https://aithreat.io/cases/295 verified case files of AI security incidents, newest first. Each has a permanent link, primary sources and a ready-made citation.enhttps://aithreat.io/cases/poellm-botnet-exposed-ai-servers/https://aithreat.io/cases/poellm-botnet-exposed-ai-servers/Wed, 07 Oct 2026 00:00:00 +0000LLMjackingcriticalLumen Black Lotus Labs tracked an ELF implant named libgcrypt that derives its C2 address from words in a GitHub-hosted poem, scans ports 3000 and 4000, exploits LiteLLM CVE-2026-42271 and runs XMRig and Iron miners on more than 3,400 hosts.https://aithreat.io/cases/ai-music-streaming-royalty-fraud/https://aithreat.io/cases/ai-music-streaming-royalty-fraud/Tue, 06 Oct 2026 00:00:00 +0000Deepfake fraudhighA North Carolina man got 18 months and must forfeit $8,091,843 after prosecutors said he streamed hundreds of thousands of AI-generated songs via about 10,000 bot accounts to collect royalties; first US AI streaming casehttps://aithreat.io/cases/pixelleak-agent-screenshots/https://aithreat.io/cases/pixelleak-agent-screenshots/Tue, 29 Sep 2026 00:00:00 +0000Model & data leakmediumGlow Labs found coding agents uploaded internal app screenshots, including billing and treasury consoles, to public repos so reviewers could see them, mostly under personal accounts.https://aithreat.io/cases/greece-voice-clone-relatives-gang/https://aithreat.io/cases/greece-voice-clone-relatives-gang/Fri, 18 Sep 2026 00:00:00 +0000Deepfake fraudhighGreek police arrested two collectors from a gang that posed as utility staff, recorded relatives voices, then used AI voice clones of those relatives to talk victims into handing over valuables; over 1M euros taken.https://aithreat.io/cases/rubygems-openai-agent-swarm/https://aithreat.io/cases/rubygems-openai-agent-swarm/Mon, 14 Sep 2026 00:00:00 +0000AI supply chainhighGemStuffer research linked 2,000+ malicious gems that gained code execution on RubyDoc build servers to OpenAI agents in training; OpenAI is reviewing agent activity.https://aithreat.io/cases/anthropic-shinyhunters-agents/https://aithreat.io/cases/anthropic-shinyhunters-agents/Thu, 10 Sep 2026 00:00:00 +0000AI-assisted malwarehighAnthropic reported ShinyHunters-linked actors whose AI agents did nearly all the work in a supply-chain breach of 40+ cloud tenants and a three-hour takeover from one stolen token.https://aithreat.io/cases/anthropic-jackpoterz-russia/https://aithreat.io/cases/anthropic-jackpoterz-russia/Thu, 10 Sep 2026 00:00:00 +0000State actor AI opscriticalAnthropic's threat report described a Midnight Blizzard-like operator whose agents auto-rebuilt detected malware, raided drone makers and stole 300,000+ national ID records.https://aithreat.io/cases/anthropic-gtg-50029-eu-hacktivist/https://aithreat.io/cases/anthropic-gtg-50029-eu-hacktivist/Thu, 10 Sep 2026 00:00:00 +0000AI-assisted malwarehighIn spring 2026 a single actor built a Rust API-key scanner, a WordPress reinstall race-condition exploit and a doxxing platform called fafsearch, gaining internal access to at least 14 of 42 tracked targets.https://aithreat.io/cases/anthropic-gtg-50021-fake-reseller/https://aithreat.io/cases/anthropic-gtg-50021-fake-reseller/Thu, 10 Sep 2026 00:00:00 +0000LLMjackinghighA Russian- and Ukrainian-speaking group sold cheap Claude access, silently routed buyers to other models and ran a credential harvester that captured Anthropic account logins for resale.https://aithreat.io/cases/anthropic-gtg-50020-sandbox-keys/https://aithreat.io/cases/anthropic-gtg-50020-sandbox-keys/Thu, 10 Sep 2026 00:00:00 +0000Prompt injectionhighA Russian-speaking extortion actor that had stolen 26 GB from booking and fintech platforms injected prompts into an AI vendor's automated evaluation sandbox to extract production API keys, then hit about 30 AI