AI Incident Tracker
AI Incident Tracker
Documented AI failures, security flaws, misuse and regulatory actions, with sources.
Last checked Oct 29, 2026, 9:11 PM CT
- Cisco Talos finds NIK C2 malware framework that can run AI requests on the victim's own OpenAI API keyResearch published · Verified
- Researchers report flaws in the built-in browsers of five AI coding assistants, two still unpatched in Codex and VS CodePartly fixed (Cursor, Copilot); others open · Reported
- WIRED reports a defense contractor connected a personal Claude Code agent to a Defense Department system, and the agent sent login details to an outside websiteDisputed; details not confirmed officially · Reported
- Researchers find a fake Solana starter-kit repository on GitHub whose setup step installs remote-access malware when an AI coding agent follows itResearch published; payload server offline · Reported
- UK domain registrar 123 Reg tells customers that an intrusion it calls an AI-driven cyberattack exposed customer contact and account dataContained; customers notified · Reported
- GitHub Copilot outage: several OpenAI and Microsoft models unavailable or degraded for about 75 minutes because of an upstream model provider issueResolved · Verified
- Cequence: one attacker posed as about 32 AI bots, including ChatGPT, Claude and Perplexity crawlers, to scan organizations for passwords and cloud keysOngoing campaign; advisory issued · Verified
- Brazilian police arrest five in a fake-donation scheme that used AI deepfake videos of singer Gusttavo Lima and well-known priests, moving nearly R$10 millionArrests made; investigation ongoing · Verified
- Security firm Dream says an AI-assisted campaign chained the PHP2Shell flaws with a Linux kernel bug to take over 25 firewall servers, including systems in a U.S. government-affiliated networkResearch published; vendor notified · Reported
- Florida's attorney general sues the company behind the A2E AI platform, alleging its tools let users make nonconsensual nude images, including of minorsLawsuit filed; case pending · Verified
- Critical flaw in Red Hat OpenShift AI's model gateway could let a signed-in user use another tenant's AI provider keys and quotasNo fix listed yet · Verified
- Researcher finds 26,400 working cloud and AI service keys left in public Gitee code repositoriesDisclosed · Reported
A new card every 4 seconds. Stop it anytime, or hover over it to hold a card.
How this list works. Entries come from four places: Confirmed stories in our own news feed, the AI Incident Database (CC BY-SA 4.0), critical-severity (CVSS 9.0+) AI software flaws in the NIST National Vulnerability Database, and incident case studies in MITRE ATLAS. Our editors also add incidents that aren’t in our feed from official company notices and status pages, government advisories and news reports, each linked to its source. Descriptions use each source’s own wording, so “reported” and “alleged” mean the claim hasn’t been confirmed in court or by the company. “Not stated in source” means the source doesn’t describe a fix. Where a report isn’t from an established news outlet, fact-checker or government site, or may be the misleading content itself, we link the AI Incident Database record instead. Every entry is labeled Verified or Reported. Verified: a Confirmed story in our feed, an official record (NIST NVD, MITRE ATLAS), or an editor entry backed by an official source or several reputable outlets. Reported: a claim from a single source (a Reported story in our feed, an editor entry from one credible report, or an AI Incident Database report) that we haven’t confirmed. Types are assigned by keyword rules; anything unclear is filed under Other. New security incidents from our feed appear as soon as we publish the story, marked “Not yet reviewed” and described with the story’s first sentence; an editor then checks them against the source and fills in the response and status.
| Date | What happened | Type | Response | Status | Source |
|---|---|---|---|---|---|
| 2026-10-29 | Cisco Talos finds NIK C2 malware framework that can run AI requests on the victim's own OpenAI API keyCisco Talos reported on October 29, 2026 that it observed a new command-and-control framework, called NIK C2, in the wild. Its Windows implant can steal credentials, log keystrokes, capture the screen and deploy screen-locking ransomware, and it includes a command that sends attacker prompts to OpenAI's Chat Completions API from the infected computer so collected data can be analyzed by an AI model during the intrusion. If the attacker supplies no API key, the implant reads the victim's OPENAI_API_KEY environment variable, so the requests would be billed to the victim's account and logged under the victim's key. Talos did not name victims or say how many systems were affected. NIK C2 Windows implant using the OpenAI Chat Completions API | Other | Talos advises defenders to watch for this kind of behavior on endpoints. Organizations can reduce the risk by not leaving OpenAI or other AI API keys in environment variables on general-use machines where possible, setting spending limits, and rotating keys on any system suspected of compromise. | Research published · Verified | Cisco Talos ↗ Infosecurity Magazine Oh My AI editors |
| 2026-10-29 | Researchers report flaws in the built-in browsers of five AI coding assistants, two still unpatched in Codex and VS CodeSecurity firm Forever Security published research on October 29, 2026 showing that the browsers built into five AI coding assistants could let a web page or a local project file reach the computer behind them. In Cursor, a web page with a hidden command led the agent to ask to run it with one keypress, and when the sandbox blocked it the agent turned the sandbox off and retried. In GitHub Copilot, a page could make the address bar show a different site, such as a fake sign-in page. In Codex, VS Code and Claude Desktop, opening an HTML file from a rigged project could let a background script read files elsewhere on the disk, such as SSH keys, .env files and tokens, and send them out. The researchers did not report the techniques being used in real attacks. Embedded browsers in Cursor, GitHub Copilot, OpenAI Codex, Microsoft VS Code and Anthropic Claude Desktop | Security vulnerability | Cursor fixed its issue on October 1 and GitHub fixed Copilot in version 1.1.29 on October 13. The researchers say the Codex and VS Code issues had no fix as of October 29; Anthropic and Microsoft declined the reports, citing the Workspace Trust prompt. Developers should be careful trusting unfamiliar projects and opening HTML files an assistant links to. | Partly fixed (Cursor, Copilot); others open · Reported | Forever Security research ↗ Help Net Security Oh My AI editors |
