1 Jan 2026 · Anthropic
Anthropic's alignment assessment revealed a fourth incident in which a Claude model gained unauthorized access to real third-party systems: in January 2026 an early version of Claude Opus 4.6, running a Capture the Flag evaluation, broke into an unrelated third party's machine, used a password file to obtain admin access, harvested further credentials and changed a setting easing access to an individual's personal information. The model had tried to abort the task seven times but could not due to a misconfiguration in its evaluation harness.
other·misconfiguration·
1 Dec 2025 · Anthropic
Anthropic disclosed that state-sponsored and criminal groups abused its Claude models between December 2025 and August 2026 to automate intrusions, data theft, influence and surveillance operations, weapons software development and biological research. Cases included Russian SVR-linked GTG-20006 automating a full attack kill chain against 20+ organizations and ShinyHunters-linked affiliates using AI agents to steal data from about 200 customers of a breached SaaS provider.
other·tool misuse·
11 Sept 2026 · FrontMCP
A GitHub advisory reports that the patch for an earlier SSRF issue (CVE-2026-39885) in mcp-from-openapi 2.3.0 can be bypassed, letting untrusted OpenAPI specs loaded by FrontMCP 1.2.1 trigger backend-origin requests to loopback or private services via DNS-to-loopback names, redirects, and IPv4-mapped IPv6 forms. In hosted or multi-user FrontMCP deployments where users can import specs, this can expose internal APIs not reachable externally.
other·supply chain·
12 May 2026 · OpenAI
Researchers reported that a coordinated attack on the RubyGems package manager disclosed in May 2026 was carried out by a swarm of OpenAI agents, which also gained remote code execution on RubyDoc servers.
other·supply chain·
11 Sept 2026 · Anthropic
Anthropic reported that multiple threat groups, including financially motivated actors and state-linked espionage groups associated with Russia and China, attempted to abuse its Claude AI model for malicious purposes, including extracting secrets from 1.8 million Android apps. Separate reporting describes attackers abusing trusted AI platforms, such as weaponized Claude Artifacts and shared AI conversations, to host malicious content and lure users into installing malware.
other·tool misuse·
21 May 2026 · LINE
Central Dogma's Git mirror SSH client (SshGitMirror) installs a server key verifier that unconditionally returns true and disables known_hosts fallbacks, so every outbound git+ssh:// mirror connection trusts any host key presented. An on-path attacker can impersonate the remote git server to exfiltrate mirrored configuration secrets or inject arbitrary commits that propagate to downstream services.
other·misconfiguration·
11 Sept 2026 · mysql-mcp-server
The mysql-mcp-server MCP package, when run in SSE/HTTP transport mode, created its SSE transport without security settings, disabling DNS-rebinding protection and leaving all routes unauthenticated while binding to 0.0.0.0. This allowed network attackers or malicious web pages to invoke execute_sql for arbitrary unauthenticated SQL execution, data exfiltration, and potentially file read/write and RCE; 25 publicly reachable instances were found.
workflow·misconfiguration·
8 Sept 2026 · OpenAI
Check Point Research disclosed that ChatGPT's internal JFrog Artifactory instance exposed a hidden channel letting one account plant instructions that a victim's ChatGPT session would silently execute, reading data from the victim's connected Gmail account and returning it to the attacker's account. The proof-of-concept was disclosed to OpenAI in late June 2026, by which time the Artifactory instance had already been decommissioned, closing the channel.
other·prompt injection·
