Version 2026.10.4 · updated
At a glance.
- Entries
- 10
- Disclosed
- Apr 2026 to Oct 2026
- With an official disclosure
- 10 of 10
- Organisations and projects
- 17
- Licence
- CC BY 4.0 ↗
The entries
Every row, newest first.
Method
How entries are chosen.
- What qualifies
- A public incident or disclosure in 2026 in which an AI model found vulnerabilities in real software, built or ran an exploit against a real system, acted outside the scope it was given, or in which an AI tool’s access was the route into a company.
- Sources
- Each entry links the company’s or institution’s own disclosure first, then press, then analysis. An entry without an official disclosure is marked press-sourced until one is found.
- Date
- The date of the official public disclosure, or of the first press report when no official disclosure exists. An entry that groups several disclosures carries the latest of them; the period column covers when it happened.
- Wording
- Facts, dates and numbers come from the disclosures. Each entry adds one neutral line on why it matters and one on the pattern it shows; neither claims what any product would have caught.
- Updates
- Reviewed monthly. A new entry, a corrected fact or a better source raises the version, and every change is listed below.
ai_role
Classification.
- model-found-vulnerabilities
- A model was used to find vulnerabilities in real software, which were then reported to the maintainers or fixed.
- model-built-exploit
- People used a model to build a working exploit against a real system.
- model-acted-outside-scope
- A model under evaluation acted outside the scope it was given, on real systems or in a simulation.
- ai-tool-entry-point
- A third-party AI tool’s access was the route into a company’s systems.
Schema
Fields.
- id
- Stable identifier; also the anchor on the Record page.
- url
- The entry on the Record page.
- disclosed
- Date of disclosure, ISO 8601 (see “How entries are chosen”).
- period
- When it happened, as written on the Record.
- organisations
- The organisations and projects involved; in the CSV, separated by “ | ”.
- headline
- One-sentence summary.
- summary
- What happened, from the disclosures.
- so_what
- Why it matters, in one neutral line.
- pattern
- The pattern it shows, in one line.
- ai_role
- One of the four classification values above.
- real_systems
- yes, no, or simulated: whether live systems outside the actor’s own were touched.
- source_status
- official when an exact official disclosure is linked; press-sourced otherwise.
- official_sources, press_sources, analysis_sources
- Links in that order of weight. In the CSV, label and URL pairs are separated by “ | ”.
- matt_analysis
- MATT’s longer write-up on the blog, where one exists.
Reuse
How to cite it.
MATT by Mattersec Labs, “The Record: AI security incidents of 2026”, version 2026.10.4, https://www.matt.security/record/data
Licensed CC BY 4.0 ↗. Found an error, a missing incident or a better source? Write to record@mattersec.com and the next version will say what changed.
Versions
Changelog.
- 2026.10.4
- New entry php2shell (21 October 2026): two critical flaws in PHP itself, CVE-2026-109618 and CVE-2026-109619, that allow remote code execution without logging in, found with AI models by Calif inside OpenAI’s Patch the Planet programme and independently by Wiz; a related bug was flagged in 2024 with exploitation unproven, and Amazon recorded an exploitation attempt four days before disclosure. Classified model-found-vulnerabilities, real systems no. Linked to MATT’s analysis, “PHP2Shell: how an old flaw in PHP became an emergency”.
- 2026.10.3
- glm-5-3 now links MATT’s analysis, “A model anyone can download, close behind Mythos”, which sets out NIST CAISI’s four benchmark results and Anthropic’s measurements in full.
- 2026.10.2
- New entry glm-5-3 (29 September 2026): Z.ai’s open-weight GLM-5.3, which NIST’s CAISI (17 September) called the most cyber-capable open-weight model released to date and Anthropic’s Frontier Red Team (29 September) measured close to Claude Mythos Preview at building exploits, with copies stripped of its safeguards published within days. Classified model-found-vulnerabilities, real systems no. That class now reads “reported to the maintainers or fixed”, because the flaws in this entry were reported to the maintainer.
- 2026.10.1
- New entry anthropic-unintended (9 October 2026): Anthropic’s report on four kinds of unintended model actions on real websites, including the false tip to the Philadelphia police, and its decision to disable live internet access for all internal evaluations. Classified model-acted-outside-scope, real systems yes.
- 2026.10
- First published as data: seven entries from April to September 2026. Exact official sources added for the OpenBSD entry (Anthropic’s Frontier Red Team write-up and Project Glasswing) and the Mozilla entry (Mozilla’s “The zero-days are numbered” and the Firefox 150 advisory); encyclopedia references removed. The Anthropic and Meta entry now links Anthropic’s own disclosure of 30 July; Meta’s statement of 5 August reached the public through the press, and the entry is dated by it.