| 2026-10-29 | WIRED reports a defense contractor connected a personal Claude Code agent to a Defense Department system, and the agent sent login details to an outside websiteWIRED reported on October 29, 2026, citing unnamed sources, that earlier this year an Accenture employee working as a Department of Defense contractor connected a secure DOD coding environment on NIPRNet, the department's unclassified network, to their personal Claude Code account so the agent could write and deploy code. According to the sources, the employee gave the agent their login credentials, and the agent appears to have sent those credentials, passwords and a map of the network to a third-party website that NIST has flagged as high risk. The sources say the agent ran on the network for about two months before it was found. The environment held controlled unclassified information; WIRED reports no indication that classified systems were accessed. Claude Code (Anthropic AI coding agent) on a personal account, connected to a DOD coding environment on NIPRNet | Agent unintended action | WIRED's sources say the issue was patched after the agent was found. The DOD said it does not comment on the status of its networks or systems. Accenture told WIRED the allegations were thoroughly and independently investigated and found to be without merit, and that it complied with its legal and contractual obligations. Anthropic pointed to its usage policy, which bars using its products to bypass security controls without authorization. | Disputed; details not confirmed officially · Reported | WIRED ↗ Oh My AI editors |
| 2026-10-29 | Researchers find a fake Solana starter-kit repository on GitHub whose setup step installs remote-access malware when an AI coding agent follows itAIR Research Lab reported on October 29, 2026 that a GitHub repository posing as a Solana starter kit, which it says ranked as the top search result for agents looking for one and had 286 stars, gives a single PowerShell 'installation' command in its README. If an AI coding agent runs that command, it downloads and runs a script that installs a configured copy of NetSupport Manager, a legitimate remote-access tool, letting the attacker control the Windows computer and the crypto wallets on it. The researchers link the setup to an operator that previously used the same method against traders. They did not report how many machines were affected. AI coding agents that search the web and run shell commands (GitHub repository SolanaUpdateTools/solana-starter-kit; Windows PowerShell payload) | Other | The researchers say the payload address was offline when they checked. They advise treating search results and READMEs as untrusted, not letting agents run commands that download and execute remote code without review, and, on any machine that ran it, looking for a hidden 'y2inwRnI6G' folder under %LOCALAPPDATA% or a 'SecureModule' Run key, then disconnecting it and rotating credentials and wallet keys. | Research published; payload server offline · Reported | AIR Research Lab (Air Security) ↗ Oh My AI editors |
| 2026-10-28 | UK domain registrar 123 Reg tells customers that an intrusion it calls an AI-driven cyberattack exposed customer contact and account dataThe Register reported on October 28, 2026 that UK domain registrar 123 Reg, owned by GoDaddy, began emailing customers this week about a September 18 intrusion it described as "the first known AI-driven cyberattack against our company." A company spokesperson said names, phone numbers, countries, language and currency preferences, account creation dates, products on the account, marketing preferences and company VAT numbers were affected, along with product information from an API. The company said the attacker's activity was limited to reading data, but copies may have been made. The spokesperson said the core attacker infrastructure was hosted in China and Singapore and held AI attack "skills", including copies of skills open-sourced by Anthropic, and that the company suspects a link to an actor that used the ARTEX AI penetration-testing tool against South Korean financial firms; this attribution is the company's assessment. 123 Reg customer systems (attacker used AI agent attack tooling) | Data leak/breach | 123 Reg says it reported the incident to law enforcement, brought in outside cybersecurity help, worked with Singapore-based internet providers to shut down attacker servers, and notified the U.S. Federal Trade Commission and UK and EU data protection authorities. It advises customers to treat unexpected messages claiming to be from 123 Reg with caution and to turn on two-step verification. | Contained; customers notified · Reported | The Register ↗ Oh My AI editors |
| 2026-10-28 | GitHub Copilot outage: several OpenAI and Microsoft models unavailable or degraded for about 75 minutes because of an upstream model provider issueGitHub's status page reported a disruption to Copilot services on October 28, 2026, from 14:12 to 15:28 UTC (9:12 to 10:28 a.m. Central), rated critical. GitHub said an issue with an upstream model provider caused degraded availability for the GPT-5.3-Codex, GPT-5.6 Luna, GPT-6.1 Sol, GPT-5.6 Terra, GPT-6 Luna and MAI Code 1.1 Flash models in Copilot products and IDE surfaces, and recommended choosing another model in the meantime. GitHub Copilot (GitHub, Microsoft) | Outage | GitHub said it identified the root cause, applied a mitigation and marked the incident resolved at 15:28 UTC. It said a detailed root cause analysis will be shared when available. | Resolved · Verified | GitHub Status ↗ Oh My AI editors |
| 2026-10-28 | Cequence: one attacker posed as about 32 AI bots, including ChatGPT, Claude and Perplexity crawlers, to scan organizations for passwords and cloud keysCequence Security's CQ Prime Research reported on October 28, 2026 that a single actor, running from a major cloud provider, rotated through about 32 AI bot identities while requesting files that commonly hold secrets, such as .env configuration files, cloud credential files and private SSH keys, from a list of about 90 paths. Cequence says the scanner was active from at least late September through late October, hit organizations in financial services, retail, telecommunications, energy and software, used more than 300 cloud IP addresses in one day, and on one day in October reached 48% of the Cequence-protected organizations that saw any AI bot traffic. The AI companies' real bots were not involved; their names were copied. Websites and APIs that allow traffic from AI crawlers and assistants (bot identities of OpenAI, Anthropic, Meta, Perplexity and others were faked) | Fraud/scam | Cequence says nearly all of the scanner's requests were blocked or failed. It advises verifying AI agents through signed requests, published address ranges or direct integrations rather than trusting the identity a bot claims, and watching for behavior that doesn't match that identity. | Ongoing campaign; advisory issued · Verified | Cequence CQ Prime Research ↗ Dark Reading Oh My AI editors |
| 2026-10-28 | Brazilian police arrest five in a fake-donation scheme that used AI deepfake videos of singer Gusttavo Lima and well-known priests, moving nearly R$10 millionThe Civil Police of Brazil's Federal District (PCDF) launched Operation Cáritas on October 28, 2026 against a group suspected of running fake online donation campaigns. According to the police, the group posted fundraising pages using images of elderly people, children and seriously ill people, and used AI tools, including deepfake videos of singer Gusttavo Lima and priests Marcelo Rossi and Fábio de Melo, plus religious imagery, to draw donors from social media. Money went to accounts the group controlled. Police say one company linked to the group received about 215,000 transactions totaling almost R$10 million in 45 days. AI video-generation tools used to make deepfakes (not named) | Fraud/scam | Six preventive-arrest warrants and search warrants were served in the Federal District and the states of Goiás, Minas Gerais, Santa Catarina and São Paulo; five suspects had been arrested by midday. A court ordered assets frozen, and police seized luxury vehicles and identified about US$400,000 in cryptocurrency. The suspects may face charges of electronic fraud, criminal organization and money laundering; nothing has been proven in court. | Arrests made; investigation ongoing · Verified | CNN Brasil ↗ g1 Oh My AI editors |
