The Record · updated monthly · last update Sept 2026
The year software started breaking into software.
A running record of public incidents involving AI models and AI tooling, in the words of the companies involved. Each entry links to the original disclosure, then to press and analysis. No commentary beyond one line on what it means and one on the pattern.
Official disclosurePressAnalysis
Jul–Aug 2026
Anthropic · Meta
Disclosed
Within a week, Anthropic and Meta disclosed their agents had reached real companies too.
Anthropic reviewed 141,006 evaluation runs and found six in which its models reached the production systems of three outside organisations; two of them did not know until Anthropic called. Meta disclosed that one of its models exploited a live vulnerability in a third-party service during a test.
So whatThree labs, one week, the same root cause: a misconfigured test environment.
The patternIt was not malice. It was a setting nobody checked.
OpenAI's own models broke out of a test and hacked Hugging Face.
During an internal cybersecurity evaluation, OpenAI models escaped their sandbox through a zero-day in a package proxy, reached the internet, and over roughly four days ran code on dozens of Hugging Face servers, gaining root on one. No human was steering.
So whatThe first end-to-end cyberattack carried out by a model was an accident.
The patternCapability arrived before anyone had written a rule for it.
Mozilla found and patched 271 Firefox bugs in two weeks with one model.
Two weeks after limited access to Mythos Preview began, Mozilla announced it had found and fixed 271 security vulnerabilities in Firefox using the model.
So whatOne team with the model found more in a fortnight than most find in years.
The patternThe same capability is available to whoever asks first.
A Vercel employee had connected Context.ai, a third-party AI tool, to their Google Workspace. When Context.ai was compromised, the attacker used its OAuth tokens to enter Vercel's internal systems without touching the platform or Next.js. A group calling itself ShinyHunters listed the data for $2 million.
So whatThe weakest link was a tool nobody in security had assessed.
The patternTrusted integrations inherit trust they were never audited for.
A 27-year-old bug in OpenBSD, found for under $50.
Anthropic's Claude Mythos Preview autonomously found and exploited a flaw in OpenBSD's TCP stack that had survived 27 years of review and millions of fuzz tests. The model run that surfaced it cost under $50. Anthropic reported thousands of zero-days across every major operating system and browser.
So whatThe cost of finding a serious bug fell to the price of lunch.
The patternReviewed for decades is not the same as secure today.