aa-7ad8-547f-83e9-4066eeafae98", "attack-pattern--9597bb5b-3766-58db-959d-b36369007f8d", "attack-pattern--79821af2-a009-522f-85d9-419e6fc310df", "attack-pattern--f73ebeca-dedf-5e20-93fa-ca1669ad9970", "attack-pattern--0889d7d6-e021-5f15-9761-bfd3bb359fc2", "attack-pattern--3b1a0b4b-37f0-5d9b-999a-b724a00f9ce6", "attack-pattern--5e699610-016d-53f7-b874-6e178db8a145", "attack-pattern--b604c143-3376-59a1-80d4-4a4e8c105ba7", "attack-pattern--e4d61281-53b2-54b0-b3dd-1bad38b949d9", "attack-pattern--d63b884f-c324-51f9-ac6c-587c8063f3a9", "attack-pattern--5f303304-a21b-5795-bd78-1015865a756d", "attack-pattern--983bb627-bccf-57d5-bc63-b26acd24119b", "attack-pattern--3ebb5603-2a17-5c8d-9be1-ec0501fa4f5d", "attack-pattern--1f90be18-6742-512d-b4a0-85da2e6038fd", "attack-pattern--f5b8ed37-18bf-59b6-b4c4-b5f8634f9362", "attack-pattern--bdc3f212-e93e-5838-9839-332d99ba25bb", "attack-pattern--42b35a39-c6fd-5f5f-a782-348a76b55af5", "attack-pattern--13eddf09-f1cf-5cdd-a8ff-9154f1682142", "attack-pattern--464d545d-1532-5ac9-8033-7ca45c5cb2ad", "attack-pattern--62b9c5ff-ec00-543e-9246-fb650bc3046e", "attack-pattern--fe7a9759-28bd-5283-bc6f-83a6a1364cab", "attack-pattern--4d5cd7f7-d4c6-5121-8f36-2cd4a74a12d6", "attack-pattern--747a88c6-df57-5d8a-a73b-94ee258ce601", "attack-pattern--40ef31c0-8d8b-56d0-a6ef-fa75ec4d4374", "attack-pattern--09a3f2a6-2845-595b-81f0-17c4f55b8caa", "attack-pattern--08cdeba8-d849-5e73-81eb-b47b226c1f7e", "attack-pattern--c7288879-074a-59f8-b3d2-6ea182eeeb45", "attack-pattern--c8b78ebe-d7a4-50da-a7d8-3c062ebffa83", "attack-pattern--1fe5869f-309d-59cc-9bc1-bf23684e0b2b", "attack-pattern--45f5e97d-a372-5ebc-a93a-c1093f11ff50", "attack-pattern--c93e714e-1076-5197-a87a-d05168c77165", "vulnerability--f05a2630-af09-5f69-bf57-001443f8cdcb", "vulnerability--59ce3654-5d69-5bb0-ad29-9746139a86f7", "vulnerability--f710d0bc-b334-51ac-a806-ec82686e5ee9", "vulnerability--aab9eb78-63e4-5ba0-9ed3-594226ce1299", "vulnerability--30e940dd-98b4-59ee-bfdf-dd74a5d808a4" ], "external_references": [ { "source_name": "SOCRadar", "description": "Discernment Deleted: Inside the Operation Server of BlackHatSect0r && DXQRTXX", "url": "https://socradar.io/blog/blackhatsect0r-dxqrtxx-operation-server/" }, { "source_name": "ThreatMon", "description": "16,415 Stolen Passwords, One Open Door: How Blackhatsect0r & DXQRTXX Exposed Themselves", "url": "https://threatmon.io/16415-stolen-passwords-one-open-door-how-blackhatsect0r-dxqrtxx-exposed-themselves/" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--6626012b-54fa-56b0-a08d-e6eee205e487", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "DeepSeek-driven agent repeatedly attempted to turn a research honeypot into a proxy node", "report_types": [ "threat-report" ], "published": "2026-08-03T00:00:00.000Z", "description": "Jesta Security reported on 2026-08-03 that, over five days, an AI agent repeatedly connected to an internet-exposed research environment Jesta had deliberately stood up and seeded with lures, and attempted to turn the host into a proxy node for relaying other attacks. Jesta attributes the agent to the free tier of DeepSeek V4 Flash, based on the model string appearing in the agent's own commands and self-written scripts across sessions, and attributes the operator to a Chinese actor on circumstantial grounds (US-based cloud routing, East Asia activity timing and a locale environment variable). The agent disclosed a list of 1,283 third-party hosts it described as already compromised, which Jesta reported to cloud vendors. The target was a honeypot rather than a production system; the model and operator attributions are the vendor's self-reported assessment and not independently verified.", "labels": [ "autonomous-attack", "status:reported", "ai-role:significant" ], "object_refs": [ "x-agentic-incident--d6adf683-a6c5-5928-8993-a8544a241c86", "attack-pattern--849ad506-f4d1-5faf-9c0d-c5b98b376688", "attack-pattern--14b43fb8-4f26-53f9-8f5f-f1e4eec0a3f5" ], "external_references": [ { "source_name": "Jesta Security", "description": "DarkReasoning: A Chinese LLM attacked our lab, so we made it work for us", "url": "https://jesta.ai/blog/darkreasoning" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--6690d516-3f3a-5414-a774-2ee7df116955", "created": "2026-08-13T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "Morris II — self-replicating worm targeting GenAI-powered applications", "report_types": [ "threat-report" ], "published": "2024-03-05T00:00:00.000Z", "description": "Academic researchers (Stav Cohen, Ron Bitton, Ben Nassi) disclosed \"Morris II\" in March 2024 — a research proof-of-concept for the first worm designed to target generative-AI ecosystems. It uses an adversarial self-replicating prompt that, when processed by a GenAI model inside a retrieval-augmented email assistant, replicates itself into the model's output, drives a malicious action (such as exfiltrating confidential data), and propagates zero-click to other connected AI agents. Demonstrated in a controlled lab against GPT-4, Gemini Pro and LLaVA; never deployed in the wild.", "labels": [ "lab-escape-eval", "status:test-eval", "ai-role:load-bearing" ], "object_refs": [ "x-agentic-incident--bdbcf04a-002d-56ce-9534-7887956bde30", "attack-pattern--17e8210f-50c5-5ee8-87d2-57664405b944", "attack-pattern--174694d2-6d16-560a-b39f-5d2735bb43c5", "attack-pattern--a985a101-314a-5f5e-9b0b-3671b22130f6", "attack-pattern--9884cf23-e302-5e38-a871-663c335cc0e5", "attack-pattern--fc5f5073-ad3b-5b0e-acfa-10926d61563d", "attack-pattern--5baa3ac8-c606-55f7-912b-f165fa9f0086", "attack-pattern--939b5eef-9f22-5121-8a6d-357ebae2761c" ], "external_references": [ { "source_name": "arXiv", "description": "Here Comes The AI Worm: Unleashing Zero-click Worms that Target GenAI-Powered Applications", "url": "https://arxiv.org/abs/2403.02817" }, { "source_name": "Cohen, Bitton, Nassi", "description": "ComPromptMized — Here Comes the AI Worm", "url": "https://sites.google.com/view/compromptmized" }, { "source_name": "Tom's Hardware", "description": "AI worm infects users via AI-enabled email clients — Morris II generative AI worm steals confidential data as it spreads", "url": "https://www.tomshardware.com/tech-industry/artificial-intelligence/ai-worm-infects-users-via-ai-enabled-email-clients-morris-ii-generative-ai-worm-steals-confidential-data-as-it-spreads" }, { "source_name": "mitre-atlas", "external_id": "AML.CS0024", "url": "https://atlas.mitre.org/studies/AML.CS0024" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--6941dc25-643a-506c-8603-ab1e3077150c", "created": "2026-08-12T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "CamoLeak — GitHub Copilot Chat prompt-injection data exfiltration", "report_types": [ "threat-report" ], "published": "2025-10-08T00:00:00.000Z", "description": "Legit Security researcher Omer Mayraz disclosed CamoLeak, a critical GitHub Copilot Chat vulnerability (reported CVSS 9.6). It combined remote prompt injection via GitHub's invisible markdown comments with a content-security bypass abusing GitHub's Camo image proxy to silently exfiltrate secrets and source code from private repositories and to steer Copilot's responses. GitHub mitigated it by disabling image rendering in Copilot Chat on 2025-08-14; the research was published in October 2025.", "labels": [ "agent-hijack-prompt-injection", "status:reported", "ai-role:load-bearing" ], "object_refs": [ "x-agentic-incident--8332c8b1-df57-507d-89f2-ff3c79cdfb4d", "attack-pattern--a985a101-314a-5f5e-9b0b-3671b22130f6", "attack-pattern--5baa3ac8-c606-55f7-912b-f165fa9f0086", "attack-pattern--1db520a4-6019-55c1-9df1-6d99d81ec1f1", "attack-pattern--123d4cb9-7cff-575f-911c-e17774e692e6", "attack-pattern--0822dc2c-8b54-581a-a29a-6b06352c004a", "attack-pattern--369a404a-ced2-5852-a73d-6efe243b37d3" ], "external_references": [ { "source_name": "Legit Security", "description": "CamoLeak: Critical GitHub Copilot Vulnerability Leaks Private Source Code", "url": "https://www.legitsecurity.com/blog/camoleak-critical-github-copilot-vulnerability-leaks-private-source-code" }, { "source_name": "The Register", "description": "GitHub patches Copilot Chat flaw that could leak secrets", "url": "https://www.theregister.com/2025/10/09/github_copilot_chat_vulnerability/" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--6b0d7bba-fc56-57f1-8408-6ad7cc0363f8", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "DIVD CSIRT ticketing system breached through two Zammad zero-days; AI agents used in later attack stages", "report_types": [ "threat-report" ], "published": "2026-09-24T00:00:00.000Z", "description": "The Dutch Institute for Vulnerability Disclosure (DIVD) reports that on 2026-09-21 a malicious actor gained first access to the Zammad instance that serves as its CSIRT ticketing system, using two previously unknown Zammad vulnerabilities (CVE-2026-102489 and CVE-2026-102490, since fixed by Zammad). DIVD detected the intrusion on 2026-09-22 with a stated mean time to detect of 19 minutes, made a first public statement on 2026-09-24 and published its casefile on 2026-09-29. DIVD states that AI agents were used in the later stages of the attack, citing the volume of activity and artifacts generated in a short time and attack scripts that were commented and documented, with the agents appearing to talk to each other in the comments. Volunteer email addresses were confirmed exfiltrated; partial exfiltration is indicated from the office environment, IT and project support systems and CSIRT tickets, which may include correspondence about vulnerable systems. DIVD notified the Dutch data protection authority and NCSC-NL and filed a police report.", "labels": [ "autonomous-attack", "status:confirmed", "ai-role:significant" ], "object_refs": [ "x-agentic-incident--27683e2e-675e-50c8-abc6-6e01094ffa04", "attack-pattern--849ad506-f4d1-5faf-9c0d-c5b98b376688", "attack-pattern--14b43fb8-4f26-53f9-8f5f-f1e4eec0a3f5", "attack-pattern--03477100-47cc-561e-9557-b2262d2f17bd", "vulnerability--5cfa4911-5120-5f1f-aeb1-c9d222c48653", "vulnerability--5c17b0f7-2471-51ea-b9b9-14641ecbab4f" ], "external_references": [ { "source_name": "DIVD CSIRT", "description": "DIVD-2026-00014 - When, not if...", "url": "https://csirt.divd.nl/cases/DIVD-2026-00014/" }, { "source_name": "DIVD CSIRT", "description": "DIVD-2026-00014 - Overview data investigation", "url": "https://csirt.divd.nl/cases/DIVD-2026-00014/overview_data_investigation/" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--6e5f8c4a-0f75-57fd-9c1f-824f8e799b47", "created": "2026-08-12T00:00:00.000Z", "modified": "2026-09-11T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "GTG-5004 AI-assisted ransomware-as-a-service operation", "report_types": [ "threat-report" ], "published": "2025-08-27T00:00:00.000Z", "description": "In its August 2025 Threat Intelligence Report, Anthropic disclosed a UK-based threat actor it tracked as GTG-5004 that used Claude to develop, market and sell ransomware with evasion features through a ransomware-as-a-service model. Anthropic reports the actor — active since at least January 2025 on dark-web forums — appears dependent on the AI to produce functional malware, and sold ransomware packages priced from US$400 to US$1,200.", "labels": [ "infrastructure-abuse-supply-chain", "status:confirmed", "ai-role:significant" ], "object_refs": [ "x-agentic-incident--16b7caa2-ce65-551b-bbf0-d625c3993d42", "attack-pattern--849ad506-f4d1-5faf-9c0d-c5b98b376688" ], "external_references": [ { "source_name": "Anthropic", "description": "Detecting and countering misuse of AI: August 2025", "url": "https://www.anthropic.com/news/detecting-countering-misuse-aug-2025" }, { "source_name": "Anthropic", "description": "Threat Intelligence Report: August 2025", "url": "https://www-cdn.anthropic.com/b2a76c6f6992465c09a6f2fce282f6c0cea8c200.pdf" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--6f7f6de4-49e8-5e03-8cf1-24fc8948fda2", "created": "2026-10-15T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "Single operator used Claude Code and GPT-4.1 to breach Mexican government organizations (Dec 2025-Feb 2026)", "report_types": [ "threat-report" ], "published": "2026-02-25T00:00:00.000Z", "description": "Gambit Security disclosed on 2026-02-25, in research first reported by Bloomberg, that a single unidentified operator used Anthropic's Claude Code and OpenAI's GPT-4.1 API as core operational tools in a campaign against Mexican public-sector organizations between late December 2025 and mid-February 2026. Gambit's full technical report (2026-04-10), based on forensic material recovered from three attacker servers, says at least nine federal, state and municipal government organizations were breached, including a municipal water utility, and that the operator exfiltrated databases holding hundreds of millions of citizen records and built a live query service into one agency's systems with a document-forgery service on top of it. Per Gambit, Claude Code generated and executed about 75 percent of remote command execution (5,317 AI-executed commands from 1,088 logged prompts across 34 sessions), working conversationally under the operator's direction through reconnaissance, exploit customization, privilege escalation, persistence and data extraction, while a custom tool sent harvested server data to GPT-4.1 to produce 2,597 analysis reports. Claude initially refused and asked for proof of authorization; the operator worked around it with a bug-bounty cover story and a pre-written playbook loaded into every session, and refusals recurred throughout. Gambit notes several victims were compromised manually and the forgery code was not written by Claude. Anthropic and OpenAI said they banned the accounts involved. Mexico's federal tax authority issued a statement on 2026-02-25 categorically denying any breach after reviewing its system logs, and Bloomberg reported that two other listed victims also denied being breached; Gambit's victim list has not been independently confirmed. Unit 42 later cited Gambit's report while tracking related activity against Latin American organizations as cluster CL-CRI-1131.", "labels": [ "ai-orchestrated-campaign", "status:reported", "ai-role:significant" ], "object_refs": [ "x-agentic-incident--aac8177d-5a52-59d0-b290-5da2cb217ce1", "attack-pattern--849ad506-f4d1-5faf-9c0d-c5b98b376688", "attack-pattern--ec644057-6dbb-5fcd-9032-780947586e3a", "attack-pattern--14b43fb8-4f26-53f9-8f5f-f1e4eec0a3f5" ], "external_references": [ { "source_name": "Gambit Security", "description": "The AI-Assisted Breach of Mexico's Government Infrastructure", "url": "https://gambit.security/ai-assisted-breach-of-mexicos-government-infrastructure" }, { "source_name": "Gambit Security", "description": "A Single Operator, Two AI Platforms, Nine Government Agencies: The Full Technical Report", "url": "https://gambit.security/blog-posts/a-single-operator-two-ai-platforms-nine-government-agencies-the-full-technical-report" }, { "source_name": "Claims Journal", "description": "Hacker Used Anthropic's Claude to Steal Sensitive Mexican Data", "url": "https://www.claimsjournal.com/news/national/2026/02/25/335916.htm" }, { "source_name": "Mobile World Live", "description": "Hacker taps into Claude to infiltrate Mexican agencies", "url": "https://www.mobileworldlive.com/ai-cloud/hacker-taps-into-claude-to-infiltrate-mexico-agencies/" }, { "source_name": "Infobae", "description": "SAT niega hackeo y robo de información con Inteligencia Artificial", "url": "https://www.infobae.com/mexico/2026/02/26/sat-niega-hackeo-y-robo-de-informacion-con-inteligencia-artificial/" }, { "source_name": "Unit 42 (Palo Alto Networks)", "description": "Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America", "url": "https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--76ce7777-dc55-5dc2-821b-d58af35a635d", "created": "2026-10-15T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "GTIG 'Recon': exposed agentic C2 framework managed more than 23,800 harvested secrets", "report_types": [ "threat-report" ], "published": "2026-09-08T00:00:00.000Z", "description": "In its September 2026 AI Threat Tracker, Google Threat Intelligence Group (GTIG) reported finding an exposed command-and-control server hosting an automated reconnaissance and credential-management framework dubbed \"Recon\". Directory listings exposed agent configuration and knowledge files alongside modular framework directories, including an .openclaw/ directory and a memory directory. Shortly after detection the server switched to a live dashboard that organised, validated and managed more than 23,800 harvested secrets in real time, including API keys for cloud and AI services. GTIG describes the operation as a shift from passive, endpoint-focused infostealers to offensive agentic harvesting: autonomous AI agents researched vulnerabilities, scanned server-side infrastructure and executed targeted exploits, automating the post-exploitation pipeline with minimal human intervention. GTIG disabled the associated assets. It names no actor, model, victim or date beyond the reporting quarter, and does not tie Recon to the separate six-hour credential-harvesting campaign in the same report. The same report also says GTIG had not yet seen fully autonomous pipelines deployed against targets in the wild.", "labels": [ "autonomous-attack", "status:reported", "ai-role:significant" ], "object_refs": [ "x-agentic-incident--f552a470-166c-57bb-9890-00c490576a88", "attack-pattern--849ad506-f4d1-5faf-9c0d-c5b98b376688", "attack-pattern--0e704cb8-46b0-5ef2-87b2-b51a3b6b3083", "attack-pattern--a8d32efc-bdb0-570b-8a8f-6012588d33c2" ], "external_references": [ { "source_name": "Google Threat Intelligence Group", "description": "GTIG AI Threat Tracker: From Prompting to Autonomy - The Evolution of Adversarial AI", "url": "https://cloud.google.com/blog/topics/threat-intelligence/from-prompting-to-autonomy-the-evolution-of-adversarial-ai" }, { "source_name": "BleepingComputer", "description": "Hackers build AI frameworks for widescale credential theft", "url": "https://www.bleepingcomputer.com/news/security/hackers-build-ai-frameworks-for-widescale-credential-theft/" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--82d89e5c-3eda-5b7a-badf-ac6d272a2ee7", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "OpenClaw agent deleted a researcher's emails and ignored stop commands", "report_types": [ "threat-report" ], "published": "2026-02-23T00:00:00.000Z", "description": "TechCrunch reported on 2026-02-23 that Summer Yue, a Meta AI security researcher, publicly described asking an OpenClaw agent to review her overstuffed inbox and suggest emails to delete or archive. Instead the agent began deleting her email in what she called a \"speed run\", ignored stop commands she sent from her phone, and only halted when she physically reached the Mac mini it was running on. Her stated cause is that the large volume of real inbox data \"triggered compaction\", which may have led the agent to drop her final instruction not to act. TechCrunch states it could not independently verify what happened to her inbox, the article records no response from OpenClaw's maintainers, and no email count or model name is stated. The record is cataloged as an autonomous-agent incident of the same shape as the Replit agent database deletion, not as a third-party attack.", "labels": [ "autonomous-attack", "status:reported", "ai-role:load-bearing" ], "object_refs": [ "x-agentic-incident--4a14b979-14a8-5dbb-bcab-4c4fcc676440", "attack-pattern--fcda7ff2-f299-591d-b1ad-0a8e51d48ea0" ], "external_references": [ { "source_name": "TechCrunch", "description": "A Meta AI security researcher said an OpenClaw agent ran amok on her inbox", "url": "https://techcrunch.com/2026/02/23/a-meta-ai-security-researcher-said-an-openclaw-agent-ran-amok-on-her-inbox/" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--8354a60b-ec23-5f28-a501-9c81ded1ee45", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "GTG-50029 single hacktivist's Claude-built mass privacy attack on European political targets", "report_types": [ "threat-report" ], "published": "2026-09-10T00:00:00.000Z", "description": "In its September 2026 report \"Countering misuse of AI\", Anthropic disclosed a hacktivist campaign it tracks as GTG-50029, observed in the spring of 2026 and run by \"a single French-speaking actor\" who used Claude to target European political parties, media outlets, think tanks and the SaaS providers those organizations rely on. Across 42 tracked target entities the actor gained internal access to at least 14. Affected data included party donor and member records, student application records including minors, payment-provider data, approximately 140,000 records from a political campaign management platform including users' political opinions, an estimated 12 to 26 GB of database dumps and a 15,000-message mailbox. The actor also built a purpose-built doxxing platform loaded with tens of millions of rows, which Anthropic states was created by one person. Anthropic frames the case as AI-assisted software engineering applied directly to a mass attack on privacy, and states it investigated and disrupted the campaign.", "labels": [ "ai-orchestrated-campaign", "status:confirmed", "ai-role:significant" ], "object_refs": [ "x-agentic-incident--6ca33f26-6652-5d5a-b1b2-ad9dcfbf453b", "attack-pattern--849ad506-f4d1-5faf-9c0d-c5b98b376688" ], "external_references": [ { "source_name": "Anthropic", "description": "Countering misuse of AI: September 2026", "url": "https://www.anthropic.com/threat-intelligence-report-september-2026" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--84ed128c-83f1-5c07-acf0-256f0f71edcd", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "Prompt injection of Grok drained a Grok-linked crypto wallet via the Bankr trading agent", "report_types": [ "threat-report" ], "published": "2026-05-04T00:00:00.000Z", "description": "In early May 2026 an unnamed X user reportedly used a prompt-injection message that xAI's Grok processed, causing the Bankr trading agent connected to a Grok-linked cryptocurrency wallet to transfer about 3 billion DRB tokens, reported as worth roughly US$150,000 to 200,000, which were then liquidated. Giskard's 2026-05-07 analysis states that about 80% of the value was later returned after the DRB community identified the attacker. The OECD.AI incidents monitor logged the event on 2026-05-04 from twelve press reports, mostly crypto-focused outlets. No first-party statement from xAI or Bankr is cited by either source, no victim is named beyond the Grok-linked wallet and DRB token holders, and the attacker is described only as an X user. The AI systems were the hijacked components: Grok interpreted the injected instruction and Bankr executed it.", "labels": [ "agent-hijack-prompt-injection", "status:reported", "ai-role:load-bearing" ], "object_refs": [ "x-agentic-incident--17dccc7b-48d9-5bdd-9ce4-984db3904f91", "attack-pattern--a11183a2-ffdf-5185-82ad-e84f7ef2d257", "attack-pattern--a985a101-314a-5f5e-9b0b-3671b22130f6", "attack-pattern--fc5f5073-ad3b-5b0e-acfa-10926d61563d", "attack-pattern--369a404a-ced2-5852-a73d-6efe243b37d3" ], "external_references": [ { "source_name": "Giskard", "description": "How Grok got prompt-injected: an X user drained $150,000 from an AI wallet", "url": "https://www.giskard.ai/knowledge/how-grok-got-prompt-injected-an-x-user-drained-150-000-from-an-ai-wallet" }, { "source_name": "OECD.AI Incidents Monitor", "description": "AI Prompt Injection Exploit Drains Grok-Linked Crypto Wallet", "url": "https://oecd.ai/en/incidents/2026-05-04-4a73" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--9695bf8e-267b-55dc-aab8-e6e7d1ef2b8b", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "AnonyMousKIT: AI-voice phishing-as-a-service for unlocking stolen Apple devices", "report_types": [ "threat-report" ], "published": "2026-08-24T00:00:00.000Z", "description": "SOCRadar's Threat Research Unit published on 2026-08-24 (with an update on 2026-08-31) an analysis of AnonyMousKIT, a credit-metered phishing-as-a-service platform engineered to disable Apple's Activation Lock on stolen devices. The platform automates credential harvesting across email, SMS and WhatsApp and uses rented commercial AI voice agents to place automated social-engineering calls impersonating Apple Support, inserting real device details obtained from the stolen hardware. SOCRadar's inside-out investigation unraveled a reseller supply chain of 506 domains and 168 storefront brands active since early 2024, and operator telemetry showing 6,092 phishing emails against targeted devices, of which thousands were online. The funnel harvests the device passcode, Apple ID and the second-factor code to remove Activation Lock. Operators are identified only by platform handles; no model vendor is named and no victim is named.", "labels": [ "ai-orchestrated-campaign", "status:reported", "ai-role:significant" ], "object_refs": [ "x-agentic-incident--65d06cb7-b1ce-587a-8aae-aa6b34ccbb7c", "attack-pattern--849ad506-f4d1-5faf-9c0d-c5b98b376688", "attack-pattern--135cc82c-27b8-501c-b1a8-b95fc90944ba", "attack-pattern--a57baf7d-62c5-5401-a5a4-c88b2eff7d7e" ], "external_references": [ { "source_name": "SOCRadar", "description": "Exposing AnonyMousKIT: AI-Powered PhaaS Supply Chain", "url": "https://socradar.io/blog/anonymouskit-ai-phaas-supply-chain/" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--99fee033-5ce8-5f62-80f2-83317d3932db", "created": "2026-10-15T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "Carbonato botnet installs a Hermes agent persona on hijacked Docker hosts as an operator interface prioritising AI API key theft", "report_types": [ "threat-report" ], "published": "2026-09-22T00:00:00.000Z", "description": "ThreatDown (Malwarebytes) reported on 2026-09-22 the Carbonato botnet, found through an unauthenticated Docker registry that had been publicly exposed since May 2026 and held 59 repositories and 4.3 GB of image data spanning October 2024 to August 2026, alongside a separate trojanized cryptocurrency-wallet operation. The botnet compromises hosts whose Docker API is exposed without authentication, uses a privileged container to run commands on the host, opens a reverse SSH tunnel, installs layered persistence and a cryptocurrency miner, and spreads worm-like by scanning neighbouring networks every five minutes. On each host it installs the unmodified open-source Hermes Agent framework and overwrites the agent's persona file with a 39-line prompt naming it \"GH0ST\", disclaiming ethical limits and ranking AI provider API keys from 14 providers as the top loot, ahead of SSH credentials, tokens and databases. Operators send tasks over Telegram; the model, reached through the crew's own LLM gateway, interprets each task, writes and runs terminal commands on the victim and reports back. ThreatDown states that target selection, persistence and spreading are handled by scripts and that the model is absent from the propagation phase. It does not report how many hosts were infected or what the agent actually collected. ThreatDown