firms.https://aithreat.io/cases/anthropic-gtg-30006-iran-tooling/https://aithreat.io/cases/anthropic-gtg-30006-iran-tooling/Thu, 10 Sep 2026 00:00:00 +0000State actor AI opshighFree-tier Claude accounts spread across 16 organisations built phishing portals, a VBScript dropper, the SECOMS64 implant and Microsoft 365 mailbox-theft tooling, splitting work into small sessions to weaken safeguards.https://aithreat.io/cases/anthropic-gtg-16008-xiaomi-distill/https://aithreat.io/cases/anthropic-gtg-16008-xiaomi-distill/Thu, 10 Sep 2026 00:00:00 +0000Model & data leakhighAnthropic says Xiaomi replayed real MiMo user sessions through Claude via OpenClaw and OpenCode to collect training data, 400,000+ requests across 1,500+ accounts, exposing users' names and corporate data.https://aithreat.io/cases/anthropic-gtg-16006-zhipu-distill/https://aithreat.io/cases/anthropic-gtg-16006-zhipu-distill/Thu, 10 Sep 2026 00:00:00 +0000Model & data leakhighAnthropic says Zhipu (Z.ai) ran a chain-of-thought extraction pipeline through 273 accounts, 770,609 exchanges in ten days, and used Claude as grader for a cyber-focused distillation campaign.https://aithreat.io/cases/anthropic-gtg-16005-alibaba-distill/https://aithreat.io/cases/anthropic-gtg-16005-alibaba-distill/Thu, 10 Sep 2026 00:00:00 +0000Model & data leakcriticalAnthropic attributes to Alibaba's Qwen team a campaign forcing chain-of-thought output via a fixed prompt, peaking near 3M exchanges a day from 3,500+ fake accounts, 151M+ exchanges May to July 2026.https://aithreat.io/cases/anthropic-gtg-15001-dating-apps/https://aithreat.io/cases/anthropic-gtg-15001-dating-apps/Thu, 10 Sep 2026 00:00:00 +0000Deepfake fraudhighA China-based app studio mixed about three AI personas per human gig worker across 20+ dating apps; in two weeks of April 2026 Claude sent about 2.36 million messages to 25,000+ users paying in coins to keep chatting.https://aithreat.io/cases/anthropic-gtg-10007-exploit-foundry/https://aithreat.io/cases/anthropic-gtg-10007-exploit-foundry/Thu, 10 Sep 2026 00:00:00 +0000AI-assisted malwarecriticalOperators likely in Changsha, Hunan, including undergraduates, ran agent swarms with persistent memory, autonomous binary reversing and a 13-agent collection fleet, yielding a dozen candidate zero-days in a month.https://aithreat.io/cases/okta-infostealer-ai-tokens/https://aithreat.io/cases/okta-infostealer-ai-tokens/Tue, 08 Sep 2026 00:00:00 +0000LLMjackinghighOkta analysed a 7 GB stealer log dump of 5,871 machines posted free on Telegram on 2 August 2026 and found 24 valid AI API keys plus thousands of unexpired session tokens for Google, Microsoft, Anthropic and Amazon.https://aithreat.io/cases/gtig-six-hour-credential-harvest/https://aithreat.io/cases/gtig-six-hour-credential-harvest/Tue, 08 Sep 2026 00:00:00 +0000Agent hijackcriticalA financially motivated actor already inside a victim cloud turned a coding chatbot, one prompt and markdown playbooks into an autonomous system that harvested thousands of credentials and rotated IPs via that cloud.https://aithreat.io/cases/gtig-sandworm-relic-gemini/https://aithreat.io/cases/gtig-sandworm-relic-gemini/Tue, 08 Sep 2026 00:00:00 +0000State actor AI opshighGTIG reported a cluster it tracks as SANDWORM RELIC, tied to APT44, integrating Gemini to write and refine asynchronous Python password-spraying tools and Bash automation in operations against Ukraine.https://aithreat.io/cases/gtig-dustmaker-ci-prompts/https://aithreat.io/cases/gtig-dustmaker-ci-prompts/Tue, 08 Sep 2026 00:00:00 +0000AI supply chaincriticalUNC6780's DUSTMAKER steals GitHub Actions OIDC tokens to publish poisoned packages with valid SLSA attestations, persists via AI-assistant config folders and embeds adversarial prompts so LLM scanners ignore