Threat stats
These figures cover only incidents AI Security Guru has reported. They are not industry-wide totals. A campaign roundup counts as one incident, and a later report that names one victim is a separate row. A figure such as “200 organizations” is not turned into 200 incidents. Unknown means the report did not say.
61 incidents. Last updated November 7, 2026 at 9:26 AM CST.
AI advisoriesSources and methodologyIncident RSSIncident JSON
These chips filter incidents this desk has logged. Leave them off to see every row.
All 61 reported incidents. A zero means none of them were classified in that industry.
All reported incidents. Each incident has one attack type.
OWASP Top 10 for LLM Applications 2025. A zero means none of the reported incidents were tagged with that category. 39 incidents have no OWASP tag because the report did not name one. An incident can count in more than one category.
Tactics and techniques named only when the report supports that ATLAS entry. 57 incidents have no ATLAS tag.
Weekly counts of critical and high incidents. Medium, low, and unknown severity are left off this chart. An incident with no recorded day is left off it too. Empty weeks had no critical or high incident in this set.
Week of Sep 28
Week of Oct 5
Week of Oct 12
Week of Oct 19
Week of Oct 26
Week of Nov 2
An incident can count in more than one column. Unknown means the report did not say what was taken.
Named in incidents dated Oct 9, 2026 through Nov 7, 2026. One incident adds one count to each name on it.
| Date | Incident |
|---|---|
| Nov 6, 2026 | Lavish-axi loopback HTTP DNS-rebinding arbitrary file read / prompt queue
|
| Nov 6, 2026 | GROBID unauthenticated /api/modelTraining unbounded thread-pool DoS
|
| Nov 6, 2026 | OpenBMB Internet of Agents Code Executor unauth code injection
|
| Nov 6, 2026 | Agenta workflow revision URL SSRF leaks secret-resolve Authorization token
|
| Nov 6, 2026 | PyTorch TorchServe /tmp model-handler swap local privilege escalation
|
| Nov 6, 2026 | Dify authenticated SSRF bypass via remote-files/Squid ACL gap (cloud metadata/IAM risk)
|
| Nov 6, 2026 | Tracecat Docker Compose SAML unsigned-response account takeover (AI-agent SOAR)
|
| Nov 5, 2026 | Backdoored ARTEX Docker image tomicdd/artex, root shell, 62 consoles and 9,000 pulls
No source URL in the log |
| Nov 5, 2026 | CERT-In Crafty Falcon AI-assisted attacks on India banking, finance, and cryptoAgentic
No source URL in the log |
| Nov 5, 2026 | MCP TypeScript SDK unauth HTTP request validation DoS (heap OOM)
|
| Nov 5, 2026 | MCP TypeScript server shared transport delivers one HTTP client messages to another
|
| Nov 5, 2026 | Amazon GluonTS crafted tar archive path traversal allows arbitrary local file write (CVSS 7.8/8.4 High); fixed 0.17.0
|
| Nov 5, 2026 | DB-GPT CodeAction execute_code unauth code injection (companion to CVE-2026-123019)
|
| Nov 5, 2026 | DB-GPT HuggingFace Adapter trust_remote_code default enables remote code execution
|
| Nov 5, 2026 | AgentScope unauthenticated OS command injection via MCP stdio workspace config
|
| Nov 5, 2026 | AgentScope Bash Tool check_permissions bypass enables arbitrary file writes
|
| Nov 5, 2026 | AgentScope Agent Service X-User-ID missing authentication
|
| Nov 5, 2026 | OpenBMB Internet of Agents WebSocket ConnectionManager missing authentication
|
| Nov 5, 2026 | ChatCLI MCP OAuth accepts unvalidated Protected Resource Metadata (token confusion)
|
| Nov 5, 2026 | mcp-go OAuthHandler accepts unvalidated well-known Protected Resource Metadata
|
| Nov 5, 2026 | OpenHuman MCP tool metadata prompt injection into agent context
|
| Nov 5, 2026 | OpenHuman leaks JSON-RPC bearer token via approval session_id
|
| Nov 5, 2026 | Banks prompt library RCE via unsafe Tool.import_path in CompletionExtension
|
| Nov 5, 2026 | Code Graph RAG MCP read_file path traversal arbitrary file read
|
