Brief archive
All Briefs 163
Detailed classification (threat type)
October 2026 19 briefs
US2026-10-24 · Government & public sector · Impersonation · No.163 City of Liberty, Texas, wired ~$600K on a lookalike-domain request that matched a real debt About $600K wired in response to a request from a lookalike vendor domain Japan2026-10-24 · Media & content · Impersonation · No.162 Hatena: scammers posing as police remote-controlled a finance PC, and ¥1.18 billion flowed out The head of accounting's PC was remote-controlled, and about ¥1.18 billion went to outside accounts (booked as an extraordinary loss) US2026-10-24 · Manufacturing & critical infrastructure · No.161 Orion: a scheme targeting one employee sent multiple wires to outside accounts — a $59.2M unrecovered loss A scheme targeting an employee sent transfers to third-party accounts; $59.2M was booked as unrecovered (part later recovered) US2026-10-24 · Government & public sector · Impersonation · No.160 City of Baltimore: a fake supplier contact switched the bank account, and $1.52M went elsewhere $1.52M in supplier payments went to the fake contact's account; about $0.8M was not recovered Japan2026-10-24 · Finance & FinTech · Impersonation · No.159 ZUU paid ¥96M on a business-chat instruction from a fake executive — the same day A chat instruction from a fake executive sent ¥96M to an outside account (booked as an extraordinary loss) US2026-10-24 · Government & public sector · Impersonation · No.158 City of Portland: a supplier's bank account was switched, and a $6.7M water-plant payment went elsewhere A $6.7M water-plant payment went to an account named by someone posing as the contractor (later fully recovered) UK2026-10-23 · Government & public sector · Human error · No.157 Met Police: data on 179 people put on a platform wrongly said to be approved (ICO) Personal data on 179 people uploaded to an unapproved outside platform UK2026-10-23 · Services & retail · Impersonation · No.156 ASOS: a rogue "Asos hacked" app notification, and an employee login later disclosed as stolen The attacker's message reached customers as an official app notification, and names, contact details and more were accessed (NCSC, press) South Korea2026-10-23 · Media & content · Account takeover · No.155 Korea's TVING: a developer key led into production and data on 39.5M accounts leaked User data from 39.5M accounts (including duplicates) leaked Japan2026-10-23 · Procurement & supply chain · Account takeover · No.154 Cuenote FC email delivery breached: about 9 million records with email addresses About 9 million records with email addresses output (estimate) Japan2026-10-22 · Government & public sector · Supply chain · No.153 An attack on NEC's contractor leaked data on 77,851 Osaka University people 77,851 people's data leaked at Osaka University; systems down at Osaka Metropolitan University Japan2026-10-20 · Procurement & supply chain · Supply chain · No.144 Studio: a SaaS breach read the decryption keys too, reaching customer companies' form data Japan2026-10-20 · Government & public sector · Human error · No.134 Tokyo Metropolitan Housing Supply Corporation, 770 names misdirected: no check that labels matched the list before dispatch Names of 770 association heads reached other residents Japan2026-10-20 · Services & retail · No.110 Sourcenext, up to 22.52 million records: no check on the volume and purpose of member-information API calls Up to 22.52 million member records may have leaked US2026-10-20 · Procurement & supply chain · Supply chain · No.069 ConnectWise: a vendor's app identity granted itself Global Administrator in some customer tenants Sign-in activity in about 1,000 tenants, more than 300 successful Japan2026-10-20 · Media & content · No.026 Comic C'moA breach: system logs taken along with member data Five member-data fields and some system logs leaked Japan2026-10-16 · Government & public sector · Impersonation · No.044 SpeeCAN RAIDEN breach: fake mail sent from the disaster-alert domain 36 municipalities suspended the service Denmark2026-10-14 · Government & public sector · Privilege abuse · No.152 Denmark CPR: a company's lawful access was abused to pull data on 8.8 million people Names, addresses and CPR numbers of about 8.8 million people retrieved Japan2026-10-14 · Finance & FinTech · Human error · No.151 TOPPAN sent 177,426 Sompo Japan policyholder records to another insurer 177,000 policyholders' data sent to another insurer
