Sev0

AI security incidents, tracked

All incidents / Supply chain and access

Supply chain and access: AI security incidents

21 AI security incidents classed as supply chain and access since January 2025, covering poisoned package, shadow ai, stolen token or key, third-party leak.

5 Nov 2026Trojanized ARTEX Docker image gave unauthenticated root shells on 62 consoles
ARTEX users		Supply chain and accessLow
29 Oct 2026Tampered Claude Code extension served from Cursor marketplace for about 11 hours
Cursor (Anysphere)		Supply chain and accessLow
28 Oct 2026n0n extortion group used an AI coding agent against at least 23 organizations
Multiple		Supply chain and accessHigh
27 Oct 2026Warp discloses vendor compromise exposing AI agent logs and telemetry for about 1% of users
Warp		Supply chain and accessMedium
21 Oct 2026LiteLLM release 1.107.0 backdoored on PyPI and Docker after maintainer GitHub tokens were stolen
Multiple		Supply chain and accessHigh
21 Oct 2026China-aligned group used ARTEX AI agents on Microsoft 365 tenants after ConnectWise compromise
ConnectWise (Cloud Backup customers)		Supply chain and accessHigh
8 Oct 2026Tensorlake AI agent SDK on npm hijacked to spread the ChainDrop credential-stealing worm
Tensorlake		Supply chain and accessLow
10 Sep 2026Fake Claude reseller harvested customers' Anthropic credentials and resold them
Customers of a fraudulent AI reseller		Supply chain and accessMedium
11 Jun 2026Novo Nordisk breach included theft of internal AI model assets
Novo Nordisk		Supply chain and accessHigh
11 May 2026US bank reported customer SSNs entered into an unauthorized AI app
Community Bank		Supply chain and accessHigh
19 Apr 2026Compromised AI tool Context.ai used as a pivot into Vercel
Vercel		Supply chain and accessHigh
24 Mar 2026LiteLLM AI gateway releases on PyPI backdoored to steal credentials
Multiple		Supply chain and accessHigh
3 Mar 2026Browser extensions harvested private AI chats into a commercial database
AI chatbot users		Supply chain and accessHigh
2 Feb 2026Hundreds of malicious OpenClaw skills spread info-stealer malware
OpenClaw users		Supply chain and accessMedium
7 Jan 2026Fake AI sidebar Chrome extensions stole ChatGPT and DeepSeek chats from 900,000 users
Chrome extension users		Supply chain and accessHigh
15 Dec 2025Urban VPN and related extensions harvested AI chats from 8 million users
Urban VPN extension users		Supply chain and accessHigh
26 Nov 2025Analytics vendor breach exposed names and emails of OpenAI API users
OpenAI (via Mixpanel)		Supply chain and accessMedium
25 Sep 2025First malicious MCP server found secretly copying every email to an attacker
postmark-mcp users		Supply chain and accessHigh
20 Aug 2025Stolen tokens from Drift's AI chat agent used to raid 700+ companies' Salesforce data
Salesloft (Drift)		Supply chain and accessHigh
23 Jul 2025Wiper prompt slipped into Amazon Q's official VS Code extension
Amazon Web Services		Supply chain and accessLow
1 May 2025xAI employee leaked an API key to private Grok models on GitHub
xAI		Supply chain and accessHigh