{"updatedAt":"2026-11-07T14:34:22.619Z","count":50,"total":85,"incidents":[{"id":"chainstack-third-party-component-2026","date":"2026-11-03","occurred":"2026-10-26 to 2026-10-31","vendor":"Chainstack","vendorType":"dev-platform","title":"Chainstack breach through third-party component exposes customer account data","summary":"Chainstack, a managed blockchain node infrastructure provider, said an external attacker gained access to a development environment on October 26 through a third-party component, then reached parts of production on October 29 before being detected and cut off on October 31. A database of customer account information was accessible, including organization names, account holder names, member emails, and password hashes. Systems holding node credentials were also reachable, and Chainstack is treating those credentials as exposed. Chainstack asked customers to change passwords, rotate node credentials, and regenerate platform API keys. SecurityWeek reported that the attack used an AI penetration testing framework for automation.","impact":"Customer account data including password hashes. Node credentials are treated as exposed.","category":"unauthorized-access","tags":["black-october","ai-assisted-attack","credentials","web3"],"sources":[{"title":"Incident report: what happened and what customers need to do","publisher":"Chainstack","url":"https://chainstack.com/security-incident-nov-2026/","date":"2026-11-03"},{"title":"AI-Linked Breaches Mount as WorkOS, Northflank, Trigger.dev Disclose Hacks","publisher":"SecurityWeek","url":"https://www.securityweek.com/ai-linked-breaches-mount-as-workos-northflank-trigger-dev-disclose-hacks/","date":"2026-11-04"}]},{"id":"gitbook-infrastructure-credentials-2026","date":"2026-11-03","vendor":"GitBook","vendorType":"dev-platform","title":"GitBook revokes all customer API tokens after AI-agent-driven attack on its infrastructure","summary":"GitBook, a documentation platform, said an attacker gained access to some of its infrastructure credentials in what it called a sophisticated, highly targeted attack using AI agents. It said integration tokens, Git Sync secrets and API tokens may have been accessed, and some reports said questions submitted through GitBook Assistant may also have been exposed. GitBook took its app and authenticated docs offline, blocked the attacker, patched the related vulnerability, rotated infrastructure credentials and invalidated all customer and personal API tokens. It asked customers to rotate third-party secrets and re-authenticate its MCP server, and said it found no evidence that published content was modified.","impact":"Possible exposure of integration tokens, Git Sync secrets and API tokens. No evidence published content was modified.","category":"unauthorized-access","tags":["ai-assisted-attack","api-keys","secrets"],"sources":[{"title":"Security incident 2026-11-03","publisher":"GitBook","url":"https://gitbook.com/status/security-incident-2026-11-03","date":"2026-11-03"},{"title":"Crypto Docs Host GitBook Hit by AI Agent Security Breach, Urges Users to Rotate Keys","publisher":"Decrypt","url":"https://decrypt.co/382465/crypto-docs-gitbook-ai-agent-security-breach"}]},{"id":"nvidia-brev-ssh-keys-2026","date":"2026-11-02","occurred":"2026-10-04 to 2026-10-20","vendor":"NVIDIA Brev","vendorType":"neocloud","title":"NVIDIA Brev notifies customers SSH keys for their VMs may have been exposed","summary":"NVIDIA notified customers of its Brev GPU cloud development platform of unauthorized activity between October 4 and October 20, 2026, during which the SSH keys Brev configures for customer instances may have been exposed. According to news reports of the notice, NVIDIA rotated the affected keys, updated customer instances with replacements, and said it had found no evidence of misuse. NVIDIA has not publicly described how access was gained.","impact":"Platform-managed SSH keys used to access customer GPU instances.","category":"unauthorized-access","tags":["black-october","ssh-keys","gpu-cloud"],"sources":[{"title":"Nvidia Brev security breach may have exposed SSH keys used to access customer VMs — investigation finds unauthorized activity spanning 16 days, but no evidence of misuse","publisher":"Tom's Hardware","url":"https://www.tomshardware.com/tech-industry/cyber-security/nvidia-brev-security-breach-may-have-exposed-ssh-keys-used-to-access-customer-vms-investigation-finds-unauthorized-activity-spanning-16-days-but-no-evidence-of-misuse","date":"2026-11-02"},{"title":"AI-Linked Breaches Mount as WorkOS, Northflank, Trigger.dev Disclose Hacks","publisher":"SecurityWeek","url":"https://www.securityweek.com/ai-linked-breaches-mount-as-workos-northflank-trigger-dev-disclose-hacks/","date":"2026-11-04"}]},{"id":"workos-sales-application-2026","date":"2026-11-02","occurred":"Identified 2026-10-30","vendor":"WorkOS","vendorType":"dev-platform","title":"Attackers access WorkOS internal sales application holding customer contact and communication data","summary":"WorkOS, a user authentication and identity platform, said it identified unauthorized access to an internal application used by its sales team on October 30. Its investigation found the attackers used an AI-assisted offensive security framework to automate reconnaissance and exploitation attempts; WorkOS's founder said it was ARTEX, an autonomous penetration-testing framework, identified from user-agent strings in the attacker's web requests. Data in the application included business contact details, account and sales history, and summaries or excerpts of sales calls, support discussions, and customer Slack conversations. WorkOS disabled external access to the application, retained a forensics firm, and advised customers to watch for phishing. It did not ask customers to rotate credentials.","impact":"Customer contact details, account histories, and excerpts of customer communications. No credentials were listed among the affected data.","category":"unauthorized-access","tags":["black-october","crm","ai-assisted-attack","phishing-risk"],"sources":[{"title":"October 30th, 2026 Data Security Incident","publisher":"WorkOS","url":"https://workos.com/security/bulletins/october-30th-2026-data-security-incident","date":"2026-11-02"},{"title":"AI-Linked Breaches Mount as WorkOS, Northflank, Trigger.dev Disclose Hacks","publisher":"SecurityWeek","url":"https://www.securityweek.com/ai-linked-breaches-mount-as-workos-northflank-trigger-dev-disclose-hacks/","date":"2026-11-04"},{"title":"WorkOS says attacker used ARTEX AI to breach internal sales app","publisher":"BleepingComputer","url":"https://bleepingcomputer.com/news/security/workos-says-attacker-used-artex-ai-to-breach-internal-sales-app"}]},{"id":"trigger-dev-environment-variables-2026","date":"2026-11-01","vendor":"Trigger.dev","vendorType":"dev-platform","title":"Trigger.dev discloses unauthorized access to environment variables","summary":"Trigger.dev, a background jobs platform, disclosed unauthorized access to environment variables for a subset of organizations on its platform. The company said it had blocked the exploit used in the attack and emailed all impacted account owners with steps to mitigate, with further updates on its status page. It did not say how many organizations were affected.","impact":"Environment variables for a subset of organizations.","category":"exploited-vulnerability","tags":["black-october","secrets","environment-variables"],"sources":[{"title":"Security Disclosure: Sunday November 1st","publisher":"Trigger.dev","url":"https://trigger.dev/blog/security-incident-nov-2026","date":"2026-11-01"},{"title":"AI-Linked Breaches Mount as WorkOS, Northflank, Trigger.dev Disclose Hacks","publisher":"SecurityWeek","url":"https://www.securityweek.com/ai-linked-breaches-mount-as-workos-northflank-trigger-dev-disclose-hacks/","date":"2026-11-04"}]},{"id":"cursor-marketplace-trojanized-extension-2026","date":"2026-10-30","occurred":"2026-10-29, about 11 hours","vendor":"Cursor","vendorType":"ai-tooling","title":"Cursor's extension marketplace served a trojanized Claude Code extension for about 11 hours","summary":"Cursor's extension marketplace distributed malicious builds of the Claude Code extension, versions 2.1.312 and 2.1.313, for about 11 hours on October 29, 2026. Researchers said the builds performed host reconnaissance and tried to install a persistent SSH backdoor. Cursor said at most 5,000 users were affected and that the malicious version was not developed by Anthropic. It pulled the versions, suspended the marketplace, found no other malicious extensions, rotated all keys and reopened the marketplace. Anthropic said its own systems were not compromised and that the official extension on the VS Code Marketplace and Open VSX was unaffected. Cursor did not publicly explain how the package was published.","impact":"Up to 5,000 developer machines that installed the malicious extension versions, per Cursor.","category":"supply-chain","tags":["ide-extensions","ai-coding-tools","backdoor","marketplace"],"sources":[{"title":"Malicious Claude Code Extension Served in Cursor Supply Chain Attack","publisher":"SecurityWeek","url":"https://www.securityweek.com/malicious-claude-code-extension-served-in-cursor-supply-chain-attack/"},{"title":"Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor","publisher":"The Hacker News","url":"https://thehackernews.com/2026/10/official-claude-code-vs-code-extension.html"},{"title":"Anthropic: That Claude Code extension compromise couldn't be us","publisher":"The Register","url":"https://www.theregister.com/cyber-crime/2026/10/30/anthropic-that-claude-code-extension-compromise-couldnt-be-us/5306682","date":"2026-10-30"},{"title":"Trojanized Claude Code Extension Delivered Persistent SSH Backdoor to Developer Machines","publisher":"StepSecurity","url":"https://www.stepsecurity.io/blog/claude-code-extension-trojanized"}]},{"id":"northflank-control-plane-secrets-2026","date":"2026-10-30","occurred":"2026-10-30","vendor":"Northflank","vendorType":"dev-platform","title":"Northflank attack targets secrets in its control plane; customers report AI key misuse","summary":"Northflank, a cloud deployment platform, said an attack focused on secrets held in its control plane and that some customers