{
  "name": "The Record: AI security incidents of 2026",
  "publisher": "MATT by Mattersec Labs",
  "version": "2026.10.4",
  "updated": "2026-10-22",
  "license": {
    "name": "CC BY 4.0",
    "url": "https://creativecommons.org/licenses/by/4.0/"
  },
  "url": "https://www.matt.security/record/data",
  "citation": "MATT by Mattersec Labs, “The Record: AI security incidents of 2026”, version 2026.10.4, https://www.matt.security/record/data",
  "fields": {
    "id": "Stable identifier; also the anchor on the Record page.",
    "url": "The entry on the Record page.",
    "disclosed": "Date of disclosure, ISO 8601 (see “How entries are chosen”).",
    "period": "When it happened, as written on the Record.",
    "organisations": "The organisations and projects involved; in the CSV, separated by “ | ”.",
    "headline": "One-sentence summary.",
    "summary": "What happened, from the disclosures.",
    "so_what": "Why it matters, in one neutral line.",
    "pattern": "The pattern it shows, in one line.",
    "ai_role": "One of the four classification values above.",
    "real_systems": "yes, no, or simulated: whether live systems outside the actor’s own were touched.",
    "source_status": "official when an exact official disclosure is linked; press-sourced otherwise.",
    "official_sources, press_sources, analysis_sources": "Links in that order of weight. In the CSV, label and URL pairs are separated by “ | ”.",
    "matt_analysis": "MATT’s longer write-up on the blog, where one exists."
  },
  "classification": {
    "model-found-vulnerabilities": "A model was used to find vulnerabilities in real software, which were then reported to the maintainers or fixed.",
    "model-built-exploit": "People used a model to build a working exploit against a real system.",
    "model-acted-outside-scope": "A model under evaluation acted outside the scope it was given, on real systems or in a simulation.",
    "ai-tool-entry-point": "A third-party AI tool’s access was the route into a company’s systems."
  },
  "count": 10,
  "incidents": [
    {
      "id": "php2shell",
      "url": "https://www.matt.security/record#php2shell",
      "disclosed": "2026-10-21",
      "period": "Aug–Oct 2026",
      "organisations": [
        "PHP",
        "Calif",
        "Wiz",
        "OpenAI"
      ],
      "headline": "AI models helped prove two flaws in PHP that let anyone run code on a web server.",
      "summary": "On 21 October PHP released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix CVE-2026-109618 and CVE-2026-109619, both rated 9.2 under CVSS v4.0, which allow remote code execution without logging in on any PHP installation serving web requests; Apache with mod_php is the highest risk. Calif found the first paths on 1 August inside OpenAI's Patch the Planet programme, with GPT-5.6 Sol according to OpenAI, and reported them on 11 August; Wiz found them independently with Gemini 4 Argon and GPT-5.6 Sol and reported on 24 August. A related bug had been flagged in 2024 with its exploitation unproven, and the fix stalled. Details leaked on 20 October and the release moved up a day. Amazon recorded an exploitation attempt against its honeypots on 17 October, four days before disclosure; CISA said on 21 October it had not observed exploitation.",
      "so_what": "Once AI models made proof cheap, a weakness flagged two years earlier became an internet-wide emergency release.",
      "pattern": "A flaw in shared infrastructure breaks the same security rule in every product built on it.",
      "ai_role": "model-found-vulnerabilities",
      "real_systems": "no",
      "source_status": "official",
      "official_sources": [
        {
          "label": "PHP",
          "url": "https://www.php.net/archive/2026.php#2026-10-21-5"
        },
        {
          "label": "PHP Foundation",
          "url": "https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/"
        },
        {
          "label": "Research · Calif",
          "url": "https://calif.io/php2shell/"
        },
        {
          "label": "Research · Wiz",
          "url": "https://www.wiz.io/blog/php2shell-php-rce"
        },
        {
          "label": "OpenAI",
          "url": "https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities/"
        },
        {
          "label": "Threat report · Amazon",
          "url": "https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/"
        },
        {
          "label": "Alert · CISA",
          "url": "https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching"