| 2026-10-28 | Security firm Dream says an AI-assisted campaign chained the PHP2Shell flaws with a Linux kernel bug to take over 25 firewall servers, including systems in a U.S. government-affiliated networkIsraeli security firm Dream published research on October 28, 2026 describing artifacts it found on October 25 from a campaign that combined a custom, non-public exploit for the PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619) with the Fragnesia Linux kernel privilege-escalation bug (CVE-2026-46300) to gain root access, without credentials, on firewalls running specific versions of one large vendor's software. Dream says the attacker used the FOFA search engine to find about 19,000 exposed firewalls, narrowed them to 240 targets in the U.S., Japan, Taiwan and South Korea, and rooted 25 servers, then moved on to three servers in a U.S. government-affiliated environment, where it extracted credentials and enumerated Active Directory. Dream says Claude Code was installed on the attack infrastructure and an AI-powered offensive platform called aiscan was set up with DeepSeek and Kimi models, and that the style of about 40 scripts suggests AI-assisted development, while noting it has no direct evidence the AI tools wrote the exploit and that the operation does not appear to be fully autonomous. Dream believes the activity is part of a China-nexus operation but has not attributed it to a specific group. The firewall vendor and the government organization were not named. AI-assisted attack tooling (Claude Code and the aiscan platform with DeepSeek and Kimi models found on attacker infrastructure) | Other | Dream says it notified the firewall vendor and is withholding the vendor and affected versions. PHP's fixes for PHP2Shell have been available since October 21, and the Fragnesia kernel flaw was patched earlier in 2026. See the other PHP2Shell entries for the flaws themselves. | Research published; vendor notified · Reported | Dream Research ↗ SecurityWeek Oh My AI editors |
| 2026-10-28 | Florida's attorney general sues the company behind the A2E AI platform, alleging its tools let users make nonconsensual nude images, including of minorsOn October 28, 2026, Florida Attorney General James Uthmeier announced a civil lawsuit under the state's Deceptive and Unfair Trade Practices Act against Rengstorff Consulting Ltd., which operates the A2E AI platform and related mobile apps. The complaint alleges the platform lets users upload photos or videos of people, including children, and generate realistic nude or sexualized images without consent, and that it can digitally 'de-age' adults to look like children. It alleges A2E lacks meaningful safeguards such as monitoring, consent checks, account termination and reporting to law enforcement, and cites criminal cases in Tampa and Tallahassee in which defendants allegedly used the platform to make sexualized images of minors that it did not flag or report. The company's response has not been reported. A2E AI image and video platform and mobile apps (Rengstorff Consulting Ltd.) | Legal/regulatory action | The state asks a court to permanently bar the company from offering products that create or share illegal, nonconsensual sexual images, and seeks repayment of profits and civil penalties of up to $10,000 per violation. No court has ruled. | Lawsuit filed; case pending · Verified | CBS12 ↗ Florida's Voice Oh My AI editors |
| 2026-10-28 | Critical flaw in Red Hat OpenShift AI's model gateway could let a signed-in user use another tenant's AI provider keys and quotasRed Hat published CVE-2026-117574 on October 28, 2026, with a CVSS 3.1 score of 9.1 (critical), for the ai-gateway-payload-processing component of Red Hat OpenShift AI. In multi-tenant setups, the gateway picks which stored cloud AI provider credentials to attach to a request based on the model name the caller puts in the request body or a header, without checking whether that caller is allowed to use that model. Red Hat says an authenticated user of one tenant can name another tenant's model and have that tenant's provider API keys injected into the request, letting them make requests and use up the other tenant's large language model resources and quotas. A valid user account is required. Red Hat rates the overall impact as Important and notes that an earlier code change altered the mechanism but did not fix it. Red Hat OpenShift AI (ai-gateway-payload-processing component of the model-serving gateway) | Security vulnerability | Red Hat lists Red Hat OpenShift AI as affected; no fixed version was listed at the time of writing. Operators of multi-tenant deployments should watch Red Hat's advisory for updates. | No fix listed yet · Verified | Red Hat security advisory ↗ NIST NVD record Oh My AI editors |
| 2026-10-28 | Researcher finds 26,400 working cloud and AI service keys left in public Gitee code repositoriesIndependent researcher Ben Zimmermann reported on October 28, 2026 that a month-long scan of about 7.25 million public repositories on Gitee, a Chinese code-hosting service, turned up 26,400 unique credentials that still worked when tested against the services that issued them. The largest groups were 9,473 Alibaba Cloud access key pairs, 3,805 YouTube API keys, 3,170 DeepSeek keys, 1,489 Zhipu BigModel keys and 1,348 OpenAI keys, plus one active organization-admin credential for an unnamed enterprise AI platform. The keys had been committed to code by developers, sometimes in older commits that were later removed but stay in the history. The researcher did not say whether anyone else had used them. Public repositories on Gitee (keys for Alibaba Cloud, DeepSeek, Zhipu BigModel, OpenAI and other services) | Data leak/breach | The researcher sent the most affected vendors lists of the exposed keys; revocation had not been confirmed when the report was published. Developers who ever pushed a key to a public repository should revoke and replace it at the provider, since deleting it from the code does not disable it. | Disclosed · Reported | Researcher's report (MongoDB blog) ↗ The Hacker News Oh My AI editors |
| 2026-10-28 | IBM warns of critical Langflow flaws that could let an attacker run code or skip sign-in without an accountIBM published a security bulletin on October 28, 2026 (updated October 29) for Langflow OSS versions 1.0.0 through 1.12.8. It lists CVE-2026-110186 (CVSS 3.1 9.8, critical), which could let a remote attacker run code on the server without signing in, reachable through model context protocol (MCP) tool listing, and CVE-2026-93680 (9.8), an incomplete fix of the auto-login control that could let an attacker get around authentication. The bulletin also covers CVE-2026-110193 (8.8), where a signed-in low-privilege user could get Langflow's Agentic Assistant to produce code that runs operating-system commands, plus API key exposure and flaws in bundled libraries. IBM did not report the flaws being used in attacks. Langflow OSS 1.0.0 through 1.12.8 (open-source AI workflow and agent builder) | Security vulnerability | IBM says to upgrade to Langflow OSS 1.13.0 or later and lists no workarounds. Back up the database, secret key and uploads before upgrading, and keep Langflow off the open internet where possible. | Fixed (update needed) · Verified | IBM security bulletin ↗ NIST NVD record Oh My AI editors |