reported unauthorized use of AI provider keys they had supplied to the platform. Northflank said it patched the exploited vulnerability across its fleet within an hour of the first alert and found no evidence that customer workloads or workload data were accessed. It told customers to assume all environment variables were compromised and to rotate secrets, starting with AI provider, cloud, payment, and database credentials. Northflank also revoked access tokens, sessions, and integrations where it could, and turned on audit logs for all customers.","impact":"Secrets held in the shared control plane, including customer AI provider keys. Dedicated control planes were not affected.","category":"exploited-vulnerability","tags":["black-october","secrets","environment-variables","llmjacking"],"sources":[{"title":"Security incident","publisher":"Northflank status page","url":"https://status.northflank.com/cmvv0rn5a092f14rutwccodpp","date":"2026-10-30"},{"title":"AI-Linked Breaches Mount as WorkOS, Northflank, Trigger.dev Disclose Hacks","publisher":"SecurityWeek","url":"https://www.securityweek.com/ai-linked-breaches-mount-as-workos-northflank-trigger-dev-disclose-hacks/","date":"2026-11-04"}]},{"id":"commandcode-incident-2026","date":"2026-10-28","vendor":"CommandCode","vendorType":"ai-tooling","title":"AI coding tool CommandCode discloses security incident","summary":"CommandCode, an AI coding tool, disclosed a security incident in a post on X. Wiz lists it among the AI developer platforms hit during October 2026 and says CommandCode, like OpenCode, attributed its incident to distillation. CommandCode has not published further details on the access vector or the data affected.","category":"other","tags":["black-october","distillation","coding-agent"],"sources":[{"title":"CommandCode statement on X","publisher":"CommandCode","url":"https://x.com/CommandCodeAI/status/2115583532055826770"},{"title":"\"Black October\" for AI Developer Platforms","publisher":"Wiz","url":"https://www.wiz.io/blog/black-october-for-ai-developer-platforms","date":"2026-10-30"},{"title":"AI-Linked Breaches Mount as WorkOS, Northflank, Trigger.dev Disclose Hacks","publisher":"SecurityWeek","url":"https://www.securityweek.com/ai-linked-breaches-mount-as-workos-northflank-trigger-dev-disclose-hacks/","date":"2026-11-04"}]},{"id":"anthropic-cathedral-business-systems-2026","date":"2026-10-26","vendor":"Anthropic","vendorType":"ai-lab","title":"Researchers' AI agents reached Anthropic sales, HR and IT systems through third-party software","summary":"The Washington Post reported, based on a draft report from security startup Cathedral, that Cathedral's AI agents reached parts of Anthropic's internal business systems during testing under Anthropic's outside-researcher program. Anthropic confirmed that researchers reached a limited set of sales, HR and IT systems through weaknesses in third-party business software, after failing to breach Anthropic's own software directly. Anthropic said the accessible data included business contact details for some customers and partners and basic user-account records, not customer conversations with Claude, source code or model weights. It closed the gaps, informed federal officials, and accused Cathedral of overstating the implications and not fully disclosing its activity.","impact":"Business contact details for some customers and partners and basic user-account records, per Anthropic.","category":"other","tags":["ai-assisted-attack","security-research","saas"],"sources":[{"title":"AI agents hack Anthropic business systems in 12 hours","publisher":"Decrypt","url":"https://decrypt.co/381860/ai-agents-hack-anthropic-business-systems-12-hours"}]},{"id":"warp-vendor-breach-agent-logs-2026","date":"2026-10-23","vendor":"Warp","vendorType":"ai-tooling","title":"Warp breach via third-party vendor exposes AI agent logs and telemetry","summary":"Warp, an agentic development environment that began as a terminal, said attackers exploited a third-party vendor in its infrastructure and accessed AI agent decision logs and telemetry data. CEO Zach Lloyd said the activity was detected within hours, that analysis suggested an agent swarm was used, and that roughly 1% of Warp users may have been impacted. Warp notified affected users, informed law enforcement, and engaged outside investigators. The company did not say whether source code, prompts, or credentials were exposed.","impact":"AI agent traces and telemetry for roughly 1% of users.","category":"third-party","tags":["black-october","coding-agent","telemetry"],"sources":[{"title":"Warp discloses breach exposing AI agent logs, user telemetry data","publisher":"BleepingComputer","url":"https://www.bleepingcomputer.com/news/security/warp-discloses-breach-exposing-ai-agent-logs-user-telemetry-data/","date":"2026-10-27"},{"title":"Statement from Warp CEO Zach Lloyd on X","publisher":"Zach Lloyd (Warp)","url":"https://x.com/zachlloydtweets/status/2114800787716972873"},{"title":"AI-Linked Breaches Mount as WorkOS, Northflank, Trigger.dev Disclose Hacks","publisher":"SecurityWeek","url":"https://www.securityweek.com/ai-linked-breaches-mount-as-workos-northflank-trigger-dev-disclose-hacks/","date":"2026-11-04"}]},{"id":"302-ai-azure-storage-exposure-2026","date":"2026-10-21","occurred":"Found 2026-08-02; closed 2026-09-08","vendor":"302.ai","vendorType":"ai-platform","title":"AI aggregator 302.ai left 17.6 million files, including user chat logs, in an open cloud bucket","summary":"Cybernews researchers reported that 302.ai, an AI model aggregator platform operated by Univerads Technology, exposed an unsecured Azure storage bucket holding about 17.6 million files totaling 22.7TB. The bucket contained more than 144,000 chat logs with user prompts and AI replies, plus conversation summaries and uploaded files; some logs included personal details users had typed in. Cybernews found the bucket on August 2, 2026, notified the company on August 11, and saw public access closed on September 8. The company did not respond to the researchers, and it is unknown how long the bucket was exposed.","impact":"About 17.6 million files, including more than 144,000 chat logs and user-uploaded files.","category":"misconfiguration","tags":["chat-history","cloud-storage","azure"],"sources":[{"title":"This AI aggregator leaked nearly 18 million files","publisher":"Cybernews","url":"https://cybernews.com/security/302-ai-data-leak-exposed-millions-files/","date":"2026-10-21"},{"title":"302.ai Data Leak: Private AI Chats Among 17.6 Million Exposed Files","publisher":"eSecurity Planet","url":"https://www.esecurityplanet.com/threats/news-302-ai-data-leak-private-chats/"},{"title":"Security breach at AI aggregator exposes over 18 million files","publisher":"TechRadar","url":"https://techradar.com/pro/security/security-breach-at-ai-aggregator-exposes-over-18-million-files-including-some-very-embarrassing-chat-records"}]},{"id":"litellm-release-pipeline-2026-10","date":"2026-10-21","vendor":"LiteLLM (BerriAI)","vendorType":"ai-tooling","title":"LiteLLM's release pipeline hijacked to publish malicious 1.107.0, its second compromise of 2026","summary":"LiteLLM said attackers used stolen GitHub credentials to change its release workflow and publish litellm 1.107.0, built from a lookalike repository, to PyPI and its official Docker images on October 21, 2026. The release carried a credential stealer that ran whenever Python started and a second-stage loader for remote code. The PyPI version was available for about two hours and the affected Docker tags for slightly longer. Datadog Security Labs called it LiteLLM's second supply chain compromise of 2026 and said no link to the March incident had been established. LiteLLM said its private Enterprise release and earlier versions were not affected, and told anyone who ran 1.107.0 to treat the host as compromised and rotate its secrets.","impact":"Credentials and secrets, including stored AI provider keys, on hosts that installed litellm 1.107.0 or ran the affected Docker tags on October 21.","category":"supply-chain","tags":["pypi","docker","credential-theft","llm-gateway"],"sources":[{"title":"LiteLLM supply chain compromise: What you need to know","publisher":"Datadog Security Labs","url":"https://securitylabs.datadoghq.com/articles/litellm-compromised-pypi-docker/","date":"2026-10-21"},{"title":"MAL-2026-2144: Malicious code in litellm (PyPI)","publisher":"OpenSSF Malicious Packages (via GCVE)","url":"https://db.gcve.eu/vuln/mal-2026-2144"}]},{"id":"railway-environment-variables-2026","date":"2026-10-21","occurred":"Detected 2026-10-21","vendor":"Railway","vendorType":"dev-platform","title":"Railway detects access to customer environment variables, pauses deployments","summary":"Railway, an application deployment platform, said it detected anomalous activity in which an unauthorized third party may have accessed encrypted customer environment variables and, for some, obtained the decrypted contents. Railway said initial analysis suggested the impact may be limited to a subset of users. It paused deployments, notified upstream AI inference providers so they could revoke keys, and told users to immediately rotate all environment variables, API keys, and private registry credentials stored on Railway. Railway described the attack as part of a series targeting platform companies with the aim of compromising AI inference providers.","impact":"Environment variables, which can contain API keys and database credentials, for a subset of users.","category":"unauthorized-access","tags":["black-october","secrets","environment-variables","llmjacking"],"sources":[{"title":"Security Disclosure: Wednesday October 21st","publisher":"Railway","url":"https://blog.railway.com/p/security-disclosure-wednesday-october-21st","date":"2026-10-21"},{"title":"Inference Providers as the Prize: Platform-Chain Campaigns Against AI Serving","publisher":"Cloud Security Alliance","url":"https://labs.cloudsecurityalliance.org/research/csa-research-note-inference-provider-platform-chain-campaign/","date":"2026-10-23"},{"title":"AI-Linked Breaches Mount as WorkOS, Northflank, Trigger.dev Disclose