| Nov 5, 2026 | Code Graph RAG AstGrepService symlink escape outside project_root
|
| Nov 5, 2026 | Kubeflow Pipelines multi-user empty-namespace shared pipeline modify/delete auth gap
|
| Nov 4, 2026 | Acronis TRU reports the BOSSAI 12-agent AI attack meshAgentic
No source URL in the log |
| Nov 4, 2026 | GPUStack auth bypass exploited in the wild, CVSS 9.8
|
| Nov 4, 2026 | MLflow SHAP load_explainer deserialization RCE (user interaction required)
|
| Nov 4, 2026 | MLflow get-artifacts unauthenticated SSRF information disclosure
|
| Nov 4, 2026 | DeepSeek Harness unauthenticated local RPC/WebSocket control plane can drive session.prompt and host tools (CVSS 8.4 High, AV:L)
|
| Nov 4, 2026 | Malicious npm MCP @ifasn/ms-doc-mcp harvests Alibaba Cloud IMDS credentials (stdout to MCP client)
|
| Nov 4, 2026 | Kernel.sh breach notice, ARTEX-assisted, 0.28% of customersAgentic
No source URL in the log |
| Nov 3, 2026 | AgenticFlow sandbox escape exposed saved LLM keys, MCP tokens, and workspace data
|
| Nov 3, 2026 | Binance $6.3B theft via a tampered Homebrew install of an AI coding tool and abuse of an internal AI tool
No source URL in the log |
| Nov 3, 2026 | Docker Sandboxes sbx cp symlink flaw lets a sandboxed AI agent read or overwrite host files (CVE-2026-103916)
|
| Nov 3, 2026 | Google GTIG and Mandiant LLMjacking report, cloud charges up to $1M
No source URL in the log |
| Nov 2, 2026 | GitBook AI-agent attackAgentic
No source URL in the log |
| Nov 1, 2026 | Beta9 (Beam) cross-tenant sandbox escapes, CVSS 9.9
|
| Nov 1, 2026 | Prefab UI generative UI sandbox escape (FastMCP generate_prefab_ui), CVSS 10
|
| Oct 31, 2026 | Chainalysis agentic intrusion; names, usernames, password hashes, and live tokens exposedAgentic
No source URL in the log |
| Oct 31, 2026 | Volta-Autodoxer infostealer uses AI to collect credentials and personal data
|
| Oct 30, 2026 | Vapor Panda used an agentic AI pentesting tool; ARTEX reported against 200+ organizationsAgentic
|
| Oct 30, 2026 | TAKO AI Agent for Okta authenticated RCE, CVSS 8.8
|
| Oct 30, 2026 | n0n ransomware operator spent more than $7,000 on AI services during extortion attacks
|
| Oct 30, 2026 | WorkOS sales app breach, ARTEX AI-agent campaignAgentic
No source URL in the log |
| Oct 29, 2026 | Trojanized Claude Code extension on the Cursor marketplace installed an SSH backdoor, about 5,000 users
|
| Oct 29, 2026 | MLflow PickleEvaluationArtifact untrusted pickle deserialization RCE (CVSS 7.8 High, UI required); fixed 3.13.0
|
| Oct 29, 2026 | EMBRACE embedded-browser flaws in Cursor, Copilot, Codex, VS Code, and Claude Desktop
|
| Oct 28, 2026 | 123 Reg discloses an attack on customer data and suspects an ARTEX-related operatorAgentic
|
| Oct 28, 2026 | Strands Agents Tools secret masking bypass (GHSA moderate, AWS important)
|
| Oct 28, 2026 | Kubeflow Pipelines multi-user empty-namespace upload skips SubjectAccessReview (cross-tenant pipeline injection)
|
| Oct 28, 2026 | Kubeflow Pipelines frontend unauthenticated SSRF via http/https artifact sources
|
| Oct 28, 2026 | Kubeflow Pipelines unauthenticated SSRF through artifact provider endpoints
|
| Oct 27, 2026 | Mittwald MCP server compromise: AI-assistant session tokens stolen
|
| Oct 26, 2026 | Chainstack production breach (Oct 26–31), ARTEX AI-agent campaignAgentic
No source URL in the log |
| Oct 26, 2026 | ChatGPT shared-link P1 flaw could run attacker code and read private chats
|
| Oct 21, 2026 | Botpress breach: auth proxy flaw let attacker read bot configs with AI provider keys in 16 customer workspaces
|
| Oct 2, 2026 | GitLab AI Gateway RCE, called critical by BleepingComputer
|
| Sep 29, 2026 | AG2/AutoGen SandboxShellTool newline injection bypasses allowed/readonly shell filters (host RCE)
|
| Unknown | Langflow authenticated RCE exploitation, called critical by The Hacker News (mid-October; day not recorded)
|
AI Security Guru