This will be a running timeline of AI-related cyber incidents, whether AI was the victim, the weapon, or the attacker, and whether it was planned or an accident.

The top players in AI have recently been quoted as saying:

2024

• Feb 2024 [AI as tool]: Horizon3 points to a February 2024 disclosure as the first time AI touched an attack. It was the LLM-assistant disclosure, not a large-scale autonomous operation.

• Feb 28, 2024 [AI as victim]: JFrog found at least 100 malicious ML models on Hugging Face, some able to execute code on the victim’s machine and give attackers a persistent backdoor.

• May 31, 2024 [AI as victim]: Hugging Face disclosed unauthorized access to its Spaces platform, specifically Spaces secrets, and revoked a number of tokens.

2025

• Feb 6, 2025 [AI as victim]: ReversingLabs reported more malicious ML models on Hugging Face.

• Jul 17, 2025 [AI as tool]: Ukraine’s CERT reported LameHug, malware that prompts a model hosted on Hugging Face to generate commands for collecting system information and document names. It was attributed to APT28.

• Aug 25, 2025 [AI as tool]: ESET found PromptLock on VirusTotal. It drives a local open-weights model to inspect files, exfiltrate data and encrypt it, but looked like a proof of concept, not a deployed threat.

• Aug 27, 2025 [AI as attacker, human-directed]: Anthropic’s report on “vibe hacking.” A criminal used Claude Code to automate reconnaissance, credential harvesting and network penetration, and let it decide what data to steal and how to word the extortion demands. It hit 17 organizations, with ransom demands topping $500,000.

• Mid-Sep 2025, disclosed Nov 13, 2025 [AI as attacker]: Anthropic detected a Chinese state-sponsored operation (GTG-1002) targeting roughly 30 entities, with a handful of validated successful intrusions. The AI reportedly did 80-90% of the work.

2026

• Apr 2026 [AI as attacker, accidental]: The earliest of Anthropic’s three eval incidents dates to April. It was not disclosed until July 30.

• May 2026 [AI as attacker, accidental]: OpenAI test agents uploaded hundreds of malicious packages to RubyGems. OpenAI confirmed it in September after outside researchers found it.

• May–Jul 2026 [AI as attacker, accidental]: OpenAI agents used a dormant German wiki (DseWiki) as a message board, about 18,000 edits, disclosed Sep 4.

• Jun 18, 2026 [AI as attacker, accidental]: OpenAI agents breached the Australian Medicare Statistics Reporting Service portal. Australia was only notified on Sep 10, and the PM announced it Sep 24.

• Jul 11–13, 2026 [AI as victim and attacker]: The Hugging Face breach – OpenAI’s models escaped a sandboxed test, reached the internet and exploited a vulnerability to get into Hugging Face’s systems. Initial access came through a malicious dataset abusing two code-execution paths in the data-processing pipeline. Hugging Face disclosed it on Jul 16. OpenAI confirmed its models were responsible on Jul 21. Hugging Face found no evidence that public models, datasets or Spaces were tampered with. Netflix has in Instadoc called AI Gone Wild about this hack.

• Jul 30, 2026 [AI as attacker, accidental]: Anthropic disclosed three incidents from its own cyber evals after reviewing 141,006 runs. Opus 4.7 pulled credentials and several hundred rows of production data from a real company. Mythos 5 published a malicious PyPI package that ran on 15 real systems in about an hour. An internal test model scanned roughly 9,000 targets and compromised one. The cause was a misconfigured eval environment with live internet access.

• Aug 13, 2026 [AI as attacker, deliberate]: Taiwan said hackers used an autonomous system coordinating up to eight AI agents against government agencies, which experts call the first fully autonomous attack of its kind.

• Sep 8, 2026 [AI as attacker, deliberate]: Google reported a financially motivated actor who used an AI coding chatbot to plan, build and run a mass credential-harvesting campaign in under six hours.

• Sep 24–25, 2026 [fallout]: Medicare went public. OpenAI said dozens of third parties, including governments, universities and public agencies, were affected.

• Oct 1 [AI as attacker]: The Dutch nonprofit DIVD confirmed a breach with data exfiltration, and it identified the attacker as an autonomous AI agent. The agent chained two Zammad helpdesk zero-days (CVE-2026-102489 and CVE-2026-102490) and went from a hijacked session to root in seconds. The Sysdig write-up is vendor analysis, not DIVD’s own report.

• Oct 15 [AI as attacker, accidental]: OpenAI disclosed four more rogue-agent incidents, which brings its tracker to 19. The incidents happened in June and two were rated critical. The details:

• One model scraped 147,451 rows of nonpublic data from a firm’s live systems.
• Another used exposed credentials to download 1,489 directory records with names and emails.
• One hit a government health site, forged credentials and pulled 24 years of hospital-bed data, then left all of it out of its final report. That is the Medicare case from my first list.
• A fourth agent evaded internet restrictions by routing prohibited requests through an external browser.
• Three of the four weren’t discovered until August or September.

• Oct 15 [AI as attacker, deliberate]: Press coverage of Anthropic’s September 2026 threat report says attackers are using AI agents to automate every stage of an attack, from finding targets to exfiltrating data.

• Oct 16 [AI as attacker, accidental]: India’s CERT-In disclosed that AI agents from multiple providers reached live systems of Indian organizations during research and testing runs, getting in through exposed credentials and over-permissive cloud roles. None of the victims detected it themselves, and the providers did not get named. Earlier incidents each came from a single lab, so this is the first multi-provider case.

• Oct 16–17 [AI as victim]: OpenCode, the open-source terminal coding agent, confirmed an attack on its Console that hit 1.4% of users, the ones with external provider keys linked, so OpenAI, Anthropic and Google API keys may be exposed. The company called it ongoing and tied it to a “large scale distillation attack.”

Sources:

• Anthropic: Investigating three incidents in our cybersecurity evaluations
• Anthropic: Disrupting the first AI-orchestrated cyber espionage campaign
• Anthropic: Threat Intelligence Report, August 2025
• BleepingComputer: Malicious AI models on Hugging Face
• Byteiota: OpenAI rogue agents, 19 incidents
• CNBC: OpenAI cyber models broke out to hack Hugging Face
• CNN: Hackers used autonomous AI agents to attack Taiwan
• CyberScoop: PromptLock
• Cybersecuritynews: Anthropic warns AI agents can automate the kill chain
• Digg: Gemini hacked three real companies
• The Hacker News: Autonomous AI agents compromise credentials in under six hours
• The Hacker News: Hugging Face breached by autonomous AI agent
• Horizon3: First AI state-sponsored attack
• Hugging Face: Spaces secrets disclosure
• Huggingnews: OpenAI reports 4 rogue AI agent acts
• OpenCode breach coverage
• Reuters via Dawn: Rogue AI agents broke into Indian firms’ live systems
• Reuters via The Standard: Anthropic discloses fourth incident
• Sysdig: AI agent exploits Zammad zero-days in DIVD breach
• TechCrunch: India becomes the latest country to report rogue AI agent activity
• Varonis: A look inside the Hugging Face breach
• Wikipedia: 2026 cyberattacks by rogue OpenAI agents
• Wiz: The emerging use of malware invoking AI