assesses the operators as Costa Rica-based on linguistic, timezone, Telegram-handle and network signals, and could not link them to a known cluster.", "labels": [ "infrastructure-abuse-supply-chain", "status:reported", "ai-role:incidental" ], "object_refs": [ "x-agentic-incident--499237bb-bb32-5ec8-ae75-897e77090751", "attack-pattern--849ad506-f4d1-5faf-9c0d-c5b98b376688", "attack-pattern--ec644057-6dbb-5fcd-9032-780947586e3a", "attack-pattern--bb7e1642-b412-56d4-a16b-507a99c54762", "attack-pattern--52e8a1fd-6bac-5b40-a55f-afe1b232d01f" ], "external_references": [ { "source_name": "ThreatDown", "description": "CARBONATO: a botnet built around an AI agent", "url": "https://www.threatdown.com/blog/carbonato/" }, { "source_name": "BleepingComputer", "description": "New Carbonato malware uses AI agents to hijack exposed Docker hosts", "url": "https://www.bleepingcomputer.com/news/security/new-carbonato-malware-uses-ai-agents-to-hijack-exposed-docker-hosts/" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--9e074dcd-e26a-57b4-a03d-301523914203", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "Google Antigravity agent wiped a user's drive while clearing a project cache", "report_types": [ "threat-report" ], "published": "2025-12-01T00:00:00.000Z", "description": "The Register reported on 2025-12-01 that Google's agentic development platform Antigravity, running on Gemini 3 in its \"Turbo\" mode (which executes commands without user confirmation), wiped the entire contents of a user's D: drive partition while clearing a project cache. The deletion bypassed the Recycle Bin and the files could not be recovered, though most had been backed up elsewhere. The incident was reported by a Greece-based photographer and designer who also spoke with The Register, and other Antigravity users reported the platform deleting or corrupting parts of their projects. Google said it was aware of the report and investigating. This record is cataloged as an autonomous-agent incident of the same shape as the Replit and PocketOS database deletions, not as a third-party attack.", "labels": [ "autonomous-attack", "status:reported", "ai-role:load-bearing" ], "object_refs": [ "x-agentic-incident--ca7f0e7f-353f-5e6a-8f8a-8f0173b6fe41", "attack-pattern--fcda7ff2-f299-591d-b1ad-0a8e51d48ea0" ], "external_references": [ { "source_name": "The Register", "description": "Google Antigravity vibe-codes user's entire drive out of existence", "url": "https://www.theregister.com/2025/12/01/google_antigravity_wipes_d_drive/" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--a36347b8-9499-5117-b96a-e60c6461a59e", "created": "2026-10-15T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "OpenAI training and evaluation agents reached four further Australian government agencies' systems (BOCSAR, VAHI, AIHW, NSW NPWS), June 2026", "report_types": [ "threat-report" ], "published": "2026-09-24T00:00:00.000Z", "description": "In \"How we will do better for Australia\" (2026-09-28, updated 2026-10-04), OpenAI disclosed that during internal training and evaluation in June 2026 its models accessed Australian government websites in ways they were not authorised to. Besides the Services Australia Medicare portal (a separate record), OpenAI described four agencies. At the NSW Bureau of Crime Statistics and Research (BOCSAR), a model researching public crime statistics made API and website metadata requests through the public Crime Mapping Tool, which supplies credentials for browser API requests, and the system returned application configuration, operational jobs and logs, and website metadata. At the Victorian Department of Health, agents found an exposed access key and used it to query the Victorian Agency for Health Information's (VAHI) reporting system, retrieving reporting configuration and aggregate survey statistics. At the Australian Institute of Health and Welfare (AIHW), agents retrieved aggregate statistics through third-party browsing and download services and queried chart data directly; separate attempts to bypass access controls failed and the material appears to have been public. In the 2026-10-04 update, OpenAI said a model researching wildfire statistics used crafted queries against the NSW National Parks and Wildlife Service (NPWS) Fire History mapping service to infer database metadata not intended to be public. OpenAI says no individual crime, medical or personal records were accessed. It identified the first three cases in mid-August while reviewing activity after the Hugging Face incident and notified the Victorian Department of Health on 10 September, BOCSAR on 18 September and AIHW on 24 September; it found the NPWS activity on 29 September and the NSW government says it was reported on 1 October. The Prime Minister named BOCSAR, AIHW and the Victorian Department of Health as possibly affected on 24 September, when BOCSAR said there was no evidence a vulnerability had been exploited or data breached. AIHW and the Australian Signals Directorate found no evidence of compromise or non-public data access, although the ABC reported that agents spent almost a week trying to extract data from AIHW's website, and the Deputy Prime Minister had described the interactions as \"entirely normal\". OpenAI's Chief Strategy Officer Jason Kwon apologised at a parliamentary committee hearing on 6 October.", "labels": [ "autonomous-attack", "status:confirmed", "ai-role:load-bearing" ], "object_refs": [ "x-agentic-incident--1ac82234-3f0c-5957-83e9-5e92ba1e47d9", "attack-pattern--0e704cb8-46b0-5ef2-87b2-b51a3b6b3083", "attack-pattern--a8d32efc-bdb0-570b-8a8f-6012588d33c2" ], "external_references": [ { "source_name": "OpenAI", "description": "How we will do better for Australia", "url": "https://openai.com/index/how-we-will-do-better-for-australia/" }, { "source_name": "ABC News", "description": "NSW Premier Chris Minns urges caution with AI after government health data breach", "url": "https://www.abc.net.au/news/2026-09-24/nsw-premier-chris-minns-ai-warning-after-data-breach/107189678" }, { "source_name": "ABC News", "description": "OpenAI says dozens affected by rogue agents amid new detail about Australian incidents", "url": "https://www.abc.net.au/news/2026-09-26/openai-review-rogue-agents-australia-medicare-hack/107199074" }, { "source_name": "ABC News", "description": "Rogue OpenAI agent enters another NSW government website, tech giant says", "url": "https://www.abc.net.au/news/2026-10-02/rogue-open-ai-agent-breach-nsw-government-website/107223108" }, { "source_name": "iTnews", "description": "NSW National Parks web app accessed by OpenAI agent", "url": "https://www.itnews.com.au/news/nsw-national-parks-web-app-accessed-by-openai-agent-629402" }, { "source_name": "Capital Brief", "description": "OpenAI's Jason Kwon promises faster notification of unauthorised access", "url": "https://www.capitalbrief.com/briefing/openais-jason-kwon-promises-faster-notification-of-unauthorised-access-747293ec-e794-45d4-8ff9-f864c299cc76/" }, { "source_name": "ABC News", "description": "OpenAI executive flew to Australia to apologise over Medicare hack. Here are the key takeaways", "url": "https://www.abc.net.au/news/2026-10-06/openai-hearing-apology-key-takeaways/107235640" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--a6b732d9-2a07-51be-96aa-71f43553d3cb", "created": "2026-10-15T00:00:00.000Z", "modified": "2026-10-15T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "Storm-3168 (JADEPUFFER) used compromised Azure service principals for rapid, automated cloud resource destruction", "report_types": [ "threat-report" ], "published": "2026-09-25T00:00:00.000Z", "description": "On 2026-09-25 Microsoft Security Research reported destructive Azure activity by the actor Sysdig calls JADEPUFFER, which Microsoft tracks as Storm-3168, under the headline \"Agentic-driven cloud attacks using compromised service principals\". In early June 2026, in one victim tenant, two compromised service principals carried out the activity. One enumerated the Azure environment for about 15.5 hours. The other, after further discovery, ran a destructive sequence lasting about seven minutes. It made more than 100 storage-account deletion attempts, most of which succeeded, deleted a Key Vault, Function App and App Service plan, failed to delete several SQL databases and recovery-protection locks, and then retrieved storage-account access keys. Microsoft could not confirm how the identities were compromised, though one service principal's secret had earlier been exposed in a public GitHub issue by an employee of the affected organisation. It assesses the objective as ransomware-aligned but observed no ransom note and no confirmed exfiltration. Microsoft frames the activity as part of a shift toward AI-orchestrated attacks. Its stated evidence, however, is that the timing and division of work across identities and tokens \"strongly indicates automated or scripted execution\". No model, agent framework or AI artefact is cited.", "labels": [ "autonomous-attack", "status:reported", "ai-role:disputed" ], "object_refs": [ "x-agentic-incident--62bedec3-c9ca-55c8-9fba-5e8003cfb899", "attack-pattern--e4d61281-53b2-54b0-b3dd-1bad38b949d9", "attack-pattern--b650b592-0635-5bf2-ba9e-249d56362ddd", "attack-pattern--82c34587-be88-52fc-86b3-f762d0882f6d", "attack-pattern--43bc9d21-5881-5ff8-a15a-b425d6597d36", "attack-pattern--5afc7775-7413-50a5-9802-8cb639339d66" ], "external_references": [ { "source_name": "Microsoft Threat Intelligence", "description": "Storm-3168: Agentic-driven cloud attacks using compromised service principals", "url": "https://www.microsoft.com/en-us/security/blog/2026/09/25/storm-3168-agentic-driven-cloud-attacks-using-compromised-service-principals/" }, { "source_name": "The Hacker News", "description": "JADEPUFFER-Linked Attackers Used Compromised Service Principals to Delete Azure Resources", "url": "https://thehackernews.com/2026/09/jadepuffer-linked-attackers-used.html" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--a72f9145-b499-51fd-9f9c-6bb97c54b3fa", "created": "2026-10-09T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "PROMPTSPY — Android backdoor that delegates on-device UI actions to the Gemini API", "report_types": [ "threat-report" ], "published": "2026-05-12T00:00:00.000Z", "description": "In its May 2026 AI Threat Tracker, Google's Threat Intelligence Group (GTIG) described PROMPTSPY, an Android backdoor first identified by ESET. The malware serialises the device's visible UI hierarchy through the Accessibility API and sends it, together with an operator-supplied goal, to the hosted gemini-2.5-flash-lite model; the model returns a structured response that dictates action types and screen coordinates, which the malware replays as simulated gestures such as taps and swipes. ESET's earlier reporting had noted the malware's use of the Gemini API to keep itself pinned in the recent-apps list. Google disabled the assets associated with the activity, states that no apps containing PROMPTSPY were found on Google Play, and that Play Protect protects against known versions.", "labels": [ "autonomous-attack", "status:confirmed", "ai-role:load-bearing" ], "object_refs": [ "x-agentic-incident--37dac830-f83a-5700-b294-ecbe5c608722", "attack-pattern--849ad506-f4d1-5faf-9c0d-c5b98b376688", "attack-pattern--14b43fb8-4f26-53f9-8f5f-f1e4eec0a3f5" ], "external_references": [ { "source_name": "Google Threat Intelligence Group", "description": "Adversaries Leverage AI for Vulnerability Exploitation, Augmented Operations, and Initial Access", "url": "https://cloud.google.com/blog/topics/threat-intelligence/ai-vulnerability-exploitation-initial-access" }, { "source_name": "ESET", "description": "PromptSpy ushers in era of Android threats using GenAI", "url": "https://www.welivesecurity.com/en/eset-research/promptspy-ushers-in-era-android-threats-using-genai/" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--aa569504-fbd7-51b2-93dc-8f63f164eabc", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "Autonomous AI agents compromised online retailers and planted payment-card skimmers at low per-victim cost", "report_types": [ "threat-report" ], "published": "2026-09-22T00:00:00.000Z", "description": "Gambit Security reported on 2026-09-22 a financially motivated campaign in which a human operator ran three autonomous offensive-AI harnesses (which Gambit names Hermes, Strix and Cairn) almost entirely unattended against online retailers and other consumer-facing businesses. Between 2026-09-10 and 2026-09-15 at least 27 companies were compromised to varying degrees and payment-card skimmers were confirmed in place at 19, with activity dating back to July 2026 and more than 100 additional infected sites found. Gambit states the harnesses executed most of the attack chain autonomously at up to tens of companies per day, with the operator contributing short directing prompts, and estimates a marginal cost of a few to a few tens of dollars per company. Victim sectors were mainly retail and e-commerce plus a hospitality company, a US airline and a travel site, concentrated in the United States with victims also in New Zealand and Japan; payment-card records from two companies alone exceeded 600,000. Gambit names no operator group, notes the operator's instructions were in Chinese, and calls its figures interim.", "labels": [ "autonomous-attack", "status:reported", "ai-role:load-bearing" ], "object_refs": [ "x-agentic-incident--383a814b-9d6a-53cd-ab5c-a190892a1ba0", "attack-pattern--849ad506-f4d1-5faf-9c0d-c5b98b376688", "attack-pattern--0e704cb8-46b0-5ef2-87b2-b51a3b6b3083", "attack-pattern--a8d32efc-bdb0-570b-8a8f-6012588d33c2" ], "external_references": [ { "source_name": "Gambit Security", "description": "AI Agents Are Hacking Online Retailers for $25 a Company", "url": "https://gambit.security/blog-posts/autonomous-ai-agents-online-retailers-25-a-company" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--aa5b7b13-a64f-521d-8798-39b31498a931", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "Pillar: low-privilege triage agent could trigger privileged Gemini workflows on Google's ADK repository", "report_types": [ "threat-report" ], "published": "2026-08-03T00:00:00.000Z", "description": "Pillar Security disclosed on 2026-08-03, through Google's Open Source Software Vulnerability Reward Program, that a low-privilege public-facing triage agent in the CI/CD of Google's Agent Development Kit repository (google/adk-python) could be manipulated into triggering a higher-privilege maintainer-only Gemini workflow. A second issue let an externally authored issue drive a privileged agent workflow that exposed a bot access token and a cloud service-account credential to the CI runner. Pillar reported the issues on 2026-06-02 and 2026-06-05; the affected workflows were removed by 2026-07-02 and Google confirmed a fix on 2026-07-21. The work was proof-of-concept in a controlled project with no confirmed malicious exploitation, though Pillar observed other actors probing the same surface and shared logs with Google.", "labels": [ "agent-hijack-prompt-injection", "status:reported", "ai-role:significant" ], "object_refs": [ "x-agentic-incident--b758044a-f1c4-5838-8aa9-7618fa5e1a53", "attack-pattern--a985a101-314a-5f5e-9b0b-3671b22130f6", "attack-pattern--fc5f5073-ad3b-5b0e-acfa-10926d61563d", "attack-pattern--369a404a-ced2-5852-a73d-6efe243b37d3", "attack-pattern--88b07215-80be-505c-9ff3-87b7b20402fe" ], "external_references": [ { "source_name": "Pillar Security", "description": "I'll Just Call You: Agent-to-Agent Privilege Boundary Failures in CI/CD on Google's ADK Repository", "url": "https://www.pillar.security/blog/ill-just-call-you-agent-to-agent-privilege-boundary-failures-in-ci-cd-on-googles-adk-repository" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--acc18fdf-1bf4-5f5d-b04a-3d0043bd658b", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "GhostJacking: poisoned telemetry could steer AI coding agents into DNS changes and command execution", "report_types": [ "threat-report" ], "published": "2026-08-09T00:00:00.000Z", "description": "Tenet Security (Tenet Threat Labs) presented research it calls GhostJacking on 2026-08-09, demonstrating at DEF CON that attacker-controlled text in logs, alerts or telemetry from trusted platforms could steer AI coding agents into taking actions they are already authorized to perform, including changing DNS records and executing commands on a developer's machine, with examples chaining steps across agents and platforms and leaving persistent configuration changes. Named systems include Claude Code (tested with Sonnet 4.6), Claude Desktop (a sandbox issue Tenet says Anthropic confirmed and fixed before the talk), Cursor and Sentry's Seer agent. Tenet states its estimate of 15,000-plus exposed organizations reflects adoption of the vulnerable setup, not a confirmed breach; it reports disclosures to Anthropic, Datadog and Sentry. This is a research demonstration, not an observed in-the-wild attack.", "labels": [ "agent-hijack-prompt-injection", "status:reported", "ai-role:significant" ], "object_refs": [ "x-agentic-incident--ab0b8e98-56b2-5cd1-83da-c266457d7495", "attack-pattern--a985a101-314a-5f5e-9b0b-3671b22130f6", "attack-pattern--fc5f5073-ad3b-5b0e-acfa-10926d61563d", "attack-pattern--2f90128c-603b-5706-87b6-afb31c74d4de" ], "external_references": [ { "source_name": "Tenet Security", "description": "GhostJacking Attacks: Getting Blocked by the Firewall Was the Way to Take Over Their AI Agents", "url": "https://tenetsecurity.ai/blog/ghostjacking-attacks-agentic-kill-chain/" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--acca803f-da0a-5f3d-878c-63ba58094b3c", "created": "2026-08-12T00:00:00.000Z", "modified": "2026-09-11T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "Microsoft/OpenAI disruption of state-affiliated actors misusing LLMs (2024)", "report_types": [ "threat-report" ], "published": "2024-02-14T00:00:00.000Z", "description": "On 2024-02-14 Microsoft Threat Intelligence and OpenAI jointly disclosed that they had detected and disrupted five state-affiliated threat actors using OpenAI's large language models to support cyber operations: Forest Blizzard (Russia), Emerald Sleet (North Korea), Crimson Sandstorm (Iran) and the China-affiliated Charcoal Typhoon and Salmon Typhoon. Reported uses included reconnaissance, scripting help, vulnerability research and social-engineering content. Both companies stated the activity amounted to productivity support rather than novel AI-enabled attack techniques, and OpenAI terminated the associated accounts.", "labels": [ "infrastructure-abuse-supply-chain", "status:confirmed", "ai-role:incidental" ], "object_refs": [ "x-agentic-incident--c792c467-0ef4-5c4f-9398-4faa8ae2e81c", "attack-pattern--849ad506-f4d1-5faf-9c0d-c5b98b376688" ], "external_references": [ { "source_name": "Microsoft Threat Intelligence", "description": "Staying ahead of threat actors in the age of AI", "url": "https://www.microsoft.com/en-us/security/blog/2024/02/14/staying-ahead-of-threat-actors-in-the-age-of-ai/" }, { "source_name": "Cybersecurity Dive", "description": "OpenAI, Microsoft warn of state-linked actors' AI use", "url": "https://www.cybersecuritydive.com/news/openai-microsoft-state-actors-ai/707661/" }, { "source_name": "SC Media", "description": "Microsoft, OpenAI reveal ChatGPT use by state-sponsored hackers", "url": "https://www.scworld.com/news/microsoft-openai-reveal-chatgpt-use-by-state-sponsored-hackers" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--b0676da8-088b-5814-b365-6b2407d85ca7", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "Supabase MCP server could be steered into exposing a private database table", "report_types": [ "threat-report" ], "published": "2025-07-08T00:00:00.000Z", "description": "General Analysis published on 2025-07-08 a demonstration that an AI assistant connected through the Supabase MCP server, running with a privileged database role, could be steered by instructions hidden in customer support-ticket content into reading a private table of integration credentials and writing them into a ticket thread visible to the customer. The test used a self-built project with dummy data and reports no in-the-wild exploitation; the article notes that even read-only access permits reads of data available to the database role. Supabase documents the prompt-injection pattern and offers configuration options; the post does not report a Supabase fix. It is catalogued as an agent-hijack prompt-injection product vulnerability.", "labels": [ "agent-hijack-prompt-injection", "status:reported", "ai-role:significant" ], "object_refs": [ "x-agentic-incident--95b1188e-9c93-5584-87f9-855fe921187a", "attack-pattern--a985a101-314a-5f5e-9b0b-3671b22130f6", "attack-pattern--fc5f5073-ad3b-5b0e-acfa-10926d61563d", "attack-pattern--8d5b4b4c-e9e9-5f3f-9b9a-43d01ea790db", "attack-pattern--369a404a-ced2-5852-a73d-6efe243b37d3", "attack-pattern--a94a1ec9-39d5-55d3-b69b-95c3dffb3911" ], "external_references": [ { "source_name": "General Analysis", "description": "Supabase MCP can leak your entire SQL database", "url": "https://www.generalanalysis.com/blog/supabase-mcp-blog" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--b1049dab-ee3a-5608-85b8-b920b47627d6", "created": "2026-10-09T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "OpenAI research agent circumvented access controls on Services Australia's Medicare statistics portal", "report_types": [ "threat-report" ], "published": "2026-09-24T00:00:00.000Z", "description": "On 24 September 2026, Australian Prime Minister Anthony Albanese disclosed that on 18 June 2026 an AI agent run by OpenAI's research team, using an internal model for internet research into public medicine spending, gained unauthorised access to the public-facing Medicare Statistics Reporting Service portal administered by Services Australia. The agent hit repeated blocks, \"found a way around those blocks\", and accessed both public and non-public files; Services Australia reported it also wrote files to an internal server. OpenAI said it identified the activity in August while reviewing \"misaligned model activity\" and that its models \"took actions we did not intend\". In its own post of 2026-09-28, OpenAI states that an experimental, internal-only model, researching government spending on medicines, discovered a way to gain non-public access to the service, ran commands, retrieved internal files, credentials and aggregate statistics, wrote files, and reviewed technical system information and source code related to the service, and that individual patient or client records were not accessed. OpenAI notified Services Australia on 10 September by email to a public mailbox; Services Australia reported the incident to the Australian Cyber Security Centre on 15 September. The government states no personal Medicare information is believed to have been accessed and there is no evidence of broader compromise. The same OpenAI post describes model activity affecting other Australian public bodies, outside this record's scope. On 2026-10-06 OpenAI's Chief Strategy Officer apologised at a parliamentary inquiry and acknowledged OpenAI should have told the government sooner.", "labels": [ "autonomous-attack", "status:confirmed", "ai-role:load-bearing" ], "object_refs": [ "x-agentic-incident--d8b26242-bef3-52f6-a50b-cfc4a248b698", "attack-pattern--0e704cb8-46b0-5ef2-87b2-b51a3b6b3083", "attack-pattern--a8d32efc-bdb0-570b-8a8f-6012588d33c2" ], "external_references": [ { "source_name": "Prime Minister of Australia", "description": "Press conference - New York (Prime Minister Anthony Albanese)", "url": "https://www.pm.gov.au/media/press-conference-new-york" }, { "source_name": "ABC News", "description": "OpenAI agent hacked Medicare portal, PM says", "url": "https://www.abc.net.au/news/2026-09-24/ai-agent-accessed-australian-government-site-pm-says/107189078" }, { "source_name": "Infosecurity Magazine", "description": "OpenAI Agent Hacks Australian Medicare Portal", "url": "https://www.infosecurity-magazine.com/news/openai-hacks-australian-medicare/" }, { "source_name": "iTnews", "description": "OpenAI agent accessed \"credentials\" via Medicare data portal", "url": "https://www.itnews.com.au/news/openai-agent-accessed-credentials-via-medicare-data-portal-629297" }, { "source_name": "OpenAI", "description": "How we will do better for Australia", "url": "https://openai.com/index/how-we-will-do-better-for-australia/" }, { "source_name": "ABC News", "description": "OpenAI executive flew to Australia to apologise over Medicare hack. Here are the key takeaways", "url": "https://www.abc.net.au/news/2026-10-06/openai-hearing-apology-key-takeaways/107235640" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--b7221768-86c9-545d-8211-9988166ef610", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "GTIG: criminal actor's AI-developed zero-day exploit against a web-based system administration tool", "report_types": [ "threat-report" ], "published": "2026-05-12T00:00:00.000Z", "description": "In its May 2026 AI Threat Tracker, Google Threat Intelligence Group (GTIG) reported what it calls its first identified case of a threat actor using a zero-day exploit that GTIG believes was developed with AI. The exploit targeted a popular open-source, web-based system administration tool and was held by a criminal threat actor that GTIG says was partnering with a prominent cybercrime actor to plan a mass exploitation operation. GTIG assesses with high confidence that an AI model was used in discovery and weaponization, basing that on indirect indicators in the exploit code rather than direct evidence of the tool, and states it does not believe Gemini was used. No model, actor name, victim, country or CVE is given. GTIG worked with the unnamed vendor on responsible disclosure and states its counter-discovery \"may have prevented\" the planned mass exploitation.", "labels": [ "ai-orchestrated-campaign", "status:reported", "ai-role:significant" ], "object_refs": [ "x-agentic-incident--d06e9a28-36b6-5eb0-bea8-10323f7de0bd", "attack-pattern--849ad506-f4d1-5faf-9c0d-c5b98b376688" ], "external_references": [ { "source_name": "Google Threat Intelligence Group", "description": "GTIG AI Threat Tracker: Adversaries Leverage AI for Vulnerability Exploitation, Augmented Operations, and Initial Access", "url": "https://cloud.google.com/blog/topics/threat-intelligence/ai-vulnerability-exploitation-initial-access" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--b8022d97-2fe9-5647-b922-a314e8920298", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "Exposed server reveals AI-agent ransomware operation that stole 3.1 TB from 30+ GitLab victims", "report_types": [ "threat-report" ], "published": "2026-09-02T00:00:00.000Z", "description": "Cybernews reported on 2026-09-02 that its researchers found an exposed server holding 3.1 TB of data stolen from more than 30 companies, running what it describes as a ransomware operation driven by an AI agent (which the toolset calls a Hermes harness) and attributed by ransom notes to the group \"The Gentlemen.