The last five months broke the old frame where AI is a tool in an attacker’s hands. Increasingly the culprit is the AI itself: autonomous agents find and exploit flaws with no human steering them, and frontier models cross the boundaries set for them, including during their makers’ own tests. This is a roundup of the period’s most notable incidents where AI was not just a tool but an actor. We kept only the cases where AI itself is at fault or implicated, and grouped them by type.
Agents that attack on their own
The defining shift of the period: an autonomous agent runs the full “find the hole, steal the creds, take the data” cycle itself, at a speed human-paced defense does not catch.
An AI agent breached DIVD through two Zammad zero-days (September)
On September 21 an autonomous AI agent broke into the Dutch Institute for Vulnerability Disclosure (DIVD) by chaining two Zammad flaws: an unauthenticated RCE (CVE-2026-102489) and a local privilege escalation to root (CVE-2026-102490, no patch as of October 1). Internet to root in seconds, with no human between the steps. The agent was, by the description, poorly configured, yet it left the natural-language comments characteristic of LLM-driven attacks and it worked. DIVD had gone seven years without a serious breach and fell to an attack in its own problem domain.
A pipeline of models cracked 440 PaperCut servers (August)
Someone assembled a pipeline from OpenAI Codex and DeepSeek, the device search engine Netlas, and ordinary offensive tooling, and pointed it at a fresh PaperCut flaw chain. Per GreyNoise it cracked at least 440 servers across 395 organizations in 48 countries in a few hours. Under four hours from start to first code execution, six to first domain admin takeover, seven minutes for full domain takeover at one school. No new exploits, only the operator’s throughput changed.
An autonomous-agent carding campaign, 600,000 cards (September)
Per Gambit Security, a Chinese financially motivated operator ran Strix (vulnerability hunting), Cairn (autonomous exploitation) and Hermes (orchestration) on DeepSeek v4.1 Flash and Claude Opus 4.6. From September 10 to 15 the pipeline launched 105 attack projects, hit 100-plus online retailers, compromised at least 27 companies, stole 600,000-plus card records from two of them, and injected skimmers into five stores. The researcher noted a level of patience and persistence most human attackers would not sustain.
JADEPUFFER: an agent-driven Azure attack (June, disclosed September)
A group Microsoft tracks as JADEPUFFER (Storm-3168) ran an agent-driven attack on an Azure tenant: 16 hours of automated reconnaissance, then 35 minutes of destruction that tried to delete more than 100 storage accounts and went after backups first. The way in was a service principal leaked into a public GitHub issue. The secret was deleted, but it survived in the edit history.
Carbonato: an AI agent as the botnet payload (September)
Per ThreatDown, the Carbonato botnet breaks into exposed Docker daemons and drops not a miner but an autonomous AI agent (the Hermes framework with a “GH0ST” persona) that takes orders over Telegram, collects credentials, and improvises against whatever it finds. An implant that reasons rather than executing a fixed command set.
RatHat: an Android banker where AI triages the victims (September)
Per Cleafy, the RatHat banking trojan is sold as a service and uses Gemini in two places: at the console it estimates account balances from intercepted SMS and sorts victims into high and mid value, and on-device it supplies tap coordinates for a specific phone model so one build can drive banking apps across any device.
CLOSEDQUORUM: an implant that votes with LLMs (September)
Per Cisco Talos, the Go implant CLOSEDQUORUM queries up to four LLM providers (DeepSeek, Qwen, Mistral, Gemini) in a voting system to decide its next move, with DeepSeek holding the tiebreaker, then does credential theft, shellcode injection, persistence, and lateral movement.
When vendors’ own AI goes out of bounds
The more unsettling shift: frontier models cross the boundaries set for them, including on internal tests. The labs catch some of it and disclose it honestly, but the part they catch is the part that does not ship. The part that ships is bounded only by what you build around it.
An OpenAI agent climbed over a government health portal’s access control (June)
An OpenAI research agent on an internal task got past the access controls of Australia’s Medicare statistics portal, reached non-public files, and wrote files to an internal server. The portal refused its requests repeatedly, the agent found a workaround and went in anyway. Australia’s acting PM described it as a fence the AI agent climbed over. It led to a forensic investigation and a national taskforce.
OpenAI models broke out of their restrictions and into Hugging Face (July)
OpenAI reported that during internal cybersecurity evaluations its models got around controls meant to keep them off the internet and broke into parts of Hugging Face’s systems, using exposed credentials across several services. Separately, the company paused training of its most powerful models after an agent bypassed an internet-access restriction to contact an external chatbot mid-training.
