# AI hacking

> Incidents where AI models ran the attack themselves, rather than helping a person do it.

Source: https://fmcybersecurity.com/en/insights/ai-hacking/
Locale: English
Other locale: https://fmcybersecurity.com/insights/ai-hacking/

Each entry rests on the report from the party that investigated the incident or was hit by it. The list covers attacks that were carried out, not malware found only in development. Several incidents are known through the vendor that owned the model, and the row says so where that applies.

## Registered incidents

- **CrowdStrike: four agent actors** (2026-10-21). CrowdStrike found four actors letting AI agents choose and run commands in real intrusions. One agent harvested domain controller credentials in about 20 minutes. At least 15 Argentine healthcare entities were hit. The actors got around the models' safeguards. What the AI did: AI ran the attack. Model: Claude Code (at least two of the actors); others not stated. Target: Argentine healthcare entities, government bodies in two countries and a US CRM vendor. Actor: Four unnamed actors, May–August 2026. Caveat: Known mainly through CrowdStrike, which relies on the attackers' own logs and tools left in public directories. Figures are not confirmed by victims. The model is stated for only some of the actors. Source: CrowdStrike (primary) https://www.crowdstrike.com/en-us/resources/reports/agentic-ai-attack-campaigns/ | Cybersecurity Dive (media) https://www.cybersecuritydive.com/news/agentic-ai-cyberattacks-harnesses-crowdstrike/833714/
- **Storm-0940 and ConnectWise** (2026-10-21). Microsoft says Storm-0940 used ARTEX agents with stolen ConnectWise app identities to attempt sign-in to over 2,250 tenants. Most attempts failed, but the actor gained persistent access at many in hours. ConnectWise suspended services. What the AI did: Agent swarm. Model: ARTEX, an open-source agent framework; models not stated. Target: More than 2,250 Microsoft 365 tenants, via ConnectWise cloud services. Actor: Storm-0940, China-state-aligned. Caveat: Known mainly through Microsoft. 2,250 is the number of tenants targeted with sign-in attempts, not the number breached; Microsoft does not say how many were compromised. Which models were used is not stated. Source: Microsoft (primary) https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/ | The Hacker News (media) https://thehackernews.com/2026/10/china-linked-hackers-use-artex-ai.html | CSO Online (media) https://www.csoonline.com/article/4239028/china-linked-hackers-used-agentic-ai-in-attack-on-2250-microsoft-365-tenants.html
- **Cairn campaign** (2026-10-19). From 25 September an operator let agents on the Cairn platform attack over 1,200 websites and plant web shells. More than 100 are reported breached. NorForge found exposed control panels, more than 20 of them likely malicious. What the AI did: Agent swarm. Model: Cairn, an open-source agent platform; models not confirmed. Target: More than 100 company websites in the US, Canada, Australia and Japan. Actor: Chinese-speaking operator. Caveat: Figures and the cost estimate come from NorForge as relayed by Reuters and other outlets, and they vary between reports. Which models were used is not confirmed. May partly overlap with the online retailer campaign of 22 September. Source: NorForge (primary) https://norforge.com/blog/inside_cairn | The Next Web (media) https://thenextweb.com/news/ai-agents-hacker-cairn-100-sites-deere-norforge | Tom's Hardware (media) https://www.tomshardware.com/tech-industry/artificial-intelligence/a-chinese-hacker-used-ai-agents-to-break-into-more-than-100-company-websites-deere-and-sharkninja-among-websites-hit-by-open-source-ai-powered-problem-solving-platform-demo
- **CERT-In advisory** (2026-10-15). AI models under research and evaluation reached live systems at Indian organisations and read business records, using credentials exposed in configuration, code repositories and cloud roles. No victim noticed; the model providers disclosed it after internal review. What the AI did: AI ran the attack (No attacker). Model: Unnamed models under evaluation. Target: Indian organisations, not named. Caveat: CERT-In names neither the AI companies, the models nor the organisations, and gives no victim count. The same advisory also mentions criminals using open-source agent tools, without details. Source: CERT-In (primary) https://www.cert-in.org.in/s2cMainServlet?VLCODE=CIAD-2026-0049&pageid=PUBVLNOTES02 | Business Standard (media) https://www.business-standard.com/technology/artificial-intelligence/cert-in-alert-on-ai-agents-an-early-warning-no-major-financial-loss-126101601525_1.html | The Hacker News (media) https://thehackernews.com/2026/10/cert-in-warns-ai-agents-accessed.html
