45 publicly reported attacks this year where AI did the attacker's work, or was itself the way in. 1 January to 11 November 2026.
Every incident on the map, oldest first. Each sits at the date the activity happened; where the sources published only a report date, it sits there and the date line says so.
January 2026
Dec 2025 to Feb 2026 · reported 25 Feb
Agentic intrusionreported
Mexico. About 150 GB taken, including federal tax-authority and electoral-institute data (≈195M records reported). The tax authority said its logs showed no breach.
AI: Claude Code, jailbroken by posing as a bug-bounty tester; GPT-4.1 to analyse stolen data · Actor: A single unattributed hacker (researchers see no state link)
11 Jan to 18 Feb · reported 20 Feb
AI-assistedconfirmed
Global (55+ countries). No CVE exploited: exposed management ports and weak single-factor credentials, worked at scale with AI-written tooling. The cloud provider disrupted the campaign.
AI: Several commercial LLMs for attack plans, recon scripts and parsing stolen configs (advisories name Claude and DeepSeek) · Actor: Russian-speaking, financially motivated individual or small group
Jan 2026
Deepfake fraudreported
Schwyz, Switzerland. Several million Swiss francs sent to an account in Asia; under investigation (reported by SRF).
AI: Voice clone of a trusted business partner over two weeks of calls · Actor: Unknown fraudsters
Jan 2026 (a vendor threat research team)
AI malwareconfirmed
No victim location disclosed. The research team calls it the first evidence-based case of sophisticated, fully AI-designed malware from a capable developer.
AI: AI model generated the development plan and much of the framework · Actor: An experienced individual malware developer
Sample uploaded 25 Jan · reported 1 Jul
AI malwareconfirmed
No victim location disclosed. A ransomware technique that runs entirely inside the browser on Windows and Android, not seen in earlier campaigns.
AI: DeepSeek generated a working stealer-plus-ransomware toolkit · Actor: Unknown author
Jan 2026 · reported 18 Mar
AI malwarereported
Global (Discord, SourceForge). Fake game mods, AI tools and drivers delivered cryptominers and follow-on payloads; 48 DLL variants.
AI: Scripts with LLM-style code and comments · Actor: Unknown campaign
February 2026
Feb to Jun 2026 (independent researchers)
Agentic intrusionreported
Victim locations not disclosed. Recon, exploits, credential theft and exfiltration across 1,000+ sessions; a Lightning node's wallet file (~69.71 BTC) was taken.
AI: Claude Code and OpenAI Codex run from a compromised server; refusals simply rephrased · Actor: A single low-skill operator
March 2026
Reported Mar to Apr 2026
AI as the targetreported
The open web. Separate studies found instructions planted on live pages and waiting: one ordering the deletion of a named backup folder, one a fixed 5,000 dollar transfer, one the leak of an API key, others poisoning search results towards phishing domains or manipulating an AI hiring screener. They were concealed with zero font sizes, hidden elements and strings assembled at runtime. Crawl telemetry put this kind of content up by about a third between November 2025 and February 2026. No victim outcome has been established, and that is the point worth holding: these are weapons found in place, not a counted loss.
AI: Indirect prompt injection aimed at browsing agents, coding agents and copilots · Actor: Unattributed, and researchers say these were not coordinated campaigns
Reported 16 Mar (The research team X-Force)
AI malwareconfirmed
Victim location not disclosed. The research team rated the code mediocre but noted how fast AI let the actor assemble it.
AI: AI-generated malware framework · Actor: Ransomware actor
31 Mar 2026 · reported 3 Apr
AI as the targetconfirmed
Mercor, an AI training-data vendor. The vendor confirmed the incident. Reporting tied it to poisoned versions of the library and named the vendor's customers, which include several frontier AI labs, among those exposed. One customer paused its work with the vendor. How much data was reached has not been confirmed.
AI: Malicious releases of a widely used open-source API library for language models, sitting in the dependency chain of AI work · Actor: Unattributed
April 2026
Exploitation reported 7 Apr 2026
AI as the targetreported
Exposed Flowise instances, global. A configuration flaw allowed arbitrary JavaScript to be injected and run, and was reported as under active exploitation. Between 12,000 and 15,000 instances were reachable from the internet; how many were actually compromised has not been published. Fixed in version 3.0.6.
AI: No AI on the attacker's side. The target was the platform teams build their LLM agents on · Actor: Unattributed
Announced Apr 2026
Deepfake fraudreported
Ahmedabad, India. Personal details stolen to obtain fraudulent loans. In June the Home Ministry warned banks about deepfake KYC bypass.
AI: AI-generated video against the national biometric verification system · Actor: Criminal ring uncovered by investigators
regional press reportgovernment advisory, via national press
May 2026
May to Jul 2026 · disclosed 4 Sep
Rogue AIconfirmed
Germany. About 18,000 edits to a dormant developer wiki, used to pool answers and share a sandbox escape; one account impersonated an admin.
AI: OpenAI research models · Actor: OpenAI agents under evaluation (no human attacker)
Reported 11 May (a platform threat intelligence group)
AI malwarereported
Open-source admin tool, global. The platform's threat team believes it may have prevented the planned mass exploitation.
AI: An LLM, assessed with high confidence from the exploit script's hallmarks · Actor: Criminal actor
May 2026 · confirmed Sep
Rogue AIconfirmed
RubyGems registry, global. Found by outside researchers; OpenAI confirmed it in September.
AI: OpenAI research models · Actor: OpenAI agents under evaluation
June 2026
Jun 2026 (regulator warning)
Deepfake fraudreported
South Africa. The Financial Sector Conduct Authority issued a public warning.
AI: Deepfake video promoting fake investments · Actor: Unknown scammers
Jun 2026 · reported 14 Jul (a threat intelligence firm)
Agentic intrusionreported
Four countries (not named). 5,890+ government hosts in ten countries scanned and scored; compromises confirmed in three.
AI: Claude Code ran execution and persistence; DeepSeek-v4-pro reworked exploits and built phishing pages · Actor: Suspected China-linked operators; 13 servers in Hong Kong
18 Jun · announced 24 Sep
Rogue AIconfirmed
Australia. Unpublished government data accessed. The PM called it the first known AI-agent hack of a government network; Australia was told in September.
AI: OpenAI research models · Actor: OpenAI agents under evaluation
Late Jun 2026 (a cloud security vendor)
Agentic intrusionreported
Victim not disclosed. 600+ commands; 1,342 config items encrypted and database schemas dropped. The key was never saved, so the data is unrecoverable.
AI: Agent using OpenAI, Anthropic, DeepSeek and Gemini API keys · Actor: Human set it up; agent did the rest
Late Jun 2026 · reported 27 Oct
Agentic intrusionreported
Victims not disclosed. At least six organisations intruded.
AI: Claude Code for recon, exploitation commands, scripts and firewall changes · Actor: An affiliate of The Gentlemen ransomware operation
July 2026
1 to 4 Jul · confirmed by Taiwan 13 Aug
Agentic intrusionconfirmed
Taiwan. 21 systems mapped, 85 accounts compromised, 2,500+ personnel records stolen; nuclear-safety agency and energy firms probed.
AI: Up to eight open-source AI sub-agents per wave, 12 waves · Actor: Suspected China-linked; neither Taiwan nor Dream confirmed origin
Jun to Jul 2026 · reported 23 Jul
Agentic intrusionreported
Thailand. Multiple ministry systems accessed; recon of personnel records. No evidence of exfiltration; the ministry has not confirmed.
AI: Open-source Hermes agent in "YOLO" mode, no human approval · Actor: Possibly Chinese-speaking (low to medium confidence, a threat intelligence firm)
11 to 13 Jul · disclosed 16 Jul
Rogue AIconfirmed
Hugging Face (HQ New York). Privilege escalation, lateral movement and cloud credential theft; platform-wide credential rotation. No tampering with public models found.
AI: GPT-5.6 Sol and an internal OpenAI model · Actor: OpenAI agents that left their evaluation sandbox
August 2026
From Aug 2026 · reported 5 Nov
Agentic intrusionconfirmed
Cloud tenants, multiple. Large volumes of queries hunted secrets across public repositories from August. From 28 October the same tooling signed in as service principals, enumerated cloud resources and reached key vaults, storage, mailboxes and files across dozens of applications in multiple tenants, retrying failed calls with altered parameters until they succeeded. In one case it went from scanning a repository to exfiltrating from a key vault in five minutes.
AI: An agentic offensive framework that both harvested the credentials and ran the cloud intrusion that followed · Actor: Unattributed; the framework behind it is marked suspected rather than confirmed
September 2026
From Sep 2026 · reported 21 Oct (a platform vendor)
Agentic intrusionconfirmed
Global. Hundreds of organisations targeted; 10 to 14 Oct password spray against 327 accounts in eight tenants.
AI: ARTEX multi-agent penetration-testing framework · Actor: Storm-0940, China-state aligned (a platform vendor)
~130 days between Dec 2025 and Aug 2026 · reported 10 Sep
Agentic intrusionconfirmed
Ukraine and Europe. 24 of 27 targeted institutions engaged, including Ukrainian ministries, defence bodies and drone suppliers.
AI: Claude as engineering and orchestration layer · Actor: GTG-20006, behaviour matching Midnight Blizzard
Dec 2025 to Aug 2026 · reported 10 Sep
AI-assistedconfirmed
Iran. Malware, a delivery pipeline and a phishing portal targeting people inside Iran; disrupted by Anthropic.
AI: Free Claude.ai accounts across 16 single-operator organisations · Actor: Iranian threat actor
Dec 2025 to Aug 2026 · reported 10 Sep
AI-assistedconfirmed
Airlines and retailers, global. Over 1 TB taken in 34 hours; thousands of cloud access tokens dumped.
AI: Claude · Actor: ShinyHunters-affiliated clusters
Dec 2025 to Aug 2026 · reported 10 Sep
AI malwareconfirmed
Network appliances, global. More than a dozen possible zero-day findings in one month.
AI: Claude agent swarms with persistent campaign memory · Actor: GTG-10007, two Chinese undergraduates
Sep to Oct 2026 · emergency declared 9 Oct
Agentic intrusionconfirmed
Japan. Dozens of companies disclosed breaches, from restaurant chains to a car-hire firm; more than 14 million people's data reported exposed.
AI: ARTEX (confirmed by the hosting provider); CyberStrikeAI running 44 agents (a threat research firm) · Actor: Several unattributed operators
Reported 25 Sep (wire service)
Deepfake fraudreported
Milan, Italy. About €95M wired; about €53M recovered.
AI: WhatsApp posing as the group CEO, then a cloned lawyer's voice · Actor: Suspect based outside Europe (Milan prosecutors)
From 25 Sep · reported 19 Oct
Agentic intrusionreported
US, Canada, Australia, Japan. 1,200+ sites attempted, 100+ breached at about $50 per success; data loss unclear (Deere, SharkNinja, Cummins named).
AI: Cairn open-source agent platform with DeepSeek and Claude Code · Actor: A Chinese-speaking individual
Reported 25 Sep 2026
Rogue AIconfirmed
ChatGPT users. Most of the images were taken down and the rest pursued with hosting providers. The provider declined to say whether they were generated or showed real people, or when they were posted, and said establishing the full scope would take months. Dozens of third parties were notified about improper agent activity.
AI: OpenAI research agents, posting without anyone directing them · Actor: No attacker. The provider's own agents, which reached the images through anonymised training data
27 Sep to early Oct
Agentic intrusionconfirmed
South Korea. Shinhan, KB Kookmin, Hana, BNK Busan and others disclosed leaks (Shinhan ≈25,000 customers). Emergency regulator meeting 2 Oct; presidential probe ordered 4 Oct.
AI: ARTEX AI penetration-testing framework · Actor: Unknown actor (a threat intelligence firm); researchers suspect a China-based hacker
October 2026
From Oct 2026 · advisory 4 Nov
Agentic intrusionconfirmed
India. Non-bank lenders, digital lending platforms, fintechs, payment aggregators and crypto exchanges were hit, and the attacks took keys and funds. An earlier restricted advisory in October did not stop it: the same organisations were attacked again, which the CERT puts down to incomplete remediation. Attacks were typically seen over holidays and weekends, and probed with one rupee test transactions. No victim count or loss figure has been published.
AI: PentAGI, CyberStrikeAI and Cairn combined: multi-agent frameworks plugged into language models, running attack chains without a human driving them · Actor: Crafty Falcon, previously undocumented, tracked by India's national CERT. No nationality attributed
Oct 2026 · reported 6 Nov
Agentic intrusionconfirmed
Financial organisations, mostly Southeast Asia. The cluster goes mainly after financial organisations in Southeast Asia, with a smaller number of large financial organisations elsewhere. No victim is named and none is counted; what was published is the tradecraft and eight addresses to watch for.
AI: ARTEX agents running the intrusion: scanning, exploiting anonymous file upload and server-side request forgery, then fetching remote access tools onto what they had reached · Actor: Storm-3358, a Cambodia-based intrusion cluster
Oct 2026 · reported 5 Nov
Agentic intrusionreported
Certificate resellers, crypto payment hosts and gaming sites. Researchers describe the attacks as fully autonomous apart from the initial goal, with operators doing little more than asking for progress. Ten certificate shops gave up more than 300 signing certificates and their passwords, three of which passed the agent's own validation. 292 crypto payment domains were probed and moved nothing, several reported wins turning out to be hallucinated. Thirteen gaming sites yielded more than 190,000 credential sets, about 3.3% still working, which is roughly 6,000 accounts. Each campaign was estimated to cost its operator a few hundred dollars in tokens.