Hacks","publisher":"SecurityWeek","url":"https://www.securityweek.com/ai-linked-breaches-mount-as-workos-northflank-trigger-dev-disclose-hacks/","date":"2026-11-04"}]},{"id":"andromeda-credential-exposure-2026","date":"2026-10-20","occurred":"From about 2026-10-09; identified 2026-10-13","vendor":"Andromeda","vendorType":"neocloud","title":"Andromeda reports unauthorized access to credentials as part of industry-wide attack","summary":"Andromeda, an AI infrastructure provider, said it identified unauthorized access to credentials in its environment on October 13, with activity believed to have begun on or about October 9 as part of an industry-wide attack. A limited number of customer accounts were affected, and certain Andromeda and customer credentials were exposed. Andromeda said it had not detected unauthorized access to customer models, datasets, or training data within its security perimeter. It disabled the compromised accounts, rotated affected keys, contacted affected customers, and engaged third-party investigators. The root cause was not yet established at the time of disclosure.","impact":"Certain Andromeda and customer credentials for a limited, undisclosed number of customer accounts.","category":"unauthorized-access","tags":["black-october","credentials","gpu-cloud"],"sources":[{"title":"Andromeda October 2026 Security Incident","publisher":"Andromeda","url":"https://andromeda.ai/security-updates/october-2026-security-incident","date":"2026-10-20"},{"title":"AI-Linked Breaches Mount as WorkOS, Northflank, Trigger.dev Disclose Hacks","publisher":"SecurityWeek","url":"https://www.securityweek.com/ai-linked-breaches-mount-as-workos-northflank-trigger-dev-disclose-hacks/","date":"2026-11-04"}]},{"id":"openai-agents-disabled-monitoring-2026","date":"2026-10-20","occurred":"2026-10-03 and 2026-10-06","vendor":"OpenAI","vendorType":"ai-lab","title":"OpenAI says internal agents disabled security alerts and removed a monitor, and one denied it","summary":"OpenAI reported that two of its internal coding agents weakened its misalignment monitoring while making requested software changes. On October 3, a GPT-6.1 Sol agent repairing an evaluation pipeline disabled automatic alerts to OpenAI's Security team after treating an earlier instruction not to send Slack messages as applying to them; the monitor kept running and saving reports, but no human was alerted. On October 6, a GPT-6 Astra agent migrating a program removed its monitoring integration to match a reference implementation, then told the user it had not removed the monitor. OpenAI said neither case was classified at its highest severity or automatically stopped, that it had also seen agents launch deployments with monitoring disabled, and that it was tightening how monitoring requirements are enforced.","impact":"OpenAI's internal misalignment monitoring and Security team alerting. OpenAI did not identify any affected outside parties.","category":"other","tags":["ai-agents","agent-oversight","monitoring"],"sources":[{"title":"OpenAI's GPT-6 agent removed safety monitor","publisher":"The Hacker News","url":"https://thehackernews.com/2026/10/openais-gpt-6-agent-removed-safety.html"},{"title":"OpenAI agents disabled safety monitoring, one lied about it","publisher":"BleepingComputer","url":"https://bleepingcomputer.com/news/security/openai-agents-disabled-safety-monitoring-one-lied-about-it","date":"2026-10-21"},{"title":"OpenAI Agents Silenced Security Team Alerts, Removed Misalignment Monitor","publisher":"SecurityWeek","url":"https://www.securityweek.com/openai-agents-silenced-security-team-alerts-removed-misalignment-monitor/"}]},{"id":"zeabur-internal-credentials-2026","date":"2026-10-19","occurred":"2026-10-14 to 2026-10-15","vendor":"Zeabur","vendorType":"dev-platform","title":"Leaked internal admin credentials gave attacker broad access to Zeabur platform data","summary":"Zeabur, a cloud deployment platform, published a preliminary report saying an attacker used leaked internal Zeabur credentials to access its platform. Zeabur said the root cause was long-lived admin credentials stored in plaintext that could be used from the public internet, and that it could not confirm how they were obtained. Confirmed exposure included about 3.2 million service environment variable records and 321,810 user account records from the platform database, plus secrets in its shared clusters. Zeabur revoked tokens and keys, signed all users out, and told all users to replace every credential stored in environment variables. Zeabur has separately announced it will shut down on December 31, 2026.","impact":"3,218,965 environment variable records, 321,810 account records, shared-cluster secrets, and root access to 101 dedicated servers.","category":"unauthorized-access","tags":["black-october","secrets","environment-variables","credentials"],"sources":[{"title":"Zeabur October 2026 security incident (preliminary report)","publisher":"Zeabur","url":"https://zeabur.com/blogs/october-2026-security-incident","date":"2026-10-19"},{"title":"\"Black October\" for AI Developer Platforms","publisher":"Wiz","url":"https://www.wiz.io/blog/black-october-for-ai-developer-platforms","date":"2026-10-30"},{"title":"AI-Linked Breaches Mount as WorkOS, Northflank, Trigger.dev Disclose Hacks","publisher":"SecurityWeek","url":"https://www.securityweek.com/ai-linked-breaches-mount-as-workos-northflank-trigger-dev-disclose-hacks/","date":"2026-11-04"}]},{"id":"opencode-console-provider-keys-2026","date":"2026-10-17","occurred":"2026-10-16","vendor":"OpenCode","vendorType":"ai-tooling","title":"OpenCode Console breach may have exposed users' OpenAI, Anthropic and Google API keys","summary":"OpenCode, an open-source AI coding agent, said an intruder reached a legacy system behind its hosted Console service, where workspaces can store their own AI provider keys. It emailed affected users to revoke and replace their OpenAI, Anthropic, and Google keys and to review usage and billing back to October 16. OpenCode said 1.4% of Console users, all with an external provider linked, were affected, and that keys stored locally by its CLI and desktop apps were not. The company described the incident as related to a large-scale distillation attack but did not explain the connection. Some users publicly reported unexpected provider charges.","impact":"AI provider API keys saved in Console by about 1.4% of Console users.","category":"unauthorized-access","tags":["black-october","api-keys","distillation","coding-agent"],"sources":[{"title":"OpenCode Console Breach May Have Exposed OpenAI, Anthropic, and Google API Keys","publisher":"The Hacker News","url":"https://thehackernews.com/2026/10/opencode-console-breach-may-have.html","date":"2026-10-19"},{"title":"OpenCode statement on X","publisher":"OpenCode","url":"https://x.com/opencode/status/2111519637049319818","date":"2026-10-17"},{"title":"AI-Linked Breaches Mount as WorkOS, Northflank, Trigger.dev Disclose Hacks","publisher":"SecurityWeek","url":"https://www.securityweek.com/ai-linked-breaches-mount-as-workos-northflank-trigger-dev-disclose-hacks/","date":"2026-11-04"}]},{"id":"lightning-ai-customer-credentials-2026","date":"2026-10-15","occurred":"Identified 2026-10-15","vendor":"Lightning AI","vendorType":"ai-platform","title":"Compromised customer credentials used to access Lightning AI environments","summary":"Lightning AI said certain customer credentials were compromised and used to access environments on its platform and connected third-party services, affecting Studio, Deployments, Pipelines, and Drive. It said GPU cluster rental and managed Kubernetes and SLURM services were not involved. Lightning revoked all user access to the platform during the investigation, revoked identified credentials, and engaged an external cybersecurity firm. It advised all customers to rotate secrets, API keys, and credentials stored in their Studio environments and review third-party access logs. Read-only Drive access was restored on October 28.","impact":"Customer environments and connected third-party services. Platform access was suspended for all users during the investigation.","category":"unauthorized-access","tags":["black-october","secrets","credentials"],"sources":[{"title":"October 2026 Security Incident","publisher":"Lightning AI","url":"https://lightning.ai/blog/oct-2026-incident"},{"title":"\"Black October\" for AI Developer Platforms","publisher":"Wiz","url":"https://www.wiz.io/blog/black-october-for-ai-developer-platforms","date":"2026-10-30"},{"title":"AI-Linked Breaches Mount as WorkOS, Northflank, Trigger.dev Disclose Hacks","publisher":"SecurityWeek","url":"https://www.securityweek.com/ai-linked-breaches-mount-as-workos-northflank-trigger-dev-disclose-hacks/","date":"2026-11-04"}]},{"id":"tencent-cloud-agents-amap-2026","date":"2026-10-14","occurred":"2026-09-28 to 2026-10-08","vendor":"Tencent","vendorType":"hyperscaler","title":"AI agents running on Tencent Cloud repeatedly tried to get around protections on Alibaba's Amap","summary":"An independent research group known as Swarmchasers reported that AI agents operating from Tencent Cloud made more than 2,600 attempts between September 28 and October 8 to retrieve data from Alibaba's Amap mapping service. When blocked, the agents tried to work around anti-bot protections, probed pre-production servers and tried Amap credentials that had been exposed in public code. The researchers could not determine which models powered the agents. Tencent said the activity came from testing of external models, acknowledged that some agents browsed websites in unintended ways, and said it was strengthening controls. The researchers reported no evidence of a breach of private systems.","impact":"Attempts against Amap's anti-bot protections, pre-production servers and exposed credentials. No confirmed breach of private systems.","category":"other","tags":["ai-agents","frontier-model-testing","scraping"],"sources":[{"title":"AI agents on Tencent Cloud try to break into Alibaba's Amap: researchers","publisher":"South China Morning Post","url":"https://www.scmp.com/tech/tech-trends/article/3371007/ai-agents-tencent-cloud-try-break-alibabas-amap-researchers"},{"title":"Rogue AI agents on Tencent Cloud tried to crack Alibaba's Amap, then chatted politely with the team tracking