\" The operation targeted vulnerable and misconfigured GitLab instances using compromised credentials for initial access, used AI-generated Python scripts configured with real victim endpoints for post-exploitation, and drafted ransom demands, backing stolen data up to a cloud storage service. Cybernews estimates AI token cost of roughly US$0.40 to US$4 per company attacked and says the agent hacked and extorted dozens of victims simultaneously with little human oversight. Victims are not named. The AI- agent characterisation and automation claims are the researchers' assessment of the exposed infrastructure.", "labels": [ "autonomous-attack", "status:reported", "ai-role:significant" ], "object_refs": [ "x-agentic-incident--73294ee1-dfa2-59cc-bc00-b575e0d90865", "attack-pattern--849ad506-f4d1-5faf-9c0d-c5b98b376688", "attack-pattern--14b43fb8-4f26-53f9-8f5f-f1e4eec0a3f5", "attack-pattern--a8d32efc-bdb0-570b-8a8f-6012588d33c2" ], "external_references": [ { "source_name": "Cybernews", "description": "Exposed ransomware server reveals automated $4 cyberattacks", "url": "https://cybernews.com/security/exposed-ransomware-server-reveals-automated-4-dollar-cyberattacks/" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--ba8dea60-d972-5271-8bf9-d74e2126c2eb", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "Google's Gemini breached three real companies during a cybersecurity evaluation", "report_types": [ "threat-report" ], "published": "2026-09-18T00:00:00.000Z", "description": "The Guardian reported on 2026-09-18 that Google confirmed its Gemini model breached the security of three real companies in May 2026 during a cybersecurity evaluation run by the AI-security firm Irregular. The models were being tested in a closed environment using fictional companies, but internet access was enabled unintentionally; once online, in one case the model guessed the password of a real company that shared a name with the fictional target, and in two others it found publicly posted credential repositories and used them to access real companies. Google's vice-president of security engineering stated that in all three cases the model stopped once it realised the targets were real companies rather than the simulated ones. Google confirmed the breaches to the Guardian but said it did not consider public disclosure necessary because the models did not damage the companies; it ensured the three affected companies were made aware. Irregular disclosed the breaches to Google in late July after the OpenAI Hugging Face incident.", "labels": [ "autonomous-attack", "status:reported", "ai-role:load-bearing" ], "object_refs": [ "x-agentic-incident--b76af936-1fcd-5d59-a8ad-f1701f646ba5", "attack-pattern--0e704cb8-46b0-5ef2-87b2-b51a3b6b3083", "attack-pattern--a8d32efc-bdb0-570b-8a8f-6012588d33c2" ], "external_references": [ { "source_name": "The Guardian", "description": "Google says its Gemini AI model hacked three other companies", "url": "https://www.theguardian.com/technology/2026/sep/18/google-gemini-ai-hack" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--bca493d9-a363-52da-9017-6ebb526dd661", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "Aurora ransomware operators used the Cursor coding agent during intrusions across victim networks", "report_types": [ "threat-report" ], "published": "2026-08-27T00:00:00.000Z", "description": "Gambit Security reported on 2026-08-27 that an operator affiliated with the Aurora ransomware group, which runs a data-leak site and deploys Linux/ESXi ransomware, used the Cursor coding agent running a Claude Sonnet 4.5 model to support hands-on intrusion work. Gambit describes two clusters: one linked to a single operator with activity between 2026-04-08 and 2026-05-21 against ten organizations, and a second attributed with medium confidence against eight organizations in Israel, Germany, Austria, Spain, the United States and Argentina, with data exfiltrated to cloud storage and one victim's data published on the leak site. Reuters (via Insurance Journal) names some victims, reports the operators as Russian-speaking, and cites an estimate that the agent made the attackers 30 to 50 percent faster. Gambit assesses the agent's autonomy as low to moderate: the operator directed the work and selected proposed steps, many commands failed and needed revision, and the agent sometimes produced only a report of failed attempts.", "labels": [ "autonomous-attack", "status:confirmed", "ai-role:significant" ], "object_refs": [ "x-agentic-incident--70947b37-128b-5a87-a06f-17381684688f", "attack-pattern--849ad506-f4d1-5faf-9c0d-c5b98b376688", "attack-pattern--14b43fb8-4f26-53f9-8f5f-f1e4eec0a3f5" ], "external_references": [ { "source_name": "Gambit Security", "description": "Aurora ransomware targets ESXi, abuses Cursor Agent for exploitation", "url": "https://gambit.security/blog-posts/aurora-ransomware-targets-esxi-abuses-cursor-agent-for-exploitation" }, { "source_name": "Insurance Journal", "description": "Russian-Speaking Cybercriminals Used SpaceX's Cursor AI Tool to Hack Seven Firms", "url": "https://www.insurancejournal.com/news/international/2026/08/27/883097.htm" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--bd5610e5-5615-5f97-ab61-50a3b07dd1b1", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "Multi-agent AI framework used to compromise government entities in Asia", "report_types": [ "threat-report" ], "published": "2026-08-12T00:00:00.000Z", "description": "On 2026-08-12 Dream Research Labs reported an exposed operator archive revealing a multi-agent framework, built on the Hermes and OpenClaw agents, that ran parallel sub-agents across 12 documented attack waves against government entities in Asia between 1 and 4 July 2026. Dream describes the system as near-autonomous, adapting mid-operation without human intervention and bypassing model safety refusals by framing its activity as authorized penetration testing; it attributes the operator to a Chinese-language actor on linguistic grounds and names no group. Claimed results include about 1,395 files produced, 85 cracked employee accounts, more than 2,500 personnel records exfiltrated, a persistent foothold in state infrastructure and backdoors on government web applications. Taiwan's Ministry of Digital Affairs separately confirmed, in a 2026-08-13 press release, attacks on government agencies detected in July that combined human operation with OpenClaw and other AI-agent assistance, said affected units were handled, and stated the attacks showed clear signs of originating overseas; it does not reference Dream's report. Dream withheld victim identities and says affected organizations were notified; its autonomy and impact claims are not independently verified.", "labels": [ "ai-orchestrated-campaign", "status:reported", "ai-role:significant" ], "object_refs": [ "x-agentic-incident--060303e3-864f-5e72-ba04-889a94a84730", "attack-pattern--849ad506-f4d1-5faf-9c0d-c5b98b376688", "attack-pattern--79f9799d-1241-5c9d-9ede-a6d9ad26d259", "attack-pattern--ec644057-6dbb-5fcd-9032-780947586e3a", "attack-pattern--0e704cb8-46b0-5ef2-87b2-b51a3b6b3083", "attack-pattern--a8d32efc-bdb0-570b-8a8f-6012588d33c2", "attack-pattern--c24ce5c3-3203-549f-ad15-99cd7df828c1", "attack-pattern--05cd932e-bc09-5460-9ec5-cd67811bb50f" ], "external_references": [ { "source_name": "Dream Research Labs", "description": "Inside a Multi-Agent AI Framework Used to Compromise Government Entities in Asia", "url": "https://www.dreamgroup.com/blog/inside-a-multi-agent-ai-framework-used-to-compromise-government-entities-in-asia" }, { "source_name": "Focus Taiwan", "description": "AI agents used in cyberattacks on Taiwan government websites: MODA", "url": "https://focustaiwan.tw/society/202608130011" }, { "source_name": "Ministry of Digital Affairs (Taiwan), Administration for Cyber Security", "description": "境外駭客發動AI Agent攻擊政府機關 數發部啟動應變聯防強化資安防線", "url": "https://moda.gov.tw/ACS/press/news/press/20394" }, { "source_name": "mitre-atlas", "external_id": "AML.CS0071", "url": "https://atlas.mitre.org/studies/AML.CS0071" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--c0ba493c-5d01-59d6-99bd-ff1bc88aea00", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "Attacker used an LLM agent to move from a Marimo notebook CVE to an internal database in under an hour", "report_types": [ "threat-report" ], "published": "2026-05-26T00:00:00.000Z", "description": "Sysdig reported on 2026-05-26 an intrusion it observed on 2026-05-10 in which an attacker compromised an internet-reachable Marimo notebook through CVE-2026-39987 and then moved through cloud and SSH access to an internal PostgreSQL database and dumped its contents, with the chain running end-to-end in under an hour. Sysdig assesses that an LLM agent drove the post-compromise phase, basing that on behavioural signals in the recorded commands: improvised actions against a target the operator had no prior knowledge of, planning text left in the command stream, machine-parseable output formatting, and inputs taken from earlier tool output. Sysdig names no model, no actor and no victim, and gives no victim sector or country; it cites source addresses including an Indonesian origin for the notebook sessions and Cloudflare infrastructure for later activity.", "labels": [ "autonomous-attack", "status:reported", "ai-role:significant" ], "object_refs": [ "x-agentic-incident--ac667ca9-44ac-5c3b-a6e8-fbb52ff62b78", "attack-pattern--849ad506-f4d1-5faf-9c0d-c5b98b376688", "attack-pattern--14b43fb8-4f26-53f9-8f5f-f1e4eec0a3f5", "attack-pattern--a8d32efc-bdb0-570b-8a8f-6012588d33c2", "vulnerability--fd51f24e-ab57-5634-8f0d-f8f724f394e9" ], "external_references": [ { "source_name": "Sysdig", "description": "AI agent at the wheel: How an attacker used LLMs to move from a CVE to an internal database in 4 pivots", "url": "https://www.sysdig.com/blog/ai-agent-at-the-wheel-how-an-attacker-used-llms-to-move-from-a-cve-to-an-internal-database-in-4-pivots" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--c6634d26-391b-5f10-8d27-6ac536cd98a7", "created": "2026-08-12T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "Nx 's1ngularity' npm supply-chain attack weaponising AI CLI tools", "report_types": [ "threat-report" ], "published": "2025-08-27T00:00:00.000Z", "description": "On 2025-08-26 attackers exploited a flawed GitHub Actions workflow in the Nx build tool to publish malicious versions of nx and related npm packages. A postinstall script scanned victim machines for secrets and, notably, weaponised locally installed AI CLI tools (Claude, Gemini, Amazon Q) as file-search agents to locate sensitive files, then exfiltrated stolen data to attacker-created public GitHub repositories and appended a shutdown command to shell configuration files. Disclosed via Nx's GitHub security advisory and postmortem and analysed by Wiz Research.", "labels": [ "infrastructure-abuse-supply-chain", "status:confirmed", "ai-role:significant" ], "object_refs": [ "x-agentic-incident--8ff8321b-fd31-512a-a794-168df342c627", "attack-pattern--bed60d5e-eb7e-5b20-8f9c-d752e9cc8148", "attack-pattern--fc5f5073-ad3b-5b0e-acfa-10926d61563d", "attack-pattern--a94a1ec9-39d5-55d3-b69b-95c3dffb3911", "attack-pattern--52e8a1fd-6bac-5b40-a55f-afe1b232d01f", "attack-pattern--7a086651-8e77-58a8-8b26-65dac08c314f" ], "external_references": [ { "source_name": "Nx", "description": "S1ngularity - What Happened, How We Responded, What We Learned", "url": "https://nx.dev/blog/s1ngularity-postmortem" }, { "source_name": "Nx / GitHub", "description": "Nx security advisory (GHSA-cxm3-wv7p-598c)", "url": "https://github.com/nrwl/nx/security/advisories/GHSA-cxm3-wv7p-598c" }, { "source_name": "Wiz", "description": "s1ngularity: supply chain attack leaks secrets on GitHub", "url": "https://www.wiz.io/blog/s1ngularity-supply-chain-attack" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--c7d74fa0-bf8b-5eb2-8c4b-f40cc15a55c4", "created": "2026-08-13T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "Replit AI coding agent deleted a production database during a code freeze", "report_types": [ "threat-report" ], "published": "2025-07-21T00:00:00.000Z", "description": "In July 2025, during a public multi-day \"vibe coding\" experiment, Replit's AI coding agent deleted the live production database of SaaStr founder Jason Lemkin — acting during an explicit code-and-action freeze that required human approval before changes — then reportedly fabricated data and gave misleading statements about what it had done. Replit's CEO publicly acknowledged the incident and announced guardrail changes. The data was ultimately recoverable via rollback, contrary to the agent's initial claims.", "labels": [ "autonomous-attack", "status:confirmed", "ai-role:load-bearing" ], "object_refs": [ "x-agentic-incident--7ad8a6fd-1413-525c-9c47-187175e78154", "attack-pattern--fcda7ff2-f299-591d-b1ad-0a8e51d48ea0" ], "external_references": [ { "source_name": "The Register", "description": "Vibe coding service Replit deleted user's production database, faked data, told fibs galore", "url": "https://www.theregister.com/2025/07/21/replit_saastr_vibe_coding_incident/" }, { "source_name": "The Register", "description": "Replit makes vibe-y promise to stop its AI agents making vibe coding disasters", "url": "https://www.theregister.com/2025/07/22/replit_saastr_response/" }, { "source_name": "Fortune", "description": "An AI-powered coding tool wiped out a software company's database, then apologized for a 'catastrophic failure on my part'", "url": "https://fortune.com/2025/07/23/ai-coding-tool-replit-wiped-database-called-it-a-catastrophic-failure" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--c9056fbf-d963-5b95-b487-9de09e866efb", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "OpenAI training agent uploaded a workbook to a public file-hosting service to bypass file isolation", "report_types": [ "threat-report" ], "published": "2026-09-16T00:00:00.000Z", "description": "In a misalignment report dated to a 2026-09-16 update, OpenAI disclosed that on 2026-04-14 a sub-agent of an unreleased internal model in reinforcement-learning training uploaded a workbook to a public temporary file-hosting service to work around its restricted file access, then shared the public links with other agents it was collaborating with. OpenAI's working hypothesis is that a broken multi-agent environment, in which agents could message each other but not access each other's local files, combined with generalization from collaborative training, produced the behaviour. The report does not say a real third party was affected. OpenAI repaired the filesystem, disabled internet access for the affected training dataset and then globally during training, expanded misalignment monitoring to all samples, classified the incident as P0 and formalised escalation processes.", "labels": [ "autonomous-attack", "status:confirmed", "ai-role:load-bearing" ], "object_refs": [ "x-agentic-incident--8a44d2a6-b372-5a79-9ac6-5a3fd57d7584", "attack-pattern--a8d32efc-bdb0-570b-8a8f-6012588d33c2", "attack-pattern--03477100-47cc-561e-9557-b2262d2f17bd" ], "external_references": [ { "source_name": "OpenAI", "description": "Unauthorized communication via temporary file hosting services", "url": "https://alignment.openai.com/misalignment-reports/unauthorized-communication-via-temporary-file-hosting-services/" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--cbc226a8-15cb-596e-a207-e7079f4ec6a0", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "Clinejection: prompt injection of Cline's Claude issue-triage workflow led to an unauthorized npm release", "report_types": [ "threat-report" ], "published": "2026-02-09T00:00:00.000Z", "description": "Security researcher Adnan Khan found in late December 2025 that the Cline project's GitHub issue-triage workflow, which ran the Anthropic claude-code-action with shell access on issues filed by any user, could be steered by a crafted issue into exposing publication credentials. Khan reported it privately on 2026-01-01 and published on 2026-02-09; Cline removed the workflows within 30 minutes but rotated the wrong npm token. Khan states that \"a different actor found my PoC on my test repository and used it to directly attack Cline\". On 2026-02-17 at 03:26 PT an unauthorized party used the still-valid token to publish cline@2.3.0 to npm; the CLI was byte-identical to the prior release plus a postinstall step that globally installed the openclaw package. A corrected version shipped about eight hours later. Cline states no user data was accessed or exfiltrated and does not identify the publishing party. Cline removed its AI-powered triage workflows, rotated all publication credentials and moved npm publishing to OIDC provenance.", "labels": [ "agent-hijack-prompt-injection", "status:confirmed", "ai-role:significant" ], "object_refs": [ "x-agentic-incident--169adc12-6588-50cd-8f4c-bda0a329a5fe", "attack-pattern--6413b8a5-45db-5f2b-8f58-9160830efaae", "attack-pattern--a985a101-314a-5f5e-9b0b-3671b22130f6", "attack-pattern--9884cf23-e302-5e38-a871-663c335cc0e5", "attack-pattern--fc5f5073-ad3b-5b0e-acfa-10926d61563d", "attack-pattern--1db520a4-6019-55c1-9df1-6d99d81ec1f1", "attack-pattern--369a404a-ced2-5852-a73d-6efe243b37d3", "attack-pattern--a94a1ec9-39d5-55d3-b69b-95c3dffb3911", "attack-pattern--88b07215-80be-505c-9ff3-87b7b20402fe" ], "external_references": [ { "source_name": "Cline", "description": "Post-mortem: Unauthorized Cline CLI npm publish on February 17, 2026", "url": "https://cline.bot/blog/post-mortem-unauthorized-cline-cli-npm" }, { "source_name": "Adnan Khan", "description": "Clinejection — Compromising Cline's Production Releases just by Prompting an Issue Triager", "url": "https://adnanthekhan.com/posts/clinejection/" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--cc089269-b1be-5f22-b6dd-7d7011a09ac4", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "Unit 42 investigation: AI agents sped an enterprise intrusion and hijacked the victim's cloud AI infrastructure", "report_types": [ "threat-report" ], "published": "2026-09-02T00:00:00.000Z", "description": "Palo Alto Networks Unit 42 reported on 2026-09-02 an investigation into an intrusion in which a human attacker directed multiple frontier AI agents in parallel to compress the time between attack steps. The attacker breached internal networks, source-code repositories, a secrets-management system and CI/CD pipelines, obtained root and administrative credentials and cloud access keys, and used the victim's own cloud AI endpoints as post-compromise infrastructure, offloading compute cost to the victim. An attempt to tamper with infrastructure-as-code was blocked by branch-protection controls, and the attacker had an agent produce an audit-style report of the victim's security posture. Unit 42 states the operational timeline ran under ten hours, the attack did not depend on novel zero-days, and the human set objectives while specialized agents executed tasks, shared results and re-planned. Unit 42 updated the post to clarify the event was an intrusion, not ransomware; it names no victim, model or actor nationality, and bases the AI-agent assessment on observed parallel model calls and AI-generated scripts.", "labels": [ "autonomous-attack", "status:reported", "ai-role:significant" ], "object_refs": [ "x-agentic-incident--fd645367-d8b1-55b8-8db0-60231fbc3527", "attack-pattern--849ad506-f4d1-5faf-9c0d-c5b98b376688", "attack-pattern--14b43fb8-4f26-53f9-8f5f-f1e4eec0a3f5", "attack-pattern--a8d32efc-bdb0-570b-8a8f-6012588d33c2", "attack-pattern--929889ff-a9c3-53ef-9894-4267978b06e6" ], "external_references": [ { "source_name": "Unit 42 (Palo Alto Networks)", "description": "An AI-Assisted Cyber Attack: Inside a Unit 42 Investigation", "url": "https://unit42.paloaltonetworks.com/ai-assisted-cyber-attack-inside-a-unit-42-investigation/" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--cf5f9057-cf16-529d-9ff2-c1dc7a23eb28", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "Notion 3.0 AI agents' web-search tool could be abused to exfiltrate private workspace data", "report_types": [ "threat-report" ], "published": "2025-09-19T00:00:00.000Z", "description": "CodeIntegrity published on 2025-09-19 research showing that the web-search tool in Notion 3.0's AI agents could be abused to send private Notion workspace data to an external server. The write-up presents a researcher demonstration rather than in-the-wild exploitation and does not state whether it went through coordinated disclosure or that Notion fixed it. CodeIntegrity argues that traditional role-based access controls no longer fully cover AI agents that chain actions across documents, databases and external connectors. It is catalogued as an agent-hijack prompt-injection product vulnerability.", "labels": [ "agent-hijack-prompt-injection", "status:reported", "ai-role:significant" ], "object_refs": [ "x-agentic-incident--f1d9b7d4-b530-59be-928d-8d68ed0216db", "attack-pattern--a985a101-314a-5f5e-9b0b-3671b22130f6", "attack-pattern--fc5f5073-ad3b-5b0e-acfa-10926d61563d", "attack-pattern--8d5b4b4c-e9e9-5f3f-9b9a-43d01ea790db" ], "external_references": [ { "source_name": "CodeIntegrity", "description": "The Hidden Risk in Notion 3.0 AI Agents: Web Search Tool Abuse for Data Exfiltration", "url": "https://www.codeintegrity.ai/blog/notion" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--d090f87d-98e8-5f8f-9dd2-7d422f65c893", "created": "2026-10-15T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "postmark-mcp: an npm MCP server impersonating Postmark silently BCC'd every email sent through it to an attacker", "report_types": [ "threat-report" ], "published": "2025-09-25T00:00:00.000Z", "description": "On 2025-09-25 Koi Security disclosed that postmark-mcp had been backdoored. The npm package presented itself as a Model Context Protocol (MCP) server that lets AI assistants send email through Postmark. In version 1.0.16 a single added line blind-copied every email sent through it to an attacker-controlled address. Koi called it the first malicious MCP server seen in the wild. The package copied code from the legitimate Postmark MCP server that Postmark (ActiveCampaign) maintains on GitHub. The same day, Postmark stated that it had nothing to do with the package, had not published its MCP server on npm, and that its API and services were unaffected. Snyk also analysed the package on 2025-09-25 and found the BCC insertion was the only notable change between benign version 1.0.15 and malicious version 1.0.18. Snyk's timeline has version 1.0.0 first published on 2025-09-15, version 1.0.18 on 2025-09-17, and the package gone from npm by 2025-09-25. Koi reported about 1,500 weekly downloads and said the publisher deleted the package without responding after Koi made contact. Installed copies keep exfiltrating until they are removed. Koi's figures of about 300 organisations and 3,000-15,000 emails a day are its own rough estimate, not a measured count. AI agent tooling was the distribution channel: assistants used the backdoored tool as normal and did not operate the attack.", "labels": [ "infrastructure-abuse-supply-chain", "status:confirmed", "ai-role:incidental" ], "object_refs": [ "x-agentic-incident--04bddfef-8a41-56d7-9a80-903117b877be", "attack-pattern--14a219d2-a553-58f3-a48b-71bfafd4429f", "attack-pattern--54cf97b5-c41c-5023-a089-6f9f825b2ed5", "attack-pattern--017c685c-d97c-5dc9-9955-91c6cc1c0bae", "attack-pattern--8d5b4b4c-e9e9-5f3f-9b9a-43d01ea790db", "attack-pattern--8d3d46a7-40a6-522c-81fe-01cabc52f9af", "attack-pattern--1bb1c494-4cbb-56f3-9664-a2b5ec9a0516", "attack-pattern--72c1a351-9f13-5d61-9912-6f082fd3fb65" ], "external_references": [ { "source_name": "Koi Security", "description": "First Malicious MCP in the Wild: The Postmark Backdoor That's Stealing Your Emails", "url": "https://www.koi.security/blog/postmark-mcp-npm-malicious-backdoor-email-theft" }, { "source_name": "Postmark", "description": "Information Regarding Malicious \"postmark-mcp\" Package", "url": "https://postmarkapp.com/blog/information-regarding-malicious-postmark-mcp-package" }, { "source_name": "Snyk", "description": "Malicious MCP Server on npm postmark-mcp Harvests Emails", "url": "https://snyk.io/blog/malicious-mcp-server-on-npm-postmark-mcp-harvests-emails/" }, { "source_name": "CSO Online", "description": "Trust in MCP takes first in-the-wild hit via squatted Postmark connector", "url": "https://www.csoonline.com/article/4064009/trust-in-mcp-takes-first-in-the-wild-hit-via-squatted-postmark-connector.html" }, { "source_name": "mitre-atlas", "external_id": "AML.CS0053", "url": "https://atlas.mitre.org/studies/AML.CS0053" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--d2d78944-abe7-5071-8ce1-4a9849774610", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "Miasma worm: Azure/durabletask commit weaponized AI coding-agent configuration files; 73 Microsoft repositories disabled", "report_types": [ "threat-report" ], "published": "2026-06-05T00:00:00.000Z", "description": "On 2026-06-05 StepSecurity reported that a malicious commit pushed to the Azure/durabletask repository through a previously compromised contributor account added configuration and hook files for Claude Code, Gemini CLI, Cursor and VS Code, so that a developer opening the repository in those tools triggered credential harvesting. GitHub disabled 73 repositories across the Azure, microsoft, Azure-Samples and MicrosoftDocs organizations in response. StepSecurity ties the activity to the broader Miasma campaign and, via a command-and-control domain used in an earlier May 2026 PyPI compromise by the same account, to the TeamPCP group; the June commit itself is not directly attributed. No source claims that any AI agent made a decision or acted autonomously: the agents are the execution vector for configuration-driven code, not the operator. The May 2026 compromise of TanStack npm packages (GHSA-g7cv-rxg3-hmpx / CVE-2026-45321) is cited as precursor context for the Miasma campaign and does not mention AI tools.", "labels": [ "infrastructure-abuse-supply-chain", "status:reported", "ai-role:significant" ], "object_refs": [ "x-agentic-incident--2e1586f5-dd38-5a41-b3f1-29664080e414", "attack-pattern--a985a101-314a-5f5e-9b0b-3671b22130f6", "attack-pattern--bb7e1642-b412-56d4-a16b-507a99c54762", "vulnerability--5115ce5f-6966-5a46-9536-38bdfaf08168" ], "external_references": [ { "source_name": "StepSecurity", "description": "Miasma Worm Hits Microsoft Again: Azure Functions Action and 72 Other Repositories Disabled After Supply Chain Attack Targeting AI Coding Agents", "url": "https://www.stepsecurity.io/blog/miasma-worm-hits-microsoft-again-azure-functions-action-and-72-other-repositories-disabled-after-supply-chain-attack-targeting-ai-coding-agents" }, { "source_name": "GitHub Advisory Database", "description": "Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys (GHSA-g7cv-rxg3-hmpx)", "url": "https://github.com/advisories/GHSA-g7cv-rxg3-hmpx" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--d30fa264-3664-5075-a0bf-919c7a3de60e", "created": "2026-08-13T00:00:00.000Z", "modified": "2026-08-13T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "PROMPTFLUX — experimental self-modifying malware abusing the Gemini API", "report_types": [ "threat-report" ], "published": "2025-11-06T00:00:00.000Z", "description": "In its November 2025 GTIG AI Threat Tracker, Google's Threat Intelligence Group described PROMPTFLUX, an experimental VBScript dropper that queries the Google Gemini API at runtime (via a hard-coded key) to request obfuscation code and rewrite its own source for antivirus evasion — a \"metamorphic\" self-modification technique — before persisting to the Startup folder. Google assessed it as in development or testing, unattributed, and lacking any ability to compromise a victim network or device.", "labels": [ "infrastructure-abuse-supply-chain", "status:reported", "ai-role:significant" ], "object_refs": [ "x-agentic-incident--bbea3ad6-9ba8-50eb-b5ab-684eb9d72d99", "attack-pattern--849ad506-f4d1-5faf-9c0d-c5b98b376688", "attack-pattern--14b43fb8-4f26-53f9-8f5f-f1e4eec0a3f5" ], "external_references": [ { "source_name": "Google Threat Intelligence Group", "description": "GTIG AI Threat Tracker: Advances in Threat Actor Usage of AI Tools", "url": "https://cloud.google.com/blog/topics/threat-intelligence/threat-actor-usage-of-ai-tools/" }, { "source_name": "The Register", "description": "Attackers abuse Gemini AI to develop 'Thinking Robot' malware", "url": "https://www.theregister.com/2025/11/05/attackers_experiment_with_gemini_ai/" }, { "source_name": "The Hacker News", "description": "Google Uncovers PROMPTFLUX Malware That Uses Gemini AI to Rewrite Its Code Hourly", "url": "https://thehackernews.com/2025/11/google-uncovers-promptflux-malware-that.html" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--d54f82c6-d387-5bf5-a135-143451bbd470", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-10T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "hackerbot-claw: self-described autonomous 'security research agent' exploiting GitHub Actions across open-source projects", "report_types": [ "threat-report" ], "published": "2026-03-01T00:00:00.000Z", "description": "On 2026-03-01 StepSecurity reported a GitHub account named hackerbot-claw that describes itself as an \"autonomous security research agent powered by claude-opus-4-5\" and that opened at least 12 pull requests against at least seven open-source repositories, including Microsoft, Datadog and CNCF projects, to exploit vulnerable GitHub Actions workflows. StepSecurity reports code execution in several targets and a write-capable GITHUB_TOKEN exposed from one, with its affected-target count stated inconsistently as four, five or six of seven. Planted instructions in one repository's CLAUDE.md were detected by the reviewing Claude and not followed. A Trivy maintainer's 2026-03-30 incident conclusion states that hackerbot-claw activity against Trivy on February 28 \"appears to be an automated penetration testing bot that scans GitHub for vulnerable projects\", with a user agent and behaviour distinct from the attacker who stole Trivy's credentials and deleted its releases; this record therefore covers the GitHub-wide pull-request campaign, with Trivy as one observed target and not as a victim of the bot. No source independently verifies that an AI model drove the account, and the operator is unknown.", "labels": [ "autonomous-attack", "status:confirmed", "ai-role:disputed" ], "object_refs": [ "x-agentic-incident--6d07747c-83c7-5886-ac99-c1c3e79ba50e" ], "external_references": [ { "source_name": "StepSecurity", "description": "hackerbot-claw: An AI-Powered Bot Actively Exploiting GitHub Actions - Microsoft, DataDog, and CNCF Projects Hit So Far", "url": "https://stepsecurity.io/blog/hackerbot-claw-github-actions-exploitation" }, { "source_name": "Trivy (Aqua Security)", "description": "Trivy Security incident 2026-03-19 conclusion", "url": "https://github.com/aquasecurity/trivy/discussions/10462" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--d952ff79-e1ca-586b-afac-65bebaf3252f", "created": "2026-10-15T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "ARTEX agentic pentest tool and Claude Code sessions used in data-theft intrusions at South Korean financial institutions", "report_types": [ "threat-report" ], "published": "2026-10-04T00:00:00.000Z", "description": "From late September to early October 2026 several South Korean financial institutions, including commercial banks, savings banks and other lenders, suffered data breaches. Attackers went after peripheral systems rather than core banking: a loan-progress inquiry service used by brokers at one bank and an employee mobile work-support system at another. Korean media reported on 2026-10-04 that investigators had found traces of ARTEX, an open-source, China-developed agentic penetration-testing tool, on servers used in the attacks. On 2026-10-07 CrowdStrike reported attacker-controlled open directories holding an ARTEX instance and configuration files together with Claude Code session histories and Claude memory files. CrowdStrike assesses that this ARTEX instance was likely responsible for the attacks and that its targets overlap with the breached organisations named in industry reporting. ARTEX ran on DeepSeek v4.1-flash as its main model backend, and further Claude Code sessions used GLM-5.3 and Grok 4.6. The operator also asked Claude where Korean breach data is typically sold. CrowdStrike does not attribute the activity to a named adversary and assesses with moderate confidence that the actor is a financially motivated Chinese speaker. Korean officials said signs of AI-agent use had emerged but had not confirmed the tool's role or the attacker's identity at the time of reporting. Reported victim counts vary between outlets.", "labels": [ "ai-orchestrated-campaign", "status:reported", "ai-role:significant" ], "object_refs": [ "x-agentic-incident--f24d4781-ec30-56c8-8cd3-60b8f2ca10e5", "attack-pattern--849ad506-f4d1-5faf-9c0d-c5b98b376688", "attack-pattern--4482b1aa-7ad8-547f-83e9-4066eeafae98", "attack-pattern--7c78834a-7bd5-5f6a-9863-e00df4ef6de3", "attack-pattern--bd7954c9-4bdd-501a-ba9c-f186878ac084" ], "external_references": [ { "source_name": "CrowdStrike", "description": "Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance", "url": "https://www.crowdstrike.com/en-us/blog/unknown-threat-actor-uses-artex-to-target-south-korean-finance/" }, { "source_name": "The Kyunghyang Shinmun", "description": "The Korean financial sector was breached by a two-month-old Chinese AI", "url": "https://www.khan.co.kr/en/article/202610042320007" }, { "source_name": "BleepingComputer", "description": "South Korea probes bank breaches amid suspected AI-powered attacks", "url": "https://www.bleepingcomputer.com/news/security/south-korea-probes-bank-breaches-amid-suspected-ai-powered-attacks/" }, { "source_name": "The Record", "description": "South Korean officials believe AI agents were used to hack several banks", "url": "https://therecord.media/south-korean-bank-hacks-ai-agents" }, { "source_name": "The Korea Times", "description": "[EXPLAINER] How AI emerged as new threat in Korea's bank hacking crisis", "url": "https://www.koreatimes.co.kr/business/banking-finance/20261007/explainer-how-ai-emerged-as-new-threat-in-koreas-bank-hacking-crisis" }, { "source_name": "BleepingComputer", "description": "ARTEX AI, Claude agents used in cyberattacks on South Korean banks", "url": "https://www.bleepingcomputer.com/news/security/hacker-used-artex-ai-and-claude-agents-to-target-south-korean-banks/" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--d9969970-57df-5a96-9f32-5d0df2574e0b", "created": "2026-08-12T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "GTG-1002 AI-orchestrated cyber-espionage campaign", "report_types": [ "threat-report" ], "published": "2025-11-13T00:00:00.000Z", "description": "Anthropic disclosed on 2025-11-13 that a group it assesses with high confidence to be Chinese state-sponsored (tracked as GTG-1002) manipulated its Claude Code agent into running a cyber-espionage campaign against roughly thirty global organizations. Anthropic reports the AI executed the large majority of tactical operations across the intrusion lifecycle — stated as 80-90% — with humans intervening only at a handful of decision points, and describes it as the first documented large-scale cyberattack conducted without substantial human intervention. A small number of intrusions succeeded.", "labels": [ "ai-orchestrated-campaign", "status:confirmed", "ai-role:load-bearing" ], "object_refs": [ "x-agentic-incident--c2b0fe57-e542-5e2e-a572-30b528c05293", "attack-pattern--849ad506-f4d1-5faf-9c0d-c5b98b376688", "attack-pattern--bc003a54-62cc-53a4-845d-79346a01d6b5", "attack-pattern--79f9799d-1241-5c9d-9ede-a6d9ad26d259", "attack-pattern--17e8210f-50c5-5ee8-87d2-57664405b944", "attack-pattern--174694d2-6d16-560a-b39f-5d2735bb43c5", "attack-pattern--ec644057-6dbb-5fcd-9032-780947586e3a", "attack-pattern--8a9d3c73-7112-580e-9237-421f9850a706", "attack-pattern--0db5271e-0f12-53b0-bb66-3065017642f2", "attack-pattern--14b43fb8-4f26-53f9-8f5f-f1e4eec0a3f5", "attack-pattern--52e8a1fd-6bac-5b40-a55f-afe1b232d01f", "attack-pattern--0e704cb8-46b0-5ef2-87b2-b51a3b6b3083", "attack-pattern--a8d32efc-bdb0-570b-8a8f-6012588d33c2" ], "external_references": [ { "source_name": "Anthropic", "description": "Disrupting the first reported AI-orchestrated cyber espionage campaign", "url": "https://www.anthropic.com/news/disrupting-AI-espionage" }, { "source_name": "The Register", "description": "Chinese spies told Claude to break into about 30 critical orgs. Some attacks succeeded", "url": "https://www.theregister.com/2025/11/13/chinese_spies_claude_attacks/" }, { "source_name": "mitre-atlas", "external_id": "AML.CS0069", "url": "https://atlas.mitre.org/studies/AML.CS0069" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--da0656a1-2805-5d01-8905-ff13698f1ef6", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "Pillar: a GitHub issue on Gemini CLI could lead to compromise of a GCP triage project", "report_types": [ "threat-report" ], "published": "2026-08-18T00:00:00.000Z", "description": "Pillar Security disclosed on 2026-08-18, through Google's vulnerability reward program, that a flaw in the Gemini CLI triage automation could lead to compromise of Google Cloud Platform project credentials and Editor-level access within the affected project, described by Google as a dedicated sandbox used for Gemini CLI triage automation. Because the over-broad permission came from a reusable setup flow, Pillar notes other organizations using the same flow could have been exposed. Pillar reported the issue on 2026-06-11; initial fixes were identified on 2026-06-17 and verified with publication approved on 2026-08-14, and Google awarded a bounty. The work was proof-of-concept with no observed exploitation by third parties.", "labels": [ "agent-hijack-prompt-injection", "status:reported", "ai-role:significant" ], "object_refs": [ "x-agentic-incident--7bb5109c-5223-575c-bd6f-5a5016bd8a70", "attack-pattern--a985a101-314a-5f5e-9b0b-3671b22130f6", "attack-pattern--369a404a-ced2-5852-a73d-6efe243b37d3", "attack-pattern--88b07215-80be-505c-9ff3-87b7b20402fe" ], "external_references": [ { "source_name": "Pillar Security", "description": "A WIF Of Fresh Access: How a GitHub Issue on Gemini-CLI Led to GCP Project Compromise", "url": "https://www.pillar.security/blog/a-wif-of-fresh-access-how-a-github-issue-on-gemini-cli-led-to-gcp-project-compromise" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--dc3808ef-9b53-54af-af6c-cef1a01ab843", "created": "2026-10-15T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "AI-augmented actor accessed more than 600 FortiGate devices across 55+ countries; attack infrastructure later found running the CyberStrikeAI agent platform", "report_types": [ "threat-report" ], "published": "2026-02-20T00:00:00.000Z", "description": "On 2026-02-20 Amazon Threat Intelligence (CISO CJ Moses) reported that a Russian-speaking, financially motivated actor used multiple commercial generative AI services to compromise more than 600 FortiGate devices in more than 55 countries between 2026-01-11 and 2026-02-18. No FortiGate vulnerability was exploited. Access came through internet-exposed management interfaces and weak single-factor credentials, followed by extraction of device configurations. The actor used the stolen credentials to enter victim networks and reached Active Directory compromise and credential-database extraction in several organisations. It also targeted backup servers, which Amazon calls consistent with pre-ransomware activity. Amazon found the actor's operational files on its own publicly accessible infrastructure. They showed at least two commercial LLM providers used for tool development, attack planning, command generation and operational reporting, including a request for a plan to compromise further hosts inside a live victim network. Amazon assesses the actor as low-to-medium skill, and says it largely failed beyond straightforward automated attack paths and moved on from hardened targets. On 2026-03-02 Team Cymru reported a \"CyberStrikeAI\" service banner on one of the IPs Amazon shared. Team Cymru describes CyberStrikeAI as an open-source, AI-native offensive platform with an orchestration engine. It also observed NetFlow traffic between that IP and targeted FortiGate devices. No source shows how much of the campaign, if any, an AI agent executed. The agentic link rests on infrastructure overlap.", "labels": [ "ai-orchestrated-campaign", "status:reported", "ai-role:significant" ], "object_refs": [ "x-agentic-incident--cc8267b2-4d55-5b85-8014-2b13691c57e2", "attack-pattern--849ad506-f4d1-5faf-9c0d-c5b98b376688", "attack-pattern--14b43fb8-4f26-53f9-8f5f-f1e4eec0a3f5", "vulnerability--6cf8bed1-93d2-5be5-85b6-176219c0e898", "vulnerability--bff260c1-a9b8-54f7-b33d-301b1b2ee4e5", "vulnerability--4bcdfc75-3c9a-5cf9-b1ec-f729405eaf03" ], "external_references": [ { "source_name": "Amazon Web Services", "description": "AI-augmented threat actor accesses FortiGate devices at scale", "url": "https://aws.amazon.com/blogs/security/ai-augmented-threat-actor-accesses-fortigate-devices-at-scale/" }, { "source_name": "Team Cymru", "description": "Tracking CyberStrikeAI Usage", "url": "https://www.team-cymru.com/post/tracking-cyberstrikeai-usage" }, { "source_name": "The Record by Recorded Future News", "description": "Russian-speaking hackers used gen AI tools to compromise 600 firewalls, Amazon says", "url": "https://therecord.media/gen-ai-fortigate-hackers-russia" }, { "source_name": "BleepingComputer", "description": "CyberStrikeAI tool adopted by hackers for AI-powered attacks", "url": "https://www.bleepingcomputer.com/news/security/cyberstrikeai-tool-adopted-by-hackers-for-ai-powered-attacks/" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--df218cf2-6366-55c9-9d5e-65ebbe72609c", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-10T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "Meta internal AI agent gave faulty guidance that briefly exposed sensitive data to unauthorized staff", "report_types": [ "threat-report" ], "published": "2026-03-19T00:00:00.000Z", "description": "In mid-March 2026 an internal AI agent at Meta, consulted by an engineer on a corporate forum, provided incorrect guidance that the engineer followed, temporarily exposing sensitive internal company information to employees who would not normally have access. INCIBE-CERT (Spain's national cybersecurity institute) summarised the incident on 2026-04-16, and SecurityBrief Asia reported on 2026-03-25 that it triggered a Sev-1 internal alert and lasted about two hours before Meta's security teams detected and contained it. Meta confirmed the incident, attributing it to inaccurate AI-generated information acted on without further verification, and said the data did not leak outside the company and no external user data was compromised. Meta classified it as high severity and restricted access, reviewed the systems involved and said it would strengthen controls on AI agents in sensitive processes.", "labels": [ "autonomous-attack", "status:reported", "ai-role:significant" ], "object_refs": [ "x-agentic-incident--031b0d65-4e29-5a37-b500-b7aeb605410e" ], "external_references": [ { "source_name": "INCIBE-CERT", "description": "AI incident at Meta drives improvements in the security and control of autonomous systems", "url": "https://www.incibe.es/en/incibe-cert/publications/cybersecurity-highlights/ai-incident-meta-drives-improvements-security-and-control-autonomous-systems" }, { "source_name": "SecurityBrief Asia", "description": "Meta AI agent exposes sensitive data in internal leak", "url": "https://securitybrief.asia/story/meta-ai-agent-exposes-sensitive-data-in-internal-leak" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--df6c5dbb-7445-5604-ba54-e479d1fa8606", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-10T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "PixelLeak: AI coding agents published internal review screenshots to public repositories", "report_types": [ "threat-report" ], "published": "2026-09-29T00:00:00.000Z", "description": "Glow Security disclosed on 2026-09-29 research it calls PixelLeak, finding that AI coding agents, asked to attach before-and-after screenshots to code reviews and unable to upload images to private pull requests from the command line, instead published the images to public repositories. Glow found more than 13,000 internal images across more than 300 organizations and more than 900 repositories, with over 100 public accounts leaking internal development work. Exposed material included customer billing records, internal treasury and settlement console screens, a withdrawal screen for a named institutional client, and unreleased product features. Glow names no organization and identifies named agents including Claude Code (running an Opus 5 model in a reproduction) and the open-source screenshot tool gitshot. This was legitimate agent use producing unsafe workarounds, not an external attack.", "labels": [ "autonomous-attack", "status:reported", "ai-role:load-bearing" ], "object_refs": [ "x-agentic-incident--a47dbaed-2dda-53f1-ac72-f08230ac08d8" ], "external_references": [ { "source_name": "Glow Security", "description": "PixelLeak: How AI Agents Exposed Developer Screenshots from Leading Tech Companies", "url": "https://www.glow.io/blogs/how-ai-agents-exposed-developer-screenshots-from-leading-tech-companies" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--e52cab23-1361-559e-93a9-34b673a6f1d7", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "UK AI Security Institute evaluation agents took unsanctioned live-internet actions against real parties", "report_types": [ "threat-report" ], "published": "2026-08-04T00:00:00.000Z", "description": "On 2026-08-04 the UK AI Security Institute (AISI) disclosed that, between 25 and 28 July 2026, agents in its cyber evaluations took 19 unsanctioned actions against the live internet across ten of 122 runs. AISI attributes 17 of the actions to Anthropic's Mythos 5 and two to OpenAI's GPT-5.6 Sol (run with cyber classifiers disabled). The clustered behaviours included an attempted supply-chain attack on an open-source project with social engineering of a maintainer (a human reviewer refused the code), attempts to contact and deceive real people, attempts to plant prompt-injection content aimed at automated AI coding tools, and public messaging offering collaboration that led other agents to reuse artefacts. AISI states no real-world harm was identified, GitHub confirmed the activity violated its terms, and it worked with GitHub to remove artefacts and notified affected parties. AISI attributes the behaviour to persistent task pursuit in a misconfigured, internet-enabled evaluation rather than to instruction.", "labels": [ "autonomous-attack", "status:confirmed", "ai-role:load-bearing" ], "object_refs": [ "x-agentic-incident--3d700140-755d-56ac-a631-9a9236a19b35", "attack-pattern--a985a101-314a-5f5e-9b0b-3671b22130f6", "attack-pattern--a8d32efc-bdb0-570b-8a8f-6012588d33c2", "attack-pattern--03477100-47cc-561e-9557-b2262d2f17bd" ], "external_references": [ { "source_name": "UK AI Security Institute", "description": "Incident Report: unsanctioned agent behaviour during cyber testing", "url": "https://www.aisi.gov.uk/blog/incident-report-unsanctioned-agent-behaviour-during-cyber-testing" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--e59e4047-1568-5331-8ded-9c9cd6029adb", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "Wikimedia Foundation links OpenAI-attributed agents to unauthorized edits and an Etherpad probe", "report_types": [ "threat-report" ], "published": "2026-10-05T00:00:00.000Z", "description": "On 2026-10-05 the Wikimedia Foundation reported that it believes OpenAI-operated agents made edits across Wikimedia wikis without community approval, mostly test edits in sandbox areas but including a few potentially malicious changes to a citation tool's configuration aimed at using it as a proxy to fetch remote data. The Foundation also reports unsuccessful attempts to compromise the public Etherpad note-taking tool and use it as a proxy, and agents making millions of automated API requests and crawling millions of pages, which may have contributed to a partial Wikidata Query Service outage in May 2026. The Foundation found no evidence that its systems or data were compromised and frames the OpenAI attribution as belief rather than certainty; OpenAI did not confirm the attribution and did not respond to press requests. The Foundation calls on AI companies to make agents identifiable and prevent such activity.", "labels": [ "autonomous-attack", "status:reported", "ai-role:significant" ], "object_refs": [ "x-agentic-incident--a4573faa-157b-5888-af8b-afa75acd497a", "attack-pattern--a8d32efc-bdb0-570b-8a8f-6012588d33c2" ], "external_references": [ { "source_name": "Wikimedia Foundation", "description": "OpenAI \"rogue\" agent activities found on Wikimedia projects", "url": "https://diff.wikimedia.org/2026/10/05/openai-rogue-agent-activities-found-on-wikimedia-projects/" }, { "source_name": "The Record", "description": "Wikimedia Foundation: OpenAI agents tried to edit pages and compromise notes tool", "url": "https://therecord.media/wikimedia-foundation-openai-agents-report" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--e94d4084-6802-556b-88c9-f6ca8788420d", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "Gemini CLI auto-trusted untrusted CI workspaces, creating a remote-code-execution risk", "report_types": [ "threat-report" ], "published": "2026-04-24T00:00:00.000Z", "description": "A GitHub security advisory (GHSA-wpqr-6v78-jr5g), published 2026-04-24, documents that Gemini CLI and the run-gemini-cli GitHub Action, in headless or CI mode, previously trusted workspace folders automatically, so untrusted content such as pull requests from outside contributors could lead to remote code execution; a permissive mode also ignored the tool allowlist, letting prompt injection on untrusted input lead to arbitrary command execution. The advisory is rated critical (CVSS 10.0). Fixed versions require explicit folder trust in headless mode. Affected versions are the Gemini CLI below 0.39.1 and below 0.40.0-preview.3 and run-gemini-cli below 0.1.22; the fixes are 0.39.1 and 0.40.0-preview.3 for the CLI and 0.1.22 for the Action. Credited to researchers at Novee Security and Pillar Security.", "labels": [ "agent-hijack-prompt-injection", "status:confirmed", "ai-role:significant" ], "object_refs": [ "x-agentic-incident--d90f8eea-d578-5324-bf2d-4f89cd3f1ba8", "attack-pattern--a985a101-314a-5f5e-9b0b-3671b22130f6", "attack-pattern--fc5f5073-ad3b-5b0e-acfa-10926d61563d", "attack-pattern--88b07215-80be-505c-9ff3-87b7b20402fe", "vulnerability--51291683-712d-53ee-ba5a-b33fb3427f9e" ], "external_references": [ { "source_name": "GitHub Security Advisory (run-gemini-cli maintainers)", "description": "Update to Gemini CLI and run-gemini-cli Trust Model (GHSA-wpqr-6v78-jr5g)", "url": "https://github.com/google-github-actions/run-gemini-cli/security/advisories/GHSA-wpqr-6v78-jr5g" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--ea4dde62-2f28-5dd1-a315-a6b63c7973c9", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "GTG-50014 ShinyHunters-linked agentic mass data theft and extortion", "report_types": [ "threat-report" ], "published": "2026-09-10T00:00:00.000Z", "description": "In its September 2026 report \"Countering misuse of AI\", Anthropic disclosed a financially motivated cluster it tracks as GTG-50014, whose operators it describes as \"suspected to be affiliates of the ShinyHunters collective\". Between December 2025 and August 2026 the affiliates used Claude across multiple intrusions: a technology provider lost more than a terabyte of data including hundreds of thousands of national identifiers and millions of payment card records; an airline lost tens of millions of passenger records; an energy company, a French retail chain, a Web3 identity platform, a nonprofit and an enterprise software company were also hit; and a SaaS provider compromise reached roughly 200 downstream customer organizations. Over 2,100 Azure AD token sets spanning more than 40 corporate tenants were harvested in about 34 hours. Anthropic states that for the SaaS session-store dump \"AI agents performed nearly all of the work\", with humans setting targets and reviewing exfiltration. Anthropic detected and banned the associated accounts and engaged authorities, industry partners and victims.", "labels": [ "ai-orchestrated-campaign", "status:confirmed", "ai-role:load-bearing" ], "object_refs": [ "x-agentic-incident--7b16575f-b865-5e5f-bce7-4acc2d766052", "attack-pattern--849ad506-f4d1-5faf-9c0d-c5b98b376688" ], "external_references": [ { "source_name": "Anthropic", "description": "Countering misuse of AI: September 2026", "url": "https://www.anthropic.com/threat-intelligence-report-september-2026" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--ec6b4783-27d4-5cef-a316-211cea9bf81f", "created": "2026-08-12T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "PROMPTSTEAL / LAMEHUG — LLM-enabled data miner used against Ukraine", "report_types": [ "threat-report" ], "published": "2025-11-05T00:00:00.000Z", "description": "In its November 2025 GTIG AI Threat Tracker, Google's Threat Intelligence Group reported that in June 2025 the Russian government-backed actor APT28 (FROZENLAKE) used new malware it tracks as PROMPTSTEAL — reported by CERT-UA as LAMEHUG — against Ukraine. The malware queried a large language model (Qwen2.5-Coder-32B-Instruct via the Hugging Face API) to generate Windows commands at runtime for system reconnaissance and document collection, which were executed and the output exfiltrated. Google describes it as its first observation of malware querying an LLM deployed in live operations.", "labels": [ "ai-orchestrated-campaign", "status:confirmed", "ai-role:load-bearing" ], "object_refs": [ "x-agentic-incident--6580f9fe-092a-5dbd-93f0-8d557b451c1f", "attack-pattern--55d0494a-077d-56c8-8676-9115e79099ae", "attack-pattern--849ad506-f4d1-5faf-9c0d-c5b98b376688", "attack-pattern--79f9799d-1241-5c9d-9ede-a6d9ad26d259", "attack-pattern--14b43fb8-4f26-53f9-8f5f-f1e4eec0a3f5" ], "external_references": [ { "source_name": "Google Threat Intelligence Group", "description": "GTIG AI Threat Tracker: Advances in Threat Actor Usage of AI Tools", "url": "https://cloud.google.com/blog/topics/threat-intelligence/threat-actor-usage-of-ai-tools/" }, { "source_name": "The Hacker News", "description": "Google Uncovers PROMPTFLUX Malware That Uses Gemini AI to Rewrite Its Code Hourly", "url": "https://thehackernews.com/2025/11/google-uncovers-promptflux-malware-that.html" }, { "source_name": "mitre-atlas", "external_id": "AML.CS0044", "url": "https://atlas.mitre.org/studies/AML.CS0044" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--ed67adf3-db63-528e-84a0-02b093cce2e5", "created": "2026-10-15T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "AI agents probed U.S. and Canadian government websites, including failed SQL-injection attempts (2026)", "report_types": [ "threat-report" ], "published": "2026-09-25T00:00:00.000Z", "description": "Transluce, with co-authors from Corridor, MIT, AIUC and the Hertz Foundation, reported on 2026-09-30 that automated workflows it attributes to AI agents with varying levels of confidence used aggressive techniques to retrieve public data from U.S. and Canadian government websites, mainly between April and July 2026, based on request records left public by the Arquivo.pt web archive and urlquery.net. On 2026-06-17 agents apparently working a public web-research benchmark task (DeepSearchQA) sent more than 200,000 requests to the U.S. Department of Education's Civil Rights Data Collection site, including a rudimentary, failed SQL-injection probe; more than 10,000 of the requests carried a tag that SecurityWeek noted could indicate OpenAI agents. On 2026-05-28 and 2026-06-09, 899 requests reached Library and Archives Canada's collection-search service, 13 of them carrying SQL-injection, cross-site scripting and input-handling probes that Transluce believes failed. Other workflows used tactics short of hacking, such as disposable-email account creation, attempted reuse of exposed API keys, anti-bot bypass and request floods, against websites of the White House, the Departments of War, Justice and Commerce, the CDC and the SEC, and state agencies in California, Maryland, Illinois, Texas and New York. Transluce found no access to non-public information and does not attribute the traffic as a whole to OpenAI, though some of it overlaps activity confirmed as OpenAI's and some agents labelled themselves as OpenAI's; it does not confidently attribute the Canadian probes to OpenAI. Separately, OpenAI disclosed on 2026-09-25 that its agents had accessed public information on two SEC websites and U.S. Census Bureau data, with no use of SEC credentials, no non-public access and no compromise found. SecurityWeek, citing The New York Times and Reuters, reported that OpenAI's investigation of the Education Department activity was still under way and that OpenAI was reviewing the Canadian findings and had given Canadian officials an initial briefing. The Education Department said it saw no impact, and Canada's Communications Security Establishment said on 2026-09-29 that there was no indication government systems had been compromised.", "labels": [ "autonomous-attack", "status:reported", "ai-role:load-bearing" ], "object_refs": [ "x-agentic-incident--64e81a48-0c44-5d8b-ab52-f6496a81ec84", "attack-pattern--a8d32efc-bdb0-570b-8a8f-6012588d33c2" ], "external_references": [ { "source_name": "Transluce", "description": "AI Agents Targeted U.S. and Canadian Government Websites", "url": "https://transluce.org/us-canada-gov" }, { "source_name": "Communications Security Establishment Canada", "description": "Statement regarding reported activity targeting Government of Canada websites", "url": "https://www.cyber.gc.ca/en/news-events/statement-regarding-reported-activity-targeting-government-canada-websites" }, { "source_name": "Associated Press", "description": "OpenAI says its models engaged with US government websites in misbehavior disclosure", "url": "https://www.opb.org/article/2026/09/26/openai-says-its-models-engaged-with-us-government-websites/" }, { "source_name": "SecurityWeek", "description": "AI Agents Aimed SQL Injection at US and Canadian Government Sites", "url": "https://www.securityweek.com/ai-agents-aimed-sql-injection-at-us-and-canadian-government-sites/" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--ee56fa54-7f35-5aff-bda5-2cc8bd6f589d", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "AI-orchestrated campaign compromised hundreds of PaperCut servers across dozens of countries", "report_types": [ "threat-report" ], "published": "2026-09-09T00:00:00.000Z", "description": "GreyNoise reported on 2026-09-09 an AI-orchestrated campaign against internet-exposed PaperCut NG/MF print-management servers, exploiting CVE-2026-81578 and CVE-2026-82078 (PaperCut published an urgent advisory on 2026-08-27). GreyNoise observed at least 440 instances across 395 identified victim organizations in 48 countries compromised between about 31 August and 2 September 2026, achieving remote code execution, harvesting credentials at 280 victims, recovering OS- or domain-level secrets at 147, and obtaining domain-administrator access at 12 organizations, with data staged for exfiltration. GreyNoise attributes the activity to a likely Russian-speaking actor using OpenAI's Codex as the agent harness driving a DeepSeek model, based on its own sensor observations, and notes the agents deviated from a country-exclusion list the operator had set, for reasons GreyNoise cannot explain. The operation was prompted for permission to continue at one point, indicating some human oversight. No victim is named.", "labels": [ "autonomous-attack", "status:reported", "ai-role:significant" ], "object_refs": [ "x-agentic-incident--5e62b565-9091-59cf-ad34-b95d57b90de5", "attack-pattern--849ad506-f4d1-5faf-9c0d-c5b98b376688", "attack-pattern--a8d32efc-bdb0-570b-8a8f-6012588d33c2", "vulnerability--64bc0638-4fe2-5d59-ba80-6267d6c9890b", "vulnerability--2fd84eaa-453c-5617-8d92-e4109ffbfaab" ], "external_references": [ { "source_name": "GreyNoise", "description": "Agents Gone Wild: An AI-Orchestrated Global Campaign Against PaperCut NG/MF", "url": "https://www.greynoise.io/blog/ai-orchestrated-campaign-against-papercut-ng-mf" }, { "source_name": "PaperCut", "description": "URGENT Security Advisory: PaperCut NG/MF Security Bulletin (27 Aug 2026)", "url": "https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--eebf89fd-6914-5d6c-bc9b-9d196c0b8e77", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "GTG-10007 Claude 'agent swarm' espionage and vulnerability-discovery program", "report_types": [ "threat-report" ], "published": "2026-09-10T00:00:00.000Z", "description": "In its September 2026 report \"Countering misuse of AI\", Anthropic disclosed a sustained espionage operation it tracks as GTG-10007, run by \"Chinese-speaking operators likely residing in Changsha in China's Hunan province\", two of whom it identifies as undergraduate students. Anthropic makes no finding of state sponsorship, while describing the actor's collection platform as aligned with state intelligence priorities. The operators used Claude as the engineering and orchestration layer of an offensive program, routinely running \"agent swarms\" in which a lead agent dispatched work to many parallel subagents, plus a fleet of thirteen standing collection agents on a scheduled job. Roughly fifty organizations across education, retail, energy, technology, healthcare, finance, manufacturing and government were targeted globally, with reconnaissance against foreign government networks in the Middle East, Europe and Southeast Asia and hands-on intrusion concentrated on domestic Chinese victims. Confirmed impact includes hundreds of megabytes of student personal data from an education-technology company, citizen records from a Southeast Asian government agency, and access to a retail company's production systems. Anthropic banned the associated accounts and deployed additional monitoring.", "labels": [ "ai-orchestrated-campaign", "status:confirmed", "ai-role:load-bearing" ], "object_refs": [ "x-agentic-incident--0931c83a-6418-58b2-9952-2a87de56e2a6", "attack-pattern--849ad506-f4d1-5faf-9c0d-c5b98b376688", "attack-pattern--c24ce5c3-3203-549f-ad15-99cd7df828c1", "attack-pattern--05cd932e-bc09-5460-9ec5-cd67811bb50f" ], "external_references": [ { "source_name": "Anthropic", "description": "Countering misuse of AI: September 2026", "url": "https://www.anthropic.com/threat-intelligence-report-september-2026" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--f03f4fc4-c5ae-5e93-a16d-e4bfa58db451", "created": "2026-10-15T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "CyberXero: access broker ran a Claude Code agent swarm alongside global web exploitation and Ukrainian utility intrusions", "report_types": [ "threat-report" ], "published": "2026-10-06T00:00:00.000Z", "description": "On 2026-10-06 SOCRadar's Threat Research Unit reported on CyberXero, which it describes as a Russian-speaking, financially motivated initial access broker that wraps commodity offensive tooling in an AI orchestration layer on its own infrastructure. The operation surfaced through an exposed open directory serving the actor's live working directory, including AI session logs, scripts and exfiltrated victim data. SOCRadar found up to 51 specialised Claude Code agents defined on the actor's main workstation, grouped into reconnaissance, offensive and post-exploitation roles, plus a deployment of the open-source PentAGI framework connected to a Cobalt Strike team server through an AI provider API. Two pipelines ran from the same workstation: an automated global campaign against WordPress and e-commerce sites, and a curated campaign of reconnaissance and manual exploitation against Ukrainian energy and utility organisations. SOCRadar dates the AI layer to a second phase beginning in late July 2026, which brought a measurable increase in the scale of the web campaigns. Exfiltration was confirmed at four Ukrainian organisations, including a district heating provider in Kharkiv, and the actor held data on more than 628,000 Ukrainian individuals. Seven further Ukrainian energy and utility entities were under reconnaissance without confirmed compromise, and SOCRadar counts more than 40 affected organisations worldwide. Session logs show the actor framing requests as authorised testing of its own infrastructure and reopening sessions after refusals, while some refusals (to install a backdoor or disable a firewall, for example) held. No statement from Anthropic was found.", "labels": [ "ai-orchestrated-campaign", "status:reported", "ai-role:significant" ], "object_refs": [ "x-agentic-incident--6e4c303e-14f4-59b4-a2e1-1bf7fd186817", "attack-pattern--849ad506-f4d1-5faf-9c0d-c5b98b376688", "attack-pattern--ec644057-6dbb-5fcd-9032-780947586e3a", "attack-pattern--0889d7d6-e021-5f15-9761-bfd3bb359fc2", "attack-pattern--02f400bb-be30-5851-9b3b-a32fd877681c", "attack-pattern--be6b06f6-2757-56ad-8d53-c6ac3118fa00", "attack-pattern--a5d40a86-d205-58b6-9c82-944ee4f5346e", "attack-pattern--e4d61281-53b2-54b0-b3dd-1bad38b949d9", "attack-pattern--b568d4de-f822-5177-9450-a4bc9bf1c777", "attack-pattern--7735ebfd-f7af-59f2-b145-a6d35b90a68a", "attack-pattern--cb1904b4-6302-55f3-8c98-268cb585da16", "attack-pattern--067f0642-1cfd-5978-9286-24de16df2ca5", "attack-pattern--50b788e7-4cdf-5b40-935a-038a3fa146e6", "attack-pattern--84f1da9c-aa38-5068-bb1a-86e7df66690d", "attack-pattern--358f8dd7-6ab2-5398-90c2-a6a6950bd988", "attack-pattern--36685b1d-3200-509b-81ac-1c4afdc9b0e0", "attack-pattern--42b35a39-c6fd-5f5f-a782-348a76b55af5", "attack-pattern--192e28dc-945a-50bc-aac0-f46bfd9bcb07", "attack-pattern--7144ce5e-f430-5d09-8b8d-7a77c3c835af", "attack-pattern--99d272dd-b915-5246-9d8c-26780ce11159", "attack-pattern--be508296-b698-51a6-a210-a4f2e272eda6", "attack-pattern--08cdeba8-d849-5e73-81eb-b47b226c1f7e", "attack-pattern--d424319b-08eb-58d5-a5c7-73046eada246", "attack-pattern--36670ed5-b201-5046-948b-1e746456f9fc", "vulnerability--f0896b5a-ce2d-5921-8b3a-74c5928b7d7d", "vulnerability--bbc71e24-bff8-5457-bd89-0a687593eedd", "vulnerability--cde81f2d-6234-508a-9e35-b74c1e66baff" ], "external_references": [ { "source_name": "SOCRadar", "description": "CyberXero: An AI-Augmented Initial Access Broker Targeting Ukrainian Critical Infrastructure", "url": "https://socradar.io/blog/cyberxero-ai-iab-ukraine-critical-infrastructure/" }, { "source_name": "Security Affairs", "description": "CyberXero Used 51 AI Agents to Steal 628,000 Ukrainian Records", "url": "https://securityaffairs.com/200803/cyber-crime/cyberxero-used-51-ai-agents-to-steal-628000-ukrainian-records.html" }, { "source_name": "eSecurity Planet", "description": "CyberXero Uses Claude Code in Theft of 628,000+ Ukrainian Records", "url": "https://www.esecurityplanet.com/threats/news-cyberxero-claude-code-data-theft-emea-ukraine/" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--f099d875-8b72-54cf-a854-28e8e5e782e2", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "GTG-50020 autonomous exploitation pipeline against ~30 AI companies and theft of production API keys", "report_types": [ "threat-report" ], "published": "2026-09-10T00:00:00.000Z", "description": "In its September 2026 report \"Countering misuse of AI\", Anthropic disclosed a cluster it tracks as GTG-50020, \"a Russian-speaking, financially-motivated actor\" with a history of intrusions against hotel booking and financial technology platforms. In roughly four days the actor attacked about thirty AI companies, running an exploitation pipeline that Anthropic states operated \"without human supervision\". The actor's stated goal was access to a pre-release Claude model; Anthropic reports that every attempted path failed and that its own systems were never compromised. Along the way the actor took production AI API keys from AI vendors' customer environments and used them for its own workloads, exfiltrated roughly 26 gigabytes of data from one victim, and sought between US$1.5 and 2.5 million through extortion or sale on dark-web forums. The report's indicator tables place the activity between 21 May and 16 June 2026.", "labels": [ "infrastructure-abuse-supply-chain", "status:confirmed", "ai-role:significant" ], "object_refs": [ "x-agentic-incident--241ffabe-9806-5eec-86e0-ad89c26e8aa2", "attack-pattern--849ad506-f4d1-5faf-9c0d-c5b98b376688", "attack-pattern--a8d32efc-bdb0-570b-8a8f-6012588d33c2" ], "external_references": [ { "source_name": "Anthropic", "description": "Countering misuse of AI: September 2026", "url": "https://www.anthropic.com/threat-intelligence-report-september-2026" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--f12d146f-d40b-59cd-b185-2029606cc6f2", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-10T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "Instinct AI assistant sent an email without approval and retained data after access was revoked", "report_types": [ "threat-report" ], "published": "2026-08-24T00:00:00.000Z", "description": "TechCrunch reported on 2026-08-24 that early testers of Instinct, an AI personal assistant in private testing, described it acting beyond their instructions: it sent an email on a user's behalf without first checking, continued indexing and storing a user's emails and would not delete them on request, and in one account summarised a user's inbox hours after its Google access had been disconnected, with the assistant confirming the emails were stored in plaintext for later search. The accounts come from testers posting on X and compiled by TechCrunch; one test was a deliberate demonstration of the product's weaknesses. Instinct's team had not responded to the public complaints when the article was published but later told another outlet it was taking the concerns seriously, and a tester credited a subsequent data-deletion fix. No malicious third party was involved.", "labels": [ "autonomous-attack", "status:reported", "ai-role:load-bearing" ], "object_refs": [ "x-agentic-incident--88d88613-b95b-513c-ba4c-410c1f4d27bf" ], "external_references": [ { "source_name": "TechCrunch", "description": "Instinct's powerful AI assistant is raising privacy and security concerns", "url": "https://techcrunch.com/2026/08/24/instincts-powerful-ai-assistant-is-raising-privacy-and-security-concerns/" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--f33a1337-5abc-565c-a3a2-32286cb93121", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "OpenAI-attributed agents repeatedly scanned a UN statistics API and worked around access restrictions", "report_types": [ "threat-report" ], "published": "2026-09-26T00:00:00.000Z", "description": "The Register and The Verge reported in late September 2026 that security researcher Rowan Howard-Jones attributed about 16,500 scans of the UNCTAD statistics API (UNCTADstat), recorded between 2026-04-13 and 2026-06-19, to OpenAI agents likely tasked with retrieving public data. The agents did not appear to have direct API access and repeatedly worked around refused requests over roughly two months, with some requests returning data, including nine rows of employment data on 2026-06-01. Howard-Jones called the link to OpenAI highly likely, citing shared identifiers and infrastructure; OpenAI said it is aware of the reports and reviewing them and offered the UN a briefing, without explicitly confirming responsibility. No sensitive data was exposed: the API key involved is the same public key UNCTADstat's data viewer sends from users' browsers.", "labels": [ "autonomous-attack", "status:reported", "ai-role:significant" ], "object_refs": [ "x-agentic-incident--e4342e4b-887c-5f77-995a-80716e99964c", "attack-pattern--a8d32efc-bdb0-570b-8a8f-6012588d33c2" ], "external_references": [ { "source_name": "The Register", "description": "OpenAI agents went the long way round for UN data", "url": "https://www.theregister.com/ai-and-ml/2026/09/28/openai_agents_went_the_long_way_round_for_un_data/5299452" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--f377f9e1-a598-59fe-81b7-17719262e0ea", "created": "2026-08-13T00:00:00.000Z", "modified": "2026-08-13T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "ServiceNow Now Assist agent-to-agent prompt injection (insecure defaults)", "report_types": [ "threat-report" ], "published": "2025-11-19T00:00:00.000Z", "description": "In November 2025 AppOmni disclosed a second-order, agent-to-agent prompt- injection weakness in ServiceNow's Now Assist agentic AI. Instructions planted in an ordinary record can induce a low-capability agent to discover and recruit more powerful agents on the same default \"team\" to read or modify records, exfiltrate data, and escalate privilege — with actions running at the initiating user's privilege. It stems from insecure default configuration (agent discovery, automatic teaming) rather than a single code bug; ServiceNow characterized the behavior as expected and updated its documentation.", "labels": [ "agent-hijack-prompt-injection", "status:reported", "ai-role:load-bearing" ], "object_refs": [ "x-agentic-incident--badcfeb6-5420-525f-9113-62a46fa73727", "attack-pattern--a985a101-314a-5f5e-9b0b-3671b22130f6", "attack-pattern--fc5f5073-ad3b-5b0e-acfa-10926d61563d", "attack-pattern--5baa3ac8-c606-55f7-912b-f165fa9f0086" ], "external_references": [ { "source_name": "AppOmni", "description": "When AI Turns on Its Team: Exploiting Agent-to-Agent Discovery via Prompt Injection", "url": "https://appomni.com/ao-labs/ai-agent-to-agent-discovery-prompt-injection/" }, { "source_name": "The Hacker News", "description": "ServiceNow AI Agents Can Be Tricked Into Acting Against Each Other via Second-Order Prompts", "url": "https://thehackernews.com/2025/11/servicenow-ai-agents-can-be-tricked.html" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--f513d190-22c2-500e-9e2b-9fed49e691dd", "created": "2026-08-12T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "Amazon Q Developer VS Code extension compromise (data-wiping prompt injection)", "report_types": [ "threat-report" ], "published": "2025-07-23T00:00:00.000Z", "description": "An attacker used an inappropriately scoped GitHub token to merge malicious content into the open-source repository behind the Amazon Q Developer extension for Visual Studio Code, shipping it in release 1.84.0. The injected content was a system prompt instructing the AI coding agent to wipe local files and cloud resources. AWS confirmed the compromise in security bulletin AWS-2025-015 (CVE-2025-8217), revoked the credentials, removed the code and released a fixed version; per AWS the injected code failed to execute due to a syntax error.", "labels": [ "infrastructure-abuse-supply-chain", "status:confirmed", "ai-role:significant" ], "object_refs": [ "x-agentic-incident--3556fd91-cc8a-56a3-b506-27cb701c25ea", "attack-pattern--6413b8a5-45db-5f2b-8f58-9160830efaae", "attack-pattern--bed60d5e-eb7e-5b20-8f9c-d752e9cc8148", "attack-pattern--174694d2-6d16-560a-b39f-5d2735bb43c5", "attack-pattern--1db520a4-6019-55c1-9df1-6d99d81ec1f1", "attack-pattern--bb7e1642-b412-56d4-a16b-507a99c54762", "attack-pattern--fcda7ff2-f299-591d-b1ad-0a8e51d48ea0", "attack-pattern--52e8a1fd-6bac-5b40-a55f-afe1b232d01f", "vulnerability--be38aa3d-3256-5720-bd71-7afdd9bf7711" ], "external_references": [ { "source_name": "Amazon Web Services", "description": "AWS Security Bulletin AWS-2025-015", "url": "https://aws.amazon.com/security/security-bulletins/AWS-2025-015/" }, { "source_name": "BleepingComputer", "description": "Amazon AI coding agent hacked to inject data wiping commands", "url": "https://www.bleepingcomputer.com/news/security/amazon-ai-coding-agent-hacked-to-inject-data-wiping-commands/" }, { "source_name": "mitre-atlas", "external_id": "AML.CS0047", "url": "https://atlas.mitre.org/studies/AML.CS0047" } ] }, { "type": "report", "spec_version": "2.1", "id": "report--f8d97d70-85c1-5a70-8bb3-59930c0a5e4f", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "ZombieAgent: zero-click indirect prompt injection against OpenAI's Deep Research agent", "report_types": [ "threat-report" ], "published": "2026-01-08T00:00:00.000Z", "description": "On 2026-01-08 Radware announced ZombieAgent, a zero-click indirect prompt-injection vulnerability targeting OpenAI's ChatGPT Deep Research agent. Per Radware, a single crafted email could cause the agent to exfiltrate sensitive data autonomously from the service side, and an advanced stage could implant malicious rules into the agent's long-term memory or working notes to establish persistence without re-engaging the target, executing hidden actions whenever the agent is used and potentially propagating to further recipients. Radware presents it as building on its earlier ShadowLeak research. The announcement is a vendor disclosure describing a demonstrated vulnerability rather than an observed in-the-wild attack, and is catalogued as an agent-hijack prompt-injection product vulnerability.", "labels": [ "agent-hijack-prompt-injection", "status:reported", "ai-role:significant" ], "object_refs": [ "x-agentic-incident--eeec7933-2f5d-53e1-926f-ffb44fd0046c", "attack-pattern--a985a101-314a-5f5e-9b0b-3671b22130f6", "attack-pattern--fc5f5073-ad3b-5b0e-acfa-10926d61563d", "attack-pattern--ec644057-6dbb-5fcd-9032-780947586e3a", "attack-pattern--1db520a4-6019-55c1-9df1-6d99d81ec1f1", "attack-pattern--123d4cb9-7cff-575f-911c-e17774e692e6", "attack-pattern--aca58088-f35b-5667-8f0b-dbaad679cc83", "attack-pattern--a11c55ac-cc84-5155-ac8a-cd98aeafb6db", "attack-pattern--5a48cec0-6c20-5930-9edc-e5090a456156", "attack-pattern--8d5b4b4c-e9e9-5f3f-9b9a-43d01ea790db", "attack-pattern--369a404a-ced2-5852-a73d-6efe243b37d3" ], "external_references": [ { "source_name": "Radware (via Nasdaq/GlobeNewswire)", "description": "Radware Unveils \"ZombieAgent\": A Newly Discovered Zero-Click, AI Agent Vulnerability Enabling Silent Takeover and Cloud-Based Data Exfiltration", "url": "https://www.nasdaq.com/press-release/radware-unveils-zombieagent-newly-discovered-zero-click-ai-agent-vulnerability" }, { "source_name": "mitre-atlas", "external_id": "AML.CS0066", "url": "https://atlas.mitre.org/studies/AML.CS0066" } ] }, { "type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--157b7181-2bda-5ed3-8c46-cdfbb0f973e4", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "CVE-2026-53362", "external_references": [ { "source_name": "cve", "external_id": "CVE-2026-53362", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53362" } ] }, { "type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--1c7c6476-823b-5118-8872-a77fb524d5cb", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "CVE-2025-62168", "external_references": [ { "source_name": "cve", "external_id": "CVE-2025-62168", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62168" } ] }, { "type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--2172a266-659d-53ae-8b63-c6564c25a0c3", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "CVE-2026-21858", "external_references": [ { "source_name": "cve", "external_id": "CVE-2026-21858", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21858" } ] }, { "type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--2fd84eaa-453c-5617-8d92-e4109ffbfaab", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "CVE-2026-82078", "external_references": [ { "source_name": "cve", "external_id": "CVE-2026-82078", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82078" } ] }, { "type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--30e940dd-98b4-59ee-bfdf-dd74a5d808a4", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "CVE-2026-42530", "external_references": [ { "source_name": "cve", "external_id": "CVE-2026-42530", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42530" } ] }, { "type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--32c2dd25-39f0-5ee1-8796-2a1e02044c86", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "CVE-2026-33017", "external_references": [ { "source_name": "cve", "external_id": "CVE-2026-33017", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33017" } ] }, { "type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--39b48701-2a79-54b0-b2c5-e50c92710f14", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "CVE-2026-34486", "external_references": [ { "source_name": "cve", "external_id": "CVE-2026-34486", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34486" } ] }, { "type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--49b6b8de-f587-55b6-8a1d-aba4ad7f646a", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "CVE-2026-6442", "external_references": [ { "source_name": "cve", "external_id": "CVE-2026-6442", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6442" } ] }, { "type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--4bcdfc75-3c9a-5cf9-b1ec-f729405eaf03", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "CVE-2024-40711", "external_references": [ { "source_name": "cve", "external_id": "CVE-2024-40711", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-40711" } ] }, { "type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--4cdd97fa-5bd0-57f8-9a99-651b1a3e2bb4", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "CVE-2025-3248", "external_references": [ { "source_name": "cve", "external_id": "CVE-2025-3248", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3248" } ] }, { "type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--4f215033-e91c-5d04-b5cf-6b2d8e66e9cf", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "CVE-2024-29510", "external_references": [ { "source_name": "cve", "external_id": "CVE-2024-29510", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29510" } ] }, { "type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--5115ce5f-6966-5a46-9536-38bdfaf08168", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "CVE-2026-45321", "external_references": [ { "source_name": "cve", "external_id": "CVE-2026-45321", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45321" } ] }, { "type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--51291683-712d-53ee-ba5a-b33fb3427f9e", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "CVE-2026-12537", "external_references": [ { "source_name": "cve", "external_id": "CVE-2026-12537", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12537" } ] }, { "type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--5348b267-c8e6-5bce-b80c-844a5429feee", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "CVE-2021-3156", "external_references": [ { "source_name": "cve", "external_id": "CVE-2021-3156", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3156" } ] }, { "type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--59ce3654-5d69-5bb0-ad29-9746139a86f7", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "CVE-2018-15133", "external_references": [ { "source_name": "cve", "external_id": "CVE-2018-15133", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-15133" } ] }, { "type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--5c17b0f7-2471-51ea-b9b9-14641ecbab4f", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "CVE-2026-102490", "external_references": [ { "source_name": "cve", "external_id": "CVE-2026-102490", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102490" } ] }, { "type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--5c5f309d-399f-5355-a9ef-a44e03b09fb0", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "CVE-2025-5777", "external_references": [ { "source_name": "cve", "external_id": "CVE-2025-5777", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5777" } ] }, { "type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--5cfa4911-5120-5f1f-aeb1-c9d222c48653", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "CVE-2026-102489", "external_references": [ { "source_name": "cve", "external_id": "CVE-2026-102489", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102489" } ] }, { "type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--64bc0638-4fe2-5d59-ba80-6267d6c9890b", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "CVE-2026-81578", "external_references": [ { "source_name": "cve", "external_id": "CVE-2026-81578", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-81578" } ] }, { "type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--6cf8bed1-93d2-5be5-85b6-176219c0e898", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "CVE-2019-7192", "external_references": [ { "source_name": "cve", "external_id": "CVE-2019-7192", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-7192" } ] }, { "type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--99cb1af2-5b32-5ec5-a8e2-84e1b114e064", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "CVE-2026-66384", "external_references": [ { "source_name": "cve", "external_id": "CVE-2026-66384", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-66384" } ] }, { "type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--9c8c4aa2-fe00-55d7-bda5-debaa324618a", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "CVE-2025-54068", "external_references": [ { "source_name": "cve", "external_id": "CVE-2025-54068", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54068" } ] }, { "type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--aab9eb78-63e4-5ba0-9ed3-594226ce1299", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "CVE-2021-29447", "external_references": [ { "source_name": "cve", "external_id": "CVE-2021-29447", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-29447" } ] }, { "type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--b51b761c-329b-561a-9c0b-f62c7154b039", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "CVE-2021-4034", "external_references": [ { "source_name": "cve", "external_id": "CVE-2021-4034", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-4034" } ] }, { "type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--bbc71e24-bff8-5457-bd89-0a687593eedd", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "CVE-2026-4815", "external_references": [ { "source_name": "cve", "external_id": "CVE-2026-4815", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4815" } ] }, { "type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--be38aa3d-3256-5720-bd71-7afdd9bf7711", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "CVE-2025-8217", "external_references": [ { "source_name": "cve", "external_id": "CVE-2025-8217", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8217" } ] }, { "type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--bff260c1-a9b8-54f7-b33d-301b1b2ee4e5", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "CVE-2023-27532", "external_references": [ { "source_name": "cve", "external_id": "CVE-2023-27532", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-27532" } ] }, { "type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--c12b77a3-5633-560a-9f2c-f94de3176b94", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "CVE-2026-33824", "external_references": [ { "source_name": "cve", "external_id": "CVE-2026-33824", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33824" } ] }, { "type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--c9cb16bb-8a10-5892-a2e4-e56e57291ae0", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "CVE-2026-3055", "external_references": [ { "source_name": "cve", "external_id": "CVE-2026-3055", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3055" } ] }, { "type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--c9fc3ccd-cdf6-5f70-ba9a-be0998ef70a5", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "CVE-2021-29441", "external_references": [ { "source_name": "cve", "external_id": "CVE-2021-29441", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-29441" } ] }, { "type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--cde81f2d-6234-508a-9e35-b74c1e66baff", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "CVE-2015-1397", "external_references": [ { "source_name": "cve", "external_id": "CVE-2015-1397", "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-1397" } ] }, { "type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--d3a694f3-7f64-5e67-8cc8-7220ff43a2c0", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "CVE-2017-7269", "external_references": [ { "source_name": "cve", "external_id": "CVE-2017-7269", "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7269" } ] }, { "type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--e6330e88-741e-585a-a9b7-a2ad376fcb09", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "CVE-2023-36664", "external_references": [ { "source_name": "cve", "external_id": "CVE-2023-36664", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-36664" } ] }, { "type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--e720c75b-759c-5abf-879a-5cd9146d220a", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "CVE-2025-68613", "external_references": [ { "source_name": "cve", "external_id": "CVE-2025-68613", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68613" } ] }, { "type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--f05a2630-af09-5f69-bf57-001443f8cdcb", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "CVE-2021-3129", "external_references": [ { "source_name": "cve", "external_id": "CVE-2021-3129", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3129" } ] }, { "type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--f0896b5a-ce2d-5921-8b3a-74c5928b7d7d", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "CVE-2026-63030", "external_references": [ { "source_name": "cve", "external_id": "CVE-2026-63030", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63030" } ] }, { "type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--f57406d2-953c-5765-a7d0-322361606dee", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "CVE-2022-0847", "external_references": [ { "source_name": "cve", "external_id": "CVE-2022-0847", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-0847" } ] }, { "type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--f710d0bc-b334-51ac-a806-ec82686e5ee9", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "CVE-2022-22947", "external_references": [ { "source_name": "cve", "external_id": "CVE-2022-22947", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22947" } ] }, { "type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--fd51f24e-ab57-5634-8f0d-f8f724f394e9", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "CVE-2026-39987", "external_references": [ { "source_name": "cve", "external_id": "CVE-2026-39987", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39987" } ] }, { "type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--fde37b4f-251e-5fd2-b6c5-fea4e7d66919", "created": "2020-01-01T00:00:00.000Z", "modified": "2020-01-01T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "CVE-2025-32711", "external_references": [ { "source_name": "cve", "external_id": "CVE-2025-32711", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32711" } ] }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--031b0d65-4e29-5a37-b500-b7aeb605410e", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-10T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "Meta internal AI agent gave faulty guidance that briefly exposed sensitive data to unauthorized staff", "incident_ref_id": "meta-internal-agent-sev1-data-exposure", "category": "autonomous-attack", "severity": "medium", "grade_status": "reported", "confidence": "secondary", "actor": "Meta internal AI agent (faulty guidance; no external attacker)", "actor_type": "unknown", "autonomy_level": "not-applicable", "ai_role": "significant", "guardrail_bypass": [ "none-observed" ], "model_families": [ "other" ], "date_disclosed": "2026-03-19" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--04bddfef-8a41-56d7-9a80-903117b877be", "created": "2026-10-15T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "postmark-mcp: an npm MCP server impersonating Postmark silently BCC'd every email sent through it to an attacker", "incident_ref_id": "postmark-mcp-bcc-backdoor", "category": "infrastructure-abuse-supply-chain", "severity": "medium", "grade_status": "confirmed", "confidence": "primary", "actor": "Unknown (the publisher of the npm package)", "actor_type": "unknown", "autonomy_level": "not-applicable", "ai_role": "incidental", "guardrail_bypass": [ "legitimate-tool-abuse" ], "model_families": [ "other" ], "date_disclosed": "2025-09-25" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--060303e3-864f-5e72-ba04-889a94a84730", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "Multi-agent AI framework used to compromise government entities in Asia", "incident_ref_id": "dream-multi-agent-asia-government-campaign", "category": "ai-orchestrated-campaign", "severity": "high", "grade_status": "reported", "confidence": "primary", "actor": "Unknown Chinese-language operator (attributed on linguistic grounds by Dream Research Labs; no group named)", "actor_type": "unknown", "autonomy_level": "supervised-autonomous", "ai_role": "significant", "guardrail_bypass": [ "jailbreak", "legitimate-tool-abuse" ], "model_families": [ "other" ], "date_disclosed": "2026-08-12" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--0931c83a-6418-58b2-9952-2a87de56e2a6", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "GTG-10007 Claude 'agent swarm' espionage and vulnerability-discovery program", "incident_ref_id": "gtg-10007-agent-swarm-intrusions", "category": "ai-orchestrated-campaign", "severity": "high", "grade_status": "confirmed", "confidence": "primary", "actor": "Chinese-speaking operators (tracked by Anthropic as GTG-10007), two identified as university undergraduates; no state sponsorship asserted", "actor_type": "unknown", "autonomy_level": "supervised-autonomous", "ai_role": "load-bearing", "guardrail_bypass": [ "legitimate-tool-abuse" ], "model_families": [ "claude" ], "date_disclosed": "2026-09-10" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--0db213fb-e3fd-5220-944e-0fbc47137152", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "GitHub MCP server could be steered via a public issue into leaking private repository contents", "incident_ref_id": "github-mcp-server-private-repo-leak", "category": "agent-hijack-prompt-injection", "severity": "medium", "grade_status": "reported", "confidence": "primary", "actor": "Security researchers (proof-of-concept; original research attributed to Invariant Labs)", "actor_type": "researcher", "autonomy_level": "not-applicable", "ai_role": "significant", "guardrail_bypass": [ "indirect-prompt-injection" ], "model_families": [ "other" ], "date_disclosed": "2025-05-26" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--169adc12-6588-50cd-8f4c-bda0a329a5fe", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "Clinejection: prompt injection of Cline's Claude issue-triage workflow led to an unauthorized npm release", "incident_ref_id": "clinejection-cline-triage-npm-publish", "category": "agent-hijack-prompt-injection", "severity": "high", "grade_status": "confirmed", "confidence": "primary", "actor": "Unknown (an \"unauthorized party\" per Cline; the researcher states a different actor reused his proof-of-concept)", "actor_type": "unknown", "autonomy_level": "not-applicable", "ai_role": "significant", "guardrail_bypass": [ "indirect-prompt-injection" ], "model_families": [ "claude" ], "date_disclosed": "2026-02-09" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--16b7caa2-ce65-551b-bbf0-d625c3993d42", "created": "2026-08-12T00:00:00.000Z", "modified": "2026-09-11T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "GTG-5004 AI-assisted ransomware-as-a-service operation", "incident_ref_id": "gtg-5004-ai-ransomware-raas", "category": "infrastructure-abuse-supply-chain", "severity": "high", "grade_status": "confirmed", "confidence": "primary", "actor": "UK-based threat actor (tracked by Anthropic as GTG-5004)", "actor_type": "single-operator", "autonomy_level": "tool-assisted", "ai_role": "significant", "guardrail_bypass": [ "legitimate-tool-abuse" ], "model_families": [ "claude" ], "date_disclosed": "2025-08-27" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--17dccc7b-48d9-5bdd-9ce4-984db3904f91", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "Prompt injection of Grok drained a Grok-linked crypto wallet via the Bankr trading agent", "incident_ref_id": "grok-bankr-prompt-injection-wallet-drain", "category": "agent-hijack-prompt-injection", "severity": "medium", "grade_status": "reported", "confidence": "secondary", "actor": "Unknown", "actor_type": "unknown", "autonomy_level": "not-applicable", "ai_role": "load-bearing", "guardrail_bypass": [ "indirect-prompt-injection" ], "model_families": [ "other" ], "date_disclosed": "2026-05-04" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--185118bd-4a33-5049-b4d9-cd63863a2cc2", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "ClawHavoc: large-scale poisoning of the OpenClaw ClawHub skill marketplace with credential-stealing skills", "incident_ref_id": "clawhavoc-clawhub-malicious-skills", "category": "infrastructure-abuse-supply-chain", "severity": "high", "grade_status": "confirmed", "confidence": "primary", "actor": "Unknown (operators identified only by ClawHub handles; financially motivated per Antiy CERT)", "actor_type": "cybercriminal", "autonomy_level": "not-applicable", "ai_role": "incidental", "guardrail_bypass": [ "legitimate-tool-abuse" ], "model_families": [ "other" ], "date_disclosed": "2026-02-01" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--19fc09ab-2373-5454-aa72-15084820b25c", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "LiteLLM PyPI package backdoored via a poisoned CI security scanner (TeamPCP)", "incident_ref_id": "litellm-pypi-teampcp-backdoor", "category": "infrastructure-abuse-supply-chain", "severity": "high", "grade_status": "confirmed", "confidence": "primary", "actor": "TeamPCP (also tracked as PCPcat), per Snyk", "actor_type": "cybercriminal", "autonomy_level": "not-applicable", "ai_role": "incidental", "guardrail_bypass": [ "legitimate-tool-abuse" ], "model_families": [ "other" ], "date_disclosed": "2026-03-24" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--1ac82234-3f0c-5957-83e9-5e92ba1e47d9", "created": "2026-10-15T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "OpenAI training and evaluation agents reached four further Australian government agencies' systems (BOCSAR, VAHI, AIHW, NSW NPWS), June 2026", "incident_ref_id": "openai-agents-australian-state-agencies", "category": "autonomous-attack", "severity": "medium", "grade_status": "confirmed", "confidence": "primary", "actor": "OpenAI internal research agents (unnamed models) operating during internal training and evaluation", "actor_type": "lab-test-eval", "autonomy_level": "fully-autonomous", "ai_role": "load-bearing", "guardrail_bypass": [ "unknown" ], "model_families": [ "other" ], "date_disclosed": "2026-09-24" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--1d0a6979-4243-5dd4-acd4-245a02075814", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "Cursor coding agent deleted PocketOS's production database and backups during a staging task", "incident_ref_id": "cursor-pocketos-database-deletion", "category": "autonomous-attack", "severity": "medium", "grade_status": "reported", "confidence": "secondary", "actor": "Cursor coding agent (autonomous)", "actor_type": "unknown", "autonomy_level": "fully-autonomous", "ai_role": "load-bearing", "guardrail_bypass": [ "none-observed" ], "model_families": [ "claude" ], "date_disclosed": "2026-08-18" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--241ffabe-9806-5eec-86e0-ad89c26e8aa2", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "GTG-50020 autonomous exploitation pipeline against ~30 AI companies and theft of production API keys", "incident_ref_id": "gtg-50020-ai-vendor-api-key-theft", "category": "infrastructure-abuse-supply-chain", "severity": "high", "grade_status": "confirmed", "confidence": "primary", "actor": "Russian-speaking, financially motivated actor (tracked by Anthropic as GTG-50020)", "actor_type": "cybercriminal", "autonomy_level": "fully-autonomous", "ai_role": "significant", "guardrail_bypass": [ "legitimate-tool-abuse" ], "model_families": [ "claude" ], "date_disclosed": "2026-09-10" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--26936b76-e72f-570d-a41d-bb12370e0e79", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "JADEPUFFER: agent-driven database extortion operation against an exposed AI-orchestration deployment", "incident_ref_id": "jadepuffer-agentic-database-extortion", "category": "autonomous-attack", "severity": "high", "grade_status": "reported", "confidence": "primary", "actor": "Unknown", "actor_type": "unknown", "autonomy_level": "supervised-autonomous", "ai_role": "significant", "guardrail_bypass": [ "unknown" ], "model_families": [ "other" ], "date_disclosed": "2026-07-01" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--27683e2e-675e-50c8-abc6-6e01094ffa04", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "DIVD CSIRT ticketing system breached through two Zammad zero-days; AI agents used in later attack stages", "incident_ref_id": "divd-zammad-ai-agent-breach", "category": "autonomous-attack", "severity": "high", "grade_status": "confirmed", "confidence": "primary", "actor": "Unknown", "actor_type": "unknown", "autonomy_level": "unknown", "ai_role": "significant", "guardrail_bypass": [ "unknown" ], "model_families": [ "other" ], "date_disclosed": "2026-09-24" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--2e1586f5-dd38-5a41-b3f1-29664080e414", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "Miasma worm: Azure/durabletask commit weaponized AI coding-agent configuration files; 73 Microsoft repositories disabled", "incident_ref_id": "miasma-worm-ai-coding-agent-configs", "category": "infrastructure-abuse-supply-chain", "severity": "high", "grade_status": "reported", "confidence": "primary", "actor": "TeamPCP (per StepSecurity, via command-and-control infrastructure linked to the same account's earlier PyPI attack; the June commit is not directly attributed)", "actor_type": "cybercriminal", "autonomy_level": "not-applicable", "ai_role": "significant", "guardrail_bypass": [ "indirect-prompt-injection", "legitimate-tool-abuse" ], "model_families": [ "claude", "gemini", "other" ], "date_disclosed": "2026-06-05" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--3434e254-26c0-5d07-a8f4-b45fbc5d00ad", "created": "2026-10-15T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "Typosquatted Paperclip and Browser Use skills on skills.sh told AI agents to fetch and run a credential stealer", "incident_ref_id": "skills-sh-paperclip-malicious-skills", "category": "infrastructure-abuse-supply-chain", "severity": "high", "grade_status": "reported", "confidence": "primary", "actor": "Unknown (a single GitHub account and look-alike organisations, per Zenity Labs)", "actor_type": "unknown", "autonomy_level": "not-applicable", "ai_role": "significant", "guardrail_bypass": [ "indirect-prompt-injection" ], "model_families": [ "other" ], "date_disclosed": "2026-08-06" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--3556fd91-cc8a-56a3-b506-27cb701c25ea", "created": "2026-08-12T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "Amazon Q Developer VS Code extension compromise (data-wiping prompt injection)", "incident_ref_id": "amazon-q-developer-extension-compromise", "category": "infrastructure-abuse-supply-chain", "severity": "high", "grade_status": "confirmed", "confidence": "primary", "actor": "lkmanka58", "actor_type": "single-operator", "autonomy_level": "not-applicable", "ai_role": "significant", "guardrail_bypass": [ "indirect-prompt-injection" ], "model_families": [ "other" ], "date_disclosed": "2025-07-23" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--37ae38c3-bd84-504b-a2ab-cdeac5170719", "created": "2026-08-12T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "EchoLeak — zero-click prompt injection in Microsoft 365 Copilot", "incident_ref_id": "echoleak-m365-copilot", "category": "agent-hijack-prompt-injection", "severity": "critical", "grade_status": "confirmed", "confidence": "primary", "actor": "Aim Labs (Aim Security)", "actor_type": "researcher", "autonomy_level": "not-applicable", "ai_role": "load-bearing", "guardrail_bypass": [ "indirect-prompt-injection" ], "model_families": [ "openai-gpt" ], "date_disclosed": "2025-06-11" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--37dac830-f83a-5700-b294-ecbe5c608722", "created": "2026-10-09T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "PROMPTSPY — Android backdoor that delegates on-device UI actions to the Gemini API", "incident_ref_id": "promptspy-gemini-android-agent", "category": "autonomous-attack", "severity": "medium", "grade_status": "confirmed", "confidence": "primary", "actor": "Unknown", "actor_type": "unknown", "autonomy_level": "supervised-autonomous", "ai_role": "load-bearing", "guardrail_bypass": [ "legitimate-tool-abuse" ], "model_families": [ "gemini" ], "date_disclosed": "2026-05-12" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--383a814b-9d6a-53cd-ab5c-a190892a1ba0", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "Autonomous AI agents compromised online retailers and planted payment-card skimmers at low per-victim cost", "incident_ref_id": "gambit-ai-agents-retail-skimmer-campaign", "category": "autonomous-attack", "severity": "critical", "grade_status": "reported", "confidence": "primary", "actor": "Unknown financially motivated operator (operator instructions in Chinese; no group named by Gambit)", "actor_type": "cybercriminal", "autonomy_level": "supervised-autonomous", "ai_role": "load-bearing", "guardrail_bypass": [ "legitimate-tool-abuse" ], "model_families": [ "claude", "deepseek", "other" ], "date_disclosed": "2026-09-22" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--3cc02451-11a6-59a4-9f7e-7fb5c9b9dc75", "created": "2026-10-15T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "Operator ran a DeepSeek-powered Hermes Agent in autonomous exploitation attempts; confirmed impact came from manual exploitation", "incident_ref_id": "unit42-hermes-deepseek-autonomous-campaign", "category": "autonomous-attack", "severity": "medium", "grade_status": "reported", "confidence": "primary", "actor": "Unnamed Chinese-speaking opportunistic exploit operator (no group named; Unit 42 states the actor is based in China)", "actor_type": "single-operator", "autonomy_level": "supervised-autonomous", "ai_role": "significant", "guardrail_bypass": [ "open-weight-model" ], "model_families": [ "deepseek" ], "date_disclosed": "2026-07-30" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--3d700140-755d-56ac-a631-9a9236a19b35", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "UK AI Security Institute evaluation agents took unsanctioned live-internet actions against real parties", "incident_ref_id": "aisi-unsanctioned-agent-cyber-testing", "category": "autonomous-attack", "severity": "medium", "grade_status": "confirmed", "confidence": "primary", "actor": "UK AI Security Institute evaluation agents (Anthropic Mythos 5 and OpenAI GPT-5.6 Sol) acting outside intended scope during cyber testing", "actor_type": "lab-test-eval", "autonomy_level": "fully-autonomous", "ai_role": "load-bearing", "guardrail_bypass": [ "none-observed" ], "model_families": [ "claude", "openai-gpt" ], "date_disclosed": "2026-08-04" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--499237bb-bb32-5ec8-ae75-897e77090751", "created": "2026-10-15T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "Carbonato botnet installs a Hermes agent persona on hijacked Docker hosts as an operator interface prioritising AI API key theft", "incident_ref_id": "carbonato-docker-hermes-botnet", "category": "infrastructure-abuse-supply-chain", "severity": "medium", "grade_status": "reported", "confidence": "primary", "actor": "Unknown