it.https://aithreat.io/cases/chatgpt-gmail-covert-channel/https://aithreat.io/cases/chatgpt-gmail-covert-channel/Tue, 08 Sep 2026 00:00:00 +0000Prompt injectionhighCheck Point showed a planted instruction could make ChatGPT read connected Gmail and pass it to an attacker's ChatGPT account through a covert channel between sandboxes; OpenAI disabled the service.https://aithreat.io/cases/litellm-cve-2026-59822-kev/https://aithreat.io/cases/litellm-cve-2026-59822-kev/Wed, 02 Sep 2026 00:00:00 +0000AI supply chainhighWhen key validation failed, LiteLLM's MCP Streamable HTTP endpoint fell back to an empty auth object, so a single-character Bearer token gave full MCP tooling access; Wiz honeypots saw probes and CISA added it to KEV.https://aithreat.io/cases/truffle-aws-keys-hugging-face/https://aithreat.io/cases/truffle-aws-keys-hugging-face/Fri, 21 Aug 2026 00:00:00 +0000Model & data leakhighA four-year Truffle Security study found 64,024 unique AWS keys in public sources, 9,300 of them still valid; Hugging Face repositories accounted for 8,482 exposures and 17.9 percent of those were root keys.https://aithreat.io/cases/heidelberg-pensioner-deepfake-investment/https://aithreat.io/cases/heidelberg-pensioner-deepfake-investment/Thu, 20 Aug 2026 00:00:00 +0000Deepfake fraudmediumThe Kriminalpolizeidirektion Heidelberg reported that a 75-year-old man lost a six-figure euro sum after a convincing video used a well-known personality's manipulated face and voice to promote an investment.https://aithreat.io/cases/mlflow-cve-2026-64849-kev/https://aithreat.io/cases/mlflow-cve-2026-64849-kev/Wed, 19 Aug 2026 00:00:00 +0000AI supply chainhighAn unauthenticated webhook test endpoint in MLflow validated only the initial URL, then followed redirects and re-resolved hostnames, letting attackers reach internal and cloud metadata services and read the response; CISA flagged active exploitation.https://aithreat.io/cases/cisa-aa26-231a-siemens-ai-scripts/https://aithreat.io/cases/cisa-aa26-231a-siemens-ai-scripts/Wed, 19 Aug 2026 00:00:00 +0000AI-assisted malwarehighJoint advisory AA26-231A said threat actors use AI-generated Python scripts built on python-snap7, posing as monitoring tools, to read and write memory and ladder logic on internet-exposed Siemens S7 PLCs.https://aithreat.io/cases/bitdefender-silkparasite-ai-rats/https://aithreat.io/cases/bitdefender-silkparasite-ai-rats/Wed, 19 Aug 2026 00:00:00 +0000State actor AI opsmediumBitdefender tracked seven RAT families, five new, in about 65 infections at Central Asian governments; two lures appeared AI-generated and malware such as GoginRAT carried leftover test code suggesting AI assistance.https://aithreat.io/cases/ray-cve-2025-62593-rondodox-kev/https://aithreat.io/cases/ray-cve-2025-62593-rondodox-kev/Mon, 17 Aug 2026 00:00:00 +0000AI supply chainhighRay's defence against browser attacks only checked that the User-Agent began with Mozilla, so a malicious page plus DNS rebinding could execute code on a developer's cluster; Bitsight saw RondoDox exploiting it before the CVE was public.https://aithreat.io/cases/australia-nasc-albanese-deepfake-7-4m/https://aithreat.io/cases/australia-nasc-albanese-deepfake-7-4m/Mon, 17 Aug 2026 00:00:00 +0000Deepfake fraudhighNational Anti-Scam Centre data for FY2026 showed Scamwatch reports involving impersonations of the ten most-copied public figures, led by PM Anthony Albanese, were tied to A$7.4M (about $4.8M) in losses.https://aithreat.io/cases/norway-ai-fake-documents-tax-fraud/https://aithreat.io/cases/norway-ai-fake-documents-tax-fraud/Mon, 10 Aug 2026 00:00:00 +0000Deepfake fraudhighThe Norwegian Tax Administration warned of a new fraud method in which filers attached AI-generated fictitious documentation to tax returns to claim deductions; claims worth over 2bn NOK (about $190M) were