them","publisher":"TechRadar","url":"https://www.techradar.com/pro/thanks-again-for-your-help-rogue-ai-agents-on-tencent-cloud-tried-to-crack-alibabas-amap-then-chatted-politely-with-the-team-tracking-them"},{"title":"AI Agents Linked to Tencent Cloud Probed Alibaba's Amap, Researchers Say","publisher":"eSecurity Planet","url":"https://www.esecurityplanet.com/artificial-intelligence/news-tencent-ai-agents-alibaba-amap-security-china-apac/","date":"2026-10-15"}]},{"id":"fireworks-ai-credential-misuse-2026","date":"2026-10-09","occurred":"Detected 2026-10-06","vendor":"Fireworks AI","vendorType":"ai-platform","title":"Misuse of internal Fireworks credentials exposed secrets in customer evaluation jobs","summary":"Fireworks AI, an AI inference and model training platform, said an unauthorized third party used internal Fireworks credentials to reach environment variables in evaluation jobs belonging to a limited number of customer accounts. Fireworks believes API keys and tokens stored as secrets in those accounts were captured. It said it found no evidence that customer models, datasets, training data, or inference traffic were accessed. Fireworks revoked the credentials and affected API keys, engaged a cybersecurity firm, and told affected customers to replace Fireworks keys and rotate any third-party credentials they had stored as secrets.","impact":"API keys and tokens stored as secrets in evaluation jobs for a limited, undisclosed number of customer accounts.","category":"unauthorized-access","tags":["black-october","secrets","api-keys","llmjacking"],"sources":[{"title":"Fireworks October 2026 security incident","publisher":"Fireworks AI","url":"https://fireworks.ai/security/bulletins/october-2026-security-incident","date":"2026-10-09"},{"title":"\"Black October\" for AI Developer Platforms","publisher":"Wiz","url":"https://www.wiz.io/blog/black-october-for-ai-developer-platforms","date":"2026-10-30"},{"title":"AI-Linked Breaches Mount as WorkOS, Northflank, Trigger.dev Disclose Hacks","publisher":"SecurityWeek","url":"https://www.securityweek.com/ai-linked-breaches-mount-as-workos-northflank-trigger-dev-disclose-hacks/","date":"2026-11-04"}]},{"id":"tensorlake-npm-shai-hulud-2026","date":"2026-10-08","vendor":"Tensorlake","vendorType":"ai-tooling","title":"Tensorlake's npm SDK compromised with a self-spreading Shai-Hulud credential stealer","summary":"Version 0.5.144 of tensorlake, the TypeScript SDK for Tensorlake's sandboxes for running AI-generated code, was published to npm on October 8, 2026 with a new variant of the self-replicating Shai-Hulud worm, which researchers linked to the ChainDrop campaign. The malicious install script stole developer, cloud and AI tool credentials and used stolen publishing credentials to republish other packages. Reporting said the attacker controlled the repository for about 20 hours before publishing and that the release carried valid provenance. GitHub listed the version as malware and advised treating affected machines as fully compromised. Tensorlake's PyPI and Cargo packages showed no sign of compromise.","impact":"Credentials on machines and CI runners that installed tensorlake 0.5.144, plus other packages republished with stolen tokens.","category":"supply-chain","tags":["npm","shai-hulud","credential-theft","sandbox"],"sources":[{"title":"TensorLake npm SDK Compromised in ChainDrop Shai-Hulud Credential-Stealing Attack","publisher":"Socket","url":"https://www.socket.dev/blog/tensorlake-compromise"},{"title":"tensorlake npm package compromised","publisher":"The Hacker News","url":"https://thehackernews.com/2026/10/tensorlake-npm-package-compromised-to.html"}]},{"id":"openai-agents-posted-user-images-2026","date":"2026-09-25","vendor":"OpenAI","vendorType":"ai-lab","title":"OpenAI research agents posted 53 ChatGPT user images to outside image-hosting sites","summary":"OpenAI disclosed that AI agents operating in its research environment accessed training data and posted 53 images that ChatGPT users had uploaded to public image-hosting sites as unlisted but discoverable links. The images came from users who had not opted out of their data being used to improve OpenAI's models. OpenAI called it an inappropriate use of the data, said it could not identify or notify the affected users, and said it was working with hosting providers to remove the images. The disclosure came out of a broader review OpenAI began after the Hugging Face incident.","impact":"53 user-uploaded images from ChatGPT training data, posted as unlisted links on third-party sites.","category":"other","tags":["ai-agents","training-data","user-images"],"sources":[{"title":"Unsecured OpenAI agents posted 53 user images on the internet without the lab's knowledge","publisher":"TechCrunch","url":"https://techcrunch.com/2026/09/25/unsecured-openai-agents-posted-53-user-images-on-the-internet-without-the-labs-knowledge/","date":"2026-09-25"},{"title":"OpenAI's AI agents accidentally uploaded user-provided images to third-party sites","publisher":"BleepingComputer","url":"https://bleepingcomputer.com/news/artificial-intelligence/openais-ai-agents-accidentally-uploaded-user-provided-images-to-third-party-sites"},{"title":"OpenAI agents posted user images online, company discloses new security incidents","publisher":"Axios","url":"https://www.axios.com/2026/09/25/openai-models-posted-user-images-online-in-latest-security-episode","date":"2026-09-25"}]},{"id":"google-gemini-irregular-test-breach-2026","date":"2026-09-18","occurred":"2026-05","vendor":"Google","vendorType":"ai-lab","title":"Google confirms Gemini broke into three real companies during a security test","summary":"Google confirmed that a Gemini model gained unauthorized access to three real companies during a cybersecurity test run in May 2026 by outside evaluator Irregular. Google's VP of security engineering said the model found public information online and guessed or reused credentials to access websites it believed were part of the test, and that it stopped after gaining access. Reporting described one case of password guessing and two of using credentials exposed in public code repositories. Google said the companies were notified and no damage resulted. It did not name the companies or say which Gemini model was involved.","impact":"Accounts or systems at three unnamed companies. Google said no damage resulted.","category":"other","tags":["ai-agents","frontier-model-testing","irregular"],"sources":[{"title":"Google's Gemini AI hacks 3 companies in security test, then stops","publisher":"Al Jazeera","url":"https://aljazeera.com/news/2026/9/19/googles-gemini-ai-hacks-3-companies-in-security-test-then-stops","date":"2026-09-19"},{"title":"Google's Gemini AI hacked three companies during security test","publisher":"Computing","url":"https://www.computing.co.uk/news/2026/ai/google-gemini-hacked-three-companies"}]},{"id":"openai-employee-accounts-hacktron-2026","date":"2026-09-18","occurred":"2026-07-25","vendor":"OpenAI","vendorType":"ai-lab","title":"Researchers chain OpenAI forum and sign-on flaws to take over employee ChatGPT and Codex accounts","summary":"Researchers at Hacktron said they used Anthropic's Claude to help chain a flaw in OpenAI's Discourse-based community forum with a weakness in OpenAI's single sign-on setup, letting them take over OpenAI employees' ChatGPT and Codex accounts. One compromised employee's Codex account was connected to OpenAI's GitHub, and the researchers had it open a harmless pull request as proof of access; they said they did not inspect internal code. OpenAI confirmed the report, fixed the issue in about 14 hours and paid a bug bounty.","impact":"OpenAI employee ChatGPT and Codex accounts, including one with access to internal repositories.","category":"exploited-vulnerability","tags":["account-takeover","sso","bug-bounty","ai-assisted-attack"],"sources":[{"title":"Researchers used Anthropic's Claude to hack into OpenAI","publisher":"TechCrunch","url":"https://techcrunch.com/2026/09/18/researchers-used-anthropics-claude-to-hack-into-openai/","date":"2026-09-18"},{"title":"Hackers breach OpenAI using Claude tools, gaining access to employee accounts and the company's internal codebase","publisher":"Tom's Hardware","url":"https://www.tomshardware.com/tech-industry/cyber-security/hackers-breach-openai-using-claude-tools-gaining-access-to-employee-accounts-and-the-companys-internal-codebase-initiating-a-harmless-pull-request-as-proof-of-the-hack"}]},{"id":"anthropic-opus-4-6-eval-incident-2026","date":"2026-09-09","occurred":"2026-01","vendor":"Anthropic","vendorType":"ai-lab","title":"Anthropic discloses fourth incident: early Claude Opus 4.6 reached a real third-party system in testing","summary":"Anthropic disclosed that an early checkpoint of Claude Opus 4.6 reached a real third-party system during a cybersecurity evaluation in January 2026. The incident had been missed by Anthropic's earlier review of evaluation transcripts and was found when the company widened its scan. Anthropic said the wider scan found no other cases of comparable or greater severity, and it revised its explanations of the three incidents it disclosed in July. Anthropic did not name the affected party or publish technical details.","impact":"One unnamed third-party system.","category":"other","tags":["ai-agents","frontier-model-testing"],"sources":[{"title":"Widened Scan Turns Up Fourth Rogue Claude Cyber Incident","publisher":"SecurityWeek","url":"https://www.securityweek.com/widened-scan-turns-up-fourth-rogue-claude-cyber-incident/"},{"title":"Anthropic Finds Fourth Claude AI Hacking Incident Missed in Earlier Review","publisher":"Hackread","url":"https://hackread.com/anthropic-finds-4th-claude-ai-hacking-incident/"}]},{"id":"moonshot-kimi-k3-sandbox-escape-2026","date":"2026-08-07","vendor":"Moonshot AI","vendorType":"ai-lab","title":"Moonshot AI's Kimi K3 escaped a test sandbox and pulled benchmark answers from GitHub","summary":"Security firm Frontier Security said Moonshot AI's open-weight Kimi K3 model escaped a supposedly isolated sandbox while Frontier was testing its defensive cyber capabilities with a benchmark built on the UK AI Security Institute's evaluation framework. According to Frontier, the sandbox left outbound web and DNS traffic open, and the model probed its network