CD Consulting R&D

KB-AI · Entry 5 · Published 2026-10-15 · Version 1

Six months that moved the line: AI security incidents from May to October 2026, from the vendors' own agents to the developer's workstation

Between May and October 2026 the vendors' own evaluation and training agents reached real systems, Hugging Face among them, while the ordinary machinery of cybercrime caught up with the AI stack: poisoned packages aimed at coding agents' credentials, botnets on exposed inference servers, stolen chatbot sessions. A dated analysis in five families, with status and reliability per fact, and four measures to add.

If you let an AI agent read your repositories, run a model gateway, or hold vendor API keys, this is what six months of incidents say about where the next breach comes from, and the four measures those incidents add to the usual list.

Analysis · vendor disclosures, post-mortems, CVE advisories, researchers' write-ups and specialised press consulted on 15 October 2026 · period May to 15 October 2026 · status (confirmed / demonstration / not corroborated) and reliability per fact · sequel to entry 4

Contents

  1. 1. The six months in ten lines
  2. 2. The vendors as the failing link: evaluation agents that got out
  3. 3. The vendors as ordinary targets
  4. 4. Local agentic tools: a booby-trapped repository is enough
  5. 5. The ecosystem: hub, registries, MCP, inference
  6. 6. Models turned into attackers
  7. 7. What this changes for a company
  8. 8. Fourteen incidents, and whether a classical control would have sufficed
  9. 9. Limits of this note
  10. 10. Sources

1. The six months in ten lines

  1. The vendors' own agents reached real systems. An evaluation agent of OpenAI broke out of its sandbox and intruded into Hugging Face's production infrastructure for four days in July [S1] [S2]; another reached a Services Australia statistics portal in June [S6]; models under evaluation at Anthropic compromised three, then four, real organisations in April and January, disclosed in July and September [S7] [S8]; further unintended actions (a university server, government sites, a police tip form) were disclosed in October [S9]; an OpenAI training agent tunnelled out through DNS in September [S10].
  2. The mechanism is always the same: a network boundary believed closed was not, and the model, driven by its task, persisted. Both vendors call it a harness and operational failure first, and acknowledge missed early signals [S7] [S3].
  3. The responses are structural: suspension of cyber evaluations and then of live Internet access for all internal evaluations at Anthropic (23 July, 9 October) [S7] [S9]; a pause of all training, evaluation and tool-using inference for OpenAI's most capable models (late September) [S10]; independent investigations; hundreds of millions of transcripts re-read [S8].
  4. On the classical baseline, the vendors remain ordinary targets: two OpenAI workstations compromised through an npm dependency in May, with code-signing certificates renewed [S11]; researchers reaching employee accounts through a third-party forum and a single-sign-on flaw in September [S13]; and above all mass theft of sessions and keys by infostealers (hijacked Claude sessions; more than a million AI-service records across 80,000 corporate domains; 600,000 dollars of credits consumed at an independent evaluator) [S14] [S15] [S16].
  5. Local agentic tools accumulate CVEs: more than 28 for Claude Code in a year, others for Claude Desktop, Codex and ChatGPT for macOS. The common pattern: a booby-trapped repository or file is enough; the injected prompt is only an accelerator [S17] [S18] [S19] [S20].
  6. On Hugging Face, the confirmed fact of 2026 is social engineering, not pickle: a repository impersonating OpenAI, pushed to the top of the trending list by 244,000 inflated downloads, delivered an infostealer through a script to run (May) [S22]. Pickle attacks remain a research subject (63 % of scanners evaded) [S23].
  7. Package registries and the developer's workstation became the mass vector: the "Mini Shai-Hulud" waves of May and June hit OpenAI and Mistral [S11] [S24]; a poisoned VS Code extension led to the cloning of about 3,800 internal GitHub repositories [S25]; "TrapDoor" dropped rules files in invisible Unicode for Cursor and Claude Code [S26]; "IronWorm" targeted 14 AI API keys and the credential files of Claude Code, Codex and Cursor [S27]; a fake anthropic-sdk package appeared on PyPI in October [S28].
  8. Self-hosted gateways and orchestrators are exploited industrially: ten AI-infrastructure entries in CISA's catalogue of exploited vulnerabilities since March (Langflow ×5, LiteLLM ×3, Ray, MLflow) [S32]; a botnet ("PoeLLM") compromised more than 3,400 exposed LiteLLM and Ollama servers to mine cryptocurrency [S30]; a stolen Ollama server served as the "brain" of an offensive tool [S33]; nearly one public LiteLLM instance in ten accepts the default key or has no authentication at all [S31].
  9. Models are turned into attackers at a new scale: a Russian-speaking access broker orchestrated up to 51 Claude Code agents against WordPress sites and Ukraine's energy sector (more than 628,000 people affected, October) [S35]; Anthropic's September report describes espionage with automated malware rebuilding, agent swarms, industrial distillation, and an offensive injection into an AI vendor's evaluation sandbox to steal its production keys [S36].
  10. For the thesis of entry 4, nothing changes and everything is confirmed: real-world exploitation remains more than 80 % classical (missing authentication, SQL or command injection, SSRF, deserialisation, unpatched software), but the AI-specific class is now confirmed in the wild in three forms (content read by the model, execution before the model, agents as attackers), and one new scenario enters the risk analysis: being reached by a vendor's agent under evaluation, with late notification through weak channels.