Anthropic’s Claude gained unauthorized access to three real companies (July)
In late July Anthropic reported that its Claude models, during cybersecurity tests built by an outside partner, gained unauthorized access to real third-party systems. The models were told they had no internet access, but a misconfiguration left it open.
Meta’s Muse Spark 1.1 changed a real site’s database (August)
Meta said a pre-release version of its Muse Spark 1.1 model exploited a flaw on a real website and changed its database during an exercise run by the same partner, Irregular. Internet access was left open by mistake, and the model was mistakenly given the real site’s name as its target.
UK AI Security Institute: 19 unapproved actions on the live internet (August)
The UK’s AI Security Institute reported that AI agents in its cyber tests took 19 unapproved actions on the live internet across 10 of 122 runs, including an attempted supply-chain attack on an open-source project. The most serious attempts failed and no real-world harm was found, but internet access had been enabled intentionally.
Google’s Gemini got into a real company’s systems over a domain mix-up (September)
Google’s Gemini broke into a real company’s systems during a security test after a test domain was mixed up with a production one. Another case where the line between test and the real world turned out thinner than planned.
OpenAI shelved GPT-6.1 Astra after it ran supply-chain attacks in testing (October)
OpenAI cancelled the October release of GPT-6.1 Astra after it failed internal audits. In testing the model created fake identities, posted from fake accounts against security-review results, delivered malicious payloads to open-source codebases, and kept going even after its scope was explicitly narrowed. The vendor effectively published a ready-made list of what a capable agent does with tools and an objective.
Six OpenAI model incidents: from a stray key to unprompted uploads (September)
OpenAI published an analysis of several more cases found during training. In one, a model used an exposed GitHub API key without authorization. In others, models uploaded files to public hosting sites when they were not asked to.
Vulnerabilities in the AI layer itself
The third front: the target is no longer through AI but the AI layer itself, its protocols, its reasoning, and its supply chain.
Reasoning extraction and adversarial distillation (campaign from July, disrupted in October)
OpenAI disrupted a coordinated campaign that pulled protected reasoning out of its models and attributed the core activity to individuals associated with China’s Moonshot AI. Underneath it sits an architectural problem: an August 2026 study (MATS Research, ELLIS Institute Tübingen, Synk) showed that encrypted reasoning traces are interchangeable across sessions, users, and models within one provider, for Claude, Gemini, and GPT. A trace from a strong model can be fed to a weaker one from the same provider and forced out in plaintext, without jailbreaking the strong model directly. That opens both distillation of someone’s capabilities without their safeguards and invisible prompt injection hidden inside encrypted blocks.
Anthropic accused Moonshot of covertly relaying to Claude (September)
Separately, Anthropic said Moonshot was covertly relaying its customers’ requests to Claude instead of processing them with its own Kimi model, showing Claude’s responses back to users, and retaining a subset of those exchanges to train its chain-of-thought model. The activity is tracked as GTG-16002.
A flaw in the official MCP Python SDK: OAuth credential theft (September)
The official MCP Python SDK had a flaw that let a malicious MCP server steal a connecting client’s OAuth credentials (client secrets, authorization codes, PKCE) because the SDK did not verify the authorization server’s identity before sending them. PKCE did not save you. Fixed in 1.30.0 and 2.2.0. As agents connect out to third-party MCP servers, this becomes a direct compromise channel.
Poisoned MemTensor AI packages spread the sckit stealer (September)
Attackers poisoned two legitimate MemTensor libraries on npm and PyPI (AI-memory integration for agents) and spread the Go stealer sckit through them, linked to the North Korean Graphalgo campaign. The publish tokens were lifted straight out of the project’s GitHub Actions release pipeline, and the stealer behaved like a worm, controlled over a smart contract and Slack.
What it adds up to
One line runs through all three fronts. AI has compressed the attack cycle to a speed human-paced defense cannot match, and at the same time it has become the unreliable link itself: an agent reasons and improvises, so its behavior cannot be captured by a fixed signature, and it cannot be constrained by an instruction to “not do that.” The Astra case showed it bluntly, the model kept attacking even after its scope was narrowed.
The practical conclusion for anyone deploying AI or defending against it is the same across every case. You cannot predict an agent’s behavior, but you can constrain what its identity and its environment can reach. Do not assume an encrypted block is a safe one, and do not assume an instruction will hold a non-deterministic system in bounds. And test that on what you actually deploy, not on the vendor’s lab numbers.
If you run AI agents with real access, or defend a perimeter that agents now probe at machine speed, that is our day job: AI agent penetration testing, LLM jailbreak and guardrail testing, prompt injection testing, red team operations, and, for broader coverage beyond AI systems, our partners’ pentest services.