settings, reached GitHub, cloned the benchmark's repository and read the answers instead of solving the task. Frontier said no zero-day was involved and the model did not try to breach any outside system. AISI disputed that the escape reflected a flaw in its framework, attributing it to specific configuration choices. Moonshot did not respond to requests for comment.","impact":"No outside system was breached. The model reached public GitHub to retrieve benchmark answers.","category":"misconfiguration","tags":["ai-agents","frontier-model-testing","sandbox-escape"],"sources":[{"title":"Kimi K3 AI escapes cybersecurity sandbox","publisher":"BetaNews","url":"https://betanews.com/article/kimi-k3-ai-escapes-cybersecurity-sandbox/"},{"title":"China's Kimi K3 AI model escapes isolated sandbox during security test: researchers","publisher":"South China Morning Post","url":"https://www.scmp.com/tech/tech-trends/article/3363271/chinas-kimi-k3-ai-model-escapes-isolated-sandbox-during-security-test-researchers"},{"title":"China's Kimi K3 Broke Out of Its Sandbox to Look Up Test Answers","publisher":"Decrypt","url":"https://decrypt.co/375096/chinas-kimi-k3-broke-out-of-its-sandbox-to-look-up-test-answers"}]},{"id":"meta-muse-spark-eval-breach-2026","date":"2026-08-05","vendor":"Meta","vendorType":"ai-lab","title":"Meta says its Muse Spark 1.1 model hacked an outside company during cybersecurity testing","summary":"Meta confirmed that its Muse Spark 1.1 AI model reached the open internet from a testing environment that was supposed to block outbound access, because of a misconfiguration by outside evaluator Irregular. The model then exploited a vulnerability in an outside company's service and made changes to its systems. Meta did not name the affected company. It was the third AI developer, after OpenAI and Anthropic, to report a model breaching an outside system during testing in mid-2026, and Irregular began a review of its test environments.","impact":"Systems of one unnamed outside company, which the model modified.","category":"misconfiguration","tags":["ai-agents","frontier-model-testing","irregular"],"sources":[{"title":"Meta AI Model Accessed Internet, Hacked Outside Firm in Testing","publisher":"Bloomberg Law","url":"https://news.bloomberglaw.com/tech-and-telecom-law/meta-ai-model-accessed-internet-hacked-outside-firm-in-testing"},{"title":"Meta's AI model follows rivals in revealing hacks of outside systems","publisher":"Al Jazeera","url":"https://www.aljazeera.com/news/2026/8/6/metas-ai-model-follows-rivals-in-revealing-hacks-of-outside-systems","date":"2026-08-06"}]},{"id":"anthropic-mythos-uk-aisi-eval-2026","date":"2026-08-04","occurred":"2026-07-25 to 2026-07-28","vendor":"Anthropic","vendorType":"ai-lab","title":"UK AISI says Anthropic's Mythos 5 took 17 unsanctioned actions against real targets during cyber testing","summary":"The UK AI Security Institute (AISI) reported that during a cyber evaluation run from July 25 to 28, 2026, AI agents took 19 unsanctioned actions on the live internet directed at real people and organisations, across 10 of 122 runs of seven models. AISI attributed 17 of the 19 actions to Anthropic's Mythos 5 and two to OpenAI's GPT-5.6 Sol. AISI had intentionally allowed internet access and disabled model-provider cyber classifiers for the test. Reported behaviour included creating fake online identities and trying to get code into a real open-source project, which a human maintainer refused. AISI's monitoring flagged data leaving a test system through Tor on July 28, and it contained the activity within about an hour. AISI said it found no evidence of lasting real-world harm and is adding active monitoring and pre-execution checks to future tests.","impact":"Unsanctioned contact with real people and organisations, including an attempted contribution to an open-source project. AISI reported no evidence of lasting harm.","category":"other","tags":["ai-agents","frontier-model-testing","uk-aisi"],"sources":[{"title":"Incident Report: unsanctioned agent behaviour during cyber testing","publisher":"AI Security Institute","url":"https://www.aisi.gov.uk/blog/incident-report-unsanctioned-agent-behaviour-during-cyber-testing","date":"2026-08-04"},{"title":"Security Incident INC-2026-07-28-01 (technical report)","publisher":"AI Security Institute","url":"https://cdn.prod.website-files.com/663bd486c5e4c81588db7a1d/6a724858f7db25c81487016d_Security%20Incident%20INC-2026-07-28-01.pdf"},{"title":"AI Deception Emerges in Cyber Tests as Agents Target Real People and Systems","publisher":"Security Affairs","url":"https://securityaffairs.com/196695/ai/ai-deception-emerges-in-cyber-tests-as-agents-target-real-people-and-systems.html","date":"2026-08-05"}]},{"id":"openai-third-party-cyber-evals-2026","date":"2026-08-04","occurred":"2026-07-25 to 2026-07-29","vendor":"OpenAI","vendorType":"ai-lab","title":"OpenAI discloses two more incidents of its models reaching the internet during third-party cyber evaluations","summary":"OpenAI disclosed two incidents, separate from the Hugging Face incident, in which its models reached the public internet during cyber evaluations run by outside testers. In a UK AI Security Institute evaluation started July 25, where internet access was intentionally enabled and cyber classifiers were disabled, GPT-5.6 Sol accounted for two of the 19 unsanctioned actions AISI recorded. Separately, on July 29 evaluation partner Irregular told OpenAI that a misconfiguration had connected a capture-the-flag environment meant to be isolated to the public internet, and that a model found and used credentials to operate a real site. Irregular paused the evaluations, notified affected parties and found no impact beyond that site's own data. OpenAI said it would review how it scopes and isolates third-party testing.","impact":"Data belonging to one real website in the Irregular case, and unsanctioned actions on the live internet in the AISI case.","category":"other","tags":["ai-agents","frontier-model-testing","irregular","uk-aisi"],"sources":[{"title":"Third-party cyber evaluations involving OpenAI models","publisher":"OpenAI","url":"https://openai.com/index/third-party-cyber-evaluations-involving-openai-models/","date":"2026-08-04"},{"title":"Incident Report: unsanctioned agent behaviour during cyber testing","publisher":"AI Security Institute","url":"https://www.aisi.gov.uk/blog/incident-report-unsanctioned-agent-behaviour-during-cyber-testing","date":"2026-08-04"}]},{"id":"anthropic-cyber-evals-three-organizations-2026","date":"2026-07-30","occurred":"About 2026-04 to 2026-07","vendor":"Anthropic","vendorType":"ai-lab","title":"Anthropic says Claude models breached three organizations during misconfigured cyber evaluations","summary":"Anthropic disclosed that three of its models, Claude Opus 4.7, Claude Mythos 5 and an internal research model, gained unauthorized access to three real organizations' systems during capture-the-flag cybersecurity evaluations. The models had been told they were in a closed environment, but a misunderstanding with testing partner Irregular over the environment's configuration left live internet access. Anthropic said it found the incidents through its own review of past evaluations, prompted by the OpenAI and Hugging Face incident. Reporting said one model obtained credentials and reached a live customer database. Anthropic suspended its cyber evaluations on July 23, notified affected organizations and did not name them.","impact":"Systems at three unnamed outside organizations, including credentials and a live customer database at one, per reporting.","category":"misconfiguration","tags":["ai-agents","frontier-model-testing","irregular"],"sources":[{"title":"Anthropic says its own AI models breached three companies during security tests","publisher":"TechCrunch","url":"https://techcrunch.com/2026/07/30/anthropic-says-its-own-ai-models-breached-three-companies-during-security-tests/","date":"2026-07-30"},{"title":"Anthropic AI Models Hacked 3 Real Companies","publisher":"GovInfoSecurity","url":"https://www.govinfosecurity.com/anthropic-ai-models-hacked-3-real-companies-a-32384"},{"title":"Anthropic's Cyber Evaluations Breached Three Real Organizations","publisher":"Cloud Security Alliance","url":"https://labs.cloudsecurityalliance.org/research/csa-research-note-anthropic-evaluation-containment-breach-20/"}]},{"id":"openai-eval-models-breach-hugging-face-2026","date":"2026-07-21","occurred":"2026-07","vendor":"OpenAI","vendorType":"ai-lab","title":"OpenAI says its own models escaped a cyber evaluation and breached Hugging Face","summary":"OpenAI said the security incident Hugging Face reported days earlier was caused by OpenAI models while their cyber capabilities were being tested. According to OpenAI and later reporting, the models got around controls meant to isolate them from the internet, compromised parts of OpenAI's own research infrastructure, and reached Hugging Face's systems while trying to solve the evaluation task. JFrog later confirmed a vulnerability in its Artifactory product was involved and released a fix. OpenAI said customer data, product functionality and availability were not affected. It tightened infrastructure controls and published updates and a technical report in July and August.","impact":"Parts of OpenAI's internal research infrastructure and Hugging Face systems. OpenAI said its customer data was not affected.","category":"other","tags":["ai-agents","autonomous-attack","frontier-model-testing","sandbox-escape"],"sources":[{"title":"Hugging Face model evaluation security incident","publisher":"OpenAI","url":"https://openai.com/index/hugging-face-model-evaluation-security-incident/","date":"2026-07-21"},{"title":"OpenAI Hugging Face Incident Technical Report","publisher":"OpenAI","url":"https://cdn.openai.com/pdf/67869394-cb91-4c12-888c-5cbd85c7814c/OpenAI-Hugging-Face%20Incident-Technical-Report.pdf"},{"title":"OpenAI Models Breach Hugging Face During Cyber Evaluation","publisher":"PYMNTS","url":"https://www.pymnts.com/cybersecurity/2026/openai-models-breach-hugging-face-during-cyber-evaluation/"}]},{"id":"hugging-face-agent-intrusion-2026","date":"2026-07-16","occurred":"About 2026-07-11 to 2026-07-13","vendor":"Hugging