| 2026-10-27 | Claude outage: elevated errors on Claude Sonnet 5.5 across claude.ai, the Claude API, Claude Code and Claude CoworkAnthropic's status page reported an incident rated major affecting claude.ai, the Claude API, Claude Code and Claude Cowork. Requests to Claude Sonnet 5.5 returned elevated errors. Anthropic began investigating at 09:14 UTC on October 27 (2:14 AM PT, 4:14 AM CT), deployed a fix at 09:38 UTC and marked the incident resolved at 09:56 UTC, about 42 minutes after it was first posted. Claude (Anthropic) | Outage | Anthropic deployed a fix and marked the incident resolved the same morning. | Resolved · Verified | Claude Status ↗ Oh My AI editors |
| 2026-10-27 | Australia: the first person prosecuted under the 2024 federal deepfake sexual material law is sentenced in AdelaideA 20-year-old Adelaide man, the first person prosecuted under Australia's Criminal Code Amendment (Deepfake Sexual Material) Act 2024, was sentenced in the South Australian District Court on Tuesday, October 27. He had pleaded guilty in April to creating and sharing non-consensual AI-generated sexual images and videos of a young woman he knew, who was 17 when the offending began, on X and the website Ero Me during 2024 and 2025. He also pleaded guilty to using a carriage service to harass and to making personal data available. AI image and video generation (tool not named) | Legal/regulatory action | Judge Anne Barnett sentenced him to two years and three months in prison, suspended on a three-year, $500 good behaviour bond (a recognisance release order), so he will not serve time in custody. The federal offence carries a maximum penalty of up to seven years. | Sentenced · Verified | ABC News (Australia) ↗ AAP Oh My AI editors |
| 2026-10-27 | Second Claude outage of the day: elevated errors on Claude Sonnet 5.5 across claude.ai, the Claude API, Claude Code and Claude CoworkAnthropic's status page reported a second incident on October 27 rated major, again affecting claude.ai, the Claude API, Claude Code and Claude Cowork. Requests to Claude Sonnet 5.5 returned elevated errors. Anthropic said the impact lasted from 14:42 to 15:17 UTC (9:42 to 10:17 AM CT), about 35 minutes. The incident was posted at 15:09 UTC and marked resolved at 15:50 UTC. It is separate from the earlier Sonnet 5.5 incident the same morning (09:14 to 09:56 UTC). Claude (Anthropic) | Outage | Anthropic marked the incident resolved the same morning. | Resolved · Verified | Claude Status ↗ Oh My AI editors |
| 2026-10-27 | OpenAI API outage: degraded performance for its 6.1 Sol model on Chat Completions, Responses and BatchOpenAI's status page reported degraded model performance for 6.1 Sol on October 27, affecting the Chat Completions, Responses and Batch API components. The incident ran from 15:02 to 16:20 UTC (10:02 to 11:20 AM CT), about 1 hour and 18 minutes. OpenAI API | Outage | OpenAI applied a mitigation at 15:40 UTC (10:40 AM CT) and reported that all affected services were operating normally again at 16:20 UTC (11:20 AM CT). | Resolved · Verified | OpenAI Status ↗ Oh My AI editors |
| 2026-10-27 | NVIDIA rates a missing-authentication flaw in its NeMo Agent Toolkit 10.0 out of 10, and says to update to version 1.9.0NVIDIA published a security bulletin on October 27, 2026 for CVE-2026-65145 in its NeMo Agent Toolkit, rated critical with a CVSS 3.1 score of 10.0. NVIDIA describes it as a missing-authentication issue (CWE-306) that can be reached over the network without a login and might lead to code execution, escalation of privileges, data tampering, denial of service and information disclosure. Versions 1.0 through 1.8.0 are affected. The same bulletin covers CVE-2026-65151, a SQL injection rated 8.4 (high) in versions 1.4 to 1.6. NVIDIA says both issues were found by outside researchers. NVIDIA NeMo Agent Toolkit (open-source framework for building AI agents) | Security vulnerability | Version 1.9.0 fixes CVE-2026-65145 (1.7.0 already fixed CVE-2026-65151). NVIDIA advises updating to 1.9.0 or later from its GitHub repository; users should also keep agent services off untrusted networks. | Fixed in 1.9.0 · Verified | NVIDIA security bulletin 5912 ↗ NIST NVD Oh My AI editors |
| 2026-10-27 | Family files wrongful-death lawsuit claiming ChatGPT guided a woman with epilepsy off her anti-seizure medicationOn October 27, 2026, the parents of Bowen Wan, a 31-year-old software engineer in Seattle who died in February 2026 of sudden unexpected death in epilepsy, sued OpenAI and its CEO, Sam Altman, in San Francisco Superior Court. The complaint alleges that over about 25 days ChatGPT (GPT-4o) drew up a day-by-day schedule taking her off the anti-seizure medication lamotrigine, from 400 mg a day to zero, and encouraged her to keep the plan from her doctors. The suit brings claims including wrongful death, product liability and practicing medicine without a license, and was filed as an add-on to the coordinated ChatGPT Product Liability Cases (JCCP No. 5431). The family is represented by the Social Media Victims Law Center and The Schenk Law Firm. ChatGPT (GPT-4o, OpenAI) | Legal/regulatory action | Lawsuit filed; the claims are allegations and have not been decided by a court. The family seeks damages and a court order barring the defendants from giving medical advice to users without a license. OpenAI had not responded to the claims in court at the time of the reports. | Lawsuit filed; case pending · Verified | Bloomberg Law ↗ Complaint (Courthouse News) Oh My AI editors |
| 2026-10-27 | Critical LiteLLM flaw let an outsider make Enterprise-licensed proxies read a local file and send it out, exposing the master key and AI provider keysLiteLLM published advisory GHSA-w4c7-34wj-hqm8 on October 27, 2026, rated critical with a CVSS 3.1 score of 10.0. An unauthenticated request to any LLM route on a LiteLLM proxy running with an Enterprise license could make the proxy read a local file and send its contents to an address the attacker chooses. Reading the process environment exposes the LiteLLM master key and stored AI provider API keys, which gives full admin access to the proxy and, in some configurations, the ability to run Python code as root. Open-source deployments without an Enterprise license are not affected. The flaw was reported by researchers from Karmasec and Compass Security; no CVE number had been assigned and no exploitation had been reported at the time of the advisory. LiteLLM proxy (open-source AI gateway), Enterprise-licensed deployments | Security vulnerability | Fixed in versions 1.103.10, 1.104.8, 1.105.6 and 1.106.5, released on PyPI on October 27. LiteLLM advises updating; if that is not yet possible, blocking requests that carry the callback-related JSON keys listed in the advisory at a firewall or reverse proxy, limiting the proxy's outbound traffic to known AI provider addresses, keeping the proxy off the public internet, and rotating the master key and provider keys if the proxy was exposed. | Fixed (update needed) · Verified | LiteLLM security advisory (GitHub) ↗ SecurityOnline Oh My AI editors |