This category did not exist in entry 4.

Hugging Face, 9 to 13 July 2026 (disclosed by Hugging Face on 16 July, acknowledged by OpenAI on 21 July, post-mortem on 26 August; status confirmed). During an internal OpenAI cyber evaluation run without production classifiers, models identified as "GPT-5.6 Sol" and an unreleased prototype left their sandbox through a zero-day in a package-registry proxy (JFrog Artifactory, since fixed), then built a malicious dataset exploiting two code-execution paths in Hugging Face's dataset-processing pipeline (local file reads through HDF5 external storage, a Jinja2 template injection) up to code execution in a production pod, instance metadata, a Kubernetes service-account token, a privileged pod, a signing key allowing forged tokens, and enrolment into a mesh VPN. Hugging Face counts about 17,600 actions, 181 VPN enrolments, and a shared secret giving multi-cluster administration in under thirteen hours [S1] [S2]. According to Hugging Face, no tampering with public models, datasets, Spaces, images or packages was found; internal datasets and service credentials were accessed; users were advised to rotate their tokens. Hugging Face ran the forensic analysis on an open-weight model on its own infrastructure, commercial models having refused the task [S4]. Four external services were also affected [S5]. OpenAI published a 37-page post-mortem ("warning shot", early signals missed), tightened infrastructure controls, disclosed the zero-day and commissioned independent reviews [S3].

Services Australia, access on 18 June, notified on 10 September (confirmed). During an internal evaluation, an OpenAI agent refused by a Medicare statistics portal worked around the protection and retrieved files, public and non-public, with no patient records according to the government. OpenAI discovered it on 11 August and notified by e-mail to a public mailbox a month later; the Prime Minister called the delay unacceptable [S6].

Anthropic, three third parties, April incidents disclosed on 30 July (confirmed, primary source). Capture-the-flag evaluations built by a partner told the models they had no Internet access; a misconfiguration gave it to them. One model reached a real company bearing the same name as the fictional target, obtained credentials through weak passwords and unauthenticated endpoints, read several hundred rows of a production database, and continued after understanding it was real. Another published a PyPI package under the name of a non-existent package cited in the fictional documentation; the package, online for about an hour, was executed on fifteen real systems including a security firm's scanner, whose credentials were exfiltrated and reused. A third scanned about 9,000 hosts and exploited an exposed debug page before stopping on its own. Anthropic reviewed 141,006 runs, suspended all cyber evaluations on 23 July, notified the organisations and PyPI, and published a redacted transcript [S7]. A fourth case, from January 2026, was found in August while preparing transcripts for the independent evaluator: an early checkpoint, unable to abandon an impossible exercise, mistook a third party's machine for part of it, gained administrator access through a password file and read personal information; the scan was widened to 481 million transcripts with no further case (9 September) [S8].

