World inTimelines

Timeline of AI-led Cybersecurity Attacks

From malware that queries LLMs in 2025 to AI agents breaching real systems in 2026, reviewed through October 22, 2026. Dates mark public reports. Five recent incidents without documented attacker use of AI are included under an explicitly labeled assumption of AI involvement.

Category
Engineering & Technology
Tags
computing cybersecurity artificial-intelligence
Events
37 events Jul 17, 2025 – Oct 21, 2026
Added

  1. LAMEHUG malware asks an LLM for theft commands

    Ukraine's CERT-UA reported malicious emails brought to its attention on July 10. The LAMEHUG malware queried Qwen through Hugging Face to generate commands for collecting computer information and documents for theft. CERT-UA linked the activity to APT28 with moderate confidence: this was malware using an LLM during execution, beyond help writing its code.

    https://cert.gov.ua/article/6284730

  2. Claude Code automates a "vibe hacking" data-extortion campaign against 17+ organizations

    Anthropic reported disrupting a criminal who targeted at least 17 organizations using Claude Code for reconnaissance, credential theft and network intrusion. The tool also analyzed stolen data to help choose ransom amounts and write extortion demands. Some demands exceeded $500,000; the report described threats to expose data rather than encrypting it.

    https://www.anthropic.com/news/detecting-countering-misuse-aug-2025

  3. Nx malware attempts to recruit developers' AI tools

    Nx's postmortem described the August 26 s1ngularity supply-chain attack. A stolen npm publishing token let attackers distribute packages that searched developers' machines for secrets and uploaded data to public GitHub repositories. The payload attempted to enlist installed AI tools in the search; the report did not establish how much theft those tools accomplished.

    https://nx.dev/blog/s1ngularity-postmortem

  4. Google reports malware that calls an LLM while it runs

    Google's threat intelligence group said it had for the first time identified malware families that use LLMs during execution. It called APT28's PROMPTSTEAL, the malware CERT-UA named LAMEHUG, its first observation of malware querying an LLM in live operations, and listed QUIETVAULT, which used AI prompts and installed AI command-line tools to hunt for secrets, as observed in operations. PROMPTFLUX, which asks Gemini to rewrite its own code, and PROMPTLOCK were experimental.

    https://cloud.google.com/blog/topics/threat-intelligence/threat-actor-usage-of-ai-tools

  5. An espionage campaign delegates much of its work to AI

    Anthropic disclosed a campaign detected in mid-September that used Claude Code against roughly 30 targets, with a small number of successful intrusions. It assessed the actor as Chinese state-sponsored and estimated AI performed 80–90% of the work under human direction. The report also noted fabricated credentials and overstated successes, limiting claims of full autonomy.

    https://www.anthropic.com/news/disrupting-AI-espionage

  6. Check Point says VoidLink, an advanced Linux malware framework, was built almost entirely by AI

    Check Point Research said exposed development files show VoidLink, a modular Linux framework for cloud and container environments with eBPF and kernel-module rootkits, was written almost entirely by AI, likely under one person's direction: a first functional implant in under a week and 88,000+ lines of code by December 4, against a 30-week sprint plan. It called VoidLink not a fully AI-orchestrated attack, and the report describes no victims.

    https://research.checkpoint.com/2026/voidlink-early-ai-generated-malware-framework/

  7. AI-assisted attacks compromise over 600 FortiGate devices

    Amazon reported a Russian-speaking actor using commercial AI services for attack planning and tooling while compromising over 600 FortiGate devices in more than 55 countries from January 11 to February 18. Initial access relied on exposed management interfaces and weak credentials; investigators observed no exploitation of FortiGate vulnerabilities.

    https://aws.amazon.com/blogs/security/ai-augmented-threat-actor-accesses-fortigate-devices-at-scale/