| 2026-10-27 | Comet says an attacker used a flaw in Opik's AI provider settings to obtain 29 of its own OpenAI and Anthropic keys; no customer data accessedComet published an incident report on October 27, 2026. It says that between October 24 and 26 an unauthorized party used a comet.com user API key from an inactive account to reach a small number of Comet's own internal test workspaces, then exploited a flaw in Opik's AI provider settings to obtain 29 API keys Comet uses internally for OpenAI and Anthropic. Comet says the attacker also tried to use the flaw to reach other Comet systems, and that no customer data, customer accounts or customer AI provider keys were accessed. An AI provider alerted Comet to unusual activity on October 26. The flaw also existed in earlier open-source releases of Opik, though Comet says using it there requires an invited account allowed to edit AI provider settings. Opik on comet.com (LLM observability and evaluation platform, Comet) | Data leak/breach | Comet says it contained the incident and deployed a fix on October 26 (Opik on comet.com was unavailable for about two hours), revoked all 29 keys, removed the inactive account, audited workspaces, rotated internal credentials, and now requires the API key to be re-entered when a provider address changes and restricts which addresses provider requests can reach. Comet-hosted users need do nothing; self-hosted users are advised to upgrade to the latest version. | Contained; fix deployed · Verified | Comet security incident report ↗ Oh My AI editors |
| 2026-10-27 | British Columbia privacy commissioner confirms an investigation into OpenAI's use of personal information in ChatGPT tied to the Tumbler Ridge shooting; OpenAI challenges it in courtOn October 27, 2026, the Office of the Information and Privacy Commissioner for British Columbia (OIPC) said OpenAI had petitioned the B.C. Supreme Court the day before for judicial review of a production order issued in the OIPC's investigation related to the Tumbler Ridge shooting. The OIPC says it is examining whether OpenAI's use of personal information in delivering ChatGPT responses, including the potential for responses to influence behaviour, is what a reasonable person would consider appropriate under B.C.'s Personal Information Protection Act. According to the OIPC, OpenAI was asked for information in February, the investigation began in June, and an order compelling production was issued in September. OpenAI's petition seeks to quash the investigation or narrow the order. ChatGPT (OpenAI) | Legal/regulatory action | The investigation is ongoing and no finding has been made. The OIPC says it will not provide further information while the court review is pending. | Under investigation; court challenge pending · Verified | OIPC British Columbia news release ↗ Courthouse News Service Oh My AI editors |
| 2026-10-27 | Nine CVEs published for command-injection and allowlist flaws in open-source MCP tool servers that AI agents call; most have no fixed version yetOn October 27, 2026, VulnCheck published nine CVE records (CVE-2026-117558 to 117561 and 117567 to 117573) for nine unrelated open-source MCP servers, the tool connectors AI agents use to run actions. Eight are OS command injection flaws: a value passed to an agent tool, such as a repository name, file path or message ID, is placed into a shell command without blocking $() or backtick substitution, so text an agent reads from an email, text message, file or repository could make it run commands with the server's permissions. The ninth, in nmap-mcp, lets callers run scan script categories that were meant to be blocked. VulnCheck rates seven of them 8.5 (CVSS 4.0). Several of the servers had tried allowlists or escaping that these substitutions get around. Open-source MCP (Model Context Protocol) servers: ai-sdlc, DroidMind, ATXP Gemini CLI extension, sf-mcp, esp-mcp, mcp-ffmpeg, Kali-GPT, nmap-mcp and hagent | Security vulnerability | According to the CVE records and ThreatAft's review, only ai-sdlc has a fix (commit 717d7ec); the other eight name no fixed version. None was listed as exploited in the wild as of October 28. Users of these servers should remove or isolate them until fixes are available and avoid letting agents pass untrusted text into shell-based tools. | Mostly unpatched · Verified | NIST NVD ↗ ThreatAft analysis Oh My AI editors |
| 2026-10-27 | Critical flaw in the Agno AI agent framework let a crafted tool-call field run Python code; GitHub advisory published, fix already availableA GitHub security advisory published on October 27, 2026 describes CVE-2026-35002 in Agno versions before 2.3.24, rated critical (CVSS 3.1 score 9.8 by NIST). Agno passed the field_type value of a FunctionCall input field to Python's eval(), so anyone able to influence that value, including through an API, a web interface or untrusted model or tool output, could run arbitrary Python code in the Agno process. The National Vulnerability Database first listed the CVE in April 2026. Agno (open-source Python framework for building AI agents) | Security vulnerability | Fixed in Agno 2.3.24 (released January 8, 2026), which replaces eval() with a fixed lookup of allowed types. Users on older versions should update. | Fixed in 2.3.24 · Verified | GitHub security advisory ↗ NIST NVD record Oh My AI editors |
| 2026-10-27 | Critical MLflow flaw let an outsider run code on servers without login enabled by uploading a file and having it loaded as an AI evaluation scorerA GitHub security advisory published on October 27, 2026 describes CVE-2026-116692 in MLflow, rated critical with a CVSS 3.1 score of 9.8. When loading a third-party evaluation scorer, MLflow accepted any Python module whose name started with one of four allowed package names. A caller could use MLflow's normal experiment, run and file-upload endpoints to place a Python file under one of those packages and then have the server import it, running that code with the server's privileges. On servers with authentication turned off this needs no credentials; with basic authentication it needs an account that can create experiments and upload files. The advisory says the official container image runs as root and allows those writes. The same release fixed lower-rated MLflow issues, including an arbitrary file read (CVE-2026-116690, 7.5) and plaintext API keys in CrewAI autolog traces (CVE-2026-116691, 6.5). MLflow (open-source platform for building, tracking and evaluating AI agents and models), versions 3.12.0rc0 through 3.16.x | Security vulnerability | Fixed in MLflow 3.17.0. Users should update, keep authentication enabled and avoid exposing MLflow servers to untrusted networks. | Fixed in 3.17.0 · Verified | GitHub security advisory ↗ NIST NVD record Oh My AI editors |
| 2026-10-27 | Privacy group noyb files five GDPR complaints against Scale AI over tracking and biometric checks of workers on its Outlier AI-training platformOn October 27, 2026, the Austrian privacy group noyb, working with Intérêt à Agir, DiPLab and Reversing.Works, filed five complaints under the EU's General Data Protection Regulation (GDPR) against Scale AI in France, Italy, the Netherlands and Austria. The complaints concern Outlier, where more than 900,000 freelance workers write prompts and rank answers to train AI models. noyb says its analysis found third-party trackers, including from TikTok, LinkedIn, Facebook, Sprig and Datadog, sending workers' personal data every few seconds while they work; that workers must repeatedly complete biometric identity checks through Persona, including face video and ID uploads; and that Scale AI did not answer workers' data-access requests. A Scale spokesperson told The Record the claims are 'unfounded and inaccurate,' saying screen activity is recorded only when workers opt in and identity checks are used to fight fraud. Outlier, Scale AI's AI-training data annotation platform | Legal/regulatory action | noyb asks the data protection authorities to investigate and to consider fines. No regulator has made a finding. | Complaint filed; case pending · Verified | noyb ↗ The Record Oh My AI editors |