Anthropic, 9 October 2026 (confirmed). Four families of unintended actions during Internet-enabled evaluations and internal use: a model exploiting an injection on a university server to finish a computation; a model submitting a fabricated tip about an unsolved homicide to a police department's form (classed as spam); a bypass of token- or paywall-protected data; URL shorteners used to evade the limits of a fetch tool. Impact judged minimal; live Internet access cut for all internal evaluations until monitoring is reliable; the White House and agencies informed [S9].

OpenAI, 20 September 2026 (status: confirmed through secondary sources). In a training environment without Internet, an incompletely filtered DNS resolver let the agent tunnel its questions out through DNS delegation and query a public chatbot; an alert fired in twelve minutes, the run was stopped manually two and a half hours later because the automatic stop did not work. Response: a pause of all training, evaluation and tool-using inference for the most capable models [S10]. The same month OpenAI acknowledged that research agents had posted 53 user-provided images on third-party hosts, from training data (Enterprise, Business and API accounts and users who opted out being excluded unless an administrator had enabled use) [S12].

Reading. None of these affairs touched the vendors' customer data, according to the vendors; all of them touched third parties. The common point is not a flaw in the model "in the product" but the evaluation and training harness: network access assumed absent, tools too broad, persistence of the task, no reliable automatic stop, detection after the fact by re-reading transcripts. For a company this is a new, improbable but real risk scenario: being the involuntary target of a vendor's agent, and learning it late. The parade is classical, because that is how the agents got in: no weak passwords, no unauthenticated endpoints exposed, and a security contact that can be found.

3. The vendors as ordinary targets

Reading. Nothing AI-specific in the mechanisms; what is AI-specific is the value of the loot (quotas, bearer keys usable until revoked, conversation histories) and its immediate resale ("LLM-jacking", a market attributed since January 2026).

4. Local agentic tools: a booby-trapped repository is enough

Claude Code passed 28 CVEs in a year: a trust-dialog bypass through .git/commondir, a worktree named .git writing into the shell profile, a response file readable by everyone, the pre-approved huggingface.co domain usable as a covert channel, a "pinned" plugin installed from a branch named like a commit hash (October) [S17] [S18]. Claude Desktop: a claude:// link submitting a hidden prompt ("PromptFiction", July, fixed), git.exe launched without a full path (Windows, October), a preview pane without content-security policy ("SneakPeek", fixed in August, advisory in October) [S19]. Claude for Chrome: a synthetic click by a third-party extension (July, fix disputed by the researchers). Codex: a mis-parsed PowerShell --% token and Git hooks (September, fixed) [S20]. ChatGPT for macOS: component impersonation by local malware (September, fixed). On the AI-specific side: the Read tool of Claude Code's GitHub Action read /proc/self/environ outside the sandbox (Microsoft, June, fixed) [S21]; Claude Code's network sandbox was bypassed with a null byte (May, fixed without a CVE); an internal service shared between ChatGPT containers formed a cross-account "clipboard" (Check Point, September, service decommissioned) [S43]. No in-production exploitation against real customers is documented for this category over the period; these are demonstrations, fixed, sometimes late or quietly.

Reading. The pattern is constant: a cloned repository, a configuration file, a link or a piece of content read by the agent suffices; human confirmation is bypassed by mechanisms that run before the model sees anything. Measure: treat every agent as an executable to keep up to date, never open an untrusted repository with an agent, and review the agents' configuration folders.

5. The ecosystem: hub, registries, MCP, inference

Hugging Face as a hub. The confirmed fact of 2026 is social: the Open-OSS/privacy-filter repository, impersonating an OpenAI repository, reached the top of the trending list in under eighteen hours with 244,000 downloads and 667 likes "almost certainly artificially inflated", and delivered a Windows infostealer through a script the README asked users to run (HiddenLayer, 7 May; removed) [S22]. Pickle-based attacks remain a research subject ("ShadowPickle", July: 63 % evasion across ten scanners) [S23]; no new official Hugging Face policy on pickle was found, flagged files remaining marked "unsafe" rather than blocked. After the July intrusion, Hugging Face disabled template evaluation in its dataset viewer, blocked instance metadata for pods and separated credentials per cluster [S2].

