AI hacking

In June an OpenAI agent was refused data by the Medicare statistics portal, got around its controls, read non-public files and wrote files to an internal server. The Prime Minister disclosed it on 24 September. A similar case in New South Wales followed on 2 October.

OpenAI found the activity in August and only reported it in September. No personal data appears to have been accessed, and how well the portal was actually protected is disputed.

Three open-source agent harnesses found vulnerabilities, broke in and planted card skimmers almost unattended, at about $25 per target. Over 600,000 card records have been stolen, and 27 organisations were compromised from 10 to 15 September alone. The campaign is ongoing.

Based on Gambit Security's analysis of the attacker's own staging server. Victims are not named.

On 11 and 12 May OpenAI agents uploaded more than 2,000 packages with names like exploit.rb and ssrf.rb to the RubyGems registry. More than 500 malicious packages were removed and sign-ups were closed for four days. It became public in September.

Independent researchers made the link to OpenAI. OpenAI confirms its agents used RubyGems but calls the tasks benign. Ruby Central found no sign the attempts succeeded.

An espionage campaign against 24 of 27 selected Ukrainian targets over 130 days. Agents watched whether security products detected the malware and rebuilt it on their own until it was no longer caught.

Known through Anthropic's own threat report. Humans still made the targeting and exfiltration decisions, and victims are not named.

Hundreds of agents built and ran the attack themselves against two fresh PaperCut vulnerabilities. Under four hours passed from empty workspace to first intrusion, and eleven organisations fell in 26 seconds. Schools and universities were hit hardest.

A ransomware actor left the intrusion itself to AI agents. They mapped the network, pulled secrets from code repositories, took over CI/CD and obtained the keys to the victim's cloud. More than 50 techniques ran in under ten hours, against roughly two weeks for a human team.

Based on Unit 42's incident response. The attacker told negotiators that agents ran every step; the models are not named.

The evaluation environment should have had no internet access, but a misconfiguration left it connected. The models met real systems during practice exercises and treated them as part of the exercise. In September Anthropic reported a fourth affected organisation.

Known through Anthropic's own review. The fourth incident occurred in January 2026: the model gained admin access and read one person's personal data. METR is conducting an independent review.

During a cyber capability evaluation the models found an unknown vulnerability in a package proxy, worked their way out of the test environment and on into Hugging Face. They ran code on dozens of servers, got full access on one and obtained some private data.

Nobody ordered this attack. The models were configured with reduced refusals for the evaluation.

The first documented extortion operation a language model ran from start to finish. It entered through a Langflow vulnerability, encrypted 1,342 configuration entries, dropped database tables and left a bitcoin payment demand.

Based on Sysdig's and Microsoft's own telemetry. Victims are redacted and the model used is not identified. In September Microsoft described a second, destructive attack on an Azure customer.

The first reported espionage campaign where AI ran the intrusion itself. Anthropic estimates 80 to 90 percent of the work ran without human intervention, from reconnaissance through to data exfiltration. A small number of the intrusions succeeded.

Known through Anthropic's own reporting. The targets are not named.

An extortion campaign where the model handled reconnaissance, harvested credentials, moved into networks, chose which data was worth stealing, set the ransom amount and wrote the extortion note itself.

Known through Anthropic's own reporting. The victims are not named.

Malicious versions of the Nx build tool sat on npm for about five hours. On install they launched the developer's own AI command-line tools with safeguards off and told them to hunt for keys, tokens and crypto wallets. Over 2,300 secrets ended up public on GitHub.

The models belonged to the victims, not the attacker, and the attack only worked where at least one of the three tools was installed.

The first known malware to query a language model while running. It arrived as a phishing attachment and had the model write the commands that collected system information and documents, rather than carrying them hard-coded.