Sev0

AI security incidents, tracked

All incidents / AI-run attack

AI-run attack: AI security incidents

19 AI security incidents classed as ai-run attack since January 2025, covering autonomous intrusion.

3 Nov 2026Chainstack discloses breach of customer account database as part of AI-powered campaign
Chainstack		AI-run attackHigh
2 Nov 2026China-linked group used ARTEX AI agents against more than 200 organizations
Multiple		AI-run attackHigh
30 Oct 2026Chainalysis reports intrusion using agentic AI techniques that exposed customer account data
Chainalysis		AI-run attackHigh
28 Oct 2026123 Reg says an AI-driven attack exposed customer contact and account data
123 Reg		AI-run attackMedium
21 Oct 2026Symantec honeypot captured an autonomous LLMjacking agent allowed 100,000 unattended steps
Multiple		AI-run attackLow
21 Oct 2026CrowdStrike finds four attacker groups running Claude Code based offensive agents
Multiple		AI-run attackHigh
19 Oct 2026Criminals used exposed Cairn AI agent instances to breach more than 100 company websites
Multiple		AI-run attackHigh
30 Sep 2026Attackers using the ARTEX AI pentest agent stole customer data from South Korean banks
South Korean banks (Shinhan, KB Kookmin, Hana and others)		AI-run attackHigh
24 Sep 2026Autonomous AI agent chained Zammad zero-days to breach Dutch nonprofit DIVD
Dutch Institute for Vulnerability Disclosure (DIVD)		AI-run attackMedium
22 Sep 2026Attacker used open-source AI agent frameworks to plant card skimmers on retail sites
Multiple		AI-run attackHigh
22 Sep 2026Carbonato botnet used the Hermes Agent framework to run commands on hijacked Docker hosts
Multiple		AI-run attackMedium
15 Sep 2026Spain's data regulator received its first breach report blaming an autonomous AI agent
Undisclosed (Spain)		AI-run attackHigh
2 Sep 2026AI agents ran an enterprise intrusion end to end in under ten hours, Unit 42 says
Undisclosed enterprise		AI-run attackHigh
12 Aug 2026AI agent swarm used against Taiwanese government systems
Taiwan government		AI-run attackHigh
23 Jul 2026Hermes AI agent automated intrusion into Thailand's Ministry of Finance
Thailand Ministry of Finance		AI-run attackHigh
1 Jul 2026JADEPUFFER: first documented LLM-driven ransomware operation
Undisclosed		AI-run attackHigh
May 2026AI agent went from marimo notebook exploit to full database dump in under an hour
Undisclosed		AI-run attackHigh
May 2026AI-driven attacker escaped container and stole Kubernetes secrets
Undisclosed		AI-run attackHigh
Mar 2026Autonomous Claude-powered bot compromised the Trivy security scanner
Aqua Security (Trivy)		AI-run attackHigh