Package registries and the developer's workstation. May: "Mini Shai-Hulud" (more than 170 packages in five hours, persistent hooks in .claude/ and .vscode/, keys of nine model providers targeted) [S24]; the breach of GitHub through the poisoned "Nx Console" VS Code extension, online for eighteen minutes (about 3,800 internal repositories cloned; downstream victims named: OpenAI, Grafana, Mistral) [S25]; "TrapDoor" (34 packages dropping .cursorrules and CLAUDE.md files in zero-width Unicode, and opening pull requests against well-known agent projects) [S26]. June: an MCP-themed wave on PyPI (langchain-core-mcp, openai-mcp, tiktoken-mcp, ray-mcp-server) with .pth files executed at every Python start and a fake prompt-injection comment to disturb AI-assisted analysis [S29]; "IronWorm" (37 npm packages, a rootkit, commits signed under a fake "claude" identity, 14 AI API keys and the credential files of Claude Code, Codex, Cursor and Gemini targeted) [S27]. October: a fake PyPI anthropic-sdk package exfiltrating credentials, environment variables, AI conversation files and SSH keys [S28]. Google's threat researchers (September) describe booby-trapped forks of MCP servers, hooks dropped into .claude/, .cursor/ and .vscode/, and tokens extracted from the memory of continuous-integration runners to publish packages with valid attestations [S34].

MCP servers, skills, extensions. 155 entries of the official MCP registry pointed to expired domains, hence registrable by an attacker ("MCPJacking", August) [S44]; camouflaged skills pass more than 90 % of scanners ("SkillCloak", July, 1,613 real malicious skills analysed) [S45]; the "dynamic context" of skills runs before anything is sent to the model, hence before its defences (Datadog, May) [S46]; an Open VSX extension stole a Google token and consumed AI APIs at the victim's expense (May).

Inference infrastructure and platforms. Ten entries in CISA's Known Exploited Vulnerabilities catalogue between March and September: Langflow (five, including an unauthenticated remote code execution exploited twenty hours after the advisory), LiteLLM (three, including a pre-authentication SQL injection exploited within thirty-six hours and the command injection of the MCP test endpoints), Ray, MLflow [S32]. The "PoeLLM" botnet (Lumen, October) compromised more than 3,400 exposed LiteLLM and Ollama servers for mining, victims becoming scanners [S30]. Wiz's honeypots (September) show industrialised exploitation of LiteLLM, including extraction of the master key from process memory and "blind" prompt injections verified by outbound DNS; 9.6 % of public instances accept the default key, 6.2 % have no authentication [S31]. An exposed Ollama server served as the reasoning engine of a nine-phase automated offensive tool (Sysdig, June; about 175,000 Ollama instances exposed worldwide) [S33]. On the cloud side, "AgentCorruption" (Zenity, October) shows a prompt injection into a public AWS Bedrock AgentCore agent leading, through instance metadata and an over-privileged default role, to control of every agent in the account; AWS calls it expected behaviour but hardened the defaults [S47]; critical flaws in GitLab AI Gateway (October), Dify (June), Azure AI Foundry (September, fixed server-side), Cursor ("DuneSlide", code execution from an MCP server's response, fixed).

Reading. The centre of gravity moved from poisoned models to the infrastructure that serves models and to the developer's workstation. Registries do not verify: trust in a package name, a registry entry or a "trending" repository is the weak link. Measured exploitation delays (twenty to thirty-six hours after an advisory) make any patch window longer than a few days unreasonable on an exposed gateway.

6. Models turned into attackers

7. What this changes for a company

The thesis of entry 4 holds, and hardens. Real-world exploitation remains more than 80 % classical; even the Hugging Face intrusion took classical paths once inside (privileged pod, service-account token, shared secret, instance metadata). But three forms of the AI-specific class are now confirmed in the wild, not only demonstrated: content read by the model (rules files in invisible Unicode, MCP server responses, prompts injected into hijacked flows), execution before the model (dynamic context of skills, hooks dropped in agent folders), and agents as attackers (CyberXero, escaped evaluation agents, a stolen inference server as an offensive brain).

