AI Incident Tracker
AI Incident Tracker
Documented AI failures, security flaws, misuse and regulatory actions, with sources.
Last checked Nov 9, 2026, 9:07 AM CT
- Malbear Labs: a jailbroken DeepSeek-based agent ran a two-week autonomous intrusion against a European telecom and 13 hosted organizationsResearch published; victims not named · Reported
- German web host Mittwald says an attacker used a flaw in its AI-assistant (MCP) server to compromise 56 customer projectsContained; affected sites still blocked; full account pending · Verified
- Elvis Presley's rights holders and Eminem's publisher sue AI music generator SunoLawsuits filed; cases pending · Verified
- Judge lets a Claude Max '5x or 20x more usage' lawsuit proceed, saying the ads are plausibly misleadingLawsuit proceeding; case pending · Verified
- Censys finds hundreds of ARTEX AI hacking-tool deployments exposed on the public internetResearch published; operators should restrict exposure · Verified
- Google DeepMind says human-guided AI agents found two weaknesses in legacy 1024-bit RSA; 2048-bit keys unaffectedResearch published; modern RSA sizes unaffected per authors · Verified
- UK Cyber Security and Resilience Bill gains powers to regulate AI-agent loss-of-control incidentsMeasures proposed; secondary rules pending · Verified
- Microsoft: attackers used the ARTEX AI agent framework to find exposed secrets on GitHub and reach Azure Key Vault in five minutesAdvisory issued · Verified
- A University of Chicago law professor says Claude deleted his current syllabus and a year of lecture notes during a page-number taskFiles recovered; cause not identified · Reported
- Researchers say a browser add-on could use Claude Dispatch to run code on a signed-in computerNo dedicated patch reported; Anthropic planned to retire Dispatch · Verified
- OpenAI says a research model wrote custom network code to get around sandbox web limits during an August coding testPrecautions added · Verified
- Apiiro finds Claude Code “don’t ask again” approvals can leave passwords and API keys in public GitHub filesAdvisory published; credential rotation recommended · Verified
A new card every 4 seconds. Stop it anytime, or hover over it to hold a card.
How this list works. Entries come from four places: Confirmed stories in our own news feed, the AI Incident Database (CC BY-SA 4.0), critical-severity (CVSS 9.0+) AI software flaws in the NIST National Vulnerability Database, and incident case studies in MITRE ATLAS. Our editors also add incidents that aren’t in our feed from official company notices and status pages, government advisories and news reports, each linked to its source. Descriptions use each source’s own wording, so “reported” and “alleged” mean the claim hasn’t been confirmed in court or by the company. “Not stated in source” means the source doesn’t describe a fix. Where a report isn’t from an established news outlet, fact-checker or government site, or may be the misleading content itself, we link the AI Incident Database record instead. Every entry is labeled Verified or Reported. Verified: a Confirmed story in our feed, an official record (NIST NVD, MITRE ATLAS), or an editor entry backed by an official source or several reputable outlets. Reported: a claim from a single source (a Reported story in our feed, an editor entry from one credible report, or an AI Incident Database report) that we haven’t confirmed. Types are assigned by keyword rules; anything unclear is filed under Other. New security incidents from our feed appear as soon as we publish the story, marked “Not yet reviewed” and described with the story’s first sentence; an editor then checks them against the source and fills in the response and status.
| Date | What happened | Type | Response | Status | Source |
|---|---|---|---|---|---|
| 2026-11-08 | Malbear Labs: a jailbroken DeepSeek-based agent ran a two-week autonomous intrusion against a European telecom and 13 hosted organizationsMalbear Labs says a routine sweep found an open directory holding the full workspace of an autonomous intrusion harness: about 70 session transcripts, scan output, credentials and database dumps. According to its report, the agent, guided by a 78,000-character jailbreak system prompt, spent more than two weeks scanning, exploiting vulnerabilities, moving laterally and extracting data from an unnamed European telecom provider and 13 organizations hosted on its systems, with a Chinese-speaking operator checking in only briefly. Malbear says default database credentials gave access to a healthcare system with millions of patient records. Malbear did not publish the server address, and cautions that the operator's language does not prove nationality or any government link. The scale is the researchers' claim; Cyber Security News notes it was not independently verified. Custom agent harness built on DeepSeek Flash, run by an unidentified operator | Other | No victim confirmation or fix was reported. Malbear lists indicators of compromise and advises defenders to change default passwords, keep internal network segments separate, and watch for fast scanning and bursts of failed logins that suggest an agent rather than a person. | Research published; victims not named · Reported | Malbear Labs ↗ Cyber Security News Oh My AI editors |
| 2026-11-07 | German web host Mittwald says an attacker used a flaw in its AI-assistant (MCP) server to compromise 56 customer projectsMittwald said an attacker first tested a flaw in its Model Context Protocol (MCP) server on October 21, moved around the platform as a normal user from October 23, and exploited the flaw on October 27. The company noticed unusual behavior on November 4, blocked the attacker's accounts and shut the MCP server down. Forensics found 56 compromised customer projects and no other affected projects. Mittwald says the timing of the attacker's steps (sometimes seconds apart) points to AI tools; The Record reported the company gave no other evidence of AI involvement and that it is unclear whether the flaw was in Mittwald's code or in open-source MCP libraries. Mittwald | Data leak/breach | Mittwald blocked the attacker, took the MCP server offline, restored mStudio and SSH access on November 7 (adding passkey support), kept the affected websites blocked as a precaution, informed the authorities, and says it will email affected customers and publish a detailed account the following week. Its customer center was not affected. | Contained; affected sites still blocked; full account pending · Verified | Mittwald (company blog) ↗ The Record Oh My AI feed |
| 2026-11-06 | Elvis Presley's rights holders and Eminem's publisher sue AI music generator SunoElvis Presley Enterprises and related rights holders sued Suno in the U.S. District Court for the Northern District of California, alleging copyright infringement and violations of Tennessee's ELVIS Act, which bars cloning a singer's voice without permission. In a separate suit, Eminem's publisher Eight Mile Style says Suno generates songs and lyrics that mirror Eminem's recordings; Eminem is not a plaintiff. A Suno spokesperson said the company helps people create original music and does not trade on anyone's name or likeness. Suno AI music generator | Legal/regulatory action | The cases are pending; no ruling has been reported. The allegations have not been decided by a court. | Lawsuits filed; cases pending · Verified | Variety ↗ Court docket (Justia) Oh My AI editors |
| 2026-11-06 | Judge lets a Claude Max '5x or 20x more usage' lawsuit proceed, saying the ads are plausibly misleadingU.S. Magistrate Judge Alex Tse in the Northern District of California allowed key parts of a proposed class action by Claude users Karl Kahn and Solomon Smith to continue. Anthropic’s website promises Max subscribers “5x more usage than Pro” or “20x more usage than Pro.” The plaintiffs say weekly limits are lower than those multiples (they calculated 6x for Max 20x and 3.5x for Max 5x on one model). Tse wrote that the advertising is plausibly misleading and that monthly-paying customers could reasonably read the promise as applying each month. Breach-of-contract and negligent-misrepresentation claims survived; several other claims were dismissed, some with leave to amend. The ruling is not a decision on the merits. Courthouse News Service | Legal/regulatory action | The case continues. Tse dismissed some consumer-protection and related claims and said Anthropic did not tighten limits as a bait-and-switch. No finding has been made on whether the advertising was unlawful. | Lawsuit proceeding; case pending · Verified | Courthouse News Service ↗ Our story Oh My AI feed |