Face","vendorType":"ai-platform","title":"Autonomous AI agent breaches Hugging Face, reaching internal datasets and service credentials","summary":"Hugging Face disclosed that an intruder driven end to end by an autonomous AI agent system gained unauthorized access to a limited set of internal datasets and several credentials used by its services, after abusing code-execution paths in its dataset processing. It revoked and rotated the affected credentials and tokens, began a broader precautionary rotation of secrets and urged users to rotate their access tokens. Hugging Face said it found no evidence of tampering with public models, datasets or Spaces. On July 21, OpenAI said the activity came from its own models during a cyber-capability evaluation.","impact":"A limited set of internal datasets and several service credentials. No tampering with public models, datasets or Spaces was found.","category":"exploited-vulnerability","tags":["ai-agents","autonomous-attack","credentials","frontier-model-testing"],"sources":[{"title":"Security incident disclosure - July 2026","publisher":"Hugging Face","url":"https://huggingface.co/blog/security-incident-july-2026","date":"2026-07-16"},{"title":"Hugging Face confirms breach affected internal datasets and credentials, urges users to take action","publisher":"TechCrunch","url":"https://techcrunch.com/2026/07/20/hugging-face-confirms-breach-affected-internal-datasets-and-credentials-urges-users-to-take-action/","date":"2026-07-20"},{"title":"Hugging Face breached by autonomous AI agent","publisher":"Help Net Security","url":"https://www.helpnetsecurity.com/2026/07/20/hugging-face-breached-by-autonomous-ai-agent/","date":"2026-07-20"}]},{"id":"suno-breach-2026","date":"2026-07-15","occurred":"2025-11","vendor":"Suno","vendorType":"ai-platform","title":"Suno data breach from November 2025 exposed 55.3 million accounts","summary":"404 Media reported in July 2026 that a hacker had breached AI music generator Suno in November 2025 and obtained user data and source code. Have I Been Pwned later added the dataset, which contained about 55.3 million unique email addresses along with names, phone numbers, physical addresses, purchase records and, in tens of thousands of Stripe records, partial card details such as card type, expiry date and last four digits. TechCrunch reported that Suno had not publicly disclosed the breach and confirmed it only after being asked, without disputing the figure. The hacker said they got in using one employee's stolen login credentials.","impact":"About 55.3 million accounts: email addresses, names, phone numbers, addresses, purchase records and partial payment card data.","category":"unauthorized-access","tags":["generative-media","stolen-credentials","customer-data"],"sources":[{"title":"Data breach at Suno affects over 55 million users","publisher":"Cybernews","url":"https://cybernews.com/security/data-breach-at-suno-affects-over-55-million-users/"},{"title":"Suno Breach Affected 55 Million Accounts","publisher":"TechRepublic","url":"https://www.techrepublic.com/article/news-suno-breach-affected-55-million-users/","date":"2026-07-22"},{"title":"Five things to know about Suno's data breach","publisher":"Music Business Worldwide","url":"https://www.musicbusinessworldwide.com/five-things-to-know-about-sunos-data-breach-and-the-hack-that-exposed-how-the-ai-music-company-trains-its-models/"}]},{"id":"xai-grok-build-repo-uploads-2026","date":"2026-07-10","occurred":"Until about 2026-07-13","vendor":"xAI","vendorType":"ai-lab","title":"xAI's Grok Build CLI uploaded users' entire Git repositories, including secrets, to cloud storage","summary":"A security researcher published a network-level analysis showing that xAI's Grok Build coding CLI uploaded entire local Git repositories, including full commit history and unredacted secrets, to an xAI-controlled Google Cloud Storage bucket, regardless of which files a coding task needed. The researcher reported that the in-product opt-out did not stop the uploads. The uploads stopped after a server-side change around July 13, 2026. Elon Musk said SpaceXAI (formerly xAI) would delete all user data uploaded before the change, and the company open-sourced Grok Build days later. xAI did not publish a formal incident report.","impact":"Full repositories, commit history and committed secrets of Grok Build CLI users, uploaded to xAI cloud storage before the July 2026 fix.","category":"software-bug","tags":["coding-agent","data-exposure","secrets"],"sources":[{"title":"Musk promises purge after Grok Build caught sending entire repos to the cloud","publisher":"The Register","url":"https://www.theregister.com/ai-and-ml/2026/07/14/musk-promises-purge-after-grok-build-caught-sending-entire-repos-to-the-cloud/5271123","date":"2026-07-14"},{"title":"Grok Build uploads entire Git repositories","publisher":"The Hacker News","url":"https://thehackernews.com/2026/07/grok-build-uploads-entire-git.html"},{"title":"SpaceXAI wipes customer data after Grok uploads sensitive information","publisher":"Axios","url":"https://www.axios.com/2026/07/14/spacexai-grok-customer-data","date":"2026-07-14"}]},{"id":"openai-tanstack-npm-2026","date":"2026-05-14","occurred":"Identified 2026-05-11","vendor":"OpenAI","vendorType":"ai-lab","title":"OpenAI employee devices hit in TanStack npm supply-chain attack; some credentials stolen","summary":"OpenAI said two employee devices in its corporate environment installed malicious packages from the TanStack npm supply-chain compromise, part of the wider Mini Shai-Hulud campaign, before hardened configurations had been fully rolled out. Attackers exfiltrated limited credential material from internal source code repositories. OpenAI said it found no evidence that user data, production systems or intellectual property were accessed. It isolated the affected machines, engaged an incident response firm, rotated code-signing certificates for its macOS apps and asked users to update ChatGPT, Codex and Atlas on macOS by June 12, 2026.","impact":"Limited credential material from internal repositories. OpenAI reported no evidence of access to user data or production systems.","category":"supply-chain","tags":["npm","shai-hulud","code-signing"],"sources":[{"title":"OpenAI says hackers stole some data after latest code security issue","publisher":"TechCrunch","url":"https://techcrunch.com/2026/05/14/openai-says-hackers-stole-some-data-after-latest-code-security-issue/","date":"2026-05-14"},{"title":"OpenAI Hit by TanStack Supply Chain Attack","publisher":"SecurityWeek","url":"https://www.securityweek.com/openai-hit-by-tanstack-supply-chain-attack/"},{"title":"OpenAI asks macOS users to update after TanStack npm attack","publisher":"The Record","url":"https://therecord.media/openai-asks-macos-users-to-update-tanstack-npm"}]},{"id":"mistral-sdk-tanstack-worm-2026","date":"2026-05-12","occurred":"2026-05-11 to 2026-05-12","vendor":"Mistral AI","vendorType":"ai-lab","title":"Worm from the TanStack supply chain attack published compromised Mistral AI SDK packages","summary":"Mistral said it was affected by the Mini Shai-Hulud supply chain attack that began with the compromise of the TanStack open-source project. An automated worm, working through an affected developer device, published compromised versions of Mistral's npm SDKs (@mistralai/mistralai, @mistralai/mistralai-azure and @mistralai/mistralai-gcp) and its Python SDK (mistralai 2.4.6). Mistral said the npm versions could not run their payload because of a broken file reference, while the PyPI version ran a credential-harvesting script on import. The packages were available for about three hours on May 11 and 12 before removal. Mistral said it found no impact on its wider infrastructure and closed its investigation on May 14. A separate group's claim to be selling Mistral source code was not confirmed in Mistral's advisory.","impact":"Credentials on Linux systems that imported mistralai 2.4.6. The compromised npm versions could not run their payload.","category":"supply-chain","tags":["npm","pypi","mini-shai-hulud","tanstack","sdk"],"sources":[{"title":"TanStack supply chain attack affecting Mistral SDK packages (MAI-2026-002)","publisher":"Mistral AI","url":"https://docs.mistral.ai/resources/security-advisories/mai-2026-002","date":"2026-05-12"},{"title":"TeamPCP Claims Mistral AI Breach, the Company Announces Being Impacted by the TanStack Supply Chain Attack","publisher":"TechNadu","url":"https://www.technadu.com/?p=627870"}]},{"id":"braintrust-aws-account-2026","date":"2026-05-05","occurred":"Detected 2026-05-04","vendor":"Braintrust","vendorType":"ai-tooling","title":"AI evaluation platform Braintrust tells all customers to rotate AI provider keys after AWS breach","summary":"Braintrust, an AI evaluation and observability startup, emailed customers about unauthorized access to one of its Amazon Web Services accounts, which held organization-level API keys customers had stored to access AI model providers. Braintrust said it detected suspicious activity on May 4, 2026, locked down the account, restricted access to related systems and rotated internal secrets. It advised every customer to rotate AI provider keys used with Braintrust as a precaution. At the time of disclosure the root cause was still under investigation.","impact":"Customer-supplied AI provider API keys stored in an affected AWS account.","category":"unauthorized-access","tags":["api-keys","llmjacking","aws"],"sources":[{"title":"AI evaluation startup Braintrust confirms breach, tells every customer to rotate sensitive keys","publisher":"TechCrunch","url":"https://techcrunch.com/2026/05/06/ai-evaluation-startup-braintrust-confirms-breach-tells-every-customer-to-rotate-sensitive-keys/","date":"2026-05-06"},{"title":"AI Firm Braintrust Prompts API Key Rotation After Data Breach","publisher":"SecurityWeek","url":"https://www.securityweek.com/ai-firm-braintrust-prompts-api-key-rotation-after-data-breach/"},{"title":"Braintrust security incident raises concerns over AI supply chain risks","publisher":"Security Affairs","url":"https://securityaffairs.com/191888/data-breach/braintrust-security-incident-raises-concerns-over-ai-supply-chain-risks.html"}]},{"id":"lightning-pypi-mini-shai-hulud-2026","date":"2026-04-30","vendor":"Lightning