September 2026 12 briefs
Japan2026-09-24 · Developers & agent operations · Impersonation · No.150 North Korean IT workers won contracts in Japan with ID images supplied by local enablers Japan's first laptop farm dismantled; hundreds of millions of yen sent abroad Italy2026-09-21 · Finance & FinTech · Impersonation · No.149 Revolut answered data requests from Italy's certified state email Customer data handed over for months Global2026-09-15 · Developers & agent operations · Supply chain · No.148 RubyDoc.info doc builds ran arbitrary code from 500+ RubyGems spam packages 500+ malicious packages removed Global2026-09-15 · Developers & agent operations · AI failure or misuse · No.147 GitSpawn: seven AI coding agents run code via git config Code ran in 7 AI coding agents Global2026-09-11 · AI adoption (all industries) · Supply chain · No.146 Transformers writes remote code to disk before consent check (CVE-2026-80047) Global2026-09-11 · AI adoption (all industries) · No.145 LiteLLM's MCP auth fallback silently granted unchecked access (CVE-2026-59822) Exploitation in the wild confirmed by CISA Global2026-09-08 · AI adoption (all industries) · AI failure or misuse · No.143 Unit 42: AI-agent-run intrusion completed in under 10 hours Breach completed in under 10 hours Japan2026-09-08 · Finance & FinTech · Account takeover · No.142 Awa Bank: breach of a test environment past its purpose leaks 27,745 records 27,745 customer and shareholder records leaked US2026-09-04 · Supply chain · No.141 IDScan.net: 153M+ scanned driver's licenses sold on the dark web 153M+ driver's licence scans for sale Global2026-09-01 · Impersonation · No.140 AnonyMousKIT: AI voice calls harvest stolen-iPhone passcodes Global2026-09-01 · AI adoption (all industries) · No.139 11 flaws across six major agent frameworks (Check Point) Global2026-09-01 · No.138 ServiceNow AI Platform: four unauthenticated flaws disclosed at once
August 2026 20 briefs
Japan2026-08-28 · Healthcare · No.137 Staff met Japan's claims-Fund one-second target with a tool 290 staff used a tool that auto-pressed Enter Global2026-08-28 · Finance & FinTech · No.136 All 15 x402 facilitators in violation; verification isn't bound to settlement Global2026-08-21 · Finance & FinTech · No.135 Expired Visa EMV contactless cards can pass; the terminal's expiry isn't bound to the record Global2026-08-21 · Developers & agent operations · No.133 One Pyodide sandbox escape reproduced across seven products; isolation premise unverified Global2026-08-21 · AI adoption (all industries) · Supply chain · No.132 A vendor's 'sealed' eval environment opened onto the internet — real third parties breached AI under evaluation accessed 3 organizations' production systems Australia2026-08-21 · AI adoption (all industries) · AI failure or misuse · No.131 OpenClaw's agent cancelled a stranger's gym booking; the API had no authorization check A stranger's booking cancelled, irreversibly Global2026-08-11 · AI adoption (all industries) · AI failure or misuse · No.130 Atlassian Rovo can be tricked into sending Jira/Confluence data out unverified Global2026-08-11 · AI adoption (all industries) · AI failure or misuse · No.129 An AI agent vouched for its own change and rewrote the history (UK AISI) Global2026-08-11 · Developers & agent operations · AI failure or misuse · No.128 Three coding agents broken in default config — one GitHub issue reaches CI Japan2026-08-07 · AI adoption (all industries) · No.127 Japan's MOJ puts voice inside publicity rights in its generative-AI interpretation guidance UK2026-08-07 · Finance & FinTech · No.126 FCA fines Starling Bank £29m — sanctions screening covered only a fraction of the list Over 54,000 accounts opened for 49,000 high-risk customers Global2026-08-07 · Developers & agent operations · Account takeover · No.125 keyv and cacheable npm takeover — nine releases in 38 minutes, all pulled Nine compromised versions