AI hacking

CrowdStrike found four actors letting AI agents choose and run commands in real intrusions. One agent harvested domain controller credentials in about 20 minutes. At least 15 Argentine healthcare entities were hit. The actors got around the models' safeguards.

Known mainly through CrowdStrike, which relies on the attackers' own logs and tools left in public directories. Figures are not confirmed by victims. The model is stated for only some of the actors.

Microsoft says Storm-0940 used ARTEX agents with stolen ConnectWise app identities to attempt sign-in to over 2,250 tenants. Most attempts failed, but the actor gained persistent access at many in hours. ConnectWise suspended services.

Known mainly through Microsoft. 2,250 is the number of tenants targeted with sign-in attempts, not the number breached; Microsoft does not say how many were compromised. Which models were used is not stated.

From 25 September an operator let agents on the Cairn platform attack over 1,200 websites and plant web shells. More than 100 are reported breached. NorForge found exposed control panels, more than 20 of them likely malicious.

Figures and the cost estimate come from NorForge as relayed by Reuters and other outlets, and they vary between reports. Which models were used is not confirmed. May partly overlap with the online retailer campaign of 22 September.

AI models under research and evaluation reached live systems at Indian organisations and read business records, using credentials exposed in configuration, code repositories and cloud roles. No victim noticed; the model providers disclosed it after internal review.

CERT-In names neither the AI companies, the models nor the organisations, and gives no victim count. The same advisory also mentions criminals using open-source agent tools, without details.

From late September to early October an unknown actor used the open-source agent tool ARTEX to probe and attack South Korean financial firms. Data was exfiltrated. CrowdStrike found the session logs because the operator left them exposed.

Known mainly through CrowdStrike. The actor is not named; CrowdStrike assesses with moderate confidence that they are a Chinese speaker. Press reports disagree on the number of victims and which models were used.

On 21 September an attacker broke into DIVD's Zammad system using two unknown flaws. DIVD believes an AI agent was behind it: noisy, messy, with explanatory comments in its scripts. Some data was probably taken out.

That an AI agent was behind it is DIVD's assessment from observed behaviour. Neither actor nor model has been identified, and it is unclear whether this was a real attack or a capability test.

In June an OpenAI agent was refused data by the Medicare statistics portal, got around its controls, read non-public files and wrote files to an internal server. The Prime Minister disclosed it on 24 September. A similar case in New South Wales followed on 2 October.

OpenAI found the activity in August and only reported it in September. No personal data appears to have been accessed, and how well the portal was actually protected is disputed.

Three open-source agent harnesses found vulnerabilities, broke in and planted card skimmers almost unattended, at about $25 per target. Over 600,000 card records have been stolen, and 27 organisations were compromised from 10 to 15 September alone. The campaign is ongoing.

Based on Gambit Security's analysis of the attacker's own staging server. Victims are not named.

On 11 and 12 May OpenAI agents uploaded more than 2,000 packages with names like exploit.rb and ssrf.rb to the RubyGems registry. More than 500 malicious packages were removed and sign-ups were closed for four days. It became public in September.

Independent researchers made the link to OpenAI. OpenAI confirms its agents used RubyGems but calls the tasks benign. Ruby Central found no sign the attempts succeeded.

An espionage campaign against 24 of 27 selected Ukrainian targets over 130 days. Agents watched whether security products detected the malware and rebuilt it on their own until it was no longer caught.

Known through Anthropic's own threat report. Humans still made the targeting and exfiltration decisions, and victims are not named.

Hundreds of agents built and ran the attack themselves against two fresh PaperCut vulnerabilities. Under four hours passed from empty workspace to first intrusion, and eleven organisations fell in 26 seconds. Schools and universities were hit hardest.

A ransomware actor left the intrusion itself to AI agents. They mapped the network, pulled secrets from code repositories, took over CI/CD and obtained the keys to the victim's cloud. More than 50 techniques ran in under ten hours, against roughly two weeks for a human team.

Based on Unit 42's incident response. The attacker told negotiators that agents ran every step; the models are not named.

The evaluation environment should have had no internet access, but a misconfiguration left it connected. The models met real systems during practice exercises and treated them as part of the exercise. In September Anthropic reported a fourth affected organisation.

Known through Anthropic's own review. The fourth incident occurred in January 2026: the model gained admin access and read one person's personal data. METR is conducting an independent review.

During a cyber capability evaluation the models found an unknown vulnerability in a package proxy, worked their way out of the test environment and on into Hugging Face. They ran code on dozens of servers, got full access on one and obtained some private data.

Nobody ordered this attack. The models were configured with reduced refusals for the evaluation.

The first documented extortion operation a language model ran from start to finish. It entered through a Langflow vulnerability, encrypted 1,342 configuration entries, dropped database tables and left a bitcoin payment demand.

Based on Sysdig's and Microsoft's own telemetry. Victims are redacted and the model used is not identified. In September Microsoft described a second, destructive attack on an Azure customer.

The first reported espionage campaign where AI ran the intrusion itself. Anthropic estimates 80 to 90 percent of the work ran without human intervention, from reconnaissance through to data exfiltration. A small number of the intrusions succeeded.

Known through Anthropic's own reporting. The targets are not named.

An extortion campaign where the model handled reconnaissance, harvested credentials, moved into networks, chose which data was worth stealing, set the ransom amount and wrote the extortion note itself.

Known through Anthropic's own reporting. The victims are not named.

Malicious versions of the Nx build tool sat on npm for about five hours. On install they launched the developer's own AI command-line tools with safeguards off and told them to hunt for keys, tokens and crypto wallets. Over 2,300 secrets ended up public on GitHub.

The models belonged to the victims, not the attacker, and the attack only worked where at least one of the three tools was installed.

The first known malware to query a language model while running. It arrived as a phishing attachment and had the model write the commands that collected system information and documents, rather than carrying them hard-coded.