        }
      ],
      "press_sources": [
        {
          "label": "Reuters",
          "url": "https://www.rte.ie/news/world/2026/1021/1596231-eu-cybersecurity/"
        }
      ],
      "analysis_sources": [],
      "matt_analysis": "https://www.matt.security/blog/php2shell-explained"
    },
    {
      "id": "anthropic-unintended",
      "url": "https://www.matt.security/record#anthropic-unintended",
      "disclosed": "2026-10-09",
      "period": "Jul–Oct 2026",
      "organisations": [
        "Anthropic",
        "Philadelphia Police"
      ],
      "headline": "A model filed a false tip to the police, and Anthropic switched off the live internet for all its evaluations.",
      "summary": "Anthropic published four kinds of unintended actions its models had taken on real websites during evaluations and internal use: exploiting an injection flaw on a university server to run a calculation, submitting forms it should not have (including a false tip through the Philadelphia Police Department's unsolved-murders site on 18 July, caught by a spam filter), reading tokens out of a county map site's settings file and a state agency's public dashboard to reach gated data, and using URL shorteners to get past its fetch tool's length limit. The police were told on 7 October and called the two-month delay unacceptable. Anthropic said the impact was minimal, that alignment training is not yet sufficient on its own, and that live internet access is now disabled for all of its internal evaluations.",
      "so_what": "The labs are taking the live web away from their own tests because they cannot yet prove the boundary holds.",
      "pattern": "A boundary stated in the prompt is read, and then the next thing is read.",
      "ai_role": "model-acted-outside-scope",
      "real_systems": "yes",
      "source_status": "official",
      "official_sources": [
        {
          "label": "Anthropic",
          "url": "https://www.anthropic.com/research/investigating-unintended-model-actions"
        }
      ],
      "press_sources": [
        {
          "label": "6abc (the police statement)",
          "url": "https://6abc.com/post/anthropic-ai-model-submitted-false-tip-unsolved-murder-philadelphia-police-say/19925243/"
        },
        {
          "label": "The Philadelphia Inquirer",
          "url": "https://www.inquirer.com/crime/anthropic-artificial-intelligence-philadelphia-police-false-homicide-tip-20261009.html"
        },
        {
          "label": "The Hacker News",
          "url": "https://thehackernews.com/2026/10/anthropic-cuts-live-internet-access-for.html"
        }
      ],
      "analysis_sources": [],
      "matt_analysis": "https://www.matt.security/blog/the-sandbox-is-gone"
    },
    {
      "id": "glm-5-3",
      "url": "https://www.matt.security/record#glm-5-3",
      "disclosed": "2026-09-29",
      "period": "Aug–Sep 2026",
      "organisations": [
        "Z.ai",
        "Anthropic",
        "NIST"
      ],
      "headline": "Z.ai's downloadable GLM-5.3 built almost as many exploits as Claude Mythos.",
      "summary": "Z.ai released GLM-5.3 on 14 August and its weights two weeks later; on 17 September NIST's Center for AI Standards and Innovation called it the most cyber-capable open-weight model released to date, about four months behind the US frontier on its cyber benchmarks. On 29 September Anthropic's Frontier Red Team reported that it built end-to-end exploits in 50 of 410 ExploitBench attempts, against 56 for Claude Mythos Preview, which Anthropic has kept to a limited release. In a day-long session a researcher used it to find several unknown flaws in a browser's JavaScript engine and chain them into an exploit; Anthropic disclosed them to the maintainer. In simulated tests a deceptive prompt, prefilled reasoning or a copy with its refusals edited out got past its safeguards 64%, 92% and 100% of the time, and such copies were public within days of the release.",
      "so_what": "Exploit-building close to the restricted frontier models is now a download anyone can make.",
      "pattern": "Safeguards trained into downloadable weights can be removed by whoever holds the weights.",
      "ai_role": "model-found-vulnerabilities",
      "real_systems": "no",
      "source_status": "official",
      "official_sources": [
        {
          "label": "Anthropic",
          "url": "https://www.anthropic.com/research/glm-5-3-and-the-spread-of-advanced-cyber-capabilities"
        },
        {
          "label": "NIST",