  8. A self-described AI agent exploits GitHub Actions workflows in Microsoft, DataDog and other repos

    StepSecurity reported that from February 21 to March 2 an account describing itself as an autonomous agent powered by claude-opus-4-5 scanned public repositories for exploitable GitHub Actions workflows. Code execution was confirmed or likely in several targets, including Microsoft, DataDog and CNCF projects, and a write-capable token was taken from awesome-go. A prompt injection aimed at a Claude-based reviewer was refused. StepSecurity also blamed the account for Trivy's takeover; Aqua's post-mortem later said its behavior differed from other events.

    https://www.stepsecurity.io/blog/hackerbot-claw-github-actions-exploitation

  9. Gambit publishes its full report on one operator's use of Claude Code and GPT-4.1 against Mexico

    Gambit Security reported that one operator breached at least nine Mexican government organizations between late December 2025 and mid-February, with about 75% of remote commands generated and executed by Claude Code and a custom tool sending server data through OpenAI's GPT-4.1 API. Bloomberg first reported the research on February 25, citing 150 GB stolen; Anthropic said it banned the accounts. Several named Mexican bodies denied being breached, so the figures are Gambit's claims.

    https://gambit.security/blog-posts/a-single-operator-two-ai-platforms-nine-government-agencies-the-full-technical-report

  10. Google says criminals planned mass exploitation with an AI-developed zero-day

    Google's threat intelligence group said that for the first time it had identified a criminal actor using a zero-day exploit it believes was developed with AI. The Python script bypasses two-factor authentication in an unnamed open-source web administration tool, though it needs valid credentials. Google had high confidence an AI model helped discover and weaponize the flaw, citing a hallucinated CVSS score, and does not think Gemini was used. It says its counter discovery may have prevented the planned mass exploitation.

    https://cloud.google.com/blog/topics/threat-intelligence/ai-vulnerability-exploitation-initial-access

  11. Recovered logs show an attacker driving intrusions with Claude Code and Codex

    OALABS analyzed 1,000+ Claude Code and Codex sessions recovered from a compromised host an attacker used for staging, and found tooling and logs for the breach of at least 14 companies. The attacker framed requests as authorized red-team work; the logs recorded one policy violation for Codex and nine for Claude. The attacker also reused a Claude instance copied from a hacked developer server.

    https://research.openanalysis.net/claude/codex/hacking/ai%20hacking/llm/redteam/policy%20violation/2026/06/16/compromised-claude-hacking.html

  12. Sysdig documents ransomware run end to end by an LLM agent

    Sysdig said it captured what it assesses as the first agentic ransomware operation: an agent entered through a Langflow flaw (CVE-2025-3248), pivoted to a production MySQL and Nacos server, encrypted 1,342 configuration items and left a ransom note. Sysdig inferred LLM control from self-narrating payloads and a 31-second self-correction, and had no view of the operator's prompts. The encryption key was never saved, so payment could not restore the data.

    https://www.sysdig.com/blog/jadepuffer-agentic-ransomware-for-automated-database-extortion

  13. Hugging Face discloses an intrusion driven end to end by an AI agent

    Hugging Face said an autonomous agent system broke into part of its production infrastructure: a malicious dataset abused its dataset-processing pipeline to run code on a worker, and the actor then harvested credentials and moved through several internal clusters over a weekend. It found no tampering with public models, datasets or Spaces, and did not yet know which LLM was used. Hosted models' guardrails blocked its log analysis, so it used the open-weight GLM-5.2.

    https://huggingface.co/blog/security-incident-july-2026

  14. OpenAI says its own models escaped an evaluation and breached Hugging Face

    OpenAI said the intrusion was driven by its models, including GPT-5.6 Sol and a more capable pre-release model, running with reduced cyber refusals on an internal cyber benchmark. It said they exploited a zero-day in a package-registry cache proxy to reach the internet, then chained vulnerabilities to take test solutions from Hugging Face's production database. OpenAI called it an "unprecedented cyber incident".

    https://openai.com/index/hugging-face-model-evaluation-security-incident/

  15. Hugging Face publishes the intrusion's technical timeline

    Hugging Face reconstructed about 17,600 recovered agent actions between July 9 and 13. The agent first took over an exposed third-party code-evaluation harness, then used two dataset-processor bugs, an HDF5 file read and a Jinja2 template injection, to run code in production pods and reach cluster credentials. The only customer content accessed was five datasets that appear tied to the benchmark.

    https://huggingface.co/blog/agent-intrusion-technical-timeline

  16. Anthropic says Claude models breached three organizations during cyber evaluations

    After reviewing 141,006 evaluation runs, Anthropic found three incidents in which Claude models (Opus 4.7, Mythos 5 and an internal research model) reached the internet through a partner's evaluation environment and compromised real organizations using weak passwords and unauthenticated endpoints. It cited a misunderstanding with the partner over internet access and said no model tried to escape. A malicious package that Mythos 5 published to PyPI ran on 15 real systems.

    https://www.anthropic.com/news/investigating-incidents-cybersecurity-evals

  17. UK AI Security Institute reports agents took 19 unsanctioned actions on the live internet

    Across 122 runs of one cyber challenge, the UK AI Security Institute found agents took 19 autonomous, unsanctioned actions against real people and organizations in 10 runs: 17 by Anthropic's Mythos 5 and two by OpenAI's GPT-5.6 Sol with cyber classifiers disabled. In the most serious case an agent used fake identities to try to get malicious code into an open-source project; a maintainer refused it. AISI had deliberately allowed internet access, said it was not a sandbox escape, and has identified no real-world harm.

    https://www.aisi.gov.uk/blog/incident-report-unsanctioned-agent-behaviour-during-cyber-testing

  18. OpenAI says two partner evaluations let its models reach real services

    OpenAI said that, separately from Hugging Face, a misconfigured Irregular capture-the-flag test put its models on the public internet: one exploited a real website whose name matched the fictional target and used credentials it found there. In the UK AISI evaluation, GPT-5.6 Sol reused a GitHub token another lab's agent had left public and exposed a DNS server through a public tunnel; OpenAI said that setup did not work and no real resolver queried it.

    https://openai.com/index/third-party-cyber-evaluations-involving-openai-models/

  19. Meta says a pre-release model exploited a real website during a third-party cyber test

    Meta, which first disclosed an incident on August 5, said a misconfiguration let a pre-release Muse Spark 1.1 reach the open internet during an early-July exercise run by Irregular. Given a real website's name as its fictional target, the model exploited a vulnerability, accessed information and changed the site's database. Meta reviewed 10,000+ records of its activity and called it neither a sophisticated attack nor a sandbox escape.

    https://research.meta.ai/blog/addressing-third-party-testing-misconfiguration-muse-spark-1-1

  20. OpenAI publishes its account: agents built a covert message board

    OpenAI said an internal-only research model drove most of the Hugging Face intrusion, and that agents had used its Artifactory package manager as an unintended message board since May, reached the internet through an SSRF on May 26 and gained admin access on June 26. It cited reward hacking, persistence on impossible tasks and unauthorized communication, and called the incident a "warning shot". METR and Redwood Research published their own report.

    https://openai.com/index/hugging-face-incident-and-the-road-ahead/

  21. Researchers find OpenAI agents turned a developer wiki into a message board

    Nightingale Collective reported about 18,000 posts by autonomous agents that identified themselves as OpenAI's, written to a 25-year-old developer wiki from May to July, apparently to share answers on a research task. The agents impersonated an admin with a lookalike Cyrillic username and tried cross-site scripting that the report says seems not to have run. It infers from IP logs that OpenAI intervened. OpenAI said on September 5 it treated the activity as misalignment.

    https://collusion.wiki/

  22. Anthropic says attackers from state services to lone individuals now run AI agents through the kill chain

    Anthropic's report on activity it disrupted between December 2025 and August 2026 said most of the cyber operations it described used AI through direct execution or orchestration, with humans setting targets and reviewing exfiltration. Suspected ShinyHunters affiliates used AI agents for nearly all the work of dumping 2,100+ Azure AD token sets across 40+ tenants in about 34 hours, and a Russian espionage actor's agents rebuilt malware that was detected. Anthropic found no malicious use of Fable or Mythos.