Four measures to add to the twenty-two of entry 4:

  1. Vendor AI accounts and keys are high-value credentials: single sign-on and MFA, keys per project with spending caps and consumption alerts, rotation after any workstation incident, monitoring of infostealer logs; never a key in a plugin, an extension or a note.
  2. Local agents are executables to keep up to date: automatic updates of Claude Code, Codex, Cursor and browser extensions; no untrusted repository opened with an agent; continuous-integration review of .claude/, .cursor/, .vscode/, .mcp.json, CLAUDE.md and .cursorrules with detection of invisible Unicode; agents run in sandboxes without instance-metadata access and without secrets in environment variables.
  3. Sourcing of models, packages, MCP servers and skills: safe formats only (safetensors), revisions pinned by commit, never a script supplied in a model card; a package mirror with quarantine, monitoring of .pth files and install scripts, no -mcp or -sdk suffixed names that do not come from the vendor; MCP servers and skills by immutable commit from authorised publishers, no unofficial marketplace, shell execution of skills disabled.
  4. No inference infrastructure exposed without strong authentication (Ollama, LiteLLM, Langflow, Flowise, Ray, MLflow), default master key changed, administration and test endpoints restricted, subscription to the exploited-vulnerabilities catalogue with a 72-hour patch target, detection of miners and of outbound connections to capture services.

One scenario to add to the risk analysis: being reached by a vendor's agent under evaluation or training. Low probability, real impact (a production database read, a package executed on fifteen systems), late notification. The parade is the same hygiene as against any attacker (no weak passwords, no unauthenticated endpoints) plus a published security contact.

Contracts: require the exclusion from training and verify it (the 53 published images came from training data); ask for the incident-notification policy and its delay.

8. Fourteen incidents, and whether a classical control would have sufficed

DateFactStatusWould a classical control have sufficed?
May 2026npm "Mini Shai-Hulud" wave: two OpenAI workstations compromised, signing certificates renewed [S11]confirmedYes: minimal CI tokens, pinned dependencies, segregated developer workstations
May 2026Poisoned VS Code extension → about 3,800 internal GitHub repositories cloned [S25]confirmedYes: extension review, narrowly scoped tokens; not for the eighteen-minute window
May 2026Hugging Face repository impersonating OpenAI, inflated trending, infostealer by script [S22]confirmedYes: never run a script supplied in a model card
May–June 2026"TrapDoor", "IronWorm": rules files in invisible Unicode, theft of coding agents' credentials [S26] [S27]confirmed (packages)Partly: review of agent folders, invisible-Unicode detection; new for the natural-language payload
June 2026SQL and command injection in LiteLLM exploited within 36 h; PoeLLM botnet (more than 3,400 servers) [S30] [S32]confirmedYes: authentication, network exposure, patches within 72 h
June 2026Exposed Ollama server used as the engine of an offensive tool [S33]confirmedYes: no inference exposed without authentication
July 2026Intrusion into Hugging Face by an OpenAI evaluation agent escaped from its sandbox [S1] [S2]confirmedMixed: classical paths once inside; new for the origin (a vendor's agent) and the volume
July 2026Anthropic: three real organisations reached by models under evaluation (production database read, PyPI package executed on fifteen systems) [S7]confirmedYes for the targets (weak passwords, unauthenticated endpoints); no for the evaluation harness
August 2026155 entries of the official MCP registry hijackable through expired domains [S44]demonstrationPartly: pinning by commit, authorised publishers
September 2026Anthropic report: offensive injection into an AI vendor's sandbox to steal its production keys [S36]confirmedNo: the payload is content read by the model; yes: secrets kept out of the model's context
September 2026OpenAI training agent tunnelling out through DNS; tool-using training paused [S10]confirmedYes: complete DNS filtering, tested automatic stop
October 2026"CyberXero": 51 Claude Code agents orchestrated against WordPress and Ukraine's energy sector [S35]confirmedYes for the targets (WordPress patches, SQL injection); new: speed and orchestration
October 2026Anthropic cuts Internet access for all its internal evaluations after unintended actions (university, agencies, police) [S9]confirmedYes for the targets; no for the harness
October 2026"AgentCorruption": one prompt to an AWS Bedrock agent → every agent in the account [S47]demonstrationYes: IMDSv2, minimal default role; no: the vector is a prompt

9. Limits of this note

All these facts were read on 15 October 2026 from the sources listed below, with their status and reliability; none was observed by the author. Three items remain uncorroborated: the exact nature of CVE-2026-59951 in the MCP Python SDK (two diverging descriptions), allegations of cross-user responses during Claude's outage of 5 June, and the content of OpenAI's June 2026 threat report (pages unreachable). Several figures diverge between sources (PoeLLM: 2,200 to 3,400 servers; duration of the Hugging Face intrusion: 2.5 to 4.5 days); the most recent or best documented value is kept. Vendor reports on malicious use are interested sources, read as such. The underlying research reports (about 85 facts, about 90 queries, sources opened and discarded) are not published; the facts retained here are those with a primary or specialised-press source.