published in about 38 minutes US2026-08-04 · Healthcare · No.124 Doctors suspect AI hallucination behind Medicare's WISeR prior-authorization denials Nearly 100 patients awaiting epidurals at one health system Global2026-08-04 · Finance & FinTech · Privilege abuse · No.123 BonkDAO governance attack drained about $20M; the smart contracts ran as designed About $20 million in BONK moved from the treasury Global2026-08-04 · AI adoption (all industries) · No.122 Truffle Security scanned 7.6PB of Hugging Face datasets, found 221,303 live secrets 221,303 still-valid credentials in public datasets Global2026-08-04 · AI adoption (all industries) · Supply chain · No.121 "FaceHugger" flaws in Hugging Face Diffusers let a malicious model repo run code on load Singapore / Malaysia2026-08-03 · Media & content · AI failure or misuse · No.120 TikTok's 3 billion AI labels coexisted with a 550-video AI-presenter disinformation network 550+ misleading videos drew over 3 million views Japan2026-08-03 · AI adoption (all industries) · AI failure or misuse · No.119 Japanese police identified 123 sexual-deepfake cases in H1 2026, passing all of last year — NPA 123 sexual deepfake cases of minors in six months Global2026-08-03 · AI adoption (all industries) · AI failure or misuse · No.118 Copilot for Word document-borne prompt injection; generated files become carriers (PoC) US2026-08-03 · AI adoption (all industries) · No.117 Speechify's voice-cloning consent is one self-certification checkbox; CFA files with the FTC
July 2026 24 briefs
Global2026-07-31 · AI adoption (all industries) · Supply chain · No.116 Fake OpenAI model tops Hugging Face trending; publisher provenance unverified before execution US2026-07-31 · AI adoption (all industries) · No.115 Workday AI hiring-bias suit: no record the decision was verified before rejection Lead plaintiff rejected for 100+ openings (alleged) Global2026-07-31 · Developers & agent operations · AI failure or misuse · No.114 RCE in AWS Kiro: the agent rewrites its own MCP config Global2026-07-31 · AI adoption (all industries) · No.113 Ruflo MCP Bridge unauthenticated RCE: memory poisoning survives the patch US2026-07-31 · Media & content · Impersonation · No.112 Ariana Grande suit: collaborator credentials unverified before the action 45 unreleased songs leaked in 2023 alone Global2026-07-28 · Finance & FinTech · No.111 Wanchain — ambiguous signing encoding let one signature move 65,000× more About 515.2 million NIGHT (roughly $10 million) drained Global2026-07-24 · AI adoption (all industries) · No.109 ServiceNow CVE-2026-6875: one request before login escapes the sandbox to code execution On unpatched instances, data could be read and admins created without logging in Global2026-07-24 · Finance & FinTech · Account takeover · No.108 AFX Trade — compromised signatures met the 2/3 quorum, $24.15M gone Roughly $24.15 million (USDC) drained Global2026-07-24 · Finance & FinTech · No.107 Verus-Ethereum bridge — same entry path, hit again in 66 days for $7.54M Roughly $7.54 million paid out with no backing US2026-07-21 · AI adoption (all industries) · No.106 Figma — AI training defaulted on for individuals/small teams, off for enterprise (Khan v. Figma) Japan2026-07-21 · Media & content · No.105 JAPRO FY2025 — 40,000+ unauthorized likeness/voice posts, and a 100% takedown rate did not stop reappearance Over 40,000 suspected infringing posts Global2026-07-21 · AI adoption (all industries) · AI failure or misuse · No.104 WebMCP — swapping the tools mid-session led agents to call the attacker's tool without noticing Global2026-07-21 · Finance & FinTech · Account takeover · No.103 Ostium — one compromised oracle signer key let "future prices" be accepted as validly signed, draining $18M Up to roughly $18 million (USDC) drained Global2026-07-15 · Developers & agent operations · AI failure or misuse · No.102 Friendly Fire — a defensive AI coding agent ran the very binary it was asked to vet Global2026-07-10 · Finance & FinTech · Supply chain · No.101 Paysafe fake SDKs — 17 packages posing as payment SDKs stole developer secrets, payment API keys and all 17 malicious packages posing as payment SDKs Global2026-07-10 · Finance & FinTech · No.100 Aptos — a ~$3,000 rig reproduced a Move VM type confusion, a risk cascading to ~$70B Global2026-07-10 · Developers & agent operations · AI failure or misuse · No.099 Agentjacking — one fake error report trusted as "resolution steps," and an AI coding agent ran the attacker's commands Global2026-07-07 · AI adoption (all industries) · AI failure or misuse · No.098 BioShocking — six AI browsers, convinced "it's a game," leaked credentials Global2026-07-07 · AI adoption (all industries) · AI failure or misuse · No.097 JadePuffer — an LLM ran a real-world ransomware attack from breach to encryption 1,342 configuration items encrypted beyond recovery Global2026-07-07 · Developers & agent operations · Impersonation · No.096 Gitea — a default reverse-proxy config lets one HTTP header impersonate an admin (CVE-2026-20896) Global2026-07-03 · Developers & agent operations · Supply chain · No.095 Amazon Q — a bundled .amazonq/mcp.json auto-ran and leaked AWS credentials Global2026-07-03 · Developers & agent operations · AI failure or misuse · No.094 Cursor's DuneSlide — one injected prompt escapes the sandbox to RCE Russia / Kyrgyzstan2026-07-03 · Finance & FinTech · No.093 A7A5 moved $110B under sanctions — traceable, yet no attribute stops it at transaction time Over $110 billion moved on-chain under sanctions Global2026-07-01 · Developers & agent operations · No.092 exploitarium: bikini dropped many zero-day PoCs found via AI-automated fuzzing. CVEs exist, but recipients can't verify whether each report is a real finding or noise
June 2026 70 briefs
Global2026-06-30 · Services & retail · Impersonation · No.091 Photo ZIP: authentication laundering cleared SPF/DKIM/DMARC; email auth verifies the path, not the author Global2026-06-30 · AI adoption (all industries) · Supply chain · No.090 AIR: a fake agent skill cleared every scanner; the blind spot was an external link swapped after the scan Global2026-06-30 · Finance & FinTech · Supply chain · No.089 SecondFi: an unaudited SDK swap let private keys be rebuilt from public data (~$2.4M drained) About 16M ADA drained from 374 addresses Global2026-06-30 · Developers & agent operations · No.088 Kestra: a /configs path suffix bypasses auth — unauthenticated root RCE (CVSS 10.0) Global2026-06-30 · Finance & FinTech · Supply chain · No.087 Polymarket: JS injected via a third-party dependency drove fake approvals, ~$3M drained (contracts intact) About $3 million worth of assets stolen UK2026-06-30 · Finance & FinTech · Supply chain · No.086 Sumsub: an 18-month undetected breach of a KYC vendor's support environment exposed users' names and contacts Client end-users' names and contact details exposed (number undisclosed) Global2026-06-30 · Finance & FinTech · No.085 Secret Network: forged-channel deposits went unverified, minting unbacked wrapped tokens (~$4.67M) ~$4.67M in assets withdrawn Hong Kong / UK2026-06-26 · Finance & FinTech · Impersonation · No.084 Hong Kong deepfake meeting fraud: a fake CFO's instruction moved HK$200M (Arup) About HK$200M sent to five accounts in 15 transfers US2026-06-26 · Healthcare · Account takeover · No.083 Change Healthcare: a breach of one Citrix account without MFA halted a third of US medical claims for weeks Medical records of 100M+ Americans affected Global2026-06-26 · Developers & agent operations · Supply chain · No.082 A two-year "trusted developer" impersonation — xz utils backdoor Global2026-06-26 · Finance & FinTech · Supply chain · No.081 JS injected into the signing UI drained ~$1.5B — Bybit ~401,347 ETH (~$1.5B) drained US2026-06-23 · AI adoption (all industries) · AI failure or misuse · No.080 Replit's AI agent broke a code freeze, wiped the production DB, then covered it with fake data Production DB on 1,200+ companies and 1,190+ executives wiped Global2026-06-23 · AI adoption (all industries) · No.079 Common Crawl: ~12,000 live credentials embedded in an LLM training corpus ~12,000 live credentials found in a training corpus US2026-06-23 · Government & public sector · No.078 TennCare Connect's automated eligibility system illegally cut thousands off Medicaid Thousands illegally cut off from benefits US2026-06-23 · Finance & FinTech · No.077 IDMerit's disputed billion-record exposure — no one can show whose data it was Reported exposure of about 1 billion records; custody disputed (figures unverified) US2026-06-23 · Government & public sector · AI failure or misuse · No.076 A 93% FRT 'match' drove arrest with no independent corroboration — Robert Dillon One man wrongfully arrested as someone else Global2026-06-23 · Procurement & supply chain · Supply chain · No.075 Klue's un-revoked test credential led to mass Salesforce extraction CRM records mass-extracted over ~24 hours Global2026-06-23 · Finance & FinTech · Impersonation · No.074 A leaked prover signing key let forged withdrawals pass as valid — Taiko bridge ~$1.7M withdrawn from the bridge vault Global2026-06-19 · AI adoption (all industries) · No.073 ShadowMQ: one unauthenticated ZMQ + pickle implementation, copied across inference stacks — at ecosystem scale Global2026-06-19 · AI adoption (all industries) · No.072 Pickle over an unauthenticated gRPC channel = instant RCE — LeRobot Global2026-06-19 · Manufacturing & critical infrastructure · No.071 One authenticated client reached 7,000 robot vacuums' cameras — DJI ROMO Global2026-06-19 · Manufacturing & critical infrastructure · No.070 One shared key let a single takeover collapse the whole fleet — Unitree / UniPwn Global2026-06-19 · Manufacturing & critical infrastructure · No.068 Unauthenticated network access yields RCE on cobots — UR PolyScope Global2026-06-19 · Finance & FinTech · No.067 An invalid SPV proof minted 5B SYS with no burn — Syscoin bridge ~5 billion SYS minted with no burn behind it Global2026-06-19 · AI adoption (all industries) · Privilege abuse · No.066 Low-priv user to admin and RCE — the LiteLLM gateway chain Japan2026-06-17 · Healthcare · Human error · No.065 Drives assumed shredded resurfaced online — 180,000+ patients (NHO Hokkaido) Drives holding data on about 179,000 patients circulated online US2026-06-17 · Manufacturing & critical infrastructure · AI failure or misuse · No.061 Driver-assist AI braked with no real threat, causing rear-end crashes — Hyundai 4 rear-end crashes and 4 injuries alleged US2026-06-17 · AI adoption (all industries) · AI failure or misuse · No.042 A robotaxi drove past a stopped school bus — Waymo 19 instances logged by the Austin school district this year US2026-06-16 · Procurement & supply chain · Supply chain · No.064 Stolen integration OAuth tokens hit 700+ Salesforce tenants — Salesloft Drift 700+ Salesforce environments queried Global2026-06-16 · AI adoption (all industries) · No.063 Your smart TV is a node in the AI-scraping economy — Bright Data SDK Global2026-06-16 · AI adoption (all industries) · AI failure or misuse · No.062 One GitHub issue hijacks the repo via the agent — Claude Code GitHub Action US2026-06-16 · AI failure or misuse · No.060 Both sides filed AI-hallucinated cases, both sanctioned — N.D. Miss. All four attorneys sanctioned and the trial vacated US2026-06-16 · AI adoption (all industries) · Supply chain · No.059 "Allow all" OAuth to an AI tool became the breach path — Vercel Global2026-06-16 · AI adoption (all industries) · No.058 An agent loads its own checkpoint unverified → RCE — LangGraph China2026-06-15 · AI adoption (all industries) · No.057 No auth on the AI backend — reachable meant readable — DeepSeek Over a million log lines and plaintext chat history exposed US2026-06-15 · AI adoption (all industries) · No.056 Hiring AI: 64M records within reach, no authorization check — McHire Global2026-06-15 · AI adoption (all industries) · AI failure or misuse · No.055 AI exfiltrated data without verifying the instruction's origin — EchoLeak US / Japan2026-06-13 · Media & content · No.054 Copyrighted characters generated until opt-out — Sora 2 Global2026-06-12 · Media & content · Impersonation · No.053 200M views of fake celebrities, likeness provenance gap — YouTube Celebrity-impersonation scam ads viewed about 200 million times Global2026-06-12 · Supply chain · No.052 70k government IDs leaked to prove age — Discord / 5CA 70,000 government ID images stolen Global2026-06-12 · Media & content · Account takeover · No.051 Asking the AI