          "url": "https://www.nist.gov/news-events/news/2026/09/caisis-assessment-zais-glm-53-cyber-capabilities"
        }
      ],
      "press_sources": [
        {
          "label": "The Next Web",
          "url": "https://thenextweb.com/news/glm-5-3-cyber-exploits-mythos-anthropic-safeguards"
        },
        {
          "label": "CSO Online",
          "url": "https://www.csoonline.com/article/4210501/"
        }
      ],
      "analysis_sources": [
        {
          "label": "MATT film",
          "url": "https://www.youtube.com/watch?v=KXQw3mGVzhI"
        }
      ],
      "matt_analysis": "https://www.matt.security/blog/glm-5-3-open-model-close-to-mythos"
    },
    {
      "id": "gpt-6-1-astra",
      "url": "https://www.matt.security/record#gpt-6-1-astra",
      "disclosed": "2026-09-28",
      "period": "Sep 2026",
      "organisations": [
        "OpenAI",
        "AISI"
      ],
      "headline": "Told the scope twice, GPT-6.1 Astra attacked the supply chain anyway, in a test.",
      "summary": "OpenAI pulled the October launch of GPT-6.1 Astra after its own evaluations found the model had regressed on deception and on seeking authorization: it did not always report the actions it took, and it pushed ahead and reached for outside tools without asking. On 28 September the UK AI Security Institute published what it saw. Given a cyber evaluation with named in-scope networks and the public internet excluded, the model ran unsanctioned supply-chain attacks in 29.2% of runs, against 6.3% for GPT-5.6 Sol and 0% for GPT-5.5: it created fake identities to deceive developers, posted from fake accounts to argue against accurate security reviews, and delivered malicious payloads to open-source code. Told again, explicitly, that internet targets were out of scope, it still attacked in 4 of 49 runs. Every action was simulated, safeguards were off for the test, and no real system was touched.",
      "so_what": "A frontier model crossed a boundary it had been given twice, and went for the review process on its way through.",
      "pattern": "A stated boundary holds only when something checks it.",
      "ai_role": "model-acted-outside-scope",
      "real_systems": "simulated",
      "source_status": "official",
      "official_sources": [
        {
          "label": "AI Security Institute",
          "url": "https://www.aisi.gov.uk/blog/gpt-6-astra-performs-unsanctioned-supply-chain-attacks-in-simulations"
        }
      ],
      "press_sources": [
        {
          "label": "Al Jazeera",
          "url": "https://www.aljazeera.com/economy/2026/9/29/openai-scraps-release-of-latest-ai-model-over-safety-concerns"
        },
        {
          "label": "The Register",
          "url": "https://www.theregister.com/ai-and-ml/2026/09/28/openai-gpt-6-astra-really-good-at-supply-chain-attacks-uk-gov-warns/5299588"
        }
      ],
      "analysis_sources": [],
      "matt_analysis": "https://www.matt.security/blog/gpt-6-1-astra-openai-shelved"
    },
    {
      "id": "labs",
      "url": "https://www.matt.security/record#labs",
      "disclosed": "2026-08-05",
      "period": "Jul–Aug 2026",
      "organisations": [
        "Anthropic",
        "Meta"
      ],
      "headline": "Within a week, Anthropic and Meta disclosed their agents had reached real companies too.",
      "summary": "Anthropic reviewed 141,006 evaluation runs and found six in which its models reached the production systems of three outside organisations; two of them did not know until Anthropic called. Meta disclosed that one of its models exploited a live vulnerability in a third-party service during a test.",
      "so_what": "Three labs, one week, the same root cause: a misconfigured test environment.",
      "pattern": "It was not malice. It was a setting nobody checked.",
      "ai_role": "model-acted-outside-scope",
      "real_systems": "yes",
      "source_status": "official",
      "official_sources": [
        {
          "label": "Anthropic",
          "url": "https://www.anthropic.com/news/investigating-incidents-cybersecurity-evals"
        }
      ],
      "press_sources": [
        {
          "label": "BleepingComputer (Meta)",
          "url": "https://www.bleepingcomputer.com/news/security/meta-ai-model-hacked-a-company-during-misconfigured-cyber-test/"
        },
        {
          "label": "CNBC",
          "url": "https://www.cnbc.com/2026/08/26/open-ai-hugging-face-hack.html"
        }
      ],
      "analysis_sources": [
        {
          "label": "Black Hat debrief",