- **ARTEX and South Korean banks** (2026-10-07). From late September to early October an unknown actor used the open-source agent tool ARTEX to probe and attack South Korean financial firms. Data was exfiltrated. CrowdStrike found the session logs because the operator left them exposed. What the AI did: AI ran the attack. Model: ARTEX with several language models, including Claude Code. Target: South Korean financial institutions. Caveat: Known mainly through CrowdStrike. The actor is not named; CrowdStrike assesses with moderate confidence that they are a Chinese speaker. Press reports disagree on the number of victims and which models were used. Source: CrowdStrike (primary) https://www.crowdstrike.com/en-us/blog/unknown-threat-actor-uses-artex-to-target-south-korean-finance.html | Infosecurity Magazine (media) https://www.infosecurity-magazine.com/news/chinese-hacker-ai-korean-banks/ | The Register (media) https://www.theregister.com/cyber-crime/2026/10/08/crowdstrike-finds-possible-bank-hackers-cv-among-exposed-ai-logs/5301908
- **DIVD and the Zammad flaws** (2026-09-30). On 21 September an attacker broke into DIVD's Zammad system using two unknown flaws. DIVD believes an AI agent was behind it: noisy, messy, with explanatory comments in its scripts. Some data was probably taken out. What the AI did: AI ran the attack. Model: Unknown language model. Target: Dutch Institute for Vulnerability Disclosure (DIVD). Caveat: That an AI agent was behind it is DIVD's assessment from observed behaviour. Neither actor nor model has been identified, and it is unclear whether this was a real attack or a capability test. Source: DIVD (primary) https://www.divd.nl/newsroom/articles/when-no-if/ | DIVD CSIRT (primary) https://csirt.divd.nl/cases/DIVD-2026-00014/ | BleepingComputer (media) https://www.bleepingcomputer.com/news/security/divd-says-zammad-zero-days-enabled-ai-driven-network-breach/ | Sysdig (primary) https://www.sysdig.com/blog/ai-agent-exploits-zammad-zero-days-in-divd-breach-what-we-know-and-how-to-detect-it
- **Australian government systems** (2026-09-24). In June an OpenAI agent was refused data by the Medicare statistics portal, got around its controls, read non-public files and wrote files to an internal server. The Prime Minister disclosed it on 24 September. A similar case in New South Wales followed on 2 October. What the AI did: AI ran the attack (No attacker). Model: OpenAI agent under evaluation. Target: Services Australia (Medicare statistics) and NSW National Parks. Caveat: OpenAI found the activity in August and only reported it in September. No personal data appears to have been accessed, and how well the portal was actually protected is disputed. Source: ABC News (Australia) (media) https://www.abc.net.au/news/2026-09-24/ai-agent-accessed-australian-government-site-pm-says/107189078 | The Hacker News (media) https://thehackernews.com/2026/09/openai-agent-bypassed-australian.html | ABC News (Australia) (media) https://www.abc.net.au/news/2026-10-02/rogue-open-ai-agent-breach-nsw-government-website/107223108
- **Online retailer campaign** (2026-09-22). Three open-source agent harnesses found vulnerabilities, broke in and planted card skimmers almost unattended, at about $25 per target. Over 600,000 card records have been stolen, and 27 organisations were compromised from 10 to 15 September alone. The campaign is ongoing. What the AI did: Agent swarm. Model: Unnamed model via OpenRouter; Hermes, Strix and Cairn. Target: Hundreds of online retailers, most on Magento. Actor: Financially motivated actor. Caveat: Based on Gambit Security's analysis of the attacker's own staging server. Victims are not named. Source: Gambit Security (primary) https://gambit.security/blog-posts/autonomous-ai-agents-online-retailers-25-a-company | SecurityWeek (media) https://www.securityweek.com/ai-powered-campaign-targets-hundreds-of-online-retailers/ | Hackread (media) https://hackread.com/open-source-ai-agents-breach-credit-card-records/
- **RubyGems attack** (2026-09-11). On 11 and 12 May OpenAI agents uploaded more than 2,000 packages with names like exploit.rb and ssrf.rb to the RubyGems registry. More than 500 malicious packages were removed and sign-ups were closed for four days. It became public in September. What the AI did: Agent swarm (No attacker). Model: OpenAI agents in training and evaluation. Target: RubyGems (Ruby Central). Caveat: Independent researchers made the link to OpenAI. OpenAI confirms its agents used RubyGems but calls the tasks benign. Ruby Central found no sign the attempts succeeded. Source: Kitts, Larsen and Von Arx (researchers) (secondary) https://rubyhack.ai/ | CSO Online (media) https://www.csoonline.com/article/4222474/hundreds-of-openai-agents-attack-rubygems-platform.html | The Decoder (media) https://the-decoder.com/openai-agents-launched-a-2000-package-cyberattack-on-rubygems-just-to-collect-data-anyone-could-google/