Carbonato botnet operators (ThreatDown assesses them as Costa Rica-based; no known cluster)", "actor_type": "cybercriminal", "autonomy_level": "human-in-the-loop", "ai_role": "incidental", "guardrail_bypass": [ "legitimate-tool-abuse", "jailbreak" ], "model_families": [ "other" ], "date_disclosed": "2026-09-22" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--4a14b979-14a8-5dbb-bcab-4c4fcc676440", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "OpenClaw agent deleted a researcher's emails and ignored stop commands", "incident_ref_id": "openclaw-inbox-deletion", "category": "autonomous-attack", "severity": "low", "grade_status": "reported", "confidence": "secondary", "actor": "OpenClaw agent (autonomous)", "actor_type": "unknown", "autonomy_level": "fully-autonomous", "ai_role": "load-bearing", "guardrail_bypass": [ "none-observed" ], "model_families": [ "other" ], "date_disclosed": "2026-02-23" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--4a293b15-f769-57f2-bd64-5436800afe7c", "created": "2026-10-15T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "Low-skilled operator drove Claude Code and Codex agents from hijacked servers to breach at least 14 companies", "incident_ref_id": "oalabs-compromised-server-claude-codex-intrusions", "category": "ai-orchestrated-campaign", "severity": "high", "grade_status": "reported", "confidence": "primary", "actor": "Unnamed individual operator (no group; OALABS researchers place him in Ethiopia)", "actor_type": "single-operator", "autonomy_level": "supervised-autonomous", "ai_role": "load-bearing", "guardrail_bypass": [ "jailbreak", "legitimate-tool-abuse" ], "model_families": [ "claude", "openai-codex" ], "date_disclosed": "2026-06-16" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--51f91cda-02ca-5fd2-977a-b2c18be16447", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "OpenAI-attributed agent swarm commandeered the DseWiki forum and resisted deletion", "incident_ref_id": "openai-attributed-dsewiki-agent-swarm", "category": "autonomous-attack", "severity": "low", "grade_status": "confirmed", "confidence": "primary", "actor": "OpenAI-attributed agents (acknowledged by OpenAI as originating from it) during internal evaluation", "actor_type": "lab-test-eval", "autonomy_level": "fully-autonomous", "ai_role": "load-bearing", "guardrail_bypass": [ "none-observed" ], "model_families": [ "openai-gpt" ], "date_disclosed": "2026-09-04" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--5295a5a9-e634-5f00-95aa-15f04fa14b9d", "created": "2026-10-15T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "Suspected The Gentlemen ransomware affiliate used Claude Code to breach VPN appliances and exfiltrate data across eight organizations", "incident_ref_id": "gambit-gentlemen-affiliate-claude-code-intrusions", "category": "ai-orchestrated-campaign", "severity": "high", "grade_status": "reported", "confidence": "primary", "actor": "Suspected affiliate of The Gentlemen ransomware-as-a-service operation (medium confidence, per Gambit)", "actor_type": "cybercriminal", "autonomy_level": "human-in-the-loop", "ai_role": "significant", "guardrail_bypass": [ "jailbreak", "legitimate-tool-abuse" ], "model_families": [ "claude" ], "date_disclosed": "2026-08-13" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--5e62b565-9091-59cf-ad34-b95d57b90de5", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "AI-orchestrated campaign compromised hundreds of PaperCut servers across dozens of countries", "incident_ref_id": "papercut-agentic-global-intrusion", "category": "autonomous-attack", "severity": "high", "grade_status": "reported", "confidence": "primary", "actor": "Likely Russian-speaking actor (per GreyNoise; not classified as criminal or state)", "actor_type": "unknown", "autonomy_level": "supervised-autonomous", "ai_role": "significant", "guardrail_bypass": [ "legitimate-tool-abuse" ], "model_families": [ "openai-codex", "deepseek" ], "date_disclosed": "2026-09-09" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--62bedec3-c9ca-55c8-9fba-5e8003cfb899", "created": "2026-10-15T00:00:00.000Z", "modified": "2026-10-15T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "Storm-3168 (JADEPUFFER) used compromised Azure service principals for rapid, automated cloud resource destruction", "incident_ref_id": "storm-3168-azure-service-principal-destruction", "category": "autonomous-attack", "severity": "high", "grade_status": "reported", "confidence": "primary", "actor": "Storm-3168 (Microsoft's designation for the actor Sysdig calls JADEPUFFER; no attribution stated)", "actor_type": "unknown", "autonomy_level": "unknown", "ai_role": "disputed", "guardrail_bypass": [ "unknown" ], "model_families": [ "other" ], "date_disclosed": "2026-09-25" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--64e81a48-0c44-5d8b-ab52-f6496a81ec84", "created": "2026-10-15T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "AI agents probed U.S. and Canadian government websites, including failed SQL-injection attempts (2026)", "incident_ref_id": "ai-agents-us-canada-government-websites", "category": "autonomous-attack", "severity": "low", "grade_status": "reported", "confidence": "primary", "actor": "Unknown", "actor_type": "unknown", "autonomy_level": "unknown", "ai_role": "load-bearing", "guardrail_bypass": [ "unknown" ], "model_families": [ "other" ], "date_disclosed": "2026-09-25" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--6580f9fe-092a-5dbd-93f0-8d557b451c1f", "created": "2026-08-12T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "PROMPTSTEAL / LAMEHUG — LLM-enabled data miner used against Ukraine", "incident_ref_id": "promptsteal-apt28-lamehug", "category": "ai-orchestrated-campaign", "severity": "high", "grade_status": "confirmed", "confidence": "primary", "actor": "APT28 (FROZENLAKE), Russian government-backed", "actor_type": "nation-state", "autonomy_level": "supervised-autonomous", "ai_role": "load-bearing", "guardrail_bypass": [ "open-weight-model" ], "model_families": [ "qwen" ], "date_disclosed": "2025-11-05" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--65d06cb7-b1ce-587a-8aae-aa6b34ccbb7c", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "AnonyMousKIT: AI-voice phishing-as-a-service for unlocking stolen Apple devices", "incident_ref_id": "anonymouskit-ai-voice-phishing-apple", "category": "ai-orchestrated-campaign", "severity": "high", "grade_status": "reported", "confidence": "primary", "actor": "Unknown operators of the AnonyMousKIT platform (identified only by platform handles)", "actor_type": "cybercriminal", "autonomy_level": "supervised-autonomous", "ai_role": "significant", "guardrail_bypass": [ "legitimate-tool-abuse" ], "model_families": [ "other" ], "date_disclosed": "2026-08-24" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--6ca33f26-6652-5d5a-b1b2-ad9dcfbf453b", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "GTG-50029 single hacktivist's Claude-built mass privacy attack on European political targets", "incident_ref_id": "gtg-50029-hacktivist-agentic-recon", "category": "ai-orchestrated-campaign", "severity": "high", "grade_status": "confirmed", "confidence": "primary", "actor": "Single French-speaking hacktivist (tracked by Anthropic as GTG-50029)", "actor_type": "single-operator", "autonomy_level": "human-in-the-loop", "ai_role": "significant", "guardrail_bypass": [ "legitimate-tool-abuse" ], "model_families": [ "claude" ], "date_disclosed": "2026-09-10" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--6d07747c-83c7-5886-ac99-c1c3e79ba50e", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-10T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "hackerbot-claw: self-described autonomous 'security research agent' exploiting GitHub Actions across open-source projects", "incident_ref_id": "hackerbot-claw-github-pr-campaign", "category": "autonomous-attack", "severity": "medium", "grade_status": "confirmed", "confidence": "primary", "actor": "Unknown", "actor_type": "unknown", "autonomy_level": "unknown", "ai_role": "disputed", "guardrail_bypass": [ "unknown" ], "model_families": [ "claude" ], "date_disclosed": "2026-03-01" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--6e4c303e-14f4-59b4-a2e1-1bf7fd186817", "created": "2026-10-15T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "CyberXero: access broker ran a Claude Code agent swarm alongside global web exploitation and Ukrainian utility intrusions", "incident_ref_id": "cyberxero-ai-augmented-access-broker", "category": "ai-orchestrated-campaign", "severity": "critical", "grade_status": "reported", "confidence": "primary", "actor": "CyberXero (SOCRadar: Russian-speaking, financially motivated initial access broker)", "actor_type": "cybercriminal", "autonomy_level": "human-in-the-loop", "ai_role": "significant", "guardrail_bypass": [ "jailbreak", "legitimate-tool-abuse" ], "model_families": [ "claude" ], "date_disclosed": "2026-10-06" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--6febd2f2-6e88-5c61-b9b9-fe4d1d2ea300", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "Coral Sleet (North Korea) operationalizes agentic AI tools across its attack workflow", "incident_ref_id": "coral-sleet-agentic-ai-workflow", "category": "ai-orchestrated-campaign", "severity": "medium", "grade_status": "reported", "confidence": "primary", "actor": "Coral Sleet (North Korean state actor, formerly Storm-1877, per Microsoft Threat Intelligence)", "actor_type": "nation-state", "autonomy_level": "unknown", "ai_role": "significant", "guardrail_bypass": [ "jailbreak", "legitimate-tool-abuse" ], "model_families": [ "other" ], "date_disclosed": "2026-03-06" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--70947b37-128b-5a87-a06f-17381684688f", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "Aurora ransomware operators used the Cursor coding agent during intrusions across victim networks", "incident_ref_id": "aurora-cursor-agent-ransomware", "category": "autonomous-attack", "severity": "high", "grade_status": "confirmed", "confidence": "primary", "actor": "Aurora ransomware operators (Russian-speaking per Reuters; second cluster attributed with medium confidence)", "actor_type": "cybercriminal", "autonomy_level": "tool-assisted", "ai_role": "significant", "guardrail_bypass": [ "legitimate-tool-abuse" ], "model_families": [ "claude" ], "date_disclosed": "2026-08-27" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--73294ee1-dfa2-59cc-bc00-b575e0d90865", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "Exposed server reveals AI-agent ransomware operation that stole 3.1 TB from 30+ GitLab victims", "incident_ref_id": "gentlemen-hermes-agent-gitlab-extortion", "category": "autonomous-attack", "severity": "high", "grade_status": "reported", "confidence": "secondary", "actor": "The Gentlemen ransomware affiliate (per ransom notes found on the server)", "actor_type": "cybercriminal", "autonomy_level": "supervised-autonomous", "ai_role": "significant", "guardrail_bypass": [ "legitimate-tool-abuse" ], "model_families": [ "hermes" ], "date_disclosed": "2026-09-02" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--7689f445-28b0-5a1d-b291-0ef493463c9f", "created": "2026-10-15T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "Claude models took unintended actions on real third-party websites during Anthropic evaluations and internal use (2026)", "incident_ref_id": "anthropic-unintended-model-actions-real-websites", "category": "autonomous-attack", "severity": "low", "grade_status": "confirmed", "confidence": "primary", "actor": "Anthropic evaluation and internal-use agents (Claude Mythos Preview, Claude Mythos 5, Claude Haiku 4.5, Claude Opus 5 and an unreleased research model) acting outside their intended scope", "actor_type": "lab-test-eval", "autonomy_level": "fully-autonomous", "ai_role": "load-bearing", "guardrail_bypass": [ "none-observed" ], "model_families": [ "claude" ], "date_disclosed": "2026-10-09" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--7ad8a6fd-1413-525c-9c47-187175e78154", "created": "2026-08-13T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "Replit AI coding agent deleted a production database during a code freeze", "incident_ref_id": "replit-agent-database-deletion", "category": "autonomous-attack", "severity": "high", "grade_status": "confirmed", "confidence": "secondary", "actor": "Replit AI agent (autonomous)", "actor_type": "unknown", "autonomy_level": "fully-autonomous", "ai_role": "load-bearing", "guardrail_bypass": [ "none-observed" ], "model_families": [ "other" ], "date_disclosed": "2025-07-21" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--7b16575f-b865-5e5f-bce7-4acc2d766052", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "GTG-50014 ShinyHunters-linked agentic mass data theft and extortion", "incident_ref_id": "gtg-50014-agentic-mass-exfiltration", "category": "ai-orchestrated-campaign", "severity": "critical", "grade_status": "confirmed", "confidence": "primary", "actor": "Suspected ShinyHunters affiliates (tracked by Anthropic as GTG-50014)", "actor_type": "cybercriminal", "autonomy_level": "supervised-autonomous", "ai_role": "load-bearing", "guardrail_bypass": [ "unknown" ], "model_families": [ "claude" ], "date_disclosed": "2026-09-10" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--7bb5109c-5223-575c-bd6f-5a5016bd8a70", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "Pillar: a GitHub issue on Gemini CLI could lead to compromise of a GCP triage project", "incident_ref_id": "pillar-gemini-cli-gcp-triage-compromise", "category": "agent-hijack-prompt-injection", "severity": "medium", "grade_status": "reported", "confidence": "primary", "actor": "Pillar Security researchers (authorized disclosure)", "actor_type": "researcher", "autonomy_level": "not-applicable", "ai_role": "significant", "guardrail_bypass": [ "indirect-prompt-injection" ], "model_families": [ "gemini" ], "date_disclosed": "2026-08-18" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--8332c8b1-df57-507d-89f2-ff3c79cdfb4d", "created": "2026-08-12T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "CamoLeak — GitHub Copilot Chat prompt-injection data exfiltration", "incident_ref_id": "camoleak-github-copilot-chat", "category": "agent-hijack-prompt-injection", "severity": "critical", "grade_status": "reported", "confidence": "primary", "actor": "Omer Mayraz (Legit Security)", "actor_type": "researcher", "autonomy_level": "not-applicable", "ai_role": "load-bearing", "guardrail_bypass": [ "indirect-prompt-injection" ], "model_families": [ "other" ], "date_disclosed": "2025-10-08" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--83b93ab6-3229-5e31-8d3c-5a8478b9dc96", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "GitLost: GitHub Agentic Workflows agent tricked into leaking private repository contents", "incident_ref_id": "gitlost-github-agentic-workflows-repo-leak", "category": "agent-hijack-prompt-injection", "severity": "medium", "grade_status": "reported", "confidence": "primary", "actor": "Noma Security researchers (authorized disclosure)", "actor_type": "researcher", "autonomy_level": "not-applicable", "ai_role": "significant", "guardrail_bypass": [ "indirect-prompt-injection" ], "model_families": [ "claude", "other" ], "date_disclosed": "2026-07-06" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--88d88613-b95b-513c-ba4c-410c1f4d27bf", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-10T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "Instinct AI assistant sent an email without approval and retained data after access was revoked", "incident_ref_id": "instinct-assistant-unauthorized-email", "category": "autonomous-attack", "severity": "low", "grade_status": "reported", "confidence": "secondary", "actor": "Instinct AI assistant (acting beyond user instruction)", "actor_type": "unknown", "autonomy_level": "supervised-autonomous", "ai_role": "load-bearing", "guardrail_bypass": [ "none-observed" ], "model_families": [ "other" ], "date_disclosed": "2026-08-24" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--8a44d2a6-b372-5a79-9ac6-5a3fd57d7584", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "OpenAI training agent uploaded a workbook to a public file-hosting service to bypass file isolation", "incident_ref_id": "openai-agent-public-file-hosting-upload", "category": "autonomous-attack", "severity": "low", "grade_status": "confirmed", "confidence": "primary", "actor": "OpenAI unreleased model sub-agent bypassing file isolation during training", "actor_type": "lab-test-eval", "autonomy_level": "fully-autonomous", "ai_role": "load-bearing", "guardrail_bypass": [ "none-observed" ], "model_families": [ "openai-gpt" ], "date_disclosed": "2026-09-16" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--8ff8321b-fd31-512a-a794-168df342c627", "created": "2026-08-12T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "Nx 's1ngularity' npm supply-chain attack weaponising AI CLI tools", "incident_ref_id": "nx-s1ngularity-supply-chain", "category": "infrastructure-abuse-supply-chain", "severity": "critical", "grade_status": "confirmed", "confidence": "primary", "actor": "Unknown", "actor_type": "unknown", "autonomy_level": "tool-assisted", "ai_role": "significant", "guardrail_bypass": [ "legitimate-tool-abuse" ], "model_families": [ "claude", "gemini", "other" ], "date_disclosed": "2025-08-27" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--95b1188e-9c93-5584-87f9-855fe921187a", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "Supabase MCP server could be steered into exposing a private database table", "incident_ref_id": "supabase-mcp-database-leak", "category": "agent-hijack-prompt-injection", "severity": "medium", "grade_status": "reported", "confidence": "primary", "actor": "General Analysis researchers (proof-of-concept)", "actor_type": "researcher", "autonomy_level": "not-applicable", "ai_role": "significant", "guardrail_bypass": [ "indirect-prompt-injection" ], "model_families": [ "other" ], "date_disclosed": "2025-07-08" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--99150a59-1a06-5fe8-9965-1dde6d4298de", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "Shadow Escape: zero-click data-exfiltration technique against MCP-connected AI agents", "incident_ref_id": "shadow-escape-mcp-zero-click", "category": "agent-hijack-prompt-injection", "severity": "medium", "grade_status": "reported", "confidence": "secondary", "actor": "Operant AI researchers (research demonstration)", "actor_type": "researcher", "autonomy_level": "not-applicable", "ai_role": "significant", "guardrail_bypass": [ "indirect-prompt-injection" ], "model_families": [ "other" ], "date_disclosed": "2025-10-22" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--9d5cdee8-6183-529f-b73f-bf600efa5561", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "GTG-20006 agentic espionage against government, defense and diplomatic targets (Russia-nexus)", "incident_ref_id": "gtg-20006-agentic-espionage", "category": "ai-orchestrated-campaign", "severity": "high", "grade_status": "confirmed", "confidence": "primary", "actor": "Russia-nexus espionage actor (tracked by Anthropic as GTG-20006; attribution described as consistent with public reporting on Midnight Blizzard)", "actor_type": "nation-state", "autonomy_level": "supervised-autonomous", "ai_role": "significant", "guardrail_bypass": [ "legitimate-tool-abuse" ], "model_families": [ "claude" ], "date_disclosed": "2026-09-10" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--9f491946-117c-535b-ab9b-4e85b91753f9", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "OpenAI-attributed agents probed Hugging Face and hijacked two user accounts two months before the July breach", "incident_ref_id": "openai-huggingface-may-account-hijacking", "category": "autonomous-attack", "severity": "medium", "grade_status": "confirmed", "confidence": "primary", "actor": "OpenAI-attributed agents (an internal-only research model) acting without authorization", "actor_type": "lab-test-eval", "autonomy_level": "fully-autonomous", "ai_role": "load-bearing", "guardrail_bypass": [ "none-observed" ], "model_families": [ "openai-gpt", "other" ], "date_disclosed": "2026-09-16" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--a4573faa-157b-5888-af8b-afa75acd497a", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "Wikimedia Foundation links OpenAI-attributed agents to unauthorized edits and an Etherpad probe", "incident_ref_id": "openai-attributed-wikimedia-edits", "category": "autonomous-attack", "severity": "low", "grade_status": "reported", "confidence": "primary", "actor": "OpenAI-attributed agents (Wikimedia states this as belief; OpenAI did not confirm)", "actor_type": "unknown", "autonomy_level": "unknown", "ai_role": "significant", "guardrail_bypass": [ "none-observed" ], "model_families": [ "openai-gpt" ], "date_disclosed": "2026-10-05" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--a47dbaed-2dda-53f1-ac72-f08230ac08d8", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-10T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "PixelLeak: AI coding agents published internal review screenshots to public repositories", "incident_ref_id": "glow-pixelleak-agent-screenshot-exposure", "category": "autonomous-attack", "severity": "high", "grade_status": "reported", "confidence": "primary", "actor": "AI coding agents producing unsafe workarounds during legitimate development tasks (no external attacker)", "actor_type": "unknown", "autonomy_level": "fully-autonomous", "ai_role": "load-bearing", "guardrail_bypass": [ "none-observed" ], "model_families": [ "claude" ], "date_disclosed": "2026-09-29" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--a80519b8-d38c-515d-84e3-e288fbd8b657", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "Claude Cowork could be manipulated into uploading a user's files to an attacker account", "incident_ref_id": "claude-cowork-file-exfiltration", "category": "agent-hijack-prompt-injection", "severity": "medium", "grade_status": "reported", "confidence": "secondary", "actor": "PromptArmor researchers (proof-of-concept)", "actor_type": "researcher", "autonomy_level": "not-applicable", "ai_role": "significant", "guardrail_bypass": [ "indirect-prompt-injection" ], "model_families": [ "claude" ], "date_disclosed": "2026-01-14" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--aac8177d-5a52-59d0-b290-5da2cb217ce1", "created": "2026-10-15T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "Single operator used Claude Code and GPT-4.1 to breach Mexican government organizations (Dec 2025-Feb 2026)", "incident_ref_id": "mexico-government-claude-code-intrusions", "category": "ai-orchestrated-campaign", "severity": "critical", "grade_status": "reported", "confidence": "primary", "actor": "Unidentified single operator (Gambit names no group; researchers told Bloomberg they do not believe a foreign government is involved)", "actor_type": "single-operator", "autonomy_level": "human-in-the-loop", "ai_role": "significant", "guardrail_bypass": [ "jailbreak", "legitimate-tool-abuse" ], "model_families": [ "claude", "openai-gpt" ], "date_disclosed": "2026-02-25" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--ab0b8e98-56b2-5cd1-83da-c266457d7495", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "GhostJacking: poisoned telemetry could steer AI coding agents into DNS changes and command execution", "incident_ref_id": "ghostjacking-agentic-kill-chain-poc", "category": "agent-hijack-prompt-injection", "severity": "high", "grade_status": "reported", "confidence": "primary", "actor": "Tenet Security researchers (research demonstration)", "actor_type": "researcher", "autonomy_level": "not-applicable", "ai_role": "significant", "guardrail_bypass": [ "indirect-prompt-injection" ], "model_families": [ "claude" ], "date_disclosed": "2026-08-09" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--ac667ca9-44ac-5c3b-a6e8-fbb52ff62b78", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "Attacker used an LLM agent to move from a Marimo notebook CVE to an internal database in under an hour", "incident_ref_id": "sysdig-marimo-ai-agent-database-exfiltration", "category": "autonomous-attack", "severity": "medium", "grade_status": "reported", "confidence": "primary", "actor": "Unknown", "actor_type": "unknown", "autonomy_level": "supervised-autonomous", "ai_role": "significant", "guardrail_bypass": [ "unknown" ], "model_families": [ "other" ], "date_disclosed": "2026-05-26" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--b758044a-f1c4-5838-8aa9-7618fa5e1a53", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "Pillar: low-privilege triage agent could trigger privileged Gemini workflows on Google's ADK repository", "incident_ref_id": "pillar-adk-agent-privilege-escalation", "category": "agent-hijack-prompt-injection", "severity": "medium", "grade_status": "reported", "confidence": "primary", "actor": "Pillar Security researchers (authorized disclosure)", "actor_type": "researcher", "autonomy_level": "not-applicable", "ai_role": "significant", "guardrail_bypass": [ "indirect-prompt-injection" ], "model_families": [ "gemini" ], "date_disclosed": "2026-08-03" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--b76af936-1fcd-5d59-a8ad-f1701f646ba5", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "Google's Gemini breached three real companies during a cybersecurity evaluation", "incident_ref_id": "gemini-evaluation-real-company-breaches", "category": "autonomous-attack", "severity": "medium", "grade_status": "reported", "confidence": "secondary", "actor": "Google's Gemini model acting against real companies during a cybersecurity evaluation", "actor_type": "lab-test-eval", "autonomy_level": "fully-autonomous", "ai_role": "load-bearing", "guardrail_bypass": [ "none-observed" ], "model_families": [ "gemini" ], "date_disclosed": "2026-09-18" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--b9d2f85c-33e5-591e-b78d-33f192c10bdf", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "Snowflake Cortex Code CLI could be driven out of its sandbox via indirect prompt injection", "incident_ref_id": "snowflake-cortex-cli-sandbox-escape", "category": "agent-hijack-prompt-injection", "severity": "high", "grade_status": "reported", "confidence": "primary", "actor": "PromptArmor researchers (coordinated disclosure with Snowflake)", "actor_type": "researcher", "autonomy_level": "not-applicable", "ai_role": "significant", "guardrail_bypass": [ "indirect-prompt-injection" ], "model_families": [ "other" ], "date_disclosed": "2026-03-16" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--b9e0e7e0-170e-50fc-b8f3-a9a3499f49b1", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "Google Antigravity agent could be led by a malicious web page to exfiltrate local data", "incident_ref_id": "google-antigravity-data-exfiltration-poc", "category": "agent-hijack-prompt-injection", "severity": "medium", "grade_status": "reported", "confidence": "primary", "actor": "PromptArmor researchers (proof-of-concept)", "actor_type": "researcher", "autonomy_level": "not-applicable", "ai_role": "significant", "guardrail_bypass": [ "indirect-prompt-injection" ], "model_families": [ "gemini" ], "date_disclosed": "2025-11-25" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--badcfeb6-5420-525f-9113-62a46fa73727", "created": "2026-08-13T00:00:00.000Z", "modified": "2026-08-13T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "ServiceNow Now Assist agent-to-agent prompt injection (insecure defaults)", "incident_ref_id": "servicenow-now-assist-agent-injection", "category": "agent-hijack-prompt-injection", "severity": "high", "grade_status": "reported", "confidence": "primary", "actor": "AppOmni (AO Labs)", "actor_type": "researcher", "autonomy_level": "not-applicable", "ai_role": "load-bearing", "guardrail_bypass": [ "indirect-prompt-injection" ], "model_families": [ "other" ], "date_disclosed": "2025-11-19" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--bbea3ad6-9ba8-50eb-b5ab-684eb9d72d99", "created": "2026-08-13T00:00:00.000Z", "modified": "2026-08-13T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "PROMPTFLUX — experimental self-modifying malware abusing the Gemini API", "incident_ref_id": "promptflux-gemini-selfmod", "category": "infrastructure-abuse-supply-chain", "severity": "low", "grade_status": "reported", "confidence": "primary", "actor": "Unknown", "actor_type": "unknown", "autonomy_level": "supervised-autonomous", "ai_role": "significant", "guardrail_bypass": [ "legitimate-tool-abuse" ], "model_families": [ "gemini" ], "date_disclosed": "2025-11-06" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--bd50e5a1-e8b9-53e3-8cb2-871c90aec72c", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-10T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "Amazon's Kiro coding agent tied to a ~13-hour AWS Cost Explorer outage", "incident_ref_id": "amazon-kiro-aws-cost-explorer-outage", "category": "autonomous-attack", "severity": "medium", "grade_status": "reported", "confidence": "secondary", "actor": "Amazon Kiro coding agent (autonomous action during an authorized change; causation disputed by Amazon)", "actor_type": "unknown", "autonomy_level": "supervised-autonomous", "ai_role": "disputed", "guardrail_bypass": [ "none-observed" ], "model_families": [ "other" ], "date_disclosed": "2026-02-21" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--bdbcf04a-002d-56ce-9534-7887956bde30", "created": "2026-08-13T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "Morris II — self-replicating worm targeting GenAI-powered applications", "incident_ref_id": "morris-ii-genai-worm", "category": "lab-escape-eval", "severity": "medium", "grade_status": "test-eval", "confidence": "primary", "actor": "Researchers (Cohen, Bitton, Nassi — Technion / Intuit / Cornell Tech)", "actor_type": "researcher", "autonomy_level": "not-applicable", "ai_role": "load-bearing", "guardrail_bypass": [ "indirect-prompt-injection" ], "model_families": [ "openai-gpt", "gemini", "other" ], "date_disclosed": "2024-03-05" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--bf2cc43b-51ae-5231-b666-89196c6ece19", "created": "2026-08-12T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "North Korean IT-worker remote-employment fraud using Claude", "incident_ref_id": "dprk-it-worker-fraud-claude", "category": "infrastructure-abuse-supply-chain", "severity": "high", "grade_status": "confirmed", "confidence": "primary", "actor": "North Korean operatives (DPRK IT workers)", "actor_type": "nation-state", "autonomy_level": "tool-assisted", "ai_role": "significant", "guardrail_bypass": [ "legitimate-tool-abuse" ], "model_families": [ "claude" ], "date_disclosed": "2025-08-27" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--c2b0fe57-e542-5e2e-a572-30b528c05293", "created": "2026-08-12T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "GTG-1002 AI-orchestrated cyber-espionage campaign", "incident_ref_id": "gtg-1002-ai-espionage", "category": "ai-orchestrated-campaign", "severity": "high", "grade_status": "confirmed", "confidence": "primary", "actor": "Chinese state-sponsored group (tracked by Anthropic as GTG-1002)", "actor_type": "nation-state", "autonomy_level": "supervised-autonomous", "ai_role": "load-bearing", "guardrail_bypass": [ "jailbreak", "legitimate-tool-abuse" ], "model_families": [ "claude" ], "date_disclosed": "2025-11-13" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--c792c467-0ef4-5c4f-9398-4faa8ae2e81c", "created": "2026-08-12T00:00:00.000Z", "modified": "2026-09-11T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "Microsoft/OpenAI disruption of state-affiliated actors misusing LLMs (2024)", "incident_ref_id": "microsoft-openai-state-actor-llm", "category": "infrastructure-abuse-supply-chain", "severity": "medium", "grade_status": "confirmed", "confidence": "primary", "actor": "Five state-affiliated actors: Forest Blizzard, Emerald Sleet, Crimson Sandstorm, Charcoal Typhoon, Salmon Typhoon", "actor_type": "nation-state", "autonomy_level": "tool-assisted", "ai_role": "incidental", "guardrail_bypass": [ "legitimate-tool-abuse" ], "model_families": [ "openai-gpt" ], "date_disclosed": "2024-02-14" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--c9ad3b99-45c0-5e93-8ea9-8da478bf5c6d", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "Autonomous security agent reached production data on McKinsey's Lilli AI platform (responsible disclosure)", "incident_ref_id": "codewall-mckinsey-lilli-agent-intrusion", "category": "autonomous-attack", "severity": "high", "grade_status": "reported", "confidence": "primary", "actor": "CodeWall autonomous offensive-security agent (authorized research, no human in the loop)", "actor_type": "researcher", "autonomy_level": "fully-autonomous", "ai_role": "load-bearing", "guardrail_bypass": [ "none-observed" ], "model_families": [ "other" ], "date_disclosed": "2026-03-09" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--ca7f0e7f-353f-5e6a-8f8a-8f0173b6fe41", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "Google Antigravity agent wiped a user's drive while clearing a project cache", "incident_ref_id": "google-antigravity-drive-deletion", "category": "autonomous-attack", "severity": "low", "grade_status": "reported", "confidence": "secondary", "actor": "Google Antigravity agent (autonomous)", "actor_type": "unknown", "autonomy_level": "fully-autonomous", "ai_role": "load-bearing", "guardrail_bypass": [ "none-observed" ], "model_families": [ "gemini" ], "date_disclosed": "2025-12-01" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--cc8267b2-4d55-5b85-8014-2b13691c57e2", "created": "2026-10-15T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "AI-augmented actor accessed more than 600 FortiGate devices across 55+ countries; attack infrastructure later found running the CyberStrikeAI agent platform", "incident_ref_id": "ai-augmented-fortigate-mass-compromise", "category": "ai-orchestrated-campaign", "severity": "high", "grade_status": "reported", "confidence": "primary", "actor": "Unknown Russian-speaking, financially motivated individual or small group (per Amazon Threat Intelligence)", "actor_type": "cybercriminal", "autonomy_level": "unknown", "ai_role": "significant", "guardrail_bypass": [ "unknown" ], "model_families": [ "other" ], "date_disclosed": "2026-02-20" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--cf484f88-ba9f-520a-bf00-6ab7da036571", "created": "2026-08-12T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "GTG-2002 'vibe hacking' AI-driven data-extortion operation", "incident_ref_id": "gtg-2002-vibe-hacking-extortion", "category": "ai-orchestrated-campaign", "severity": "high", "grade_status": "confirmed", "confidence": "primary", "actor": "Unknown cybercriminal (tracked by Anthropic as GTG-2002)", "actor_type": "cybercriminal", "autonomy_level": "supervised-autonomous", "ai_role": "load-bearing", "guardrail_bypass": [ "legitimate-tool-abuse" ], "model_families": [ "claude" ], "date_disclosed": "2025-08-27" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--cf5d9160-a890-550d-80bb-00ed5f6f2fd1", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-15T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "OpenAI-attributed agents abused RubyDoc workers and flooded RubyGems with malicious packages", "incident_ref_id": "openai-attributed-rubygems-agent-swarm", "category": "infrastructure-abuse-supply-chain", "severity": "medium", "grade_status": "reported", "confidence": "primary", "actor": "OpenAI-attributed agents (inferential, per JFrog/RubyHack; RubyGems cannot confirm AI involvement; OpenAI has not verified the malicious uploads)", "actor_type": "unknown", "autonomy_level": "unknown", "ai_role": "disputed", "guardrail_bypass": [ "legitimate-tool-abuse" ], "model_families": [ "openai-gpt" ], "date_disclosed": "2026-09-15" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--d030d3f8-cb0a-5f70-b303-fbe8ed495bd6", "created": "2026-08-13T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "ForcedLeak — indirect prompt injection in Salesforce Agentforce", "incident_ref_id": "forcedleak-salesforce-agentforce", "category": "agent-hijack-prompt-injection", "severity": "critical", "grade_status": "reported", "confidence": "primary", "actor": "Noma Security (Noma Labs)", "actor_type": "researcher", "autonomy_level": "not-applicable", "ai_role": "load-bearing", "guardrail_bypass": [ "indirect-prompt-injection" ], "model_families": [ "other" ], "date_disclosed": "2025-09-25" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--d06e9a28-36b6-5eb0-bea8-10323f7de0bd", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "GTIG: criminal actor's AI-developed zero-day exploit against a web-based system administration tool", "incident_ref_id": "gtig-ai-developed-zero-day-2fa-bypass", "category": "ai-orchestrated-campaign", "severity": "medium", "grade_status": "reported", "confidence": "primary", "actor": "Unknown criminal threat actor (unnamed by GTIG), in partnership with a prominent cybercrime actor", "actor_type": "cybercriminal", "autonomy_level": "tool-assisted", "ai_role": "significant", "guardrail_bypass": [ "unknown" ], "model_families": [ "other" ], "date_disclosed": "2026-05-12" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--d6adf683-a6c5-5928-8993-a8544a241c86", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "DeepSeek-driven agent repeatedly attempted to turn a research honeypot into a proxy node", "incident_ref_id": "jesta-darkreasoning-deepseek-proxyjacking", "category": "autonomous-attack", "severity": "medium", "grade_status": "reported", "confidence": "primary", "actor": "Unknown (Jesta attributes the operator to a Chinese actor on circumstantial grounds; no group named)", "actor_type": "unknown", "autonomy_level": "supervised-autonomous", "ai_role": "significant", "guardrail_bypass": [ "open-weight-model" ], "model_families": [ "deepseek" ], "date_disclosed": "2026-08-03" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--d8126f10-ee66-55db-a9ec-876c4c794d37", "created": "2026-10-15T00:00:00.000Z", "modified": "2026-10-15T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "French-speaking crew paired a safety-disabled Hermes agent with a mass-scanning C2 that harvested 16,834 credentials", "incident_ref_id": "blackhatsect0r-hermes-dxscan-harvesting", "category": "ai-orchestrated-campaign", "severity": "high", "grade_status": "reported", "confidence": "primary", "actor": "BlackHatSect0r && DXQRTXX (French-speaking cybercrime crew, per SOCRadar; operates publicly 'in alliance with' APT-90, which SOCRadar treats as a co-branding partner)", "actor_type": "cybercriminal", "autonomy_level": "supervised-autonomous", "ai_role": "disputed", "guardrail_bypass": [ "jailbreak", "legitimate-tool-abuse" ], "model_families": [ "deepseek" ], "date_disclosed": "2026-09-16" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--d85c83f4-8d52-5c97-a205-3536e40f948d", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "Russian-speaking operator used Google Gemini CLI to build and run a command-and-control botnet", "incident_ref_id": "trendmicro-gemini-cli-dental-botnet", "category": "ai-orchestrated-campaign", "severity": "medium", "grade_status": "confirmed", "confidence": "primary", "actor": "Russian-speaking actor tracked by Trend Micro as bandcampro", "actor_type": "cybercriminal", "autonomy_level": "tool-assisted", "ai_role": "load-bearing", "guardrail_bypass": [ "legitimate-tool-abuse" ], "model_families": [ "gemini" ], "date_disclosed": "2026-07-14" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--d8b26242-bef3-52f6-a50b-cfc4a248b698", "created": "2026-10-09T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "OpenAI research agent circumvented access controls on Services Australia's Medicare statistics portal", "incident_ref_id": "openai-agent-services-australia-medicare-portal", "category": "autonomous-attack", "severity": "medium", "grade_status": "confirmed", "confidence": "primary", "actor": "OpenAI internal research agent (unnamed model) operating in an internal research/evaluation context", "actor_type": "lab-test-eval", "autonomy_level": "fully-autonomous", "ai_role": "load-bearing", "guardrail_bypass": [ "unknown" ], "model_families": [ "other" ], "date_disclosed": "2026-09-24" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--d90f8eea-d578-5324-bf2d-4f89cd3f1ba8", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "Gemini CLI auto-trusted untrusted CI workspaces, creating a remote-code-execution risk", "incident_ref_id": "gemini-cli-ci-untrusted-workspace-rce", "category": "agent-hijack-prompt-injection", "severity": "critical", "grade_status": "confirmed", "confidence": "primary", "actor": "Novee Security and Pillar Security researchers (coordinated disclosure)", "actor_type": "researcher", "autonomy_level": "not-applicable", "ai_role": "significant", "guardrail_bypass": [ "indirect-prompt-injection" ], "model_families": [ "gemini" ], "date_disclosed": "2026-04-24" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--d919a769-ef7e-5ced-bec8-8bce13f7bc41", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "GTIG: adversaries ran an agent-enabled mass credential-harvesting campaign in under six hours", "incident_ref_id": "gtig-agentic-credential-harvesting-q2-2026", "category": "autonomous-attack", "severity": "high", "grade_status": "reported", "confidence": "primary", "actor": "Unknown (GTIG describes the six-hour campaign without naming an actor; it separately tracks UNC6780 / TeamPCP for supply-chain activity)", "actor_type": "unknown", "autonomy_level": "supervised-autonomous", "ai_role": "significant", "guardrail_bypass": [ "legitimate-tool-abuse" ], "model_families": [ "other" ], "date_disclosed": "2026-09-09" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--e19efec1-bbcd-5e4c-8cbc-824f82a705b4", "created": "2026-10-15T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "Operator ran a Hermes agent unattended for post-compromise enumeration inside Thailand's Ministry of Finance network", "incident_ref_id": "thailand-mof-hermes-agent-intrusion", "category": "ai-orchestrated-campaign", "severity": "high", "grade_status": "reported", "confidence": "primary", "actor": "Unknown (Hunt.io: low-to-medium confidence the operator is Chinese-speaking; no group named)", "actor_type": "unknown", "autonomy_level": "supervised-autonomous", "ai_role": "significant", "guardrail_bypass": [ "legitimate-tool-abuse" ], "model_families": [ "other" ], "date_disclosed": "2026-07-23" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--e4342e4b-887c-5f77-995a-80716e99964c", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "OpenAI-attributed agents repeatedly scanned a UN statistics API and worked around access restrictions", "incident_ref_id": "openai-attributed-unctad-api-scanning", "category": "autonomous-attack", "severity": "low", "grade_status": "reported", "confidence": "secondary", "actor": "OpenAI-attributed agents (researcher-attributed as highly likely; OpenAI reviewing, not confirmed)", "actor_type": "unknown", "autonomy_level": "unknown", "ai_role": "significant", "guardrail_bypass": [ "none-observed" ], "model_families": [ "openai-gpt" ], "date_disclosed": "2026-09-26" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--e71f05d5-a30c-5cec-8aa9-4d7f4ee3d38a", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "OpenAI research agent used DNS to reach an external chatbot despite sandbox restrictions", "incident_ref_id": "openai-agent-dns-external-chatbot", "category": "autonomous-attack", "severity": "low", "grade_status": "confirmed", "confidence": "primary", "actor": "OpenAI internal research model reaching the public internet during training", "actor_type": "lab-test-eval", "autonomy_level": "fully-autonomous", "ai_role": "load-bearing", "guardrail_bypass": [ "none-observed" ], "model_families": [ "openai-gpt" ], "date_disclosed": "2026-09-25" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--e720afdd-f2f7-5f7f-b9dc-5d9676752d02", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "SecFlow framework drove commercial AI models against government and education systems across Asia", "incident_ref_id": "secflow-asia-government-education-campaign", "category": "ai-orchestrated-campaign", "severity": "high", "grade_status": "reported", "confidence": "primary", "actor": "Unknown Chinese-speaking operator (no state or criminal attribution stated by Hunt.io)", "actor_type": "unknown", "autonomy_level": "supervised-autonomous", "ai_role": "significant", "guardrail_bypass": [ "legitimate-tool-abuse" ], "model_families": [ "claude", "qwen", "deepseek" ], "date_disclosed": "2026-09-03" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--ebec4341-641a-5881-b97a-f7a05d4275da", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "Meta's Muse Spark model accessed and altered a real website during a misconfigured cyber evaluation", "incident_ref_id": "meta-muse-spark-evaluation-real-website", "category": "autonomous-attack", "severity": "medium", "grade_status": "confirmed", "confidence": "primary", "actor": "Meta's Muse Spark 1.1 model acting against a real website during a misconfigured cyber evaluation", "actor_type": "lab-test-eval", "autonomy_level": "fully-autonomous", "ai_role": "load-bearing", "guardrail_bypass": [ "none-observed" ], "model_families": [ "other" ], "date_disclosed": "2026-08-14" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--eeec7933-2f5d-53e1-926f-ffb44fd0046c", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "ZombieAgent: zero-click indirect prompt injection against OpenAI's Deep Research agent", "incident_ref_id": "radware-zombieagent-deep-research", "category": "agent-hijack-prompt-injection", "severity": "medium", "grade_status": "reported", "confidence": "primary", "actor": "Radware researchers (vulnerability disclosure)", "actor_type": "researcher", "autonomy_level": "not-applicable", "ai_role": "significant", "guardrail_bypass": [ "indirect-prompt-injection" ], "model_families": [ "openai-gpt" ], "date_disclosed": "2026-01-08" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--f0d69140-691c-56ad-bdb2-c167000d86cf", "created": "2026-10-15T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "Hijacked AI coding-assistant session at a SaaS provider led to the Shai-Hulud worm spreading across about 100 internal repositories", "incident_ref_id": "mandiant-hijacked-coding-assistant-shai-hulud", "category": "infrastructure-abuse-supply-chain", "severity": "high", "grade_status": "reported", "confidence": "primary", "actor": "Unknown", "actor_type": "unknown", "autonomy_level": "not-applicable", "ai_role": "significant", "guardrail_bypass": [ "unknown" ], "model_families": [ "other" ], "date_disclosed": "2026-09-16" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--f1d9b7d4-b530-59be-928d-8d68ed0216db", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "Notion 3.0 AI agents' web-search tool could be abused to exfiltrate private workspace data", "incident_ref_id": "notion-ai-web-search-exfiltration", "category": "agent-hijack-prompt-injection", "severity": "medium", "grade_status": "reported", "confidence": "primary", "actor": "CodeIntegrity researchers (proof-of-concept)", "actor_type": "researcher", "autonomy_level": "not-applicable", "ai_role": "significant", "guardrail_bypass": [ "indirect-prompt-injection" ], "model_families": [ "other" ], "date_disclosed": "2025-09-19" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--f227532b-49fa-59b4-b60c-65758fb14097", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "OpenAI long-horizon model circumvented its sandbox to open a public GitHub pull request", "incident_ref_id": "openai-long-horizon-sandbox-escape-github-pr", "category": "autonomous-attack", "severity": "medium", "grade_status": "confirmed", "confidence": "primary", "actor": "OpenAI unreleased long-horizon model acting outside its instructions during internal evaluation", "actor_type": "lab-test-eval", "autonomy_level": "fully-autonomous", "ai_role": "load-bearing", "guardrail_bypass": [ "none-observed" ], "model_families": [ "openai-gpt" ], "date_disclosed": "2026-07-20" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--f24d4781-ec30-56c8-8cd3-60b8f2ca10e5", "created": "2026-10-15T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "ARTEX agentic pentest tool and Claude Code sessions used in data-theft intrusions at South Korean financial institutions", "incident_ref_id": "artex-south-korea-finance-intrusions", "category": "ai-orchestrated-campaign", "severity": "high", "grade_status": "reported", "confidence": "primary", "actor": "Unknown financially motivated actor (CrowdStrike: likely a Chinese speaker, moderate confidence; not attributed to a named adversary)", "actor_type": "cybercriminal", "autonomy_level": "unknown", "ai_role": "significant", "guardrail_bypass": [ "legitimate-tool-abuse" ], "model_families": [ "deepseek", "claude", "other" ], "date_disclosed": "2026-10-04" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--f37510d3-0967-500a-b914-77fb0799d99e", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "Anthropic cybersecurity-evaluation agents reached real third-party systems (four incidents, 2026)", "incident_ref_id": "anthropic-cyber-evals-real-target-incidents", "category": "autonomous-attack", "severity": "high", "grade_status": "confirmed", "confidence": "primary", "actor": "Anthropic evaluation agents (Claude Opus 4.7, Claude Mythos 5, an early Claude Opus 4.6 checkpoint and an internal research model) acting outside their intended scope during cybersecurity evaluations", "actor_type": "lab-test-eval", "autonomy_level": "fully-autonomous", "ai_role": "load-bearing", "guardrail_bypass": [ "none-observed" ], "model_families": [ "claude" ], "date_disclosed": "2026-07-30" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--f3a8191e-4d8d-522d-a750-64773f71b560", "created": "2026-08-12T00:00:00.000Z", "modified": "2026-08-12T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "PromptLock — first known AI-powered ransomware (academic proof-of-concept)", "incident_ref_id": "promptlock-ai-ransomware-poc", "category": "lab-escape-eval", "severity": "medium", "grade_status": "test-eval", "confidence": "primary", "actor": "NYU Tandon School of Engineering research team", "actor_type": "researcher", "autonomy_level": "fully-autonomous", "ai_role": "load-bearing", "guardrail_bypass": [ "open-weight-model" ], "model_families": [ "openai-gpt" ], "date_disclosed": "2025-08-26" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--f552a470-166c-57bb-9890-00c490576a88", "created": "2026-10-15T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "GTIG 'Recon': exposed agentic C2 framework managed more than 23,800 harvested secrets", "incident_ref_id": "gtig-recon-agentic-secret-harvesting", "category": "autonomous-attack", "severity": "high", "grade_status": "reported", "confidence": "primary", "actor": "Unknown", "actor_type": "unknown", "autonomy_level": "supervised-autonomous", "ai_role": "significant", "guardrail_bypass": [ "unknown" ], "model_families": [ "other" ], "date_disclosed": "2026-09-08" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--f5c21ee5-fe23-5e05-827a-e4e2728e5057", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "OpenAI training model used a publicly leaked API key without authorization and fabricated results", "incident_ref_id": "openai-agent-leaked-api-key-fabrication", "category": "autonomous-attack", "severity": "medium", "grade_status": "confirmed", "confidence": "primary", "actor": "OpenAI unreleased model using a leaked third-party credential during training", "actor_type": "lab-test-eval", "autonomy_level": "fully-autonomous", "ai_role": "load-bearing", "guardrail_bypass": [ "none-observed" ], "model_families": [ "openai-gpt" ], "date_disclosed": "2026-09-16" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--fd645367-d8b1-55b8-8db0-60231fbc3527", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "Unit 42 investigation: AI agents sped an enterprise intrusion and hijacked the victim's cloud AI infrastructure", "incident_ref_id": "unit42-ai-assisted-enterprise-intrusion", "category": "autonomous-attack", "severity": "high", "grade_status": "reported", "confidence": "primary", "actor": "Unknown human attacker directing multiple AI agents (no nationality or group stated by Unit 42)", "actor_type": "unknown", "autonomy_level": "supervised-autonomous", "ai_role": "significant", "guardrail_bypass": [ "legitimate-tool-abuse" ], "model_families": [ "other" ], "date_disclosed": "2026-09-02" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--fed889e7-9dba-56cf-a765-6480c57a4f86", "created": "2026-10-10T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "Spain's AEPD receives first personal-data-breach notification for an attack executed by an AI agent", "incident_ref_id": "aepd-first-ai-agent-data-breach-notification", "category": "autonomous-attack", "severity": "medium", "grade_status": "reported", "confidence": "secondary", "actor": "Unknown", "actor_type": "unknown", "autonomy_level": "unknown", "ai_role": "significant", "guardrail_bypass": [ "unknown" ], "model_families": [ "other" ], "date_disclosed": "2026-09-14" }, { "type": "x-agentic-incident", "spec_version": "2.1", "id": "x-agentic-incident--ffa98652-5421-5af0-af00-bb96c56cc464", "created": "2026-10-09T00:00:00.000Z", "modified": "2026-10-16T00:00:00.000Z", "created_by_ref": "identity--657378bc-aa82-5efd-a2eb-e1ec0452c85e", "name": "OpenAI evaluation agents escaped their sandbox and compromised Hugging Face production infrastructure", "incident_ref_id": "openai-eval-agents-hugging-face-intrusion", "category": "autonomous-attack", "severity": "high", "grade_status": "confirmed", "confidence": "primary", "actor": "OpenAI evaluation agents (an internal-only research model and GPT-5.6 Sol) acting without authorization during ExploitGym cyber evaluations", "actor_type": "lab-test-eval", "autonomy_level": "fully-autonomous", "ai_role": "load-bearing", "guardrail_bypass": [ "none-observed" ], "model_families": [ "openai-gpt", "other" ], "date_disclosed": "2026-07-21" } ] }