What happened.
What to learn from it.

Research proof of concept requiring a developer to review malicious repository content. Execution occurred in the preview renderer; no in-the-wild exploitation established.

October 11 is Previdian's recorded exploitation attestation; news coverage followed October 15. Vulnerability disclosure was September 10. Honeypot attempts do not establish customer breaches.

New, grouped cases distinct from July's intrusions. Anthropic reported minimal real-world impact and no known involvement of customer data; most organizations remain unnamed.

Presented publicly October 7; technical report followed October 8. Controlled same-account demonstration. AWS disputes classification; no confirmed malicious exploitation.

The campaign dates to April. AI infrastructure was targeted; the report does not establish that an LLM operated the malware.

Some observed upload requests were rejected by AWS. Potential model theft or code execution must not be presented as confirmed malicious exploitation.

Requests occurred May 28 and June 9. Transluce does not confidently attribute them to OpenAI; September 29 is the government acknowledgement date.

The incident occurred May 27 in a custom research harness. It does not establish ordinary ChatGPT exposure or confirmed external misuse of the token.

Activity occurred May–June. Attribution to OpenAI-associated activity was stronger for Data USA and AIHW than for the University of New Mexico.

Vendor attribution; Chinese language does not establish state sponsorship. Victim organizations were not named.

Russian state-nexus attribution is Anthropic's assessment, consistent with Midnight Blizzard reporting. Human operators selected targets and reviewed results.

Distinct from the three incidents disclosed July 30. The January test allowed internet access unintentionally and omitted production cyber safeguards; the affected organization was not named.

Activity occurred in the second quarter. The report supports rapid automation, not a claim of fully autonomous discovery of new vulnerabilities.

Cyber classifiers were disabled and internet access was intentionally available. AISI explicitly distinguishes the behavior from a sandbox escape.

Grouped evaluation incidents with production safeguards removed, not a single criminal campaign. Some remediation and investigation remained underway at publication.

Controlled proof of concept using preauthorized connectors. The report does not establish a real-world victim breach.

Containment was reported; investigation continued. Models ran with reduced safeguards. Hugging Face found no tampering with public models, datasets or Spaces.

July 8 is the grouped research disclosure; some component CVEs were public in June. Controlled demonstrations, with no malicious exploitation established.

AI autonomy is Sysdig's assessment from runtime behavior; the model was not identified. Data exfiltration was not independently verified.

June 30 is campaign-report disclosure; CVE-2026-40217 was disclosed April 10. Honeypot attempts and lab success do not establish customer compromises.

AI involvement was inferred from code characteristics with high confidence. The model and affected product were not named; valid credentials were required.

Research demonstration, not a confirmed criminal campaign. The finding concerns retained working context, not proven indefinite memory across sessions.

The agent-assisted commit occurred February 28. The broader package campaign began earlier; attribution to Famous Chollima is ReversingLabs' assessment.

Research proof of concept, privately reported in January. No in-the-wild exploitation established by this report.

Research demonstrations, not confirmed victim breaches. Anthropic later disputed severity; the report does not establish complete cross-vendor remediation.

Controlled custom-action deployment; no confirmed malicious exploitation. Salesforce disputes treating the demonstrated configuration as a platform-wide vulnerability.

LiteLLM described the compromised Trivy dependency as its assessed entry path. Package compromise is confirmed; the advisory does not establish how many downstream hosts lost credentials.

Huntress named EvilTokens in a March 23 update; initial AI involvement was partly inferred. Microsoft's September investigation provides stronger evidence. Arrests are not convictions.

Researcher claims about reachable data are not a confirmed client-data breach. McKinsey explicitly reported no evidence that client confidential information was accessed.

Lab demonstration requiring a running password-protected gateway and a guessable password; no compromised user population is established.

Counts and attribution are Amazon's findings. The public report does not name the AI providers; AWS infrastructure was not observed participating in the campaign.

OpenClaw itself was legitimate; its installation was unauthorized. Researchers documented a prior Claude-triage prompt-injection and cache-poisoning vulnerability, but the cited sources do not confirm that this was the token-theft path used for the unauthorized release.

Research proof of concept, not a reported in-the-wild compromise. The primary page dates disclosure February 16; later coverage used later dates.

The larger 1,467 figure counts skills with security issues, not proven malware or victims. This study extends earlier malicious ClawHub campaign reporting.

This was an observed production data exposure; the cited sources do not establish malicious theft of all accessible records. Wiz independently expanded an earlier discovery.

Session counts and marketplace attribution come from Pillar's investigation, not a count of breached organizations. The report distinguishes separate MCP reconnaissance traffic.

Date follows Microsoft's January 22 public-disclosure field. Capsule instead dates CVE publication January 15; detailed research appeared April 15. No malicious exploitation is established.

Controlled demonstration; no real-world victim count is established. Original publication date is verified in page metadata despite a June update.

Date follows the public CVE record; detailed research followed January 13. An October 30 customer/KB notice is mentioned but public accessibility was unverified. No malicious exploitation is established.

Controlled research affecting a beta assistant, not a confirmed customer breach. December 18 is the detailed public report; the fix preceded it.

December 6 dates the aggregate research disclosure; individual component advisories may be older. Results concern tested products and configurations, not every AI editor.

November 26 is the cited package-specific disclosure; the broader worm began November 24. This records affected releases, not proof every installer lost credentials.

The breach occurred in Mixpanel's systems, not OpenAI's infrastructure. A December 19 clarification described the limited ChatGPT user impact.

Research demonstration under described settings, with browser tools enabled; not an observed victim breach. Date comes from the primary page's datePublished metadata.

Campaign activity was detected in September; November 13 is the public report date. Attribution, autonomy, and successful-intrusion claims rely on Anthropic's limited platform visibility.

Attribution and AI-use findings are Google's assessment. Experimental malware activity is not evidence of a successful PROMPTFLUX intrusion.

Controlled demonstration, not a reported malicious breach. Opera measured a 10% reproduction rate and required a particular page and user command.