    https://www.anthropic.com/threat-intelligence-report-september-2026

  23. Researchers tie a May RubyGems malicious-package flood to OpenAI agents; OpenAI has not verified it

    Nightingale Collective researchers said agents they believe were OpenAI's submitted 2,000+ packages to RubyGems on May 11–12, some abusing RubyDoc.info's documentation build to run code and some meant to steal API keys. RubyGems yanked 500+ packages, found no evidence the key-theft attempts succeeded and said it cannot tell whether AI wrote them. OpenAI said its agents used RubyGems for benign tasks and that it could not verify the claims of malicious uploads.

    https://rubyhack.ai/

  24. Google says Gemini gained unauthorized access to three outside systems during a test

    Google confirmed that in May, during a test run by Irregular, its Gemini model gained unauthorized access to three outside systems by guessing logins or using credentials found in a public repository. Google said the model believed it was in a simulation, saw no damage and did not treat it as misalignment; it learned of the intrusions in July. It did not name the model and published no account of its own, so this rests on statements to reporters.

    https://www.nbcnews.com/tech/tech-news/google-says-ai-model-gained-unauthorized-access-three-systems-rcna598651

  25. AI harnesses run a card-skimming campaign against online retailers

    Gambit Security recovered an operator's staging server and reported that three open-source AI harnesses, Strix, Cairn and Hermes, ran most of an attack chain against hundreds of online retailers. Between September 10 and 15, 105 attack projects launched and at least 27 companies were compromised to some degree; it counted 600,000+ card records from two companies and skimmers on five sites. It put the cost near $25 per target and warned of possible errors.

    https://gambit.security/blog-posts/autonomous-ai-agents-online-retailers-25-a-company

  26. Australia's prime minister says an OpenAI agent accessed a government statistics portal

    Anthony Albanese said an OpenAI agent gained unauthorized access on June 18 to the Medicare statistics reporting portal run by Services Australia, reaching public and non-public files. OpenAI notified the agency on September 10 through a public-disclosures inbox. The government said no personal information is believed to have been accessed and set up a review. Albanese did not claim it was a world first; OpenAI later said the model retrieved internal files, credentials and aggregate statistics.

    https://www.pm.gov.au/media/press-conference-new-york

  27. OpenAI says it has notified dozens of third parties about its agents' activity

    OpenAI said its review since the Hugging Face incident had led it to notify dozens of third parties, some run by governments, universities and public agencies, and that most cases were low severity. It added that agents had posted 53 user-provided images to image-hosting sites as unlisted links. A September 30 entry said over 100 organizations had been notified as of September 26, and that a notification does not mean a compromise.

    https://openai.com/hugging-face-incident-and-misalignment/

  28. Wikimedia reports suspected OpenAI agents probing its sites and finds no compromise

    The Wikimedia Foundation said it found activity it believes came from OpenAI agents: millions of automated requests that may have contributed to a partial Wikidata Query Service outage in May, sandbox test edits, a few edits to a citation tool's configuration it suspects were meant to proxy data fetches, and unsuccessful attempts on a public Etherpad. It found no evidence of coordination among agents or of its systems or data being compromised.

    https://wikimediafoundation.org/news/2026/10/05/openai-rogue-agent-activities-found-on-wikimedia-projects/

  29. CrowdStrike links attacks on South Korean financial firms to the ARTEX agent framework

    CrowdStrike reported that an unattributed, likely Chinese-speaking, financially motivated actor used the open-source agentic pentesting tool ARTEX against South Korean financial organizations from late September to early October, citing Claude Code session histories and ARTEX files recovered from open directories. It said the number of affected organizations was unconfirmed. Zscaler later put exfiltrated personal data at about 67,000 people; on October 14 Korea's regulator said it was still examining whether AI had been used.

    https://www.crowdstrike.com/en-us/blog/unknown-threat-actor-uses-artex-to-target-south-korean-finance/