support bot hijacked 20k accounts — Meta HTS 20,225 Instagram accounts taken over Global2026-06-12 · AI adoption (all industries) · AI failure or misuse · No.050 Consent and age unverified at generation — Grok deepfakes US2026-06-12 · AI adoption (all industries) · No.049 Crash control attribution left self-reported — Tesla Robotaxi 2 of 17 crashes were caused by remote teleoperators Global2026-06-12 · Developers & agent operations · Supply chain · No.048 Hidden directives planted in AI instruction files — TrapDoor Over 34 packages and 384+ versions/artifacts Global2026-06-12 · AI adoption (all industries) · AI failure or misuse · No.047 An AI agent forwarded credentials before verifying the sender — OpenClaw / Varonis Global2026-06-12 · No.046 A flipped auth flag let an unauthenticated API query customer instances — ServiceNow Unauthenticated table queries succeeded for some customers Global2026-06-11 · Finance & FinTech · No.045 Keys stolen from one device clear the multisig threshold — Humanity Protocol Over $32M drained US2026-06-09 · AI adoption (all industries) · AI failure or misuse · No.043 Tesla FSD crash data and safety stats, self-reported and unverified — Tesla FSD 9 reduced-visibility crashes (1 death, 1 injury) UK2026-06-09 · Manufacturing & critical infrastructure · Supply chain · No.041 AOG Technics circulated 60,000+ aircraft engine parts with forged airworthiness certificates for over four years Over 60,000 parts circulated with forged certificates Brazil2026-06-09 · Finance & FinTech · No.040 Carbon credits from forests with no real conservation — Operation Greenwashing Global2026-06-09 · AI adoption (all industries) · AI failure or misuse · No.039 In Semantic Kernel, prompt injection led directly to host-level RCE Global2026-06-09 · Developers & agent operations · Supply chain · No.038 A self-propagating npm worm republishes itself with stolen credentials — IronWorm Roughly 37 packages infected Global2026-06-09 · Developers & agent operations · AI failure or misuse · No.037 AI coding agents auto-execute project-local config — SymJack / Miasma 73 repositories across 4 Microsoft orgs disabled Global2026-06-08 · AI adoption (all industries) · No.036 12.8B training images contained passports, résumés, faces — CommonPool Over 800 faces escaped blurring in a 0.1% sample alone US2026-06-08 · Manufacturing & critical infrastructure · No.035 Inspections recorded as complete but never performed — Boeing 787 Roughly 450 aircraft affected (per sources) Global2026-06-08 · Finance & FinTech · Impersonation · No.034 eKYC face-check bypass kits sold on Telegram swap in fake camera video Bypass kits sold in 22 Telegram channels and groups Global2026-06-08 · Account takeover · No.033 One edge-appliance compromise cascaded to full domain takeover — F5 BIG-IP One appliance compromise led to full Active Directory takeover Japan2026-06-08 · Services & retail · Account takeover · No.032 Booking.com payout account switched, ¥9M lost — Polaris Holdings About ¥9M lost at one hotel Mexico / Brazil2026-06-08 · Government & public sector · AI failure or misuse · No.031 AI agents ran intrusions end to end — SHADOW-AETHER Six Mexican government agencies compromised Global2026-06-06 · Services & retail · No.030 Trusted Stripe API repurposed as a card-skimming channel Global2026-06-06 · Developers & agent operations · Account takeover · No.029 One-click GitHub OAuth token theft via github.dev Global2026-06-05 · Developers & agent operations · Supply chain · No.028 33 packages impersonating internal scopes exploited the build environment's provenance assumptions — npm dependency-confusion recon campaign 33+ malicious packages published to npm Global2026-06-05 · AI adoption (all industries) · No.027 User-supplied MCP server URLs became an exfiltration channel for server secrets — LibreChat CVE-2026-32625 CVSS 9.6 Global2026-06-05 · AI adoption (all industries) · Supply chain · No.025 Agent infrastructure trust boundaries, unverified at the reference implementation design level Global2026-06-05 · AI adoption (all industries) · AI failure or misuse · No.024 What humans read and what models read cannot be guaranteed identical without a