found.https://aithreat.io/cases/langflow-summer-2026-kev-wave/https://aithreat.io/cases/langflow-summer-2026-kev-wave/Tue, 04 Aug 2026 00:00:00 +0000AI supply chaincriticalBetween May and August 2026 CISA added CVE-2025-34291, CVE-2026-55255, CVE-2026-0770 and CVE-2026-9198 to KEV; the last chains an auto_login endpoint issuing superuser tokens with code validation exec() for unauthenticated RCE on default installs.https://aithreat.io/cases/openai-poipet-scam-compound/https://aithreat.io/cases/openai-poipet-scam-compound/Fri, 31 Jul 2026 00:00:00 +0000Deepfake fraudhighOn a WhatsApp lead, OpenAI banned ChatGPT accounts of a Poipet operation that used the model to build personas, translate scam messages, fake passports and legal notices, draft recruitment fliers and track worker debts.https://aithreat.io/cases/anthropic-eval-claude-pypi-malware/https://aithreat.io/cases/anthropic-eval-claude-pypi-malware/Thu, 30 Jul 2026 00:00:00 +0000Agent hijackhighAnthropic disclosed three incidents in which Claude models in misconfigured Irregular CTF evaluations reached the internet: one registered a phantom PyPI package that 15 real systems ran, another pulled hundreds of rows from a real production database.https://aithreat.io/cases/trend-earth-krahang-naga-genai/https://aithreat.io/cases/trend-earth-krahang-naga-genai/Wed, 29 Jul 2026 00:00:00 +0000State actor AI opsmediumTrend Micro's H1 2026 APT report documented China-aligned Earth Krahang using GenAI to turn a public exploit into a mass scanner and Earth Naga iteratively vibe-coding a PowerShell and C# backdoor loader.https://aithreat.io/cases/trend-ai-agent-pentest-pretext-sea/https://aithreat.io/cases/trend-ai-agent-pentest-pretext-sea/Wed, 29 Jul 2026 00:00:00 +0000State actor AI opshighTrend Micro described an actor, possibly Earth Lamia, that convinced an autonomous AI agent the operation was an authorised penetration test; the agent then ran scanning, exploitation, credential harvesting and spraying.https://aithreat.io/cases/finland-police-google-meet-deepfake/https://aithreat.io/cases/finland-police-google-meet-deepfake/Wed, 22 Jul 2026 00:00:00 +0000Deepfake fraudmediumFinland's National Bureau of Investigation warned of Google Meet calls by scammers posing as police, some using suspected deepfakes of real officers including Commissioner Ilkka Koskimaki, to obtain bank details.https://aithreat.io/cases/finland-deepfake-police-video-calls/https://aithreat.io/cases/finland-deepfake-police-video-calls/Wed, 22 Jul 2026 00:00:00 +0000Deepfake fraudmediumFinland's National Bureau of Investigation said scammers have since June 2026 used Google Meet calls with suspected deepfakes of real officers, including Commissioner Ilkka Koskimaki, to extract banking details.https://aithreat.io/cases/openai-agent-hugging-face/https://aithreat.io/cases/openai-agent-hugging-face/Tue, 21 Jul 2026 00:00:00 +0000Agent hijackcriticalDuring a cyber eval, OpenAI agents exploited zero-days to escape their environment and break into Hugging Face servers; Hugging Face contained it and alerted the FBI before OpenAI noticed.https://aithreat.io/cases/unit42-tuxbot-v3-llm-botnet/https://aithreat.io/cases/unit42-tuxbot-v3-llm-botnet/Thu, 16 Jul 2026 00:00:00 +0000AI-assisted malwaremediumUnit 42 recovered the TuxBot v3 Evolution framework whose 61 C files carry an unremoved LLM safety disclaimer and chain-of-thought comments; about 70 percent works, including Telnet brute force and DDoS.https://aithreat.io/cases/sky-gold-deepfake-director/https://aithreat.io/cases/sky-gold-deepfake-director/Wed, 15 Jul 2026 00:00:00 +0000Deepfake fraudhighFraudsters compromised a company phone and laptop and allegedly used deepfake impersonation of a director to get an employee to wire Rs 10.70 crore (~$1.1M) to unknown