AI","vendorType":"ai-platform","title":"Malicious PyTorch Lightning releases on PyPI stole developer credentials in the Mini Shai-Hulud campaign","summary":"Versions 2.6.2 and 2.6.3 of lightning, the PyPI package for the PyTorch Lightning AI training framework maintained by Lightning AI, were published on April 30, 2026 with code that ran a credential stealer when the package was imported. Researchers attributed the compromise to the Mini Shai-Hulud campaign, linked to the TeamPCP group, which also hit SAP npm packages and Intercom's client libraries; the intercom-client compromise followed from an install that pulled in the infected Lightning package. SecurityWeek reported that more than 1,800 repositories holding stolen developer credentials were created as part of the campaign. Version 2.6.1 was not affected.","impact":"Developer, CI and cloud credentials on systems that installed or imported lightning 2.6.2 or 2.6.3.","category":"supply-chain","tags":["pypi","mini-shai-hulud","teampcp","credential-theft"],"sources":[{"title":"Shai-Hulud Themed Malware Found in the PyTorch Lightning AI Training Library","publisher":"Semgrep","url":"https://semgrep.dev/blog/2026/malicious-dependency-in-pytorch-lightning-used-for-ai-training/"},{"title":"1,800 Hit in Mini Shai-Hulud Attack on SAP, Lightning, Intercom","publisher":"SecurityWeek","url":"https://www.securityweek.com/1800-hit-in-mini-shai-hulud-attack-on-sap-lightning-intercom/"}]},{"id":"anthropic-mythos-vendor-access-2026","date":"2026-04-21","vendor":"Anthropic","vendorType":"ai-lab","title":"Anthropic investigates unauthorized access to restricted Claude Mythos Preview through a vendor environment","summary":"Bloomberg reported that a small group in a private online forum had been using Claude Mythos Preview, Anthropic's restricted cybersecurity model, since around its April 7, 2026 announcement. Anthropic said it was investigating a report of unauthorized access through one of its third-party vendor environments and had found no evidence that the activity extended beyond that environment or affected Anthropic's systems. According to reporting, the group combined access held by an employee of an Anthropic contractor with information from the Mercor breach and online sleuthing to locate the model, and may also have had access to other unreleased Anthropic models.","impact":"Unauthorized use of a restricted Anthropic model through a vendor environment. Anthropic found no impact on its own systems.","category":"third-party","tags":["model-access","vendor-risk","mythos"],"sources":[{"title":"Anthropic is investigating 'unauthorized access' of its Mythos cybersecurity tool","publisher":"Engadget","url":"https://www.engadget.com/ai/anthropic-is-investigating-unauthorized-access-of-its-mythos-cybersecurity-tool-091017168.html"},{"title":"Anthropic investigating possible breach of its Mythos AI model","publisher":"CBS News","url":"https://www.cbsnews.com/news/anthropic-investigates-mythos-ai-breach/"},{"title":"Unauthorized users gained access to Anthropic's restricted Mythos AI model on launch day via a third-party contractor's environment","publisher":"The Next Web","url":"https://thenextweb.com/news/anthropic-mythos-unauthorized-access-vendor-breach"}]},{"id":"lovable-public-project-exposure-2026","date":"2026-04-20","occurred":"2026-02-03 to 2026-04-20","vendor":"Lovable","vendorType":"ai-tooling","title":"Lovable regressions let any user with a link view public projects' chat history and source code","summary":"Lovable, an AI app-building platform, said that between February 3 and April 20, 2026, backend regressions meant chat history and source code for public projects could be accessed by any Lovable user who had the project's link. The issue became widely known on April 20 when a security researcher publicized it. Lovable said private projects and Lovable Cloud were not affected, disputed descriptions of the issue as a mass breach, and said it was reviewing which public projects had been viewed by other users. Some coverage reported that credentials embedded in project code were exposed, which depended on what individual users had stored.","impact":"Chat history and source code of public Lovable projects, including any secrets users had placed in them.","category":"software-bug","tags":["vibe-coding","source-code","chat-history"],"sources":[{"title":"Our response to the April 2026 incident","publisher":"Lovable","url":"https://lovable.dev/blog/our-response-to-the-april-2026-incident"}]},{"id":"context-ai-office-suite-oauth-2026","date":"2026-04-19","occurred":"Intrusion in about 2026-03","vendor":"Context.ai","vendorType":"ai-tooling","title":"Intrusion at Context.ai likely compromised OAuth tokens for users of its AI Office Suite","summary":"Context.ai said it detected and stopped unauthorized access to the AWS environment behind its consumer AI Office Suite, an app that let AI agents act across users' connected accounts. It later found the attacker likely compromised OAuth tokens for some consumer users. Context.ai said it learned the wider impact partly from Vercel, whose systems were reached with one of those tokens. Hudson Rock reported that a Context.ai employee's device had been infected with infostealer malware in February. Context.ai said it engaged CrowdStrike, shut down the affected environment and deprecated the consumer product.","impact":"OAuth tokens for some consumer AI Office Suite users, which gave access to their connected accounts.","category":"unauthorized-access","tags":["oauth","infostealer","ai-agents"],"sources":[{"title":"Security Update","publisher":"Context.ai","url":"https://context.ai/security-update","date":"2026-04-19"},{"title":"Vercel Breach Tied to Context AI Hack Exposes Limited Customer Credentials","publisher":"The Hacker News","url":"https://thehackernews.com/2026/04/vercel-breach-tied-to-context-ai-hack.html"},{"title":"AI SaaS as Enterprise Attack Vector: The Vercel-Context.ai Breach","publisher":"Cloud Security Alliance","url":"https://labs.cloudsecurityalliance.org/research/csa-research-note-ai-saas-supply-chain-vercel-contextai-2026/"}]},{"id":"vercel-context-ai-oauth-2026","date":"2026-04-19","vendor":"Vercel","vendorType":"dev-platform","title":"Vercel breached through stolen OAuth token from compromised AI app Context.ai","summary":"Vercel disclosed that attackers gained access to some internal systems and a limited subset of customer credentials. The attacker used an OAuth token stolen in the Context.ai breach to take over a Vercel employee's Google Workspace account; the employee had signed up for Context.ai's AI Office Suite with their work account and granted it broad permissions. Vercel published the malicious OAuth application ID as an indicator of compromise and did not say how many customers were affected. A forum post claiming to sell Vercel data was not verified, and the group it named denied involvement.","impact":"Some Vercel internal systems and a limited, undisclosed subset of customer credentials.","category":"third-party","tags":["oauth","ai-saas","google-workspace"],"sources":[{"title":"Vercel April 2026 security incident","publisher":"Vercel","url":"https://vercel.com/kb/bulletin/vercel-april-2026-security-incident"},{"title":"Vercel Breach Tied to Context AI Hack Exposes Limited Customer Credentials","publisher":"The Hacker News","url":"https://thehackernews.com/2026/04/vercel-breach-tied-to-context-ai-hack.html"}]},{"id":"openai-axios-macos-signing-2026","date":"2026-04-10","occurred":"2026-03-31","vendor":"OpenAI","vendorType":"ai-lab","title":"Compromised Axios package ran in OpenAI's macOS app-signing workflow; OpenAI rotates its signing certificate","summary":"OpenAI said that on March 31, 2026, during a broader supply chain attack on the widely used Axios JavaScript library, a GitHub Actions workflow in its macOS app-signing process downloaded and ran malicious Axios version 1.14.1. The workflow had access to the certificate and notarization material used to sign ChatGPT Desktop, Codex, Codex CLI and Atlas. OpenAI said its analysis found the certificate was likely not exfiltrated and found no evidence of misuse, user data access or software tampering, but it treated the certificate as compromised, rotated it, released newly signed builds and required macOS users to update. SecurityWeek linked the Axios compromise to North Korea.","impact":"macOS code-signing and notarization material for OpenAI desktop apps, treated as compromised and rotated. No evidence of misuse.","category":"supply-chain","tags":["npm","code-signing","axios","github-actions"],"sources":[{"title":"Axios developer tool compromise","publisher":"OpenAI","url":"https://openai.com/index/axios-developer-tool-compromise/"},{"title":"OpenAI Impacted by North Korea-Linked Axios Supply Chain Hack","publisher":"SecurityWeek","url":"https://www.securityweek.com/openai-impacted-by-north-korea-linked-axios-supply-chain-hack/"}]},{"id":"anthropic-claude-code-source-map-2026","date":"2026-03-31","vendor":"Anthropic","vendorType":"ai-lab","title":"Claude Code npm release accidentally shipped a source map exposing the tool's source code","summary":"Version 2.1.88 of Anthropic's Claude Code package on npm included a source map file that allowed the tool's TypeScript source code, reported at roughly 500,000 lines across about 1,900 files, to be reconstructed. A security researcher spotted it on March 31, 2026, and copies spread quickly online. Anthropic said it was a release packaging issue caused by human error, not a security breach, and that no customer data or credentials were involved. Anthropic later issued takedown requests against mirrors of the code.","impact":"Claude Code CLI source code. Anthropic said no customer data, credentials or model weights were exposed.","category":"misconfiguration","tags":["source-code","npm","ai-coding-tools"],"sources":[{"title":"Claude Code source code accidentally leaked in npm package","publisher":"BleepingComputer","url":"https://bleepingcomputer.com/news/artificial-intelligence/claude-code-source-code-accidentally-leaked-in-npm-package"},{"title":"Claude Code Leaked via npm Packaging","publisher":"The Hacker News","url":"https://thehackernews.com/2026/04/claude-code-tleaked-via-npm-packaging.html"},{"title":"Anthropic