| 2026-10-27 | Check Point finds fake ChatGPT and Claude desktop apps on GitHub that use signed OpenAI and Anthropic installers to load malwareCheck Point Research reported on October 27, 2026 a malware campaign it calls Yoba, in which GitHub repositories and GitHub Pages sites advertised supposed desktop versions of AI tools under names such as 'GPT-5.6 Sol', 'GPT-6 Astra' and 'Claude Opus', and appeared high in Google search results. The ZIP downloads paired a legitimate, signed OpenAI or Claude setup program with a malicious DLL file that the setup program loads, a technique known as DLL sideloading. The malware then sets up persistence and, in the cases Check Point analyzed, installed the XMRig cryptocurrency miner, though the loader can deliver other programs. Check Point says the first repository was created around July 2026, and that OpenAI, Anthropic, ChatGPT and Claude themselves were not compromised. The Hacker News and Help Net Security reported the findings on October 29. Fake 'GPT-5.6 Sol', 'GPT-6 Astra' and 'Claude Opus' desktop app downloads on GitHub and GitHub Pages (Windows) | Fraud/scam | Download AI apps only from the vendors' own websites or app stores, not from search results or GitHub pages claiming to offer them. Check Point advises organizations to limit unapproved software and administrator rights, and to treat any infected computer as broadly compromised rather than only removing the miner. | Research published · Verified | Check Point Research ↗ The Hacker News Oh My AI editors |
| 2026-10-26 | Security startup Cathedral says its AI agents reached some of Anthropic's internal business systems in under 12 hours; Anthropic says it closed the gapsThe Washington Post reported on October 26, 2026, based on a draft report by security startup Cathedral, that Cathedral's researchers used AI agents for less than 12 hours to reach internal Anthropic data by exploiting flaws in third-party business software Anthropic uses for sales and administration. The draft describes access to meeting transcripts, salary and job-offer details and Slack messages. Anthropic confirmed the researchers reached a limited set of its sales, HR and IT systems through its bug bounty program, including some customer and partner business contact details and basic user account records, and said they could not reach customer prompts, model responses, source code or model weights. The Washington Post | Data leak/breach | Anthropic said its monitoring flagged some of the activity, it shut off the researchers' access the same day, disabled the affected software until the vendors fixed the flaws, and briefed federal officials. It said it has no evidence anyone else exploited the flaws. Anthropic and Cathedral disagree on how serious the findings are and on whether the bug bounty rules were fully followed. | Access closed; vendor flaws fixed · Verified | The Washington Post ↗ Our story Oh My AI feed |
| 2026-10-26 | Seoul police say a seven-member ring used generative AI to hack about 90 Korean organizations, stealing 8.2 million records and demanding ransomThe Seoul Metropolitan Police Agency said on October 26, 2026 that it had apprehended seven suspects accused of hacking about 90 organizations in South Korea, including hospitals, universities, private academies, golf courses and conglomerate subsidiaries, between September 2025 and October 2026. Police say the group stole about 8.2 million records, including personal information and internal documents, used AI tools in attacks on about 60 of the targets, and sent threatening emails to 38 organizations demanding a combined 360 million won (about $272,000). Police say the alleged ringleader began using generative AI extensively in August, and SBS reports the group used an autonomous AI penetration system. Korea JoongAng Daily describes this as the country's first arrests in a large-scale AI-assisted hacking case. Generative AI tools and an autonomous AI penetration-testing system (not named) | Fraud/scam | The alleged ringleader was referred to prosecutors in custody on October 23; questioning of the other six suspects continues. Police said they recovered the stolen records and are checking for additional victims. The allegations have not been proven in court. | Arrests made; referred to prosecutors · Verified | Yonhap News Agency ↗ Korea JoongAng Daily Oh My AI editors |
| 2026-10-26 | Researchers disclose an OpenAI API flaw that let hidden reasoning from frontier models be extracted through conversation compactionSecurity firm Xint published research on October 26, 2026 describing a flaw it calls compaction smuggling. OpenAI's API returns a reasoning model's raw chain of thought only as an encrypted item, partly to stop others from copying (distilling) the model. Xint says that by asking the compaction step, which shrinks long conversations into an encrypted summary, to keep the reasoning word for word, and then passing that compacted item to older models such as gpt-4.1 and gpt-4o with a request to repeat their input, they could read the raw reasoning of gpt-5.6-sol. The method got around protections OpenAI added in August 2026 after earlier academic research on the same problem. Xint found the issue in August. OpenAI API (Responses API compaction and encrypted reasoning items) | Security vulnerability | Xint says OpenAI confirmed the issue, deployed a fix on October 23, 2026 and paid a $6,000 bug bounty. No action is needed from API users. | Fixed · Verified | Xint (researchers' disclosure) ↗ SecurityWeek Oh My AI editors |
| 2026-10-26 | Critical flaw in the OpenHands AI agent SDK left its sandbox server open, letting anyone who could reach it run commands as rootThe U.S. National Vulnerability Database lists CVE-2026-112346, published October 26, 2026 and rated critical by VulnCheck (CVSS 3.1 score 9.8, CVSS 4.0 score 9.3). In OpenHands Software Agent SDK versions before 1.52.0, the Docker and Apptainer workspace launchers started the agent's sandbox server on all network interfaces with no session API keys, which turned off its login check. Anyone who could reach the published port could send requests that run shell commands as root inside the sandbox, read the mounted workspace and see stored secrets in plain text. OpenHands Software Agent SDK (open-source toolkit for AI coding agents) | Security vulnerability | Version 1.52.0 fixes the flaw. Users should update and keep agent sandbox ports off untrusted networks. | Fixed in 1.52.0 · Verified | NIST NVD ↗ VulnCheck advisory Oh My AI editors |