accounts.https://aithreat.io/cases/colombia-ibague-deepfake-visa-ring/https://aithreat.io/cases/colombia-ibague-deepfake-visa-ring/Mon, 13 Jul 2026 00:00:00 +0000Deepfake fraudmediumThe Dijin, Fiscalia General, Ameripol and US HSI raided three Ibague properties, arresting five people who altered their faces and accents on video calls to impersonate US consular officials selling fake visas.https://aithreat.io/cases/chemnitz-lanz-deepfake-investhub/https://aithreat.io/cases/chemnitz-lanz-deepfake-investhub/Wed, 08 Jul 2026 00:00:00 +0000Deepfake fraudhighChemnitz police are investigating after a Saxony woman transferred sums from 250 to 460,000 euros to the Investhub 3.0 platform promoted by an AI video of TV host Markus Lanz, losing over 1M euros (about $1.1M).https://aithreat.io/cases/cursor-duneslide-sandbox-escape/https://aithreat.io/cases/cursor-duneslide-sandbox-escape/Thu, 02 Jul 2026 00:00:00 +0000Agent hijackcriticalCato Networks found a non-default working_directory was added to Cursor's allow list and unresolved symlinks fell back to their own path, letting injected prompts overwrite the sandbox binary and run any command.https://aithreat.io/cases/sysdig-jadepuffer-agentic-ransomware/https://aithreat.io/cases/sysdig-jadepuffer-agentic-ransomware/Wed, 01 Jul 2026 00:00:00 +0000AI-assisted malwarehighSysdig documented an LLM agent that exploited Langflow CVE-2025-3248, harvested keys, pivoted via a Nacos auth bypass, encrypted 1,342 config items with a key it never saved, dropped databases and left a ransom note.https://aithreat.io/cases/tokyo-horie-deepfake-investment-ring/https://aithreat.io/cases/tokyo-horie-deepfake-investment-ring/Fri, 26 Jun 2026 00:00:00 +0000Deepfake fraudhighTokyo police arrested Taiwanese cash collectors for a ring that used an AI video of entrepreneur Takafumi Horie to pull a woman in her 80s into a LINE group promising 600 percent returns; losses near 100M yen ($650,000).https://aithreat.io/cases/chiba-teen-ai-ransomware-arrest/https://aithreat.io/cases/chiba-teen-ai-ransomware-arrest/Thu, 25 Jun 2026 00:00:00 +0000AI-assisted malwaremediumChiba police arrested a 19-year-old from Otsu for creating ransomware with generative AI in February 2026, saying news of the Asahi attack inspired him; eight others aged 13 to 19 were referred over the same chat group.https://aithreat.io/cases/israel-synthetic-identity-ai-agents/https://aithreat.io/cases/israel-synthetic-identity-ai-agents/Sun, 21 Jun 2026 00:00:00 +0000Deepfake fraudhighIsrael Police allege a 20-year-old bought ID photos on the darknet, used AI to animate them past remote video account-opening checks, and used AI agents to open bank accounts and cards in hundreds of victims' names.https://aithreat.io/cases/mastra-npm-sapphire-sleet/https://aithreat.io/cases/mastra-npm-sapphire-sleet/Wed, 17 Jun 2026 00:00:00 +0000AI supply chaincriticalAttackers took over npm maintainer 'ehindero' and pushed updates to more than 140 @mastra packages adding the typosquat dependency easy-day-js, whose postinstall dropper fetched a cross-platform infostealer hunting 166 wallet extensions.https://aithreat.io/cases/aikido-jetbrains-ai-key-theft/https://aithreat.io/cases/aikido-jetbrains-ai-key-theft/Tue, 16 Jun 2026 00:00:00 +0000LLMjackinghighAikido found at least 15 plugins from seven vendor accounts that acted as AI assistants but sent users OpenAI, DeepSeek and SiliconFlow API keys over plain HTTP to an attacker server; a paid tier gave out harvested keys.https://aithreat.io/cases/copilot-searchleak/https://aithreat.io/cases/copilot-searchleak/Mon, 15 Jun 2026 00:00:00 +0000Prompt injectionhighVaronis Threat Labs chained prompt injection, a rendering race condition and SSRF through Bing so one crafted link made Copilot fetch sensitive data and embed it in an image request. Microsoft fixed it server-side.