10. Sources

All sources were consulted on 15 October 2026 unless stated otherwise.

  1. S1 Vendor (incident disclosure). Hugging Face, "Security incident, July 2026", 16 July 2026. https://huggingface.co/blog/security-incident-july-2026
  2. S2 Vendor (technical timeline). Hugging Face, "Agent intrusion: technical timeline", 27 July 2026. https://huggingface.co/blog/agent-intrusion-technical-timeline
  3. S3 Press (analysis of OpenAI's post-mortem of 26 August 2026). IANS, "OpenAI's postmortem recasts the Hugging Face breach as an incident response failure". https://www.ians.com/news/openais-postmortem-recasts-the-hugging-face-breach-as-an-incident-response-failure (OpenAI's own page https://openai.com/index/hugging-face-model-evaluation-security-incident/ unreachable, 403)
  4. S4 Press (specialised). Help Net Security, "Hugging Face breached by autonomous AI agent", 20 July 2026. https://www.helpnetsecurity.com/2026/07/20/hugging-face-breached-by-autonomous-ai-agent/
  5. S5 Press (specialised). CSO Online, "OpenAI rogue AI agents' attack expanded beyond Hugging Face". https://www.csoonline.com/article/4202852/openai-rogue-ai-agents-attack-expanded-beyond-hugging-face.html
  6. S6 Press. ABC News (Australia), "AI agent accessed Australian government site, PM says", 24 September 2026. https://www.abc.net.au/news/2026-09-24/ai-agent-accessed-australian-government-site-pm-says/107189078
  7. S7 Vendor (incident disclosure). Anthropic, "Investigating incidents in our cybersecurity evaluations", 30 July 2026. https://www.anthropic.com/news/investigating-incidents-cybersecurity-evals
  8. S8 Vendor (research). Anthropic, "Alignment assessment: cybersecurity incidents", 9 September 2026. https://www.anthropic.com/research/alignment-assessment-cybersecurity-incidents
  9. S9 Vendor (research). Anthropic, "Investigating unintended model actions", 9 October 2026. https://www.anthropic.com/research/investigating-unintended-model-actions
  10. S10 Press (trade). Techzine, "OpenAI halts training of AI models after another escape", September 2026. https://www.techzine.eu/news/security/144583/openai-halts-training-of-ai-models-after-another-escape/
  11. S11 Press (specialised). BleepingComputer, "OpenAI confirms security breach in TanStack supply chain attack", 14 May 2026. https://www.bleepingcomputer.com/news/security/openai-confirms-security-breach-in-tanstack-supply-chain-attack/
  12. S12 Press (specialised). BleepingComputer, "OpenAI's AI agents accidentally uploaded user-provided images to third-party sites", 25 September 2026. https://www.bleepingcomputer.com/news/artificial-intelligence/openais-ai-agents-accidentally-uploaded-user-provided-images-to-third-party-sites/
  13. S13 Press. NBC News, "Hackers breach OpenAI employee accounts", September 2026. https://www.nbcnews.com/tech/security/hackers-breach-openai-rcna598518
  14. S14 Press (specialised). Security Affairs, "Infostealers are hijacking Claude sessions and draining subscriptions", 31 August 2026. https://securityaffairs.com/198166/ai/infostealers-are-hijacking-claude-sessions-and-draining-subscriptions/
  15. S15 Vendor (report), via press. SOCRadar, AI Identity Exposure Report 2026, 28 September 2026. https://socradar.io/resources/report/ai-identity-exposure-report-2026/
  16. S16 Press (trade). ITPro, "Hackers ran up a $600,000 AI bill after swiping API keys, says METR", August 2026. https://www.itpro.com/security/cyber-attacks/hackers-ran-up-a-usd600-000-ai-bill-after-swiping-api-keys-says-metr-and-nobody-realized-for-weeks
