Tracker
AI incident log 2026
A log of AI incidents from our reporting: sandbox escapes, data leaks, break-ins, malware and misuse, with what happened, how it came out, and the sourced story behind each case.
Each case says who disclosed it and what is still unconfirmed. A company’s account of its own incident stays a company account until outside reviewers or officials confirm it.
Filter the list
Showing 10 entries of 36. Show all
October 2026
- Tampered Claude Code extension in Cursor’s store plants an SSH backdoorCursorRemoved; how it got in is unknownMalwareCopy the link to this entry
For about 11 hours, versions 2.1.312 and 2.1.313 added an attacker’s SSH key, tried to open remote access and sent out computer details. Anthropic says it did not build them.
Next step Run Cursor’s clean-up scripts; Cursor says uninstalling alone may not be enough
Tampered Claude Code add-on in Cursor’s store had a backdoor - Decoy server catches an attack agent built to run on hijacked AI modelsUnknown attackers (found by Symantec)Captured; no known victimsAI-run cyberattackCopy the link to this entry
Symantec’s AI honeypot captured the full instructions of an agent that looks for AI models left open online, uses them to plan attacks, and installs cryptocurrency miners. It was set to run up to 100,000 steps without a human.
Outcome The honeypot ran none of the tools; Symantec has not named the attackers
Symantec traps an attack agent built to run on hijacked AI - Hacked LiteLLM 1.107.0 release carries a key stealerLiteLLM (BerriAI)Contained, under investigationMalwareCopy the link to this entry
A poisoned version of the open-source AI gateway was on PyPI for less than two hours and on Docker for longer. Security firms say it steals cloud, SSH and AI keys. LiteLLM says three engineers’ GitHub accounts were misused.
Next step Stay on version 1.106.2; LiteLLM has not yet found how the tokens were stolen
Hacked release of AI tool LiteLLM carried a key stealer - One hacker’s AI agents attack 1,200+ websitesUnnamed Chinese-speaking hacker (found by NorForge)Reported by a researcherAI-run cyberattackCopy the link to this entry
AI agents in the Cairn tool attacked more than 1,200 websites from September 25 and breached more than 100 companies, a NorForge researcher told Reuters. Deere and SharkNinja say the damage was contained.
AI agents let one hacker breach 100+ firms, researcher says - CrowdStrike links the AI agent ARTEX to hacks of South Korean banksUnknown attacker (CrowdStrike finding)Police investigating; attacker unknownMisuseCopy the link to this entry
An unknown attacker used ARTEX, an open-source AI agent, with DeepSeek and other models against South Korean financial firms from late September, CrowdStrike says. Regulators say data on more than 68,000 people leaked.
Next step Police opened a formal case on October 6; the developer made ARTEX closed-source on October 8
Maker closes AI hacking tool linked to Korean bank hacks - AI child abuse images in the first half of 2026 top all of 2025Internet Watch Foundation (finding)ReportMisuseCopy the link to this entry
The UK charity assessed 6,310 illegal AI-made images from January to June 2026, 40% more than the 4,512 in all of 2025. Girls appear in 98% of the images where age and gender were recorded.
AI child abuse images already top all of 2025, IWF says - Flood of invalid automated bug reports pauses Google’s open-source bountyGooglePaused; update in Q1 2027MisuseCopy the link to this entry
Google stopped taking reports of flaws in its open-source code after a sharp rise in automated submissions, most of them not valid. Supply-chain reports and earlier reports are still handled.
Google pauses a bug bounty, flooded by automated reports
September 2026
- CLOSEDQUORUM malware lets AI models vote on its next stepCisco TalosNo victims foundMalwareCopy the link to this entry
Windows malware built to let up to four AI models vote on what to do after a break-in. Talos released a free tool, CAIRN, that looks for AI use in malware. The public sample cannot run as shipped.
Malware lets AI models vote on its next step, Talos says - Researchers reached OpenAI’s private code with Claude Opus 5Hacktron AIFixed, bounty paidAI-assisted attackCopy the link to this entry
A forum image bug and a sign-in flaw were chained to take over an OpenAI employee account and open a pull request in OpenAI’s private repository. OpenAI and Discourse fixed the flaws; OpenAI paid a $6,500 bounty.
Hacktron used Claude Opus 5 to reach OpenAI’s private code - Misuse blocked across seven harm areasAnthropicCompany reportMisuse reportCopy the link to this entry
Cyberattacks, surveillance, fraud, weapons work and model copying found from December 2025 to August 2026, as described by the company about its own service.
Anthropic blocked AI misuse across seven harm areas
How this tracker works
A case appears when one of our stories reports an AI system or agent doing something it was not meant to do, being misused, or being broken into. The date is the one the story gives; when a story gives none, it is the story’s own date. We add entries with each edition and correct them under the story when a fact changes.
Reusing this list: you may quote it with a link to this page. Facts belong to the sources each story cites.