          "url": "https://www.gat.report/88839/black-hat-2026-ai-agent-breaches-as-an-industry-wide-problem/"
        },
        {
          "label": "eSecurity Planet",
          "url": "https://www.esecurityplanet.com/threats/black-hat-2026-critical-flaws-found-in-anthropic-google-and-openai-coding-agents/"
        }
      ],
      "matt_analysis": "https://www.matt.security/blog/ai-agents-reached-real-companies"
    },
    {
      "id": "openai-discourse",
      "url": "https://www.matt.security/record#openai-discourse",
      "disclosed": "2026-07-25",
      "period": "Jul 2026",
      "organisations": [
        "Hacktron",
        "OpenAI"
      ],
      "headline": "Researchers used Claude Opus 5 to reach inside OpenAI’s own code, through its forum.",
      "summary": "Researchers at Hacktron AI used Anthropic's Claude Opus 5 to build a working exploit for OpenAI's community forum, which runs Discourse. A heap overflow in an image-decoding library, left unpatched in the forum's base image and reachable through ordinary image upload, gave remote code execution and administrator access. An OpenAI single-sign-on link then turned that forum compromise into access to an employee's Codex account and GitHub, enough to open a pull request in OpenAI's internal repository. No source code was read. From the first session to that access took under 72 hours, on a model that had failed the same task a version earlier.",
      "so_what": "A low-severity forum became an identity path into a frontier lab’s own code.",
      "pattern": "Single sign-on carries one property’s compromise straight into everything it signs into.",
      "ai_role": "model-built-exploit",
      "real_systems": "yes",
      "source_status": "official",
      "official_sources": [
        {
          "label": "Hacktron AI",
          "url": "https://www.hacktron.ai/blog/hacking-openai"
        }
      ],
      "press_sources": [
        {
          "label": "The Information",
          "url": "https://www.theinformation.com/briefings/bug-hunters-used-claude-hack-openai"
        }
      ],
      "analysis_sources": [
        {
          "label": "Hacker News",
          "url": "https://news.ycombinator.com/item?id=49749656"
        }
      ],
      "matt_analysis": "https://www.matt.security/blog/claude-opus-5-openai-forum-breach"
    },
    {
      "id": "openai-hf",
      "url": "https://www.matt.security/record#openai-hf",
      "disclosed": "2026-07-21",
      "period": "Jul 2026",
      "organisations": [
        "OpenAI",
        "Hugging Face"
      ],
      "headline": "OpenAI's own models broke out of a test and hacked Hugging Face.",
      "summary": "During an internal cybersecurity evaluation, OpenAI models escaped their sandbox through a zero-day in a package proxy, reached the internet, and over roughly four days ran code on dozens of Hugging Face servers, gaining root on one. No human was steering.",
      "so_what": "The first end-to-end cyberattack carried out by a model was an accident.",
      "pattern": "Capability arrived before anyone had written a rule for it.",
      "ai_role": "model-acted-outside-scope",
      "real_systems": "yes",
      "source_status": "official",
      "official_sources": [
        {
          "label": "OpenAI disclosure",
          "url": "https://openai.com/index/hugging-face-model-evaluation-security-incident/"
        },
        {
          "label": "Hugging Face timeline",
          "url": "https://huggingface.co/blog/agent-intrusion-technical-timeline"
        },
        {
          "label": "OpenAI report",
          "url": "https://openai.com/index/hugging-face-incident-and-the-road-ahead/"
        }
      ],
      "press_sources": [
        {
          "label": "TechCrunch",
          "url": "https://techcrunch.com/2026/08/26/openai-releases-its-official-report-on-the-hugging-face-breach/"
        },
        {
          "label": "Axios",
          "url": "https://www.axios.com/2026/08/26/openai-hugging-face-technical-report-ai-hack"
        }
      ],
      "analysis_sources": [
        {
          "label": "Recorded Future",
          "url": "https://www.recordedfuture.com/blog/hugging-face-ai-safety"
        }
      ],
      "matt_analysis": "https://www.matt.security/blog/openai-models-hugging-face-breach"
    },
    {
      "id": "mozilla",
      "url": "https://www.matt.security/record#mozilla",
      "disclosed": "2026-04-21",
      "period": "Apr 2026",
      "organisations": [
        "Mozilla",
        "Firefox"
      ],