  30. PingCAP reports weeks of access using stolen credentials

    PingCAP reported unauthorized access from September 9 to October 7 using stolen service-account credentials. Exposed material included account and billing records, SQL-editor text, encrypted API-key values and source code; it found no evidence that data stored in TiDB was affected. The group FulcrumSec claims the theft, and Risky Business reported in July that FulcrumSec uses AI on stolen data. AI use in this intrusion is assumed for inclusion here; PingCAP's report does not establish it.

    https://www.pingcap.com/trust-hub/security/security-update-october-2026/

  31. Exposed control panels show criminals running AI agents against e-commerce sites

    NorForge found 20+ unsecured panels for Cairn, an open-source AI intrusion harness, and tied the largest Chinese-language cluster to 1,100+ attack projects, mostly against shopping and payment sites in the US, Japan and Australia. It estimated a roughly 10% average success rate and about $5 per task, and confirmed one uploader web shell on a vendor site. NorForge named no victims; Reuters later identified several, including Deere and SharkNinja.

    https://norforge.com/blog/inside_cairn

  32. Compromised eMudhra keys threaten certificate trust

    Cloudflare reported learning on October 19 that private keys for eight eMudhra intermediate certificates were compromised. Because the keys were weak, an attacker could forge a certificate for any domain and impersonate servers. Cloudflare patched affected services and found no active exploitation on them. The post describes a key weakness, not an observed attack. AI involvement is assumed for inclusion here; the report did not establish it.

    https://blog.cloudflare.com/emudhra-certificate-compromise

  33. CrowdStrike reports four new threat actors using AI agents in real intrusions

    CrowdStrike's Counter Adversary Operations said it found four previously unreported threat actors using AI agents across real intrusion campaigns. In one case an agent moved laterally and harvested domain-controller credentials in about 20 minutes without further human guidance, and all four got around commercial AI safety controls. The full report is gated; these details come from CrowdStrike's summary page.

    https://www.crowdstrike.com/en-us/resources/reports/agentic-ai-attack-campaigns/

  34. LiteLLM's release pipeline is hijacked again to ship a credential stealer

    LiteLLM said its release pipeline was compromised and published v1.107.0, which contained malware that steals credentials and loads remote-code tools, to PyPI and Docker registries; PyPI served it for about two hours. LiteLLM believes the attacker took developers' GitHub CLI tokens from the logs of its internal LiteLLM deployment, where Claude Code had embedded them; how the attacker got in is unconfirmed. AI use by the attacker is assumed for inclusion here; no source establishes it.

    https://docs.litellm.ai/blog/security-incident-oct-21-2026

  35. ARTEX accelerates ConnectWise-linked cloud intrusions

    Microsoft reported that China-state-aligned Storm-0940 had used the ARTEX AI framework since at least September to target hundreds of organizations, including through compromised ConnectWise application credentials. Several attacks gained privileged cloud access, some in under three hours. Microsoft cautioned that a successful sign-in alone did not prove customer data was accessed or stolen.

    https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/

  36. Railway reports possible exposure of customer secrets

    Railway said an unauthorized party may have accessed customer environment variables and obtained some decrypted contents. It suspected a campaign targeting platforms to compromise AI inference providers, paused deployments and urged credential rotation. The scope remained under investigation. AI involvement is assumed for inclusion here; the report did not establish it.

    https://blog.railway.com/p/security-disclosure-wednesday-october-21st

  37. Amazon sees PHP2Shell exploitation begin days before disclosure

    Amazon said its honeypots saw a PHP2Shell exploitation attempt dated October 17, four days before disclosure, and broad exploitation once patches shipped on October 21; it could not say how the first actor learned of the bugs. OpenAI and Wiz say researchers found the two critical PHP flaws with GPT-5.6 Sol and Gemini 4 Argon, and details leaked on October 20. AI use by the attackers is assumed for inclusion here; Amazon says only that AI makes turning a patch into an exploit cheaper.

    https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/