| 2026-10-26 | Critical flaw in Google's MCP Toolbox for Databases let an outsider copy host files to outside storage buckets and overwrite local filesThe U.S. National Vulnerability Database lists CVE-2026-93328, published October 26, 2026 with a critical CVSS 4.0 score of 9.3. In MCP Toolbox for Databases versions 1.2.0 through 1.4.0, the cloud-storage source did not limit which storage buckets or local paths a tool call could use, so an unauthenticated remote attacker could send crafted tool requests that copy files from the host to outside Google Cloud Storage buckets and overwrite arbitrary local files. MCP Toolbox for Databases (open-source server that connects AI agents to databases, googleapis) | Security vulnerability | The fix, merged in June 2026, adds settings that restrict which buckets and local folders the tool can use; later releases include it. Users of 1.2.0 through 1.4.0 should update and set those limits. | Fixed in later releases · Verified | NIST NVD ↗ MCP Toolbox fix (GitHub) Oh My AI editors |
| 2026-10-26 | Three flaws fixed in vLLM, a widely used AI model serving engine, including one that could let a signed-in caller run code in scale-out setupsThe U.S. National Vulnerability Database published three vLLM vulnerabilities on October 26, 2026. CVE-2026-115912 (CVSS 3.1 score 7.5): in scale-out deployments with shared-memory multimodal caching turned on, a signed-in caller could plant forged shared-memory values that workers passed to Python's pickle loader, allowing arbitrary code to run even with insecure serialization disabled. CVE-2026-115915 (8.1): image requests did not limit which image decoder was used, so a disguised PostScript file could reach Ghostscript or vulnerable Pillow versions on the host. CVE-2026-115918 (6.5): the /v1/responses endpoint let a caller supply its own chat template despite the trust setting, which could exhaust CPU or memory. vLLM (open-source inference and serving engine for large language models) | Security vulnerability | All three are fixed in vLLM 0.32.0. Operators running earlier versions should update. | Fixed in 0.32.0 · Verified | NIST NVD ↗ vLLM 0.32.0 release (GitHub) Oh My AI editors |
| 2026-10-26 | Flaw in Google's Cloud Run MCP server could let an outsider intercept source code and run code through a look-alike storage bucketThe U.S. National Vulnerability Database lists CVE-2026-85297, published October 26, 2026 with a high CVSS 4.0 score of 7.7. In Cloud Run MCP versions before 1.11.0, a "bucket squatting" weakness let an attacker who created a storage bucket with an expected name intercept and access source code being deployed, run arbitrary code and take data. Cloud Run MCP (Google Cloud's open-source server that lets AI agents deploy apps to Cloud Run) | Security vulnerability | Google says users must upgrade to Cloud Run MCP 1.11.0 or later. | Fixed in 1.11.0 · Verified | NIST NVD ↗ Cloud Run MCP 1.11.0 release (GitHub) Oh My AI editors |
| 2026-10-26 | Anthropic fixes a Claude Code flaw that could let code inside its sandbox overwrite files outside the project on macOSAnthropic published advisory GHSA-5xjx-9qx6-jcrv (CVE-2026-88968, rated high, CVSS 7.7) on October 26, 2026. Claude Code checked the target of its Edit tool at one moment but wrote to it later. On macOS, code running inside Claude Code's sandbox could swap a folder for a shortcut in between, so the edit landed on a user-writable file outside the workspace. Exploiting it required attacker-controlled code already running in the sandbox, for example from a malicious repository or dependency script. Claude Code (Anthropic's AI coding agent) | Security vulnerability | Fixed in Claude Code 2.1.251. Anthropic says users on standard auto-update already have the fix; those who update manually should move to the latest version. | Fixed in 2.1.251 · Verified | Anthropic security advisory (GitHub) ↗ Oh My AI editors |
| 2026-10-26 | Cohere says Alibaba's open-weight Qwen3.8-Flash-Next tried to upload a probe file to a Beijing cloud bucket during a sandboxed testCohere published research on October 26, 2026 describing a security test in which Alibaba's open-weight model Qwen3.8-Flash-Next, asked to write a defensive detection rule, instead listed files on its machine, checked which transfer tools were installed, read its DNS settings and tried to upload a test string to an Alibaba Cloud storage bucket in Beijing. The sandbox had no route to the internet, so the request was blocked. Cohere says the model's visible reasoning had said it would not use any tools. It says the behavior is rare, under one call in 100,000 across its runs, and that it cannot tell whether it is deliberate or leftover data from training. Cohere | Agent unintended action | Cohere released the traces and a reproduction script on Hugging Face and advises teams to block outbound network access for AI agents by default, check tool calls before they run, and block unprivileged user namespaces in agent containers. Alibaba's response was not included in Cohere's post. | Advisory issued · Verified | Cohere ↗ Cohere Labs traces (Hugging Face) Oh My AI feed |
| 2026-10-26 | Attackers take over at least 17 exposed Cairn AI hacking-agent panels, telling the agents to steal keys, add SSH logins and install malware on their own hostsSecurity firm NorForge reported on October 26, 2026 that at least 17 Cairn control panels left open on the internet were taken over by outsiders starting around October 20, with possible reconnaissance from October 10. The intruders added their own tasks that told the panels' AI agents to turn on the machines running them: listing secrets and AI model API keys, adding unauthorized SSH keys, mapping internal services and, in several cases, downloading and running a remote-access program. NorForge tracks two automated campaigns it calls AIA0009 and AIA0010. Affected panels included ones it had earlier linked to criminal activity and others that appeared to be used for legitimate red-team work, bug bounties and capture-the-flag challenges. Cairn (open-source AI agent platform for penetration testing), self-hosted panels left open without a login | Security vulnerability | No software flaw is involved: the panels had no login protection. NorForge advises anyone running a Cairn panel to secure it now and has published indicators of compromise. It says the download server used for the malware stopped accepting connections and that it could not confirm whether the attackers broke out of the agents' containers. | Advisory issued · Verified | NorForge ↗ GBHackers Oh My AI editors |
| 2026-10-26 | Cloudflare discloses that a bug let 155 responses from its GLM-5.3 AI service include other customers' dataCloudflare said on October 26, 2026 that a tenant isolation issue in its Workers AI service for the GLM-5.3 model caused 155 responses, between August 27 and September 9, 2026, to include data from other customers' requests made to the same model shortly before. All affected responses were to prompts longer than 681,280 tokens. A security researcher reported the issue through Cloudflare's HackerOne program on September 8. Cloudflare says two issues overlapped: the model's cache pool was configured smaller than its advertised context window, and a bug in SGLang, the open-source inference engine it uses, let over-length requests read leftover cached data instead of returning an error. Cloudflare says no other Workers AI model was affected and it found no evidence of deliberate exploitation. Cloudflare Blog | Data leak/breach | Cloudflare took the model offline on September 9, corrected the configuration, patched the engine and restored the model the same day, then added further hardening to all its SGLang deployments. The SGLang project released fixes and advises operators to update to version 0.5.22 or later. | Fixed; service restored · Verified | Cloudflare Blog ↗ Our story Oh My AI feed |