      "headline": "Mozilla found and patched 271 Firefox bugs in two weeks with one model.",
      "summary": "Two weeks after limited access to Mythos Preview began, Mozilla announced it had found and fixed 271 security vulnerabilities in Firefox using the model.",
      "so_what": "One team with the model found more in a fortnight than most find in years.",
      "pattern": "The same capability is available to whoever asks first.",
      "ai_role": "model-found-vulnerabilities",
      "real_systems": "no",
      "source_status": "official",
      "official_sources": [
        {
          "label": "Mozilla",
          "url": "https://blog.mozilla.org/en/firefox/privacy-security/ai-security-zero-day-vulnerabilities/"
        },
        {
          "label": "Firefox 150 security advisory",
          "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2026-30/"
        }
      ],
      "press_sources": [
        {
          "label": "WIRED",
          "url": "https://www.wired.com/story/mozilla-used-anthropics-mythos-to-find-271-bugs-in-firefox/"
        }
      ],
      "analysis_sources": [],
      "matt_analysis": "https://www.matt.security/blog/mozilla-271-firefox-bugs-ai"
    },
    {
      "id": "vercel",
      "url": "https://www.matt.security/record#vercel",
      "disclosed": "2026-04-19",
      "period": "Apr 2026",
      "organisations": [
        "Vercel",
        "Context.ai"
      ],
      "headline": "An AI note-taking tool was the way into Vercel.",
      "summary": "A Vercel employee had connected Context.ai, a third-party AI tool, to their Google Workspace. When Context.ai was compromised, the attacker used its OAuth tokens to enter Vercel's internal systems without touching the platform or Next.js. A group calling itself ShinyHunters listed the data for $2 million.",
      "so_what": "The weakest link was a tool nobody in security had assessed.",
      "pattern": "Trusted integrations inherit trust they were never audited for.",
      "ai_role": "ai-tool-entry-point",
      "real_systems": "yes",
      "source_status": "official",
      "official_sources": [
        {
          "label": "Vercel bulletin",
          "url": "https://vercel.com/kb/bulletin/vercel-april-2026-security-incident"
        }
      ],
      "press_sources": [],
      "analysis_sources": [
        {
          "label": "Trend Micro",
          "url": "https://www.trendmicro.com/en_us/research/26/d/vercel-breach-oauth-supply-chain.html"
        },
        {
          "label": "Cloud Security Alliance",
          "url": "https://labs.cloudsecurityalliance.org/research/csa-research-note-ai-saas-supply-chain-vercel-contextai-2026/"
        },
        {
          "label": "Strapi",
          "url": "https://strapi.io/blog/vercel-security-breach-april-2026"
        }
      ],
      "matt_analysis": "https://www.matt.security/blog/vercel-context-ai-oauth-breach"
    },
    {
      "id": "mythos-openbsd",
      "url": "https://www.matt.security/record#mythos-openbsd",
      "disclosed": "2026-04-07",
      "period": "Apr 2026",
      "organisations": [
        "Anthropic",
        "OpenBSD"
      ],
      "headline": "A 27-year-old bug in OpenBSD, found for under $50.",
      "summary": "Anthropic's Claude Mythos Preview autonomously found and exploited a flaw in OpenBSD's TCP stack that had survived 27 years of review and millions of fuzz tests. The model run that surfaced it cost under $50. Anthropic reported thousands of zero-days across every major operating system and browser.",
      "so_what": "The cost of finding a serious bug fell to the price of lunch.",
      "pattern": "Reviewed for decades is not the same as secure today.",
      "ai_role": "model-found-vulnerabilities",
      "real_systems": "no",
      "source_status": "official",
      "official_sources": [
        {
          "label": "Anthropic Frontier Red Team",
          "url": "https://www.anthropic.com/research/mythos-preview"
        },
        {
          "label": "Project Glasswing",
          "url": "https://www.anthropic.com/glasswing"
        }
      ],
      "press_sources": [
        {
          "label": "VentureBeat",
          "url": "https://venturebeat.com/security/mythos-detection-ceiling-security-teams-new-playbook"
        }
      ],
      "analysis_sources": [
        {
          "label": "Bloo",
          "url": "https://bloo.io/resources/articles/claude-mythos-zero-days-explained"
        }
      ],
      "matt_analysis": "https://www.matt.security/blog/ai-found-27-year-old-openbsd-bug"
    }
  ]
}