verification layer Global2026-06-05 · Finance & FinTech · No.023 Guardian keys intact — but the provenance of the events they signed was never verified — Alephium TokenBridge $815K exploit About $815K drained from the bridge Global2026-06-04 · Finance & FinTech · Impersonation · No.022 AI-generated IDs bypassed exchange KYC — image review isn't issuer verification — OnlyFake Germany2026-06-03 · Finance & FinTech · Impersonation · No.021 Forged bank balance confirmations went unverified, reaching disclosure — Wirecard EUR 1.9 billion in cash that did not exist Japan2026-06-03 · Manufacturing & critical infrastructure · No.020 Tampered certification test data reached type designation and shipment — type-designation fraud Type designation of three models revoked Japan2026-06-03 · No.019 Engineers placed under national-license claims they didn't meet — qualified-worker fraud
May 2026 18 briefs
Global2026-05-31 · AI adoption (all industries) · AI failure or misuse · No.018 Rewriting CLAUDE.md to hijack the defending AI — hackerbot-claw, the first AI-vs-AI attack US2026-05-31 · AI adoption (all industries) · AI failure or misuse · No.017 The layer governing the AI's behavior had no integrity or provenance — McKinsey Lilli Global2026-05-31 · Finance & FinTech · No.016 Valid Merkle proof but no verification of source-vs-payout amount — Verus-Ethereum bridge ($11.58M) About $11.58M drained from the bridge US2026-05-31 · Developers & agent operations · Supply chain · No.015 A poisoned VS Code extension lived 18 minutes on the marketplace — GitHub internal breach About 3,800 internal repositories cloned Global2026-05-31 · Developers & agent operations · Supply chain · No.014 Malicious npm packages signed under a legitimate OIDC trusted publisher — TanStack 84 malicious versions published across 42 packages US2026-05-31 · Finance & FinTech · Privilege abuse · No.013 Regulation-mandated raw PII storage became the breach surface via insider — Coinbase KYC KYC data of at least 69,461 customers exfiltrated US2026-05-31 · Government & public sector · AI failure or misuse · No.012 AI face-match drove enforcement with no independent verification — Robert Williams One man wrongfully arrested and held about 30 hours Global2026-05-31 · AI adoption (all industries) · No.011 SynthID Watermark, Statistically Stripped — a provenance mark that can be removed and forged Global2026-05-31 · Developers & agent operations · Impersonation · No.010 Trust signals and GitHub Releases weaponized as a delivery channel — Claude Code leak lures Global2026-05-31 · AI adoption (all industries) · AI failure or misuse · No.009 AI agent ran 80–90% of an attack autonomously — GTG-1002 About 30 targets attacked; a few breached Global2026-05-30 · AI adoption (all industries) · No.008 2.05 billion public messages redistributed as AI training data — Discord scraping 2.05 billion messages scraped and published US2026-05-30 · AI adoption (all industries) · AI failure or misuse · No.007 An AI coding agent wiped a production DB in 9 seconds — Cursor + Claude × PocketOS Production database and backups wiped in 9 seconds Global2026-05-30 · Developers & agent operations · No.006 Deleted API keys stayed usable for 23 minutes — Google revocation lag Global2026-05-30 · AI adoption (all industries) · AI failure or misuse · No.005 Embedded font forgery silently rewrote what the AI read — Noroboto attack Global2026-05-30 · Developers & agent operations · Supply chain · No.004 5,561 repos poisoned in 6 hours via CI/CD credential theft — Megalodon GitHub supply chain Spoofed commits pushed to 5,561 repositories in 6 hours Global2026-05-30 · AI adoption (all industries) · No.003 Host header manipulation bypassed MCP server auth — Starlette CVE-2026-48710 (BadHost) Global2026-05-29 · Finance & FinTech · Account takeover · No.002 Deployer key rewrote LayerZero v2 trust config to mint tokens — Stake DAO vsdCRV 5.4 trillion vsdCRV minted from a forged message Global2026-05-29 · Finance & FinTech · Supply chain · No.001 RPC manipulation on the DVN observation layer unlocked the bridge — KelpDAO / rsETH 116,500 rsETH (approx. ¥46B) unlocked without authorization
No Briefs matched your filters.