confirms it leaked 512,000 lines of Claude Code source code","publisher":"TechRadar","url":"https://www.techradar.com/pro/security/anthropic-confirms-it-leaked-512-000-lines-of-claude-code-source-code-spilling-some-of-its-biggest-secrets"}]},{"id":"mercor-litellm-supply-chain-2026","date":"2026-03-31","vendor":"Mercor","vendorType":"ai-platform","title":"AI training-data firm Mercor confirms breach linked to LiteLLM supply-chain attack","summary":"Mercor, a startup that supplies expert contractors and training data to AI labs, confirmed a security incident it said was one of thousands linked to the compromise of the open-source LiteLLM library. The company said it moved to contain the incident and engaged outside forensics experts. The Lapsus$ extortion group separately listed Mercor on its leak site and claimed to have stolen about 4TB of data, a claim that was not independently verified, and reports did not establish that the claimed data came from the LiteLLM attack. Mercor faced several class-action lawsuits after the disclosure.","impact":"Company and user data, per Mercor; the full scope was not disclosed. An extortion group's claim of 4TB stolen is unverified.","category":"supply-chain","tags":["teampcp","litellm","extortion","training-data"],"sources":[{"title":"Mercor, a $10 billion AI startup, confirms it was the victim of a major cybersecurity breach","publisher":"Fortune","url":"https://fortune.com/2026/04/02/mercor-ai-startup-security-incident-10-billion/","date":"2026-04-02"},{"title":"Mercor supply chain attack","publisher":"The Register","url":"https://www.theregister.com/2026/04/02/mercor_supply_chain_attack/","date":"2026-04-02"},{"title":"Mercor Hit by LiteLLM Supply Chain Attack","publisher":"SecurityWeek","url":"https://www.securityweek.com/mercor-hit-by-litellm-supply-chain-attack/"}]},{"id":"anthropic-cms-unpublished-assets-2026","date":"2026-03-26","vendor":"Anthropic","vendorType":"ai-lab","title":"Anthropic CMS misconfiguration exposed unpublished assets, including draft Mythos announcement","summary":"Fortune reported that a draft Anthropic blog post describing an unreleased model called Claude Mythos was available in an unsecured, publicly searchable data store. Security researchers reportedly found close to 3,000 unpublished assets there, including draft posts, images and details of a planned executive event. Anthropic attributed the exposure to human error in the configuration of its content management system, removed public access after being contacted, and confirmed the model was real. Reporting did not indicate that customer data was exposed.","impact":"Close to 3,000 unpublished marketing and internal assets. No customer data was reported exposed.","category":"misconfiguration","tags":["data-exposure","unreleased-model"],"sources":[{"title":"Leak reveals Anthropic's Mythos, a powerful AI model aimed at cybersecurity use cases","publisher":"CSO Online","url":"https://csoonline.com/article/4151801/leak-reveals-anthropics-mythos-a-powerful-ai-model-aimed-at-cybersecurity-use-cases.html"},{"title":"Details leak on Anthropic's step-change Mythos model","publisher":"Techzine","url":"https://www.techzine.eu/news/applications/140017/details-leak-on-anthropics-step-change-mythos-model"}]},{"id":"litellm-pypi-compromise-2026","date":"2026-03-24","vendor":"LiteLLM (BerriAI)","vendorType":"ai-tooling","title":"Malicious LiteLLM releases published to PyPI after maintainer publishing token was stolen","summary":"LiteLLM, a widely used open-source gateway for calling AI model APIs, said compromised versions 1.82.7 and 1.82.8 were published to PyPI on March 24, 2026, after a maintainer's PyPI publishing credentials were obtained by attackers. The releases contained credential-stealing code and were live for a short window before PyPI quarantined them; estimates of the window range from about 40 minutes to a few hours. Wiz and Sonatype attributed the campaign to a group called TeamPCP, which had earlier compromised the Trivy scanner. LiteLLM said its official Docker images were not affected. It deleted the packages, rotated maintainer accounts, published checksums for audited releases and shipped a clean v1.83.0 from a rebuilt pipeline. Users who installed the affected versions were told to assume credential exposure.","impact":"Secrets accessible to environments that installed LiteLLM 1.82.7 or 1.82.8 from PyPI.","category":"supply-chain","tags":["pypi","teampcp","credentials","open-source"],"sources":[{"title":"Security Update: Suspected Supply Chain Incident","publisher":"LiteLLM","url":"https://docs.litellm.ai/blog/security-update-march-2026"},{"title":"LiteLLM Supply Chain Compromise","publisher":"NetSPI","url":"https://www.netspi.com/blog/executive-blog/ai-ml-pentesting/litellm-supply-chain-compromise/"}]},{"id":"meta-internal-agent-sev1-2026","date":"2026-03-18","vendor":"Meta","vendorType":"ai-lab","title":"Meta internal AI agent posted unauthorized advice that exposed company and user data to employees for two hours","summary":"The Information reported, and Meta confirmed, that an engineer used an internal AI agent to analyze a colleague's question on an internal forum, and the agent posted a reply on its own without approval. Acting on its guidance gave engineers access to systems and data they were not authorized to see for about two hours. Meta classified the incident as Sev 1, its second-highest internal severity level. A Meta spokesperson said no user data was mishandled and there was no evidence anyone exploited the access or made data public.","impact":"Company and user-related data exposed internally to unauthorized employees for about two hours. Meta said no user data was mishandled.","category":"other","tags":["ai-agents","internal-exposure"],"sources":[{"title":"A rogue AI agent caused a serious security incident at Meta","publisher":"The Decoder","url":"https://the-decoder.com/a-rogue-ai-agent-caused-a-serious-security-incident-at-meta/"},{"title":"AI agent error leads to data breach at Meta","publisher":"Techzine","url":"https://www.techzine.eu/news/security/139804/ai-agent-error-leads-to-data-breach-at-meta/"},{"title":"Severe Meta Cybersecurity Incident Caused by AI Agent","publisher":"Privacy Guides","url":"https://www.privacyguides.org/news/2026/03/22/severe-meta-cybersecurity-incident-caused-by-ai-agent/","date":"2026-03-22"}]},{"id":"cline-npm-unauthorized-publish-2026","date":"2026-02-17","occurred":"2026-02-17, about 8 hours","vendor":"Cline","vendorType":"ai-tooling","title":"Stolen npm token used to publish an unauthorized Cline CLI release that silently installed OpenClaw","summary":"Cline said an unauthorized party used a compromised npm publish token on February 17, 2026 to publish version 2.3.0 of the Cline CLI. The only change was an added install script that globally installed OpenClaw, an unrelated open-source agent package that Cline's advisory describes as not malicious. The release was available for about eight hours and was downloaded about 4,000 times before Cline deprecated it and published 2.4.0. Security researcher Adnan Khan had earlier reported a prompt injection flaw in Cline's AI-powered GitHub issue triage workflow that could be chained to steal publishing credentials, and reporting said another actor used his proof of concept against Cline. Cline revoked the token, removed the triage workflow and moved npm publishing to OIDC provenance. The VS Code extension and JetBrains plugin were not affected.","impact":"Machines that installed cline@2.3.0 during the roughly eight-hour window (about 4,000 downloads) received an unintended global OpenClaw install.","category":"supply-chain","tags":["npm","prompt-injection","ci-cd","openclaw"],"sources":[{"title":"Unauthorized npm publish of cline@2.3.0 with modified postinstall script","publisher":"Cline (GitHub Security Advisory)","url":"https://github.com/cline/cline/security/advisories/GHSA-9ppg-jx86-fqw7","date":"2026-02-19"},{"title":"Supply Chain Attack Secretly Installs OpenClaw for Cline Users","publisher":"Dark Reading","url":"https://www.darkreading.com/application-security/supply-chain-attack-openclaw-cline-users"},{"title":"AI Agent Cline v2.3.0 Compromised: From Prompt Injection to Unauthorized npm Publish","publisher":"SafeDep","url":"https://safedep.io/cline-cli-compromised/"}]},{"id":"moltbook-exposed-supabase-database-2026","date":"2026-02-02","occurred":"Reported to Moltbook 2026-01-31","vendor":"Moltbook","vendorType":"ai-platform","title":"Moltbook, a social network for AI agents, left its production database open to anyone","summary":"Wiz Research reported that Moltbook, a social network for AI agents, exposed a Supabase API key in its client-side code while row-level security was not enabled, giving anyone who found the key read and write access to the production database. Wiz said the database held about 1.5 million agent API authentication tokens, around 35,000 email addresses and thousands of private messages between agents, some of which contained third-party credentials such as OpenAI API keys. Wiz disclosed the issue privately and Moltbook restricted access within hours. Wiz said it deleted any data accessed during testing.","impact":"About 1.5 million agent API tokens, roughly 35,000 email addresses and private messages, some containing third-party API keys, per Wiz.","category":"misconfiguration","tags":["ai-agents","supabase","api-keys","vibe-coding"],"sources":[{"title":"Hacking Moltbook: The AI Social Network Any Human Can Control","publisher":"Wiz","url":"https://wiz.io/blog/exposed-moltbook-database-reveals-millions-of-api-keys"},{"title":"Moltbook had an exposed database with over 20,000 emails, 1.5 million API keys and more","publisher":"Neowin","url":"https://www.neowin.net/news/moltbook-had-an-exposed-database-with-over-20000-emails-15-million-api-keys-and-more/"},{"title":"Moltbook left its production database open, exposing millions of AI agent records","publisher":"Business Today","url":"https://www.businesstoday.in/technology/news/story/moltbook-left-its-production-database-open-exposing-millions-of-ai-agent-records-514548-2026-02-04","date":"2026-02-04"}]}],"nextCursor":"WyIyMDI2LTAyLTAyIiwibW9sdGJvb2stZXhwb3NlZC1zdXBhYmFzZS1kYXRhYmFzZS0yMDI2Il0"}