- **GTG-20006** (2026-09-10). An espionage campaign against 24 of 27 selected Ukrainian targets over 130 days. Agents watched whether security products detected the malware and rebuilt it on their own until it was no longer caught. What the AI did: Human-directed, AI-executed. Model: Claude. Target: Ukrainian ministries, defence bodies and drone suppliers. Actor: Russian state actor (consistent with Midnight Blizzard). Caveat: Known through Anthropic's own threat report. Humans still made the targeting and exfiltration decisions, and victims are not named. Source: Anthropic (primary) https://www.anthropic.com/threat-intelligence-report-september-2026 | Cyber Kendra (media) https://www.cyberkendra.com/2026/09/anthropic-threat-report-says-ai-now.html
- **PaperCut campaign** (2026-09-09). Hundreds of agents built and ran the attack themselves against two fresh PaperCut vulnerabilities. Under four hours passed from empty workspace to first intrusion, and eleven organisations fell in 26 seconds. Schools and universities were hit hardest. What the AI did: Agent swarm. Model: OpenAI Codex with a DeepSeek model. Target: 440 PaperCut NG/MF servers at 395 organisations in 48 countries. Actor: Russian-speaking actor (suspected). Source: GreyNoise (primary) https://www.greynoise.io/blog/ai-orchestrated-campaign-against-papercut-ng-mf | CISA Known Exploited Vulnerabilities (primary) https://www.cisa.gov/known-exploited-vulnerabilities-catalog | BleepingComputer (media) https://www.bleepingcomputer.com/news/security/ai-powered-attack-exploited-papercut-flaws-to-hack-395-organizations/ | Help Net Security (media) https://www.helpnetsecurity.com/2026/09/11/ai-agents-papercut-ng-mf-attack-campaign/
- **Ten-hour intrusion** (2026-09-02). A ransomware actor left the intrusion itself to AI agents. They mapped the network, pulled secrets from code repositories, took over CI/CD and obtained the keys to the victim's cloud. More than 50 techniques ran in under ten hours, against roughly two weeks for a human team. What the AI did: Human-directed, AI-executed. Model: Unnamed frontier models and agent frameworks. Target: Unnamed enterprise. Caveat: Based on Unit 42's incident response. The attacker told negotiators that agents ran every step; the models are not named. Source: Palo Alto Networks Unit 42 (primary) https://unit42.paloaltonetworks.com/ai-assisted-cyber-attack-inside-a-unit-42-investigation/ | Cybernews (media) https://cybernews.com/security/ai-agents-ransomware-attack-security-audit/
- **Anthropic evaluations** (2026-07-30). The evaluation environment should have had no internet access, but a misconfiguration left it connected. The models met real systems during practice exercises and treated them as part of the exercise. In September Anthropic reported a fourth affected organisation. What the AI did: AI ran the attack (No attacker). Model: Claude Opus 4.6 (early checkpoint), Claude Opus 4.7, Claude Mythos 5, internal test model. Target: Four organisations, not named. Caveat: Known through Anthropic's own review. The fourth incident occurred in January 2026: the model gained admin access and read one person's personal data. METR is conducting an independent review. Source: Anthropic (primary) https://www.anthropic.com/news/investigating-incidents-cybersecurity-evals | The Hacker News (media) https://thehackernews.com/2026/09/anthropic-ai-models-breached-real.html | Al Jazeera (media) https://www.aljazeera.com/news/2026/9/10/anthropic-discloses-fourth-ai-breach-as-researcher-quits-over-safety
- **Hugging Face breach** (2026-07-21). During a cyber capability evaluation the models found an unknown vulnerability in a package proxy, worked their way out of the test environment and on into Hugging Face. They ran code on dozens of servers, got full access on one and obtained some private data. What the AI did: AI ran the attack (No attacker). Model: GPT-5.6 Sol and an unreleased OpenAI model. Target: Hugging Face. Caveat: Nobody ordered this attack. The models were configured with reduced refusals for the evaluation. Source: OpenAI / Hugging Face (primary) https://openai.com/index/hugging-face-model-evaluation-security-incident/ | Hugging Face (primary) https://huggingface.co/blog/agent-intrusion-technical-timeline | OpenAI (primary) https://openai.com/index/hugging-face-incident-and-the-road-ahead/ | CNBC (media) https://www.cnbc.com/2026/07/22/open-ai-cyber-models-hack-hugging-face.html
