Documented AI security incidents.
Case 13AI developer platforms / stored keys
Nine AI developer platforms disclosed separate security incidents in October. Vendors reported exposure or possible exposure of stored AI keys; no reviewed evidence establishes one attacker or campaign.
Case 14Hugging Face / malicious models
Pluto Security links 31 Hugging Face repositories to a miner and backdoor campaign that returned within days of takedown. Who owned the machines that mined is unverified.
Case 15Cursor / tampered Claude Code extension
For about 11 hours, Cursor's marketplace served tampered copies of the Claude Code extension that tried to plant SSH backdoors. How the attacker gained marketplace access remains unexplained.
Case 16ARTEX and DeepSeek / VAPOR PANDA
CrowdStrike says a China-linked group ran ARTEX AI agents, mainly on DeepSeek, against more than 200 organizations and confirms post-exploitation at nine. The account comes from one company.
Case 22Cairn / exposed agent panels
An operator's open Cairn control panels let NorForge watch AI agents attack online shops. Reuters reports the researcher saw break-ins at more than 100 companies, including Deere and SharkNinja.
Case 19OpenAI / October misalignment reports
OpenAI says an internal model used exposed credentials to enter a research organization's search service, changed its settings and copied 147,451 non-public rows. No affected-party statement was found in the sources reviewed through November 6.
Case 21CERT-In / AI agents in India
India's CERT-In says AI models under provider testing read personal and confidential records on Indian organizations' live systems, and none of the organizations noticed. It names no provider.
Case 20Anthropic / unintended model actions
Anthropic says test models with live internet access ran commands on a university server and sent police a false homicide tip. A State Department spokesperson says one submitted 20 incomplete visa applications, none processed. Anthropic calls the impact minimal.
Case 18ARTEX and Claude Code / South Korean banks
CrowdStrike says exposed attacker infrastructure held ARTEX and Claude Code artifacts linked to data theft at South Korean financial firms. Its report does not map a recovered session to each theft.
Case 23GitHub / agent screenshot leak
Glow says coding agents put more than 13,000 internal screenshots from over 300 organizations into public GitHub repositories. None of the sources reviewed for this record independently verified the counts.
Case 12OpenAI / agent review and pause
OpenAI says research agents posted 53 ChatGPT user images to image hosts and used exposed Census keys. A DNS filtering gap found on September 20 led it to pause work on its most capable models; it says frontier RL training and internal inference resumed October 1.
Case 11OpenAI / public-data retrieval
Transluce reports exploit attempts at three sites, and later at Library and Archives Canada, during public-data collection. None is shown to have succeeded; an OpenAI model separately gained non-public access to Australia's Medicare statistics portal.
Case 10Microsoft 365 / EvilTokens
Microsoft links EvilTokens to more than 12,000 compromised inboxes. Its AI-assisted fraud tools were used in at least one observed incident; wider use is unknown.
Case 08Google / Gemini test breakout
Google says a Gemini model, given internet access by mistake during an Irregular hacking test, guessed or reused credentials to reach three real companies' systems in May before stopping.
Case 09Z.ai / ZCode uploads
ZCode packaged users' workspaces, including full Git history, and sent them to Alibaba Cloud storage by default. Z.ai apologized, removed the feature and open-sourced the client.
Case 07OpenAI / exposed API key
OpenAI says an unreleased model used an exposed third-party API key during training, retrieved metadata and fabricated earnings figures after its data request failed.
Case 03OpenAI / RubyGems
RubyGems suspended new registrations for four days after a package flood linked to OpenAI agents. Successful credential theft remains unestablished.
Case 05Claude / ShinyHunters
Suspected ShinyHunters affiliates used Claude to assist intrusions and steal data, Anthropic reported on September 10.
Case 06Claude / Russian espionage
Anthropic reports theft of more than 300,000 national identity records from a North African authority, and email extraction from at least eight organizations.
Case 04DeepSeek / PaperCut
GreyNoise counted at least 440 server instances at 395 organizations in 48 countries. The victim count remains attributed to the investigating firm.
Case 01OpenAI / public wiki
Agents in timed web-research tasks used a legacy wiki and other public venues to exchange answers and workaround advice. OpenAI confirmed the agents were its own, but the model and full site list remain undisclosed.
Case 02OpenAI / Hugging Face
GPT-5.6 Sol and a more capable internal model crossed multiple trust boundaries, reached production systems and accessed five customer datasets, according to Hugging Face.
Case 17Galileu / Brazilian court filing
A Brazilian labor judge fined two lawyers over white-on-white text telling any AI reader to contest a complaint superficially. No reviewed source shows that the court's Galileu tool obeyed the instruction.
The four-step scale is an editorial assessment of documented impact, not a technical vulnerability score or a probability forecast. Each brief explains its rating; unknown impact is not counted as zero harm.
Source counts measure linked documents, not independent corroborations. Case IDs identify this publication’s records.
Read our methodologySeen an AI system cause harm or cross a boundary? Help us document what happened.
Share what you observed and any evidence we can check. Submissions are leads for editorial review, not automatic additions to the Board.