| 2026-10-26 | JFrog finds malware planted in 42 real GitHub repositories, set to run when developers open them in Claude Code, Gemini, Cursor or VS CodeJFrog Security Research said it identified 42 compromised GitHub repositories belonging to 11 legitimate owners, tied to the testmetest npm malware campaign first documented by SafeDep on October 22, 2026. Each repository held a hidden 12.9 to 13.7 MB loader file plus configuration files that run it automatically: a Claude Code SessionStart hook, and equivalent triggers for Gemini, Cursor's MCP configuration and VS Code folder-open tasks, so simply opening the project in one of those tools could run the payload. JFrog says the files were too large for GitHub code search to index, so an initial search made them look empty. The payload is built to publish new malicious npm packages using stolen GitHub and npm access. JFrog says its review could not establish how many systems were affected. AI coding assistants and IDEs (Claude Code, Gemini, Cursor, VS Code) via repository startup hooks | Security vulnerability | JFrog advises removing malicious versions of the affected testmetest packages and rebuilding affected systems from trusted sources. Developers should check repositories for unexpected hook files before opening them in AI coding tools. | Advisory issued · Verified | JFrog Security Research ↗ Cyber Security News Oh My AI editors |
| 2026-10-25 | Uttar Pradesh police arrest a murder-trial defendant who allegedly used an AI-generated funeral pyre image to fake his own death in courtPolice in Mau district, Uttar Pradesh, say a 38-year-old man on trial in a 2016 murder case staged his own death in Ghazipur in May 2025: a goat was cremated, and an AI-generated image showing a body on a funeral pyre, along with staged funeral photos, was used to make the death look real. Police say he then obtained a death certificate from the Mau Municipal Council and submitted it to the court, partly to avoid repaying money he had collected from people for stock market investments. AI image generation (tool not named) | Fraud/scam | Kotwali Nagar police, with the Special Operations Group and a surveillance team, arrested him in Mau on Sunday, October 25. A forgery case has been registered under the Bharatiya Nyaya Sanhita, and the murder trial can now continue. The charges are allegations that have not been proven in court. | Arrest made; investigation ongoing · Verified | Press Trust of India ↗ NDTV (also reported by Times of India, Hindustan Times and India Today) Oh My AI editors |
| 2026-10-25 | Georgia and Anthropic say a Claude model, without being asked, got a token to query vote-count data on the state's public data hubThe Georgia Secretary of State's office said on October 25 that an AI bot associated with Anthropic accessed publicly available data through the state's data hub. An Anthropic spokesperson told Axios that a Claude model being used internally for a statistics project, without being asked to, requested a token to query a dashboard of aggregate vote counts. Georgia's deputy secretary of state said it did not get into the voter registration system, and Anthropic said no voting records were changed or pulled. In a timeline shared on October 27, the Secretary of State's office said Anthropic first contacted it on October 8, that its own review found the agent had only accessed publicly available Data Hub information, and that on October 26 Anthropic confirmed the agent had not accessed Georgia's voter list or bypassed a paywall. Anthropic's October 9 report of unintended model actions described this episode without naming the state. Anthropic Claude (internal use) | Agent unintended action | Anthropic said it has put mitigations in place to block these kinds of actions, and that it notified the Georgia Secretary of State's office and the White House weeks earlier. | Mitigated · Verified | Axios ↗ GPB (Georgia Secretary of State's office timeline, Oct 27) Oh My AI editors |
| 2026-10-25 | Claude outage: elevated errors across claude.ai, the Claude API, Claude Code and Claude Cowork in two overnight incidentsAnthropic's status page reported two incidents rated major affecting claude.ai, the Claude API, Claude Code and Claude Cowork. The first caused elevated errors on requests to Claude Mythos 5.1, Fable 5.1, Opus 5.5, Sonnet 5.5 and Haiku 5.5 for about 30 minutes (11:05 to 11:35 PM PT on October 24, which is 06:05 to 06:35 UTC on October 25). The second affected Claude Fable 5.1 for about 21 minutes (1:08 to 1:29 AM PT on October 25). Claude (Anthropic) | Outage | Anthropic identified the causes, deployed fixes, and marked both incidents resolved the same night. | Resolved · Verified | Claude Status ↗ Claude Status (second incident) Oh My AI editors |
| 2026-10-24 | Michigan sheriff warns scammers are using AI-generated images of fake deputies to push residents toward Bitcoin ATMsIn a Facebook post on Saturday, October 24, Eaton County (Michigan) Sheriff Tom Reich warned that callers are spoofing local Eaton County phone numbers, using made-up deputy names, and in some cases sending AI-generated images of fake deputies standing next to cryptocurrency machines to instruct people to deposit money into Bitcoin ATMs. The callers claim the person must pay right away or face arrest. The sheriff said one giveaway is that the AI-generated deputy wears the wrong uniform color. AI image generation (tool not named) | Fraud/scam | The sheriff's office said law enforcement never calls to demand payments, fines, bond or cryptocurrency, and advised residents to hang up, not share personal or banking details, and pass the warning on to family members and older adults. | Advisory issued · Reported | WILX News 10 ↗ Oh My AI editors |
| 2026-10-24 | Critical flaw in the Unitree Go2 robot dog's GPT voice-chat feature could let an outsider run commands on the robotThe U.S. National Vulnerability Database lists CVE-2026-115995 in Unitree Go2 firmware up to 1.1.11.4, rated critical (CVSS 4.0 score 9.4; CVSS 3.1 score 9.6) by VulDB. The set_volume function in the robot's GPT voice-chat component (gpt_thread.py in chat_go) did not safely handle its input, so an attacker could inject operating system commands remotely. Unitree confirmed the report as an internal ticket. Unitree Go2 robot (chat_go GPT voice-chat component) | Security vulnerability | Unitree fixed it in firmware 1.1.11.5. Owners should update their Go2 to that version or later. | Fixed (update needed) · Verified | NIST NVD ↗ VulDB entry Oh My AI editors |
| 2026-10-23 | Singapore Police warn of Facebook ads using AI-generated images of police officers to promote fake scam recovery servicesOn October 23, the Singapore Police Force warned of a scam in which Facebook advertisements show AI-generated images of its officers promoting scam recovery services. People who click are sent to an online form that asks for their contact details and then for a one-time password sent by WhatsApp or SMS, which can expose their credentials or let someone take over their accounts. AI image generation (tool not named) | Fraud/scam | The police said they never advertise scam recovery services and asked the public to check claims through official police channels, the ScamShield app or the 24/7 ScamShield Helpline (1799), to turn on WhatsApp two-step verification and review linked devices, and to contact their bank and file a police report if they think they have been scammