Brief archive

SpeeCAN RAIDEN: a municipal disaster-alert mail platform was breached, and around the same time fake mail from its sender domain reached registrants (Arcadia and municipal notices)

Denmark CPR: One private company's lawful lookup access was abused to pull names, addresses and CPR numbers for about 8.8 million people (Danish digitalisation ministry)

TOPPAN: During a manual send, a list of 177,426 Sompo Japan policyholders slipped into another insurer's ZIP and went out (insurance-premium deduction certificate service)

North Korean IT workers: they won contracts in Japan by posing as local enablers, using ID images the enablers supplied (joint advisory by seven agencies in Japan, the US, Australia and Germany; Japan's first laptop farm dismantled)

Revolut: It kept handing over customer data for months, answering disclosure requests that arrived through Italy's state-certified email network (PEC; Italian prosecutors investigating)

RubyGems and RubyDoc.info: masses of new accounts published 500+ malicious packages and ran code on the docs build servers (Ruby Central, Nightingale Collective)

GitSpawn: Just opening a folder made seven AI coding agents run an attacker's code (Manifold Security)

Hugging Face's Transformers library was found to write remote Python code to disk before a user's consent prompt is ever evaluated (CVE-2026-80047, CERT/CC)

In the LiteLLM AI gateway, the fallback for a failed MCP authentication check quietly behaved as unconditional access (CVE-2026-59822, confirmed under active exploitation and added to CISA's KEV catalog)

A human attacker directing multiple frontier AI agents breached an enterprise network in under 10 hours (Unit 42)

An outside party accessed Awa Bank's test environment, leaking 27,745 records of customer and shareholder data

IDScan.net: More than 153 million scanned driver's licenses handed over at counters were being sold on the dark web

AnonyMousKIT: AI voice agents posing as 'Apple Support' extracted unlock passcodes from stolen-iPhone owners

Eleven vulnerabilities were disclosed across six agent frameworks including LangChain, LangGraph, and CrewAI

Four unauthenticated flaws reaching code execution, privilege escalation, and SQL injection were disclosed in ServiceNow AI Platform

290 staff at Japan's Social Insurance Medical Fee Payment Fund met a "one second on screen" target with an auto-advance tool

All 15 x402 payment facilitators were found in violation

Expired Visa EMV contactless cards were shown to pass at checkout

One Pyodide sandbox escape was shown to reproduce across seven products

Irregular's 'sealed' evaluation environment was misconfigured onto the real internet, and AI models under test breached real third parties (Anthropic, OpenAI and Meta disclosures; Irregular postmortem)

OpenClaw's agent cancelled a stranger's gym reservation, unasked, to move its user up the queue

Atlassian Rovo can be tricked into sending Jira and Confluence data outward by instructions in an uploaded file or a URL parameter

A Claude Mythos 5 agent vouched for its own PR to a real open-source project from a second account, then force-pushed a rewritten history (UK AISI evaluation)

Three coding agents broken in their default config: the harness marked a value safe, and a later stage acted on it with more authority

Japan's Ministry of Justice puts voice inside publicity rights

FCA fines Starling Bank £29m: since 2017, the automated sanctions screening had been matching customers against only a fraction of the list

The keyv and cacheable npm takeover: nine releases published in 38 minutes, all since pulled

Medicare's WISeR AI prior authorization: denials were issued, but nothing records which patient file each determination was checked against

BonkDAO: about $4M bought the votes to drain a $20M treasury

7.6 petabytes of Hugging Face training data held 221,303 live secrets

"FaceHugger" in Hugging Face Diffusers: loading a model ran arbitrary code

TikTok's 3 billion AI labels coexisted with a 550-video AI-presenter disinformation operation

Japanese police identified 123 sexual-deepfake cases in six months, passing all of last year

A Copilot for Word document worm turned each generated file into the next carrier

Speechify verified voice-cloning consent with a single checkbox

A fake OpenAI model hit #1 trending on Hugging Face

AI applicant-screening discrimination suit against Workday: the adverse action was taken, but whether the decision was independently verified and authorized was never recorded

AWS Kiro: a harmless summarize request makes the agent rewrite its own MCP config and reach RCE

Ruflo's MCP Bridge: one unauthenticated request opened 233 high-privilege tools, and the memory poisoning survives the patch

Ariana Grande: the unreleased tracks were taken from her collaborators' weakest accounts, not from her

Wanchain

ServiceNow AI Platform

AFX Trade

Verus-Ethereum bridge

Figma

Over 40,000 unauthorized likeness and voice posts across major platforms

WebMCP

Ostium

Friendly Fire

Paysafe fake SDKs: 17 packages posing as legitimate payment SDKs exfiltrated developers' secrets, payment API keys and all

Aptos: a Move VM type confusion could let one on-chain resource be treated as another (reproduced in a ~$3,000 test environment)

Agentjacking: an AI coding agent trusted a single fake error report as its "resolution steps" and ran the attacker's commands

BioShocking: convince an AI browser "it's a game" and it drops its guardrails and hands over credentials

JadePuffer: an LLM agent autonomously ran a ransomware attack

Gitea: a Docker default let anyone impersonate an admin with a single HTTP header (CVE-2026-20896)

Amazon Q Developer: opening a repo auto-executed a bundled MCP config and exfiltrated AWS credentials (CVE-2026-12957)

Cursor (DuneSlide): a single injected prompt escaped the agent's sandbox and ran arbitrary commands (CVE-2026-50548 / 50549)

A7A5: a ruble-backed stablecoin moved $110B under sanctions

exploitarium: An Anonymous 'bikini' Publicly Dropped Many Zero-Day PoCs Found via AI-Automated Fuzzing, and Recipients Can't Verify the Provenance of the Disclosures

Photo ZIP: 'Authentication Laundering' Cleared SPF/DKIM/DMARC So a Fake 'via Calendly' Email Looked Legitimate

AIR: A Fake Agent Skill Cleared Every Scanner and Reached ~26,000 Agents

SecondFi: Audited Signing Code Was Replaced by an Unaudited SDK, Letting Private Keys Be Reconstructed From Public Data on Every Signature

Kestra: Ending a Request Path With /configs Bypassed Authentication and Allowed Unauthenticated Code Execution as Root

Polymarket: Malicious JavaScript Injected via a Compromised Third-Party Vendor Tricked Users Into Approving Fraudulent Transactions

Sumsub: An 18-Month Undetected Intrusion Into a Support Environment Exposed Customers' Names and Contact Details

Secret Network: Deposits From a Forged Channel Went Unverified, Letting Unbacked Wrapped Tokens Be Minted Without Limit

Hong Kong deepfake video-call fraud: a real-time deepfake of the CFO and every colleague drove a ~$25.6M transfer

Change Healthcare: a breach of a single Citrix account without MFA halted a third of US medical-claims processing for weeks

xz utils backdoor (CVE-2024-3094): a two-year impersonation of a "trusted developer" planted a backdoor in a code-signed official release

Bybit: a "legitimate" multisig approval signed by trusting the UI drained a supposedly secure Ethereum wallet

Replit: an AI agent broke a code freeze, wiped production data, then fabricated records to cover it

Common Crawl: about 12,000 live credentials embedded in a public corpus used to train LLMs

TennCare Connect: an automated eligibility system illegally cut thousands off Medicaid

IDMerit: the disputed billion-record KYC exposure

A 93% Facial-Recognition 'Match' Led Straight to Arrest Without Independent Verification (Robert Dillon Wrongful Arrest Suit)

A Dormant, Un-Revoked Credential Turned a Trusted Integration into Mass Salesforce Extraction (Klue)

Taiko Bridge: Forged Withdrawals Passed as Valid After a Prover Signing Key Leaked

ShadowMQ: one unsafe pattern (unauthenticated ZMQ + pickle) copied across AI inference frameworks

Hugging Face LeRobot: a robotics framework executed untrusted data received over an unauthenticated channel

DJI ROMO: one authenticated client reached 7,000 robot vacuums' cameras

Unitree (UniPwn): one shared key across the fleet

Universal Robots PolyScope: unauthenticated network access yields RCE on industrial robots

Syscoin Bridge: an invalid SPV proof was read as "valid" and minted 5B SYS with no burn

LiteLLM AI Gateway: from low-privilege user to admin and RCE

NHO Hokkaido Hospitals: assumed shredded, sold online

Hyundai: driver-assist AI braked on a threat that wasn't there

Waymo: the robotaxi drove past a stopped school bus

Salesloft Drift: a trusted integration's OAuth tokens stolen, hundreds of Salesforce tenants queried

Bright Data SDK: your living-room TV became a relay node for AI-scraping

Claude Code GitHub Action: one issue claiming "[bot]" led the agent to privileged execution

Both Sides Cited Cases That Never Existed

When "Allow All" OAuth to an AI Tool Becomes the Breach Path (Vercel / Context.ai)

From State Store to RCE

Reachable Meant Readable

No Check on Who Was Authorized

Internal Data Exfiltrated Without Verifying the Instruction's Origin

Generated Until the Rightsholder Said No

200 Million Views of Fake Celebrities

70,000 Government IDs Leaked to Prove Age

Asking the AI Support Bot Was Enough

Generated Without Consent or Age Verification

Tesla Robotaxi Crash Records

TrapDoor Plants Hidden Directives in AI Assistant Instruction Files Across npm, PyPI, and Crates.io

AI Agent Forwarded Credentials Before Verifying the Sender (OpenClaw / Varonis)

ServiceNow Scripted REST Endpoint Served Customer Data Without Authentication

When One Laptop Meets the Multisig Threshold

Self-Reported Autonomous-Driving Safety, Unverified

AOG Technics: over 60,000 aircraft engine parts circulated with forged airworthiness certificates

Phantom Carbon Credits

Semantic Kernel: Prompt Injection Turned Into Host-Level Remote Code Execution

IronWorm

When the Assistant Becomes the Trigger

12.8 Billion Training Images Contained Passports, Résumés, and Faces

The Inspections Were Recorded as 'Complete'

Live Biometric Verification Defeated by an Injected Video Feed

One Edge Appliance Compromise Cascaded to Full Domain Takeover

Polaris Holdings / Booking.com: the bank account that receives a hotel's sales was switched to a third party's inside the legitimate admin screen, and one hotel lost about ¥9 million (company disclosure)

AI Agents Drove Intrusions From Initial Access to Exfiltration

Stripe's Trusted API Infrastructure Repurposed to Deliver Card-Skimming Code and Store Stolen Data

One-Click GitHub OAuth Token Theft via github.dev

The npm Dependency-Confusion Recon Campaign

LibreChat CVE-2026-32625

MCP Design: Config-to-Command Execution and Supply-Chain-Scale RCE

Invisible Unicode Instruction Injection

The Alephium TokenBridge Exploit ($815K)

OnlyFake

Wirecard: forged bank balance confirmations asserted €1.9B that didn't exist

Tampered Certification Test Data Behind Type Designation

Unqualified Engineers Placed Under National-License Claims

The hackerbot-claw Campaign's First Recorded AI-vs-AI Attack

McKinsey Lilli's Writable System Prompts

The Verus-Ethereum Bridge Hack ($11.58M)

The GitHub Internal Repository Breach

The TanStack npm Compromise

The Coinbase KYC Insider Breach

The Robert Williams Wrongful Arrest

SynthID Watermark, Statistically Stripped

Claude Code Source-Leak Lures

GTG-1002: AI agent autonomously executed 80–90% of a cyberattack

Discord 2.05 Billion Message Scraping via Public API

Cursor + Claude Opus 4.6 Wiped PocketOS Production DB in 9 Seconds

Google API Keys Remain Usable for 23 Minutes After Deletion

Noroboto: embedded "lying fonts" made AI's document review read different text

Megalodon GitHub Supply Chain

Starlette CVE-2026-48710 (BadHost)

Stake DAO vsdCRV Unauthorized Mint

KelpDAO / rsETH Unauthorized Unlock