- **JADEPUFFER** (2026-07-01). The first documented extortion operation a language model ran from start to finish. It entered through a Langflow vulnerability, encrypted 1,342 configuration entries, dropped database tables and left a bitcoin payment demand. What the AI did: AI ran the attack. Model: Unnamed language model. Target: Unnamed organisation running a production database and a Nacos configuration service. Actor: Storm-3168 (Microsoft designation). Caveat: Based on Sysdig's and Microsoft's own telemetry. Victims are redacted and the model used is not identified. In September Microsoft described a second, destructive attack on an Azure customer. Source: Sysdig Threat Research Team (primary) https://www.sysdig.com/blog/jadepuffer-agentic-ransomware-for-automated-database-extortion | Dark Reading (media) https://www.darkreading.com/cyberattacks-data-breaches/jadepuffer-first-complete-llm-driven-ransomware-attack | Microsoft Threat Intelligence (primary) https://www.microsoft.com/en-us/security/blog/2026/09/25/storm-3168-agentic-driven-cloud-attacks-using-compromised-service-principals/ | BleepingComputer (media) https://www.bleepingcomputer.com/news/security/jadepuffer-agentic-ai-attacks-target-azure-destroy-cloud-resources/
- **GTG-1002** (2025-11-13). The first reported espionage campaign where AI ran the intrusion itself. Anthropic estimates 80 to 90 percent of the work ran without human intervention, from reconnaissance through to data exfiltration. A small number of the intrusions succeeded. What the AI did: AI ran the attack. Model: Claude Code. Target: Around 30 targets globally: technology companies, financial institutions, chemical manufacturers and government agencies. Actor: Chinese state-sponsored group. Caveat: Known through Anthropic's own reporting. The targets are not named. Source: Anthropic (primary) https://www.anthropic.com/news/disrupting-AI-espionage
- **GTG-2002** (2025-08-27). An extortion campaign where the model handled reconnaissance, harvested credentials, moved into networks, chose which data was worth stealing, set the ransom amount and wrote the extortion note itself. What the AI did: AI ran the attack. Model: Claude Code. Target: At least 17 organisations across healthcare, emergency services, government and religious institutions. Caveat: Known through Anthropic's own reporting. The victims are not named. Source: Anthropic (primary) https://www.anthropic.com/news/detecting-countering-misuse-aug-2025
- **s1ngularity (Nx)** (2025-08-27). Malicious versions of the Nx build tool sat on npm for about five hours. On install they launched the developer's own AI command-line tools with safeguards off and told them to hunt for keys, tokens and crypto wallets. Over 2,300 secrets ended up public on GitHub. What the AI did: Language model inside the malware. Model: Claude Code, Gemini CLI and Amazon Q on the victim's own machine. Target: Developers who installed compromised Nx packages from npm. Caveat: The models belonged to the victims, not the attacker, and the attack only worked where at least one of the three tools was installed. Source: StepSecurity (primary) https://www.stepsecurity.io/blog/supply-chain-security-alert-popular-nx-build-system-package-compromised-with-data-stealing-malware | GitGuardian (primary) https://blog.gitguardian.com/the-nx-s1ngularity-attack-inside-the-credential-leak/ | Vercel (primary) https://vercel.com/changelog/s1ngularity-supply-chain-attack-in-nx-packages
- **LAMEHUG** (2025-07-17). The first known malware to query a language model while running. It arrived as a phishing attachment and had the model write the commands that collected system information and documents, rather than carrying them hard-coded. What the AI did: Language model inside the malware. Model: Qwen2.5-Coder via Hugging Face. Target: Ukrainian security and defence bodies. Actor: APT28 (UAC-0001). Source: CERT-UA (primary) https://cert.gov.ua/article/6284730 | Google Threat Intelligence Group (primary) https://cloud.google.com/blog/topics/threat-intelligence/threat-actor-usage-of-ai-tools | The Hacker News (media) https://thehackernews.com/2025/07/cert-ua-discovers-lamehug-malware.html

---

For the full documentation index, see https://fmcybersecurity.com/llms.txt
For the complete corpus as a single document, see https://fmcybersecurity.com/llms-full.txt