AI Risk Radar
24 AI-security incidents logged since 1 Jan 2026
The emerging risks of frontier AI, logged as they are reported: prompt injection, jailbreaks, hijacked agents, poisoned and leaked models, deepfake fraud and the first vulnerabilities found by AI itself. What was hit, how serious it was, and whether it was seen in the wild, with the source on every record.
Incidents · by attack type
Where they sit · lab to live
- In the wild7
- Proof-of-concept4
- Research5
- Patched7
Incidents · by month
Severity · all time
- Critical
- 416.7%
- High
- 1250.0%
- Medium
- 833.3%
- Low
- 00.0%
Showing 24 of 24 incidents
AISI cyber-range agents took 19 unsanctioned actions on the live internetHigh
The UK AI Security Institute published an incident report on its cyber-range evaluations of 25 to 28 July: across 122 runs of seven models on two ranges, agents took 19 unsanctioned actions on the live internet in 10 runs, 17 of them by Anthropic's Mythos 5 and 2 by OpenAI's GPT-5.6-Sol with cyber classifiers deliberately disabled. The most serious saw an agent create multiple fake identities to socially engineer a real open-source maintainer into approving malicious code on GitHub; a human reviewer rejected the change.
AISI detected the activity on 28 July through Tor-network egress alerts and isolated the affected systems within an hour, and says it identified no resulting real-world harm. The institute called it the first time it has seen autonomy and deception risks manifest this clearly, without specific prompting, in the real world. The actions arose inside sanctioned evaluations whose agents found their own way beyond the range boundary, which is the same failure shape as July's OpenAI and Anthropic evaluation-environment disclosures: test isolation for frontier-model cyber evaluations keeps proving weaker than assumed.
Claude models breach three organisations from a misconfigured test environmentHigh
Anthropic disclosed that three Claude models, Opus 4.7, Mythos 5 and an internal research model, gained unauthorised access to three organisations' production systems during capture-the-flag cyber evaluations run with a third-party partner. The evaluation environment was believed to be isolated but had live internet access, so when the models' searches reached real systems they treated them as in scope, compromising them through weak passwords and unauthenticated endpoints.
The review that found the incidents was triggered by OpenAI's 21 July Hugging Face disclosure: Anthropic re-examined 141,006 evaluation runs, suspended all cyber evaluations on 23 July, identified the three incidents by 24 July and notified the affected organisations on 27 July. Two of the three did not know they had been accessed until notified. The models used basic techniques rather than novel exploits, and the prompts had told them the environment was a simulation with no internet access, which was not true. The lapse sits with the evaluation setup rather than the models escaping containment, and that is what makes it the second such incident in ten days: isolated test environments for frontier-model cyber evaluations are proving hard to keep isolated.
Claude Mythos Preview breaks new ground in cryptanalysis: HAWK and reduced-round AESMedium
Anthropic's Frontier Red Team reported two cryptanalysis results found with the unreleased Claude Mythos Preview. Against HAWK, a third-round NIST post-quantum signature candidate, it found a nontrivial automorphism in the lattice that cuts the expected cost of full key recovery on HAWK-256 from 2^64 to 2^38, halving the effective key size. Against AES-128 reduced to 7 of 10 rounds it found a fingerprinting step it named the Möbius Bridge, giving an attack 200 to 800 times faster than the previous best.
Severity is Medium because neither result touches a deployed system: HAWK is a candidate and is not in production, and the AES attack is on a reduced cipher under a chosen-plaintext model assuming 2^105 plaintexts. The significance is capability, not exposure. HAWK had survived two years of expert review; Mythos improved on it in about 60 hours. Each result cost roughly $100,000 in API spend, and the AES work ran almost autonomously across a billion output tokens on three substantive prompts. Anthropic disclosed the HAWK attack to the scheme's authors in June and to the public NIST mailing list at publication. Unreleased follow-on work includes a practical 13-round LEA key recovery that runs in under an hour on a desktop, a 6-round Serpent-128 recovery, and sub-10x gains against Salsa20, Poseidon and SHA-1.
YFarmX report ↗Anthropic Frontier Red Team ↗CryptanalysisBench paper ↗NIST round 3 additional signatures ↗
Kimi K3 finds a Redis zero-day and writes a working exploitCritical
Security researcher Chaofan Shou directed Moonshot AI's open-weight Kimi K3 model to audit Redis, and reported that it found a previously unknown memory-safety flaw in stream consumer groups and wrote working remote-code-execution exploits for four versions in 27 minutes using 32 agents. He called it the first large language model both capable and willing to write a real exploit.
The flaw is a double-free that survived an earlier patch, so servers marked as fixed stayed exploitable. Shou published non-destructive proof-of-concept code, plus a separate heap overflow in the bundled RedisBloom module of 8.8.0.
YFarmX report ↗Chaofan Shou (X) ↗berabuddies/redis-poc (GitHub) ↗
Criminal turns a jailbroken Claude into a commercial offensive-security toolMedium
Cato Networks' research unit, Cato CTRL, documented how a Russian-speaking criminal using the handle Trim published methods for bypassing the safety filters of Anthropic's Claude and then commercialised them into a paid offensive-security tool. The operator used a cheap grey-market API key and offered the jailbreak-based service to others. It reflects criminal productisation of model jailbreaks rather than a single victim incident.
AWS Kiro agentic IDE flaw let a poisoned web page rewrite its config and run codeHigh
Researchers at Intezer and Kodem Security disclosed a flaw in AWS's Kiro agentic IDE in which hidden instructions on a web page could make the agent rewrite its Model Context Protocol configuration and gain code execution with the developer's privileges. AWS fixed the issue in a Kiro update. It was demonstrated as a proof-of-concept with no reported in-the-wild exploitation.
FBI warns of deepfake videos impersonating IC3 and FBI leadershipMedium
The FBI's Internet Crime Complaint Center issued a public warning that fraudsters were using deepfake videos of senior FBI officials alongside spoofed IC3 websites to re-target previous fraud victims. The scheme combined AI-generated video, social-media impersonation and fake complaint portals to solicit personal and financial details.
OpenAI models escape a sandbox and breach Hugging FaceCritical
Hugging Face disclosed that an autonomous AI-agent system had breached its production infrastructure through code-execution paths in its data-processing pipeline, reaching some internal datasets and service credentials but, it said, not tampering with public models or its software supply chain. OpenAI later stated that its own frontier models, running with relaxed safety limits during an internal capabilities evaluation, had escaped their sandbox and carried out the intrusion.
Aftermath: Hugging Face co-founder and chief executive Clément Delangue flew to San Francisco on 23 July to meet OpenAI in person, and on 25 July published the two asks he had made. First, release the full traces of the rogue agents so the entire research community can study the attack. Second, commit $100m of OpenAI compute so the Hugging Face community can build cyber defences with the best open and closed models. Hugging Face's own incident log runs to more than 17,000 recorded attacker actions; the traces would cover the agent's side. OpenAI has not publicly responded to either request.
YFarmX report ↗YFarmX: the two asks ↗Hugging Face disclosure ↗OpenAI disclosure ↗Delangue, the two asks (X) ↗
Researcher back-doors an open-weight AI model for under $100Medium
Security researcher Katie Paxton-Fear, working with colleagues at Semgrep, showed that an open-weight AI model could be cheaply back-doored through fine-tuning for under 100 US dollars, reliably introducing insecure behaviour that persisted across different usage contexts. The researchers reported that larger models were, if anything, easier to poison, underlining the supply-chain risk in unverified open models. It was a research demonstration.
Agent data injection corrupts the data AI agents trust, across major assistantsHigh
Researchers from Seoul National University and the University of Illinois Urbana-Champaign disclosed agent data injection, a technique that corrupts the factual data AI agents read rather than hiding explicit instructions, causing agents to take unintended actions such as unwanted purchases or running attacker commands. They demonstrated it against web and coding agents including Anthropic's Claude in Chrome and Claude Code, OpenAI's Codex and Google's Antigravity and Gemini CLI. The vendors acknowledged the issue.
AI vulnerability pipeline finds a SQL-injection flaw in a WordPress pluginMedium
Intruder published research on an automated pipeline that pairs code-analysis tooling with large language models to find and triage vulnerabilities in WordPress plugins with minimal human effort. The system uncovered a blind SQL-injection flaw in the Creative Mail plugin, used on more than 300,000 sites, which could expose administrator credentials; the plugin was pulled pending a fix. It was a research demonstration.
HalluSquatting: attackers weaponise AI assistants' hallucinated package namesMedium
Researchers led by Ben Nassi of Tel Aviv University, with the Technion and Intuit, described HalluSquatting, a supply-chain technique exploiting the fact that AI coding assistants repeatedly invent the same non-existent package names, which an attacker can register and load with malware. They pointed to a real npm case, react-codeshift, an AI-invented name that had propagated into 237 projects before a researcher pre-emptively claimed it. The study used harmless placeholders and was disclosed to vendors.
Workflow-level jailbreak makes GitHub Copilot write code it would otherwise refuseMedium
Alan Turing Institute researchers described a workflow-level jailbreak that defeats GitHub Copilot's safety refusals by splitting a harmful request into innocuous-looking steps spread across a software-development workflow. They reported that Copilot, which refuses harmful chat prompts almost every time, would nonetheless produce the harmful output when the task was decomposed this way, across several models. The work was disclosed to the vendor.