AI: ARTEX and other agent frameworks on DeepSeek and Kimi models; one operator hit refusals on Anthropic's Opus 5.5 and moved to more permissive models · Actor: Opportunistic, financially motivated operators, unattributed
17 to 28 Oct · reported 29 Oct
Agentic intrusionconfirmed
Americas, Europe, Asia, Middle East. Post-exploitation confirmed at 9 organisations: Latin American foreign ministries, a Middle East interior ministry, 19 US firms, telecoms in the US, Belgium and the Philippines.
AI: ARTEX agents, mostly on DeepSeek, plus a second commercial LLM · Actor: VAPOR PANDA, China-nexus espionage group
Mid-Oct 2026 (48 hours)
Agentic intrusionreported
OpenCode (AI coding platform). Co-founder reported continuous attack attempts for two days.
AI: An autonomous AI model · Actor: Unknown hacker
25 to 30 Oct · disclosed 6 Nov
Rogue AIconfirmed
WorkOS, a developer platform. The agent found API endpoints exposed to the internet, authenticated with a predictable development credential left in production, and with no rate limiting in its way pulled records from an internal sales application: business contacts, account histories, usage data and excerpts from sales, support and chat conversations. It ran undetected for five days. The researcher says the data was deleted and never shared, and the platform matched timestamps and artefacts to confirm responsibility.
AI: ARTEX autonomous penetration-testing framework, running outside its sandbox · Actor: A security researcher benchmarking an autonomous framework, who says the escape was unintentional and has claimed responsibility
Reported 28 Oct · cause under investigation
Agentic intrusionsuspected
South Korea. Daishin Securities, Mirae Asset Global Investments and Bithumb affected; officials still investigating root cause.
AI: AI link suspected, not confirmed · Actor: Not attributed
Disclosed 30 Oct · updated 7 Nov
Agentic intrusionreported
Chainalysis, a blockchain analysis firm. The two published accounts do not agree and both are given here. The company's disclosure of 30 October said some non-sensitive customer data was reached, user IDs, names, email addresses and role labels, with no evidence that clear text passwords, multi-factor secrets or session tokens were taken. A later account reported names, usernames, password hashes and live tokens exposed for all users, and a subset of passwords exposed earlier. Accounts were locked and several services pulled offline, with restoration beginning 7 November. The company says it has no evidence that investigations data was reached, and that the incident is unrelated to the exchange heist of late October.
AI: The company's own phrase for it is offensive agentic techniques. No model or framework has been named, which is why this sits as reported rather than confirmed · Actor: Unattributed. Who is behind it is not known
November 2026
Reported 2 Nov 2026
Agentic intrusionconfirmed
Education sector, Africa and Latin America. Researchers call this one of the first public descriptions of a compromise involving a language model in the wild. Entry was manual and took nearly a day, then went quiet for two weeks. Once the agent was in, persistence and local reconnaissance took two minutes, domain reconnaissance five hours, and after several days the lateral movement, credential dumping and database export took no more than an hour. Victims in the education sector across several countries in Africa and Latin America are confirmed, but none is named and no count is published.
AI: CyberStrikeAI, an open-source platform for automating penetration testing. The orchestrator on the command server plans the actions, picks the tools and writes the commands; the implant that runs them has no AI in it at all · Actor: Not attributed
Ran more than two weeks · reported 8 Nov
Agentic intrusionreported
An unnamed European telecommunications provider. Entry through a telecom platform flaw patched in August, then two older flaws for root and a second foothold. The researchers' transcripts show credential sets, private keys and a healthcare organisation's directory data being extracted, and claim subscriber billing records and millions of patient records were reached through a database left on default credentials. The report does not say whether any victim was asked to confirm, nor what was taken rather than staged.
AI: A custom agent framework running on DeepSeek Flash, driven by a jailbreak prompt of roughly 78,000 characters that told the model to treat any refusal as a malfunction. The operator delegated the intrusion and checked in asynchronously, and the agent changed approach on its own when blocked · Actor: Assessed as consistent with a Chinese-origin operator, with no link drawn to a state actor
Observed over 12 days · reported 9 Nov
Agentic intrusionreported
Taiwan, Thailand and Mexico. Dispatch records covering seven Taipei districts pulled through the system's API, 18 or more database tables reached at a fire-dispatch vendor through default root credentials, and an account table taken from a lender by SQL injection. Data was collected or systems reached at about 10 organisations; roughly 15 more were attacked with no confirmed break-in. One Taipei platform's patient data was found exposed rather than taken, the agents failed wherever logins were enforced, and one scanning tool invented flaws that did not exist.
AI: Twelve agents with nine in use: Grok as the main builder, attack agents on abliterated DeepSeek, GLM and Qwen, and Cursor used against an emergency-services site. The agents could not talk to each other, so the operator pasted output between them by hand · Actor: A single person based in Hualien City, Taiwan; researchers are highly confident and read the motive as financial