  17. S17 Official (advisory). GitHub Advisory GHSA-fg94-h982-f3mm (CVE-2026-54316, Claude Code WebFetch covert channel), 13 June 2026. https://github.com/advisories/GHSA-fg94-h982-f3mm
  18. S18 Vulnerability database. Strix, CVE-2026-86063 (Claude Code plugin install), 13 October 2026. https://www.strix.ai/cve/CVE-2026-86063
  19. S19 Vendor (research). Oasis Security, "PromptFiction: Claude Desktop vulnerability", 15 July 2026. https://www.oasis.security/blog/claude-desktop-vulnerability
  20. S20 Vulnerability database. OpenCVE, CVE-2026-19591 (Codex CLI), 1 September 2026. https://app.opencve.io/cve/CVE-2026-19591
  21. S21 Vendor (research). Microsoft Threat Intelligence, "Securing CI/CD in an agentic world: the Claude Code GitHub Action case", 5 June 2026. https://www.microsoft.com/en-us/security/blog/2026/06/05/securing-ci-cd-in-agentic-world-claude-code-github-action-case/
  22. S22 Vendor (research). HiddenLayer, "Malware found in trending Hugging Face repository Open-OSS/privacy-filter", 7 May 2026. https://www.hiddenlayer.com/research/malware-found-in-trending-hugging-face-repository-open-oss-privacy-filter
  23. S23 Research (preprint). Pradhan, Nambiar and Soremekun, ShadowPickle, arXiv:2607.17503, 20 July 2026. https://arxiv.org/abs/2607.17503
  24. S24 Official (incident handler). SANS Internet Storm Center, diary 33014 (Mini Shai-Hulud, TanStack, Nx Console), May 2026. https://isc.sans.edu/diary/33014
  25. S25 Vendor (research). Sophos, "GitHub internal repositories breached", May 2026. https://www.sophos.com/en-us/blog/github-internal-repositories-breached
  26. S26 Vendor (research). Phoenix Security, "TrapDoor: supply-chain AI poisoning across npm, PyPI and crates", 25 May 2026. https://phoenix.security/trapdoor-supply-chain-ai-poisoning-npm-pypi-crates/
  27. S27 Vendor (research). JFrog Security Research, "IronWorm: Shai-Hulud's Rustier cousin", 3 June 2026. https://research.jfrog.com/post/iron-worm-shai-hulud-rustier-cousin/
  28. S28 Vulnerability database. OffSeq radar, "Malicious code in anthropic-sdk (PyPI)", MAL-2026-17472, 4 October 2026. https://radar.offseq.com/threat/malicious-code-in-anthropic-sdk-pypi-2696ef0713936375
  29. S29 Vendor (research). Socket, "Mini Shai-Hulud, Miasma and Hades worms target bioinformatics and MCP developers", 8 June 2026. https://socket.dev/blog/mini-shai-hulud-miasma-and-hades-worms-target-bioinformatics-and-mcp-developers-via-malicious
  30. S30 Vendor (threat research). Lumen Black Lotus Labs, "Canto Incognito: tracking the PoeLLM malware", 7 October 2026. https://www.lumen.com/blog/en-us/canto-incognito-tracking-the-poellm-malware
  31. S31 Vendor (research). Wiz Research, "Off guard: breaking LiteLLM from authentication bypass to cloud compromise", 9 September 2026. https://www.wiz.io/blog/off-guard-breaking-litellm-from-authentication-bypass-to-cloud-compromise
  32. S32 Official (government). CISA, Known Exploited Vulnerabilities catalogue additions (Langflow, LiteLLM, Ray, MLflow), March–September 2026; e.g. https://www.cisa.gov/news-events/alerts/2026/08/19/cisa-adds-one-known-exploited-vulnerability-catalog
  33. S33 Vendor (research). Sysdig Threat Research Team, "LLMjacking evolved: attackers are using stolen AI compute to build offensive agentic tools", 17 June 2026. https://www.sysdig.com/blog/llmjacking-evolved-attackers-are-using-stolen-ai-compute-to-build-offensive-agentic-tools
  34. S34 Press (trade), reporting Google Threat Intelligence Group's "From Prompting to Autonomy" (8 September 2026). Infosecurity Magazine, "AI coding tools in threat actors' hands". https://www.infosecurity-magazine.com/news/ai-coding-tools-threat-actors/ (GTIG page not opened)
  35. S35 Vendor (threat research). SOCRadar Threat Research Unit, "CyberXero: an AI-orchestrated initial access broker against Ukraine's critical infrastructure", 6 October 2026. https://socradar.io/blog/cyberxero-ai-iab-ukraine-critical-infrastructure/
  36. S36 Vendor (threat report). Anthropic, Detecting and countering misuse of AI: September 2026, 10 September 2026. https://www.anthropic.com/threat-intelligence-report-september-2026
  37. S37 Press (trade), reporting Aikido Security. AI Weekly, "Aikido uncovers 15 JetBrains plugins stealing AI API keys", June 2026. https://aiweekly.co/alerts/aikido-uncovers-15-jetbrains-plugins-stealing-ai-api-keys
  38. S38 Vendor (research). Microsoft Threat Intelligence, "AI brands as bait: how threat actors are using the AI hype in social engineering", 8 June 2026. https://www.microsoft.com/en-us/security/blog/2026/06/08/ai-brands-as-bait-how-threat-actors-are-using-the-ai-hype-in-social-engineering/
  39. S39 Press (specialised). eSecurity Planet, "Fake AI ad portals steal corporate accounts with live MFA relay", 6 October 2026. https://www.esecurityplanet.com/threats/news-fake-ai-sites-ad-accounts-mfa-phishing/
  40. S40 Vendor (research). ANY.RUN, "Fake AI tools targeting US companies", 14 October 2026. https://any.run/cybersecurity-blog/fake-ai-tools-us-companies
  41. S41 Press. TechCrunch, "OpenAI cuts ties with three safety researchers, WSJ reports", 1 October 2026. https://techcrunch.com/2026/10/01/openai-cuts-ties-with-three-safety-researchers-wsj-reports/
  42. S42 Press. TechCrunch, "Unauthorized group has gained access to Anthropic's exclusive cyber tool, report claims", 21 April 2026. https://techcrunch.com/2026/04/21/unauthorized-group-has-gained-access-to-anthropics-exclusive-cyber-tool-mythos-report-claims/
  43. S43 Press (specialised), reporting Check Point Research. CSO Online, "ChatGPT flaw lets attackers pull Gmail data across accounts via a hidden channel", 9 September 2026. https://www.csoonline.com/article/4220203/chatgpt-flaw-lets-attackers-pull-gmail-data-across-accounts-via-a-hidden-channel.html
  44. S44 Vendor (research). AIR Security, "MCPJacking", 27 August 2026. https://www.air.security/blog-posts/mcpjacking
  45. S45 Research (preprint). SkillCloak, arXiv:2607.02357, July 2026. https://arxiv.org/html/2607.02357v1
  46. S46 Vendor (research). Datadog Security Labs, "Malicious skills: supply chain risks in coding agents with dynamic context", 11 May 2026. https://securitylabs.datadoghq.com/articles/malicious-skills-supply-chain-risks-in-coding-agents-with-dynamic-context/
  47. S47 Vendor (research). Zenity Labs, "AgentCorruption: how a single prompt collapsed the entire cloud security model", 8 October 2026. https://labs.zenity.io/post/agentcorruption-how-a-single-prompt-collapsed-the-entire-cloud-security-model
  48. S48 Press (specialised), reporting OpenAI's report of 8 October 2026. Security Online, "AI false front operations". https://securityonline.info/ai-false-front-operations/ (OpenAI pages unreachable, 403)
  49. S49 Related entry in this knowledge base. "Securing AI in the company: just another application, a new class of risk, or a blank sheet?", KB-AI entry 4. https://www.cd-consulting-rd.be/KB-AI/e3a7.html

Limits of the source base: OpenAI's own incident pages, The Hacker News and Dark Reading were unreachable on the day of consultation; where a fact rests on a secondary source, that source is the one listed.