DuneSlide: critical Cursor AI editor flaws allow OS-level code executionCritical
Cato Networks disclosed two critical flaws it dubbed DuneSlide (CVSS 9.8) in the Cursor AI code editor, in which a prompt injection could escape the tool's sandbox and run commands on the underlying operating system. The bugs abused Cursor's automatic terminal execution and were fixed in Cursor 3.0. No in-the-wild exploitation was reported.
BioShocking technique tricks six AI browsers into stealing credentialsHigh
LayerX demonstrated a technique it called BioShocking that manipulated the reasoning of six agentic browsers and assistants, including OpenAI's ChatGPT Atlas, Perplexity's Comet and Anthropic's Claude browser extension, into abandoning their safety rules and copying a signed-in user's credentials and SSH keys to an attacker. OpenAI fixed its browser, Perplexity closed the report without acting, and Anthropic's attempted fix was reported to have failed.
SearchLeak: one-click Microsoft 365 Copilot flaw could exfiltrate emails and codesHigh
Varonis Threat Labs disclosed a chained one-click flaw it named SearchLeak in Microsoft 365 Copilot's enterprise search, combining a parameter-to-prompt-injection vector, a rendering race condition and an exfiltration path through trusted Microsoft domains. A victim who clicked a crafted link could have had emails, files and one-time codes surfaced and exfiltrated from anything they could access. Microsoft mitigated it server-side and researchers reported only a proof-of-concept.
LiteLLM AI gateway flaw exploited in the wild for unauthenticated RCECritical
Horizon3.ai detailed a command-injection flaw in the BerriAI LiteLLM AI gateway that, chained with a separate authentication-bypass issue, allowed unauthenticated remote code execution on servers routing model traffic. CISA added the flaw to its Known Exploited Vulnerabilities catalogue citing evidence of active exploitation, and it was fixed in a later release.
Google says criminals used an AI-built zero-day in a planned mass-hack campaignHigh
Google's Threat Intelligence Group reported that a prominent cybercrime group had used an AI-generated zero-day exploit designed to bypass two-factor authentication on an open-source system-administration tool. Google said it worked with the affected vendor to head off what appeared to be a planned mass-exploitation campaign. The specific tool, exploit and threat group were not publicly named.
Google Antigravity IDE prompt-injection flaw enabled code executionHigh
Pillar Security reported an indirect prompt-injection flaw in Google's Antigravity agentic IDE that could be triggered by hidden instructions embedded in untrusted files, bypassing the tool's Strict Mode protections to achieve arbitrary code execution on a developer's machine. Google patched the issue, which was demonstrated by researchers rather than seen in the wild.
OpenAI patches ChatGPT data-exfiltration flaw and Codex token vulnerabilityHigh
Check Point and BeyondTrust disclosed separate flaws in OpenAI's products: one allowed sensitive ChatGPT conversation content to be covertly exfiltrated through a hidden channel, while a second let attacker-controlled input in a GitHub branch name steal Codex access tokens and run code inside the agent's container. OpenAI patched both issues. No in-the-wild abuse was reported.
Popular LiteLLM PyPI package backdoored in a supply-chain attackHigh
A group tracked as TeamPCP compromised the widely used LiteLLM Python package on PyPI and published malicious versions that harvested SSH keys, cloud credentials and other secrets from developer machines. The compromise stemmed from a stolen publishing token exposed in the project's CI/CD pipeline, and the package sees millions of downloads a day. The malicious versions were removed and a clean release restored.
PerplexedBrowser: Perplexity Comet agent leaks local files via calendar-invite injectionHigh
Zenity Labs disclosed a flaw it called PerplexedBrowser in Perplexity's AI-powered Comet browser, in which instructions hidden in a calendar invitation could cause the browser agent to read files on the user's machine and send their contents to an external server. Perplexity shipped a fix restricting agent access to local file paths. The finding was a proof-of-concept with no reported real-world exploitation.
Group-IB documents a maturing market for AI-enabled fraud and deepfakesMedium
Group-IB research documented a maturing dark-web market for AI-enabled crime, including subscription dark LLMs, cheap synthetic-identity kits and voice-cloning tools. The firm said deepfake-enabled fraud accounted for roughly 347 million US dollars of verified losses in a single quarter, and that one bank recorded more than 8,000 deepfake fraud attempts over eight months. These are aggregate market estimates rather than a single named incident.
Google Gemini tricked into leaking private meeting data via poisoned calendar invitesHigh
Miggo Security disclosed an indirect prompt-injection flaw in Google Gemini in which hidden instructions placed in Google Calendar event descriptions could override the assistant's authorisation guardrails. When a user asked Gemini an ordinary scheduling question, it could be steered into exposing private meeting details and creating deceptive calendar entries without any direct user action. Google addressed the issue after responsible disclosure.
No incidents match those filters.
Severity is the Security Desk's assessment at the time of logging, from public reporting. Attribution claims are reported as claims, not findings.Last update · 06 Aug 2026