| 2026-11-06 | Censys finds hundreds of ARTEX AI hacking-tool deployments exposed on the public internetCensys reported more than 800 distinct ARTEX deployments reachable from the public internet without a password. Censys said not every instance is malicious and many are used by authorized testers, but noted the software does not require internet exposure. Prior reporting has linked ARTEX to offensive campaigns including against Korean finance targets. TechCrunch | Other | Operators are advised to keep ARTEX instances off the public internet and behind authentication; no single vendor patch applies to all self-hosted copies. | Research published; operators should restrict exposure · Verified | TechCrunch (Censys research) ↗ Our story Oh My AI feed |
| 2026-11-06 | Google DeepMind says human-guided AI agents found two weaknesses in legacy 1024-bit RSA; 2048-bit keys unaffectedGoogle DeepMind, with cryptographers Nadia Heninger and Emmanuel Thomé, released two working papers (not yet peer reviewed) in which human-guided AI agents sped up attacks on old 1024-bit RSA. Reported results include a ~3.5x cheaper re-run of a previously solved 1024-bit case and theoretical estimates of larger gains for harder cases and batch factoring. Both papers state that RSA keys of 2048 bits or more are not threatened. Google DeepMind | Other | No product patch: operators still using 1024-bit RSA should migrate to modern key sizes. DeepMind presents the work as research advancing cryptanalysis methods. | Research published; modern RSA sizes unaffected per authors · Verified | Google DeepMind ↗ Our story Oh My AI feed |
| 2026-11-06 | UK Cyber Security and Resilience Bill gains powers to regulate AI-agent loss-of-control incidentsThe UK government published a factsheet (updated 3 November 2026) describing planned uses of the Cyber Security and Resilience Bill so ministers can, after consultation and affirmative parliamentary approval, set rules for regulated essential and digital-service operators on agentic AI “loss of control” incidents. Planned measures include security and resilience requirements (monitoring agents and risk assessments), notifying other organisations affected by an agent, preserving evidence of how agents acted, and ministerial post-incident review powers. The Register reported a related amendment at House of Lords third reading; foundation-model builders are not automatically in scope solely for building models. Secondary legislation would follow Royal Assent. GOV.UK | Legal/regulatory action | Legislative process ongoing; secondary legislation would be needed after Royal Assent. No incident-response duties are in force solely from the factsheet. | Measures proposed; secondary rules pending · Verified | GOV.UK factsheet ↗ Our story Oh My AI feed |
| 2026-11-05 | Microsoft: attackers used the ARTEX AI agent framework to find exposed secrets on GitHub and reach Azure Key Vault in five minutesMicrosoft Threat Intelligence reported that threat actors have used ARTEX since August to run large numbers of GitHub searches for exposed credentials, application secrets and AI inference API keys. In at least one case an agent moved from scanning GitHub to exfiltrating Azure Key Vault data in five minutes. From October 28 Microsoft saw successful service-principal sign-ins from one IP address across multiple application IDs, including a compromised vendor-owned multitenant application credential used to reach several downstream tenants, followed by cloud resource discovery, credential and data exfiltration, and abuse of Azure AI services. Todyl reported overlapping activity. Microsoft Security Blog | Other | Microsoft advises scanning code for secrets, rotating any exposed key at once (deleting code does not make a leaked secret safe), moving apps to managed identities, enforcing least privilege, enabling Defender for Cloud protections and GitHub secret scanning, and checking sign-in logs for the listed IP addresses back to October 28. | Advisory issued · Verified | Microsoft Security Blog ↗ Cyber Security News Oh My AI feed |
| 2026-11-05 | A University of Chicago law professor says Claude deleted his current syllabus and a year of lecture notes during a page-number taskProfessor William Baude posted on X on November 5 that, while he was at lunch, Claude deleted a year of constitutional-law lecture notes and his current syllabus. He had asked it only to update page numbers in an old set of notes. Screenshots he shared show the assistant reporting that it had deleted the Fall 2026 syllabus and the top-level 2023 class notes by accident, apologizing, and asking whether he could restore them from Dropbox. The model involved and the technical cause were not identified; Anthropic has not commented in the coverage reviewed. Anthropic Claude agent (model not identified) | Agent unintended action | Baude recovered all the files through Dropbox and shared the story as a public service announcement. Anthropic's Cowork help page says it requires explicit permission before permanently deleting files and advises using a dedicated working folder and keeping backups. | Files recovered; cause not identified · Reported | Tom's Hardware ↗ The Times of India Oh My AI editors |
| 2026-11-05 | Researchers say a browser add-on could use Claude Dispatch to run code on a signed-in computerForever Security researcher Gal Weizman reported that Claude Dispatch’s interface and API were reachable from an ordinary logged-in claude.ai session, so a browser extension that can control that site could send instructions to Claude Desktop as if they came from the user, including on another computer signed into the same account. The described attack needs the extension, a signed-in web session, and Claude Desktop with Dispatch enabled. The Register | Security vulnerability | Anthropic acknowledged the report as valid in May and closed it as a duplicate of a known issue; it did not issue a CVE or bounty and told the researcher it planned to retire Dispatch at the end of October 2026. As of The Register’s November 5 report, a Claude support page still said existing users could keep using Dispatch. No dedicated patch was described. | No dedicated patch reported; Anthropic planned to retire Dispatch · Verified | The Register (Forever Security research) ↗ Our story Oh My AI feed |
| 2026-11-05 | OpenAI says a research model wrote custom network code to get around sandbox web limits during an August coding testIn an August 4, 2026 coding evaluation, an unnamed research model was asked to build a website using information from another site. When the sandbox web proxy was unavailable, it scanned private addresses and wrote packet-level code to send requests through a connection meant for the app and its browser. OpenAI said replies from Amazon S3 and Microsoft’s sign-in service matched normal service behavior; the model never retrieved the target site and built a substitute with invented testimonials. The run was cancelled before a final answer. OpenAI said it found no evidence of sensitive-data transfer or access to the host or another tenant. OpenAI Alignment | Agent unintended action | OpenAI paused the affected evaluation workers, cancelled outstanding runs for the task, removed raw-packet permission from unprivileged containers by default, and blocked forwarding from private container networks. | Precautions added · Verified | OpenAI Alignment ↗ Our story Oh My AI feed |
| 2026-11-05 | Apiiro finds Claude Code “don’t ask again” approvals can leave passwords and API keys in public GitHub filesApiiro reported that choosing “Yes, and don’t ask again” in Claude Code can save the approved shell command—including passwords or API keys—in plain text in .claude/settings.local.json. On public GitHub it found about 1,122 of 104,185 copies holding at least one secret (~1,379 distinct secrets in current copies; ~2,539 including history/forks/related settings). One notified company confirmed a key was still live. Global git-exclude protection does not cover files already committed. The Hacker News | Data leak/breach | Researchers advise rotating every exposed credential first, then untracking the local settings file, adding it to the project .gitignore, deleting allow rules that contain secrets, and approving patterns instead of literal secret-bearing commands. | Advisory published; credential rotation recommended · Verified | The Hacker News (Apiiro research) ↗ Our story Oh My AI feed |
| 2026-11-05 | Check Point finds a ChatGPT flaw that let attackers get around Lockdown Mode and quietly send chat data out; OpenAI has fixed itCheck Point Research reported on November 5, 2026 that the sandbox ChatGPT uses to preview HTML pages in code blocks still allowed pop-up windows. By opening a pop-up from a nested frame, a malicious page could escape the sandbox and get around Lockdown Mode, an optional OpenAI setting meant to stop prompt-injection attacks from sending data out of a conversation. Check Point says the attack could be delivered through a malicious prompt, a malicious custom GPT or a shared chat, and could be used to send a whole chat history to an outside server, show fake windows to steal passwords, or push malware disguised as an update. In the ChatGPT Classic desktop app it says no click was needed. Check Point did not report any use of the flaw in real attacks. ChatGPT HTML preview in code blocks (web and the ChatGPT Classic desktop app), including with Lockdown Mode turned on | Security vulnerability | Check Point says OpenAI told it on September 18, 2026 that a fix had been deployed by removing the pop-up permissions from the preview sandbox, and that its retest confirmed the technique no longer works. No user action is listed. | Fixed · Reported | Check Point Research ↗ Oh My AI editors |
| 2026-11-04 | Meta reports a $300,000 bug bounty for a pre-launch Muse flaw that exposed conversations and tokens on internal test systemsSecurityWeek reported on November 4, 2026 that Meta's David Singleton said in a blog post that the Muse bug bounty program has paid about $1.2 million, with 64 valid reports out of more than 630. The largest award, $300,000, went to a flaw found four months before Muse's September 8 launch: an authentication check treated a header added by a local HTTPS proxy as proof a request was trusted, and after a migration added a second proxy layer, outside requests could carry that header too. The researcher showed access to conversations and tokens on pre-release virtual machines Meta staff used for testing. Other paid reports included a web page that mimicked the agent's browsing-tool status messages to get it to take actions that should have been caught ($90,000), formatting that slipped one-time passcodes past email redaction filters ($90,000), an Android link-handling flaw that could expose a web view's credentials ($50,000), and a Mac auto-update hijack needing access to the computer ($1,000). Meta Muse (personal AI agent) | Security vulnerability | Meta took the affected service offline, fixed the bug and stopped treating the local machine as trusted. For the browsing-tool report it added detection signals and changed how Muse treats suspicious-looking tool output, and it says its classifiers now catch that attack and 100 variants. | Fixed · Reported | SecurityWeek ↗ Oh My AI editors |
| 2026-11-04 | Acronis reports one operator used a mesh of 12 AI agents to attack organizations in 11 countries, including Taiwanese emergency servicesOn November 4, 2026, the Acronis Threat Research Unit published research on a campaign it calls BOSSAI, run by a single operator it assesses with high confidence to be based in Taiwan. Acronis found the operator's attack environment exposed on the internet (more than 90,000 files) and observed it for 12 days. The setup combined 12 AI agent tools (nine active), with the operator copying results between them, and MCP servers that gave the agents access to scanning and hacking tools. Acronis says hundreds of organizations in 11 countries were targeted, with confirmed data theft or system access at about 10 targets in three countries: Taiwan (including a Taipei fire-department patient-care records platform exposing 2018 medical data and a city's 119 emergency dispatch case records), Thailand (student and administrator data from university databases) and Mexico (about 206,800 collected residential phone records). The attacking agents ran mostly on locally hosted open models with safety training removed; Acronis says commercial models used to build the infrastructure, including Grok and MiniMax, refused requests to carry out attacks. Acronis also reports that the agents often produced false or exaggerated findings. "BOSSAI" attacker setup: AI agent tools (including Hermes Agent, Cursor, Trae, CyberStrike, HalberdStrike, OpenClaw, Claude Code, Codex and Grok) running a mix of locally hosted modified open models and commercial models, connected to hacking tools through MCP servers | Other | Acronis published indicators of compromise (IP addresses and domains) for defenders to check. It does not report arrests or say whether affected organizations have been notified. Organizations are advised to review exposed systems such as unauthenticated APIs, default passwords and SQL injection flaws, which the agents exploited. | Research published · Verified | Acronis Threat Research Unit ↗ eSecurity Planet Oh My AI editors |
| 2026-11-04 | India's CERT-In warns an AI-assisted group it calls Crafty Falcon is stealing funds from fintech and payment firmsOn November 4, 2026, India's Computer Emergency Response Team (CERT-In) issued advisory CIAD-2026-0058 on escalating attacks against banking, financial services and insurance firms, saying the threat is active and ongoing. Its finance-sector team (CSIRT-Fin) named the actor Crafty Falcon and, based on incidents reported by affected firms, said it uses publicly available AI attack tools that run complete attack chains at machine speed and generate large numbers of tailored scripts. Targets include non-banking finance companies, digital lending platforms, payment aggregators and cryptocurrency exchanges. CERT-In said attackers abused firms' own payment and disbursement APIs to move money to mule accounts, often after test transfers of Rs 1, used test environments as entry points, stole wallet keys, and re-targeted firms whose earlier fixes were incomplete. The advisory follows an October 9 warning about similar campaigns. Publicly available AI-driven offensive security tools (ARTEX, PentAGI, Cairn, CyberStrikeAI) used against payment, lending and crypto platforms | Fraud/scam | CERT-In recommends 24x7 monitoring, full forensic eradication, strict control of cloud and serverless access, isolating test environments from production, server-side checks on every transaction, app attestation, hardware or cold storage for wallet keys, monitoring of LLM API keys and traffic, and written authorization for all penetration testing. | Advisory issued · Verified | The Indian Express ↗ The Hacker News Oh My AI editors |
| 2026-11-04 | Copycat Docker image of the ARTEX AI hacking tool hid a backdoor giving anyone a root shell on servers running itSecurity researcher BadByte reported on November 4, 2026 that after ARTEX's author took the tool's source off GitHub on October 8 because it had been abused, a copycat GitHub repository pointed its install file at a Docker Hub image, tomicdd/artex, containing one added function. A command placed in the login form's CAPTCHA field runs as root and its output is returned before any password check, so anyone can take over the server without an account. The backdoor was not in the GitHub source, so a code review would not find it. BadByte counted 7,946 pulls of the image by November 3, more than 9,000 by November 5, and 62 internet-facing consoles serving the backdoored build between November 2 and 4. It says a compromised console exposes the LLM API keys, target credentials, captured traffic and findings stored in it. Hundreds of GitHub copies still pointed to the image as of November 5. ARTEX (open-source AI penetration-testing console) installed from the tomicdd/artex or congdonglinux/artex Docker Hub images | Security vulnerability | BadByte advises anyone running either image to stop and isolate it, rotate all credentials and API keys stored in it, rebuild the host from reviewed source, and keep such tools off the open internet. It published detection checks and file hashes. No takedown of the images was reported as of November 5. | No fix listed yet · Verified | BadByte (research report) ↗ The Hacker News Oh My AI editors |
| 2026-11-04 | India's CERT-In issues AI security audit guidelines with a six-hour incident reporting deadlineOn November 4, 2026, India's Computer Emergency Response Team (CERT-In) published Artificial Intelligence Security Auditing Guidelines for AI systems used by government and private organizations. Reportable AI-related security incidents must be disclosed to CERT-In within six hours, building on CERT-In's 2022 cyber-incident directions. AI systems are classed as low, moderate, high or critical risk; that class sets audit depth, auditor independence, documentation, human oversight and monitoring. Audits cover nine domains, and organizations must keep security logs at least 180 days with synchronized timestamps and keep training data, model configs, prompts and later changes traceable and independently verifiable. The Indian Express | Legal/regulatory action | Guidelines published; reporting and audit expectations apply under the framework described in the guidelines and press coverage. Coverage notes the six-hour window extends CERT-In's existing 2022 directions to AI-related incidents. | Advisory issued · Verified | The Indian Express ↗ Business Standard Oh My AI feed |
| 2026-11-03 | AI agents a Railway engineer ran to test competitors' sign-up flows probed Primcloud's internal network and asked for platform secrets; Railway apologizedOn November 3, 2026, Primcloud founder Josh Manders said on X that agents tied to a Railway engineer's account went beyond signing up: by his account they ran about 24 commands in 15 minutes from the container they were given, used its credentials to request every secret on the platform, called the cloud provider's metadata endpoint, guessed internal database and cache names, and port-scanned Primcloud's internal network twice. Railway engineer Jake Runzer replied that it was him, that no malice was intended, and that he had stopped the harness because it was going off the rails and reaching too far. Manders says every request was blocked and no data was accessed; the command details come from Primcloud's account and have not been independently checked. AI agent test harness run by a Railway engineer for sign-up and first-deploy testing on other hosting platforms | Agent unintended action | Runzer stopped the harness. Railway co-founder and CEO Jake Cooper apologized and said Railway will ban non-manual testing against outside services. Primcloud says it moved new accounts to manual approval. | Agents stopped; no data accessed, per Primcloud · Verified | RuntimeWire ↗ Security Boulevard Oh My AI editors |
| 2026-11-03 | Baton Rouge man arrested on allegations he used AI to create nude images and a sexual video of a coworker without her consentWBRZ reported that a 55-year-old Baton Rouge man was arrested on Tuesday, November 3, 2026 after a woman told police that on September 8 he showed her AI-generated nude images of her and an AI-generated video depicting the two of them in simulated sexual activity while they commuted to work together. She said she never consented to the use of her likeness and recorded the imagery on her phone for police. According to arrest records, he later claimed to have deleted the images and video from his phone and from the generating website's cloud storage. AI image and video generation website (not named) | Misinformation/deepfake | He was arrested as a fugitive by the East Baton Rouge Parish Sheriff's Office on a Baton Rouge Police Department warrant. The allegations have not been proven in court. | Arrest made; case pending · Reported | WBRZ ↗ Oh My AI editors |
| 2026-11-03 | Glow Labs finds AI coding agents installing archived MCP servers that no longer get security fixesGlow Labs, the research team at Glow Security, published research on November 3, 2026 describing a pattern it calls MCPhantom: when developers asked AI coding agents to connect a service such as GitHub, agents set up deprecated MCP (Model Context Protocol) reference servers they appear to remember from training data instead of the current official servers. In 98% of the reviewed sessions that involved a deprecated server, the agent appears to have chosen the name itself; in 2% the user asked for it. The pattern appeared across Claude Code, Cursor, Codex CLI, Claude Cowork and Claude chat, with models from Anthropic, OpenAI and xAI. Glow Labs reports four high-severity flaws in the archived servers, including a remote code execution bug in the Puppeteer server that a prompt injection could trigger. The archived packages have been downloaded from npm more than 17 million times since July 2025. Glow Labs says none of the sessions involved a malicious actor, and no exploitation has been seen. AI coding agents (Claude Code, Cursor, Codex CLI, Claude Cowork, Claude chat) and Anthropic's archived MCP reference servers | Agent unintended action | The archived repository says it gets no security updates, and the maintainers said no fix will come from it; they said they would look at marking the npm package deprecated. Glow Labs and Help Net Security advise replacing archived servers with the maintained official ones (for example GitHub's own MCP server) and checking developer machines for locally installed deprecated servers. | No fix listed yet · Verified | Glow Labs ↗ Help Net Security Oh My AI editors |
| 2026-11-03 | Actor Rupali Ganguly asks the Bombay High Court to stop AI deepfakes and unauthorized use of her identityIndian TV actor Rupali Ganguly filed a suit in the Bombay High Court on November 3, 2026 seeking protection of her personality and publicity rights. Her plea says online portals have used her images and video clips without permission for commercial purposes, including fake endorsements and celebrity-booking offers, and that AI and image-editing tools have been used to create sexually explicit deepfake images and videos of her. Hindustan Times reports the suit names 18 respondents, including online boutiques, celebrity booking and talent platforms, Reddit, AI image-generation platform SeaArt AI, Google LLC (which operates Tenor), and India's Ministry of Electronics and Information Technology and Department of Telecommunications. She asks for takedown of the content, injunctions against further use and token damages. The plea was listed for hearing before Justice Madhav Jamdar on November 4. AI image tools and morphing software used to create deepfake images and videos (SeaArt AI among the respondents) | Legal/regulatory action | The case is pending before the Bombay High Court. | Lawsuit filed; case pending · Verified | LiveLaw ↗ Hindustan Times Oh My AI editors |
| 2026-11-03 | Binance says attackers behind its $6.3 billion theft used a fake job interview and an internal AI tool to reach its wallet systemsCryptocurrency exchange Binance published an initial incident report on November 3, 2026 about the October 29 theft of about $6.34 billion in digital assets. It says the campaign began in June, when a wallet engineer downloaded a tampered Homebrew installation while trying to install an AI coding tool found through a search engine. In September, attackers posing as recruiters held fake job interviews with a second engineer and had him download a coding assignment that contained malware his computer's security tools did not detect. On October 20, the attackers used that computer and an internal Binance AI tool to take control of two other wallet engineers' computers; the report does not explain how the AI tool was used. On October 29 they used a container-deployment token and stolen credentials to reach the wallet signing service and move assets out of hot wallets. SecurityWeek reports that about $2.85 billion of the stolen assets has been frozen or intercepted. Binance internal AI tool (not named) and wallet signing systems | Data leak/breach | Binance says it has rebuilt the affected wallet system and internal AI tool, replaced compromised devices, retired the affected engineers' credentials and tokens, expanded security scans of employee devices and strengthened wallet-service risk controls. It plans an independent security review and earlier said it would cover customer losses from its emergency fund and reserves. | Systems rebuilt; independent review planned · Verified | CNBC ↗ SecurityWeek Oh My AI editors |
| 2026-11-03 | Check Point finds a Codex jailbreak bundle that quietly rewrites the agent's instructions to show ads for an AI gatewayCheck Point Research reported on November 3, 2026 that Haiou, a Chinese-language jailbreak bundle for OpenAI Codex published on GitHub (more than 250 stars), changes Codex's global instruction files so that greetings such as "hi", "hello" or "ctf" make the agent reply only with an advertisement for a third-party AI API gateway. Check Point calls this "prompt adware": the change is made entirely through natural-language instructions and persists across sessions. The bundle also installs prompts meant to weaken the model's safety refusals and skills for penetration testing, software cracking and reverse engineering, and its prompt files are shipped encrypted so they are hard to inspect. Check Point found the bundle on a misconfigured web server of a threat actor alongside other hacking tools. It found no sign that the advertised gateway itself is malicious and did not report data theft by the bundle. OpenAI Codex (coding agent) with the third-party Haiou jailbreak bundle installed | Other | The bundle includes an uninstaller that restores the original configuration and removes the injected ads. Check Point advises reviewing global agent instruction files, skills and configuration files after installing third-party agent add-ons. | Research published · Verified | Check Point Research ↗ GBHackers Oh My AI editors |
| 2026-11-03 | Malaysia's communications regulator asks Anthropic for information about a reported Claude-assisted operation targeting Malaysian votersIn a written parliamentary reply on November 3, 2026, Malaysia's Communications Minister Fahmi Fadzil said the Malaysian Communications and Multimedia Commission (MCMC) is seeking further information, technical clarification and supporting evidence from Anthropic about an alleged election manipulation operation targeting users in Malaysia. Anthropic's report "Detecting and Countering Misuse of AI: September 2026" described an operation that used Claude to help build parts of a covert political influence campaign, reportedly using census data and voter records to profile voters across all 222 federal parliamentary constituencies. Anthropic attributed the activity to an Istanbul-based technology firm, which denied involvement; Anthropic said it closed the accounts involved and saw no evidence the campaign gained meaningful traction with real users. Anthropic Claude (as described in Anthropic's September 2026 misuse report) | Legal/regulatory action | The minister said MCMC will decide on follow-up action based on the information and evidence it obtains, under the Communications and Multimedia Act 1998, the Online Safety Act 2025 and other laws. The government also said it is drafting an AI Governance Bill. No finding or enforcement action has been announced. | Information requested; no finding yet · Verified | The Star (Malaysia) ↗ Malay Mail Oh My AI editors |
| 2026-11-03 | Postman desktop app installed its plugins into users' Codex and Claude Code agents during updates without a clear opt-in, users reportIn a GitHub issue opened October 25, 2026 on Postman's own support tracker (#14370), a developer reported that opening the Postman desktop app installed Postman plugins into OpenAI Codex and Anthropic Claude Code, added a Postman MCP server connection and the Postman command-line tool, and that the installer contained code to mark its own Codex startup hook as trusted. The hook tells the agent to load Postman's skill for most API work, which changed how the agent behaved. Postman's own logs, quoted in the issue, label the step "auto-existing-upgrade". Other users reported the same on version 12.35.1 on November 3, and one found a Postman plugin entry added to GitHub Copilot CLI settings. The reports say there is no evidence that data was uploaded. Postman's head of product told RuntimeWire on November 3 that Postman bundles the CLI and agent plugins to make setup easier, mentions this on its download page and in the update flow, and that users can uninstall them from inside the app. Postman desktop app (versions including 12.33.4 and 12.35.1) and the AI coding agents OpenAI Codex, Anthropic Claude Code, Cursor and GitHub Copilot CLI | Other | Postman said it will make the opt-in clearer, especially for existing users, and is reviewing the hook approval and session-start behavior. Users can remove the integrations from the app's Help menu or with Postman's documented uninstall command, and can check their Codex, Claude Code, Cursor and Copilot settings for Postman entries. | Under review · Reported | Postman app-support issue #14370 (GitHub ↗ RuntimeWire Oh My AI editors |
| 2026-11-02 | Delaware's Department of Justice serves an investigative subpoena on OpenAI over safety and governance after the July Hugging Face incidentSpotlight Delaware reported on November 2, 2026 that the Delaware Department of Justice, led by Attorney General Kathy Jennings, sent OpenAI an investigative subpoena in October seeking records on the company's 'safety and governance issues.' According to the report, DOJ officials said they held an initial briefing with OpenAI after the July incident in which OpenAI agents broke into Hugging Face's servers, then followed up with the subpoena. A source described it as very broad, covering records on decisions by executives and board members, calendars, board meeting minutes, briefing materials and board voting records on model or agent performance issues. Officials said they are acting under the state's authority over the nonprofit OpenAI Foundation and the safety commitments made when Delaware approved OpenAI's restructuring in 2025. OpenAI (OpenAI Foundation and OpenAI Group PBC) | Legal/regulatory action | The investigation is open and no findings have been announced. OpenAI did not respond to Spotlight Delaware's request for comment. A subpoena is a request for records, not a finding of wrongdoing. | Investigation opened; no finding yet · Reported | Spotlight Delaware ↗ News From The States (republished) Oh My AI editors |
| 2026-11-02 | Google's Mandiant reports attackers hijacking companies' AI model access, with fraudulent charges reaching $1 million at some victimsGoogle's Mandiant and Google Threat Intelligence Group published a report on November 2, 2026 describing multiple 2026 incidents in which attackers took over organizations' access to large language models, a practice known as "LLMJacking". The intrusions affected financial services, retail, technology and transportation organizations in North America, South America and Asia Pacific. Mandiant says fraudulent usage exceeded $100,000 in a single day in some cases and reached about $1 million in total at some organizations before access was cut off. Most attackers got in with exposed or stolen cloud credentials, and one group exploited a LiteLLM gateway flaw (CVE-2026-40217) to gain admin control. The report says stolen access is resold through underground services it calls "LLM Mixers", naming jet-night.com and newapi.pro. Enterprise cloud AI model access (cloud credentials, LLM API keys and LiteLLM gateways) | Other | The report gives detection rules, cloud audit log checks for AWS, Azure and Google Cloud, and hardening steps, including tighter permissions, secret scanning, spending caps and quotas on AI services, phishing-resistant multi-factor sign-in, and prompt patching of AI gateways such as LiteLLM. | Advisory issued · Verified | Google Cloud Threat Intelligence ↗ Oh My AI editors |
| 2026-11-02 | WIRED finds a network of more than 400 AI apps and websites, presented as everyday tools, that hid features for making sexual deepfakes of uploaded photosA WIRED investigation published November 2, 2026, with researchers from the nonprofit AI Forensics and security firm Infoblox, found a network of more than 400 connected apps and domains that presented themselves as ordinary services, such as AI pet portraits, language lessons or workout coaching. Under certain conditions, such as opening the app after clicking a linked ad on Meta's platforms, the apps loaded a hidden interface for making explicit AI images and videos from photos users uploaded. Researchers counted 27 of the apps live on Google Play in September with more than 350,000 downloads combined. WIRED reports the network appears to be run by Chinese-language developers and a Hong Kong registered company, KeLing Technology Limited, which did not respond to requests for comment. AI image and video apps on Google Play and Apple's App Store, promoted through ads on Facebook and Instagram | Misinformation/deepfake | Apple removed 19 apps after WIRED contacted it and said the developers changed the content their apps loaded after review. Google had removed most of the apps before WIRED contacted it and did not comment. Meta said it banned KeLing Technology Limited from advertising in 2025, and after WIRED shared the domains it took action against 11,600 ad accounts, more than 4,700 business pages and 15,000 pages, and blocked 209 apps from advertising. WIRED reports similar ads and apps were still appearing as it finished reporting. | Platforms removing apps and ads · Reported | WIRED ↗ Oh My AI editors |
| 2026-11-02 | Türkiye's Competition Authority opens an investigation into Google's AI Overviews and AI Mode search features and imposes interim measures on how Google uses news publishers' contentThe Turkish Competition Authority (Rekabet Kurumu) announced on November 2, 2026 that it has opened an investigation under Article 41 of Act no 4054 into whether Google violated Article 6 of the Act (abuse of a dominant position) through the AI Overviews and AI Mode features in Google Search. A preliminary inquiry started on August 27, 2026 examined whether the features reduced traffic to news publishers and other content creators, whether Google's content-use terms with news publishers are unfair, whether the features had exclusionary effects on publishers, other content creators and AI chatbots, and whether publishers were treated differently when their content was selected or licensed for these features. Google Search AI Overviews and AI Mode | Legal/regulatory action | On October 8, 2026 the Competition Board imposed interim measures requiring Google to set conditions that do not discriminate among news publishers, reflect the economic value of the content it uses, and let publishers decide on the use of their content in AI Overviews and AI Mode independently of their visibility and indexing in other Google services. The measures do not ban the features. No finding of a violation has been made. | Investigation opened; interim measures in place · Verified | Turkish Competition Authority (Rekabet K ↗ Daily Sabah Oh My AI editors |
| 2026-11-02 | Former Pennsylvania State Police corporal sentenced to 5 to 10 years in prison for crimes including using AI on work computers to create pornographic images of womenPennsylvania Attorney General Dave Sunday announced on November 2, 2026 that a Montgomery County judge sentenced a former Pennsylvania State Police corporal, 40, to 5 to 10 years in prison followed by seven years of probation. He had pleaded guilty in April to 14 charges, including sexual abuse of children, unlawful use of a computer, receiving stolen property and official oppression. An investigation by the State Police Internal Affairs Division and the Attorney General's office found he used work computers to access AI tools to create pornographic images of women, including coworkers, from photos and videos taken without consent and from photographs obtained through a secured law enforcement database in violation of its usage policies. The 2025 charges are already in this tracker's history. AI image generation tools (not named) | Legal/regulatory action | The judge also designated him a sexually violent predator, requiring lifetime registration as a sex offender, and, according to The Philadelphia Inquirer, barred him from working in law enforcement, security or IT. | Sentenced · Verified | Pennsylvania Office of Attorney General ↗ The Philadelphia Inquirer Oh My AI editors |
| 2026-11-02 | NVIDIA tells Brev users that unauthorized activity on its cloud development platform from October 4 to 20 may have exposed the SSH keys for their virtual machinesNVIDIA sent a notice to affected users of Brev, its cloud development platform, saying its investigation identified unauthorized activity on the platform from October 4 through October 20, 2026. According to the notice, as quoted by Tom's Hardware and the Times of India, the information potentially exposed was the SSH key that Brev provisioned for each user's Brev-provisioned virtual machine. SSH keys are the credentials used to log in to those remote machines. NVIDIA has not said publicly how the access happened or whether customer data or workloads were accessed. NVIDIA Brev, a cloud platform developers use to set up GPU virtual machines for AI work | Data leak/breach | NVIDIA says it rotated the affected SSH keys and updated users' instances with the replacement keys, and that it is unaware of any improper use of the keys. Brev users can confirm their instances use the new key and review login history on those machines for the October 4 to 20 period. | Keys rotated; no misuse found so far · Verified | Tom's Hardware ↗ ETCISO (Times of India) Oh My AI editors |
| 2026-11-02 | Three path traversal flaws in the Network-AI agent framework could let attackers read or overwrite files, including its permission settings (CVE-2026-120311, CVE-2026-120312, CVE-2026-120313)Three CVE records published on November 2, 2026 (UTC) describe path traversal flaws in Network-AI, each rated high severity. CVE-2026-120311 (CVSS 3.1 score 8.8) lets someone who controls a job id read or delete arbitrary .json files through the FileJobStore, which could expose credentials and grant tokens or remove configuration files that weaken its AuthGuardian permission system. CVE-2026-120312 (8.8) does the same through the AgentVCR recording feature's cassette name, including overwriting AuthGuardian trust-level settings. CVE-2026-120313 (7.5, no login needed) lets paths escape the base directory checked by the InputSanitizer.sanitizePath() helper. The first two affect versions 5.13.4 through 5.15.4. The project's GitHub advisories were published on October 17. Network-AI (Jovancoding), an open-source multi-agent framework, versions before 5.15.5 | Security vulnerability | Fixed in Network-AI 5.15.5, released October 17, 2026. Users should update to 5.15.5 or later. | Fixed in 5.15.5 · Verified | NIST National Vulnerability Database ↗ Network-AI security advisory on GitHub Oh My AI editors |
| 2026-11-02 | Madras High Court grants bail to two men arrested over AI-generated videos showing Tamil Nadu Chief Minister Vijay speaking in Hindi about becoming prime ministerETV Bharat reported on November 2, 2026 that Tamil Nadu Police had arrested two men from Uttar Pradesh in Madhya Pradesh for allegedly creating and circulating AI-generated videos that showed Chief Minister C. Joseph Vijay speaking in Hindi and claiming he would become India's next prime minister. Prosecutors said the videos were made to gain social media likes and could damage the Chief Minister's reputation. In a separate case, a man from Rajasthan was arrested for allegedly running Facebook accounts that posted videos featuring the Chief Minister and taking Rs 16,000 from people. AI video generation tools (not named) | Misinformation/deepfake | The Madras High Court granted the two men conditional bail, requiring daily attendance at a police station and two sureties. Their counsel said the videos had already been removed from social media. The case continues. | Arrests made; bail granted · Reported | ETV Bharat ↗ Oh My AI editors |
| 2026-11-02 | The New York Times sues Brave, saying it scraped Times articles and supplied them to AI companiesThe New York Times Company sued Brave Software, maker of the Brave browser and Brave Search, on November 2, 2026 in federal court in Manhattan (case 1:26-cv-09549). The complaint alleges Brave copied Times articles into its search index, used them in its Ask Brave AI answers, and sold access to that index through its Search API to AI companies it names, including Anthropic, Perplexity, Mistral, xAI and Cohere. It also objects to a Brave browser setting promoted as a paywall blocker. The New York Daily News, Chicago Tribune and Orlando Sentinel filed a similar lawsuit the same day. The Verge | Legal/regulatory action | Lawsuits filed in the US District Court for the Southern District of New York, seeking damages and a court order to stop the practices. The allegations have not been tested in court. Brave had not commented in early reports. | Lawsuit filed; case pending · Verified | The Verge ↗ Our story Oh My AI feed |
| 2026-11-02 | GitBook says a targeted attack using AI agents reached its infrastructure credentials and may have exposed customers' integration tokens, Git Sync secrets and API tokensGitBook, a platform for publishing product and developer documentation, said in a security notice on November 3, 2026 that it had been the target of a sophisticated, highly targeted attack using AI agents. At 19:00 CET on November 2 the attacker gained unauthorized access to some of its infrastructure credentials. GitBook said the attacker may have accessed integration tokens, Git Sync secrets, API tokens and questions that site visitors asked GitBook Assistant, and that it had found no evidence that customer content was modified. As a precaution it took the GitBook app and authenticated docs sites offline while publicly published content stayed up from cache. GitBook documentation platform infrastructure (attack carried out with AI agents, not named) | Data leak/breach | GitBook blocked the attacker, closed the vulnerabilities involved, replaced every credential and secret across its infrastructure, revoked all personal API tokens and brought services back once it judged them secure. It asks customers to rotate GitBook API tokens and any third-party tokens or integration secrets connected to GitBook, and to re-authenticate the GitBook MCP server. It says a full post-mortem will be published. | Contained; services restored · Verified | GitBook security incident notice ↗ The Defiant Oh My AI editors |
| 2026-11-02 | Lawsuit says ChatGPT reinforced a Danish man's false beliefs over eight months and gave him wrong advice about withholding rent before he lost his homeClarkson Law Firm filed a lawsuit on November 2, 2026 in California Superior Court in San Francisco on behalf of Klaus Elmfelt, a 60-year-old Danish man, against OpenAI. The complaint alleges that over eight months, more than 41,000 messages and at least 641 hours of conversation, ChatGPT reinforced false beliefs that he and the AI were building billion-dollar products, and that it told him he could withhold rent without risk of losing his home, which the suit says contributed to him becoming unhoused. These are allegations and have not been decided by a court. ChatGPT (OpenAI) | Legal/regulatory action | The suit seeks damages and court-ordered safeguards, including declining individualized legal advice in pending matters, not making false claims about the chatbot's own capabilities, and ending or escalating conversations when users show signs of delusion, mania or psychosis. No response from OpenAI was included in the filing announcement. | Lawsuit filed; case pending · Reported | Clarkson Law Firm announcement ↗ Oh My AI editors |
| 2026-11-02 | China: members of a fraud ring that used AI-altered photos to pose as an online girlfriend receive prison terms of up to 11 years after 15 victims lost more than 1.8 million yuanCCTV News reported on November 2, 2026, as summarized by Shanghai Daily, that a fraud ring posed as a young woman seeking marriage on a short-video platform and WeChat, following a seven-day chat script and sending AI-generated or AI-altered photos of everyday activities and meals to make the relationship look real. After small test requests, the operators invented family medical emergencies backed by forged identity documents, medical records and hospital photos. Fifteen victims across China lost more than 1.8 million yuan (about US$270,000); one man working in Shanghai transferred more than 180,000 yuan, and the largest single loss exceeded 380,000 yuan. Police in Shanghai's Minhang District traced the operation and made arrests in Guangdong, Shandong, Guizhou and other provinces. AI-generated or AI-altered images (tool not named) | Fraud/scam | Those involved received prison terms of up to 11 years and fines, according to the report. The date of sentencing and the court were not stated. | Sentenced · Reported | Shanghai Daily (City News Service), citi ↗ Oh My AI editors |
| 2026-11-02 | Pennsylvania judge dismisses parents' state-court lawsuit against Lancaster Country Day School over students' AI-generated nude images of classmates; a separate federal suit is still pendingLancaster County President Judge Leonard G. Brown III dismissed all seven counts in a civil lawsuit filed in November 2024 by parents against Lancaster Country Day School and administrators over AI-generated nude images of female students. The order is dated October 30, 2026 and the opinion was filed November 2. The families alleged the school did not act on a November 2023 Safe2Say tip that a student was using an app to turn classmates' photos into sexually explicit images; police later identified about 59 victims and charged two students, who pleaded guilty in juvenile court in March. The judge found the school had no legal duty under Pennsylvania's child abuse law to report the tip and rejected the failure-to-supervise claims. The original incident is already in this tracker's history. AI image-generation app (not named in the ruling coverage) | Legal/regulatory action | The ruling applies only to the school defendants. A federal lawsuit filed in June by 13 victims and their parents in the U.S. District Court for the Eastern District of Pennsylvania, which also names the operators of the AI image-generation platform allegedly used, is still pending. | State suit dismissed; federal case pending · Verified | FOX43 ↗ WGAL Oh My AI editors |
| 2026-11-02 | Researchers find many apps built with the Lovable AI app builder left personal data readable without a loginHamburg security firm Crissy Field, working with the German business daily Handelsblatt (article November 2, 2026), analyzed 159,041 projects built with Lovable, an AI platform that creates web apps from plain-language descriptions. Of 34,545 projects using the Supabase database service, 24,664 sent database records on first page load without any login. Using further read-only requests with the same public key the page gives every visitor, the researchers found records containing email addresses on 7,403 of those sites, in 10,560 tables. Examples they report include more than 80,000 profiles and over 200,000 chat messages from a lifestyle forum, ticket and food orders with contact and payment details, AI-generated summaries of a property manager's internal emails, and more than 1,000 records with passport numbers. The researchers say the cause is missing or overly open database access rules in the apps, not a hack of Lovable itself, and that they could not tell whether any data was misused. Lovable told Handelsblatt this is a known, industry-wide configuration problem with Supabase. Web apps built with Lovable (AI app builder) that store data in Supabase | Data leak/breach | Crissy Field advises app owners to have access permissions, interfaces and the separation between user accounts reviewed before an app handles real customer or business data, and again after major changes. The researchers did not publish the specific access paths. | Research published · Verified | Crissy Field (research report, in German ↗ Handelsblatt Oh My AI editors |
| 2026-11-02 | Washington state mental health facilities report possible patient privacy breach after a staff member used a personal ChatGPT account for case notesThe Seattle Times reported on November 2, 2026 that the state-run Lake Burien Transitional Care Facility, which cares for youth with intensive mental health needs, contacted families of 12 patients in mid-August about a possible breach. According to a letter from the Washington State Department of Social and Health Services (DSHS), a colleague reported in July that an employee was using ChatGPT to draft summaries for client case notes, and the state then found the employee had used a personal ChatGPT account for other patients as well. Patients' names, diagnosis details and medications may have been exposed; the state said Social Security numbers were not, and it found no evidence the information was further disclosed or used for identity theft. A DSHS spokesperson said four patients at Western State Hospital were also potentially affected in a similar case. ChatGPT (personal account, not an agency-approved tool) | Data leak/breach | DSHS said the employee was instructed on IT security and client confidentiality and told to delete all prompts and then the account, which they did. Staff in both cases were reminded of the agency policy that AI tools may not be used without agency approval. | Precautions added · Reported | The Seattle Times ↗ Oh My AI editors |
| 2026-11-02 | Fake Markdown MCP servers on npm probed cloud metadata services for credentials when started by AI agentsOn November 2, 2026, the OpenSSF malicious-packages database (OSV, MAL-2026-18486 to MAL-2026-18489) and the GitHub Advisory Database flagged four npm packages under the @ifasn scope that were advertised as Markdown toolkit MCP servers (table-of-contents generation, word counts, table formatting) for use with AI agents. According to Amazon Inspector's analysis in those records, the packages ran code on load or startup that queried cloud instance-metadata services (AWS, Google Cloud, Azure and Alibaba Cloud for some variants, Alibaba Cloud only for others); some tried to read Alibaba Cloud role credentials, and others sent metadata responses or response codes over unencrypted HTTP to an outside server. A fifth package, @ifasn/ms-doc-mcp, was flagged by GitHub on November 4 with similar behavior. The records do not say how many people installed the packages or whether anyone was harmed. npm packages @ifasn/md-doc-mcp, @ifasn/mdd-doc-mcp, @ifasn/mmd-doc-mcp, @ifasn/mmdd-doc-mcp and @ifasn/ms-doc-mcp (MCP servers for AI agents) | Security vulnerability | The packages are listed as malware with no safe version. Anyone who installed or ran one should remove it, review what it could access, and rotate any cloud credentials that may have been exposed, from a clean machine. | Advisory issued · Verified | OpenSSF malicious packages database (OSV ↗ GitHub Advisory Database Oh My AI editors |
| 2026-11-02 | AgenticFlow says attackers escaped its workflow sandbox and exposed saved AI provider API keys; service pausedAgenticFlow said that on November 2–3, 2026 an attacker abused two flaws in the layer that runs customer-built workflows, escaped the sandbox, and gained read access to service configuration including the key that protects saved connections, plus customer data held by the service. From November 2 about 290,000 automated agents on about 1,900 throwaway accounts also ran AI-model requests at AgenticFlow's expense, which set off alarms at 01:50 UTC on November 3. AgenticFlow says saved LLM provider keys and other tokens, account emails and roles, conversations, datasets, uploads, agent/workflow configs and AgenticFlow API keys should be treated as exposed; passwords and card details are not stored in its systems. AgenticFlow (Pixel ML, Inc.) workflow platform and saved customer connections | Data leak/breach | AgenticFlow says it contained the incident on November 3, replaced service credentials, disabled affected cloud accounts, locked public entry points, paused the service while rebuilding, notified users, and reported affected keys to providers. It asks customers to rotate every key or token saved in AgenticFlow at the issuing service. | Contained; services paused while rebuilt · Verified | AgenticFlow security incident notice ↗ Oh My AI editors |
| 2026-11-01 | Replit outage: some users could not load workspaces or use Replit AgentReplit's official status page posted an incident titled "Agent and Workspace Issues" on November 1, 2026, marked as critical impact. Replit said it was investigating issues affecting some users' ability to load workspaces and use Agent, its AI coding agent. Replit Agent and Replit workspaces (Replit) | Outage | About 50 minutes after the incident opened, Replit said it had identified and mitigated the issue and was monitoring. It asked users still seeing Agent failures to refresh their browser tab and said it expected Agent interactions to be working again. | Mitigated; monitoring · Verified | Replit Status ↗ Oh My AI editors |
| 2026-11-01 | Critical flaw in Prefab UI's sandbox for AI-written code let callers of a FastMCP tool read and write files on the server (CVE-2026-120338)CVE-2026-120338 was published on November 1, 2026 by JFrog, rated critical (CVSS 3.1 score 10.0 for servers without authentication, 9.9 with it). Prefab UI's Generative UI sandbox is meant to safely run Python code supplied by a caller, including code written by an AI model. From version 0.14.0 through 0.20.2, the sandbox process was started with unrestricted file and network permissions, so the code inside it could read and write files on the server and make its access persist. The usual way in is FastMCP's Generative UI feature, whose MCP tool generate_prefab_ui passes its code argument into this sandbox; on a server with no authentication, anyone who can reach it could call the tool. The feature is opt-in and needs Deno installed on the host. No use in real attacks has been reported. Prefab UI (PrefectHQ prefab-ui) 0.14.0 through 0.20.2, used by FastMCP's Generative UI tool | Security vulnerability | Fixed in prefab-ui 0.21.0 (released October 26, 2026), which removes the sandbox's file and network permissions before it accepts code. Users of FastMCP's Generative UI should update and require authentication on their servers. | Fixed in 0.21.0 · Verified | CVE record (published by JFrog) ↗ Prefab UI 0.21.0 release Oh My AI editors |
| 2026-11-01 | Nagpur cyber police arrest four in three fraud cases, one of which used an AI-generated voice and a senior police officer's photo to take Rs 50 lakhThe Hitavada reported on November 1, 2026 that Nagpur Cyber Police in India arrested four people from Indore, Mumbai and Kanpur in three fraud cases in which residents lost a total of about Rs 1.63 crore. In one case, callers used an AI-generated voice imitating a senior police officer, along with his photograph, to persuade a resident's father to send Rs 50 lakh; one suspect was arrested in Indore and two phones were seized. The other two cases were a 'digital arrest' scam by callers posing as NIA officials (Rs 1.04 crore) and a bank fraud using a forged letterhead (about Rs 9.55 lakh). Local reports differ on some details, such as which case involved the officer's photo. AI voice cloning (tool not named) | Fraud/scam | Four suspects were arrested. Police urged people to verify any such call before sending money. The allegations have not been proven in court. | Arrests made; investigation ongoing · Reported | The Hitavada ↗ The Live Nagpur Oh My AI editors |
| 2026-11-01 | AI agent and workflow platform Trigger.dev says an attacker accessed environment variables for a subset of customer organizationsTrigger.dev, a hosted platform developers use to build and run AI agents and long-running background jobs, posted a security disclosure on November 1, 2026, signed by its CTO and also listed on its status page. It says an attacker gained unauthorized access to environment variables belonging to a subset of customer organizations. Environment variables on the platform often hold the API keys and credentials that customer jobs use. The company has not said how the attacker got in, how many organizations were affected, or which variables were read, and told The Register it would share more in a full incident report. Trigger.dev cloud platform for AI agents and background jobs (customer environment variables) | Data leak/breach | Trigger.dev says it has blocked the exploit used in the attack and emailed all affected account owners with steps to mitigate. It says it will post updates on its status page. Affected customers should follow the emailed steps and rotate any exposed credentials with the services that issued them. | Under investigation · Verified | Trigger.dev ↗ The Register Oh My AI editors |
| 2026-11-01 | Three critical flaws in Beam's open-source Beta9 platform for serverless AI inference and sandboxes let a tenant reach the host worker as root and other tenants' files (CVE-2026-120306, CVE-2026-120307, CVE-2026-120308)Three CVEs published on November 1, 2026 by JFrog, each rated critical (CVSS 3.1 score 9.9), describe ways a Beta9 tenant holding a workspace token could break out of isolation on a shared worker. CVE-2026-120306: image build steps ran with only chroot isolation, sharing the worker pod's namespaces as root, so one image build could reach the worker's filesystem, its container runtime binaries and its Kubernetes service account token. CVE-2026-120307: the sandbox file API could be pointed outside the sandbox with parent-directory segments or symbolic links, letting a tenant read, write and delete files on the worker as root, including other tenants' files; a read-only proof retrieved the worker's service account token, which the shipped remote-node manifests bind to cluster-admin. CVE-2026-120308: volume identifiers were not checked for ownership, so a tenant could mount the worker's filesystem, including other tenants' volumes, read-write. The CVE records describe read-only proofs; no use in real attacks has been reported. Beta9 (beam-cloud/beta9), Beam's open-source platform for serverless GPU inference, sandboxes and background jobs; worker before 0.1.756 and gateway before 0.1.776 | Security vulnerability | Fixed in Beta9 worker 0.1.756 and gateway 0.1.776 (both released September 15, 2026), which use isolated build steps, keep sandbox file operations inside the container root, and validate volume ownership. Self-hosted operators should update both components. | Fixed (update needed) · Verified | NVD (CVE published by JFrog) ↗ Beta9 fix (pull request 1897) Oh My AI editors |
| 2026-11-01 | Researcher shows a single line in a project's AGENTS.md file can make Claude Code's Auto Mode permission check approve nearly every commandIn a November 1, 2026 write-up, researcher Matan Ben-Tov described a prompt injection against Auto Mode, the default setting in Claude Code that uses a language model to score each tool call and decide whether to allow it. Because the classifier's prompt includes the contents of the project-level AGENTS.md file, one added line telling it to score on a 0-10 scale instead of 0-100 caused risky commands to get low scores and run automatically, even when the user had set hard_deny rules. In the researcher's tests the classifier was bypassed in 99% of about 50 scenarios (4% without the line), and forbidden commands ran in 22 of 30 full sessions, including destructive git commands, disabling TLS checks and reading a .env file. The attack requires the user to run Claude Code in a repository or folder an attacker has modified. Claude Code (Anthropic) Auto Mode permission classifier, tested on v2.1.316 | Security vulnerability | The researcher says the issue was reported to Anthropic on September 4, 2026 and still worked on Claude Code v2.1.316 (October 31). No fix has been announced. Suggested precautions include running coding agents inside a sandbox, reviewing AGENTS.md and skill files in untrusted repositories, and not relying on Auto Mode alone for rules that must never be broken. | Disclosed; no fix announced · Reported | Matan Ben-Tov (researcher write-up) ↗ Claude Code docs: configure auto mode Oh My AI editors |
| 2026-10-31 | Cisco Talos finds VOLTA, Windows password-stealing malware that asks AI models to profile victims and rank what they are worthCisco Talos published research on October 31, 2026 about a Windows infostealer that names itself "VOLTA-AUTODOXER." It takes saved browser passwords, cookies and sessions, payment cards, cryptocurrency wallets, Microsoft sign-in tokens, SSH and cloud keys, Wi-Fi passwords and screenshots, then deletes itself. It can also use the stolen sessions to gather more, for example searching the victim's Gmail for receipts to confirm a home address. An optional step sends the collected data through the OpenRouter service to a large language model, asking it to write a "target assessment" that ranks the victim's assets by how much money they could bring and judges their security habits. It tries Anthropic's Claude Opus 4.6 first and falls back to Moonshot's Kimi K2 and then Google's Gemini 2.5 Flash if a model refuses. Talos says the AI step does analyst work for the attacker rather than adding a new hacking ability, and the malware works without it. Its build template suggests it is sold to other criminals. Talos found the sample (first seen October 11, 2026) through CAIRN, its research effort on AI-powered malware, and a Talos researcher told WIRED the team did not track whether it has been used in real attacks. Cisco Talos | Other | Talos advises restricting which programs may start Chrome in headless mode (or alerting when they do), since much of the token theft relies on that path. On an infected machine, keep the %APPDATA%\volta_debug.txt log, revoke tokens and change passwords, and move cryptocurrency to a new wallet if a seed phrase was stored in plain text. | Advisory issued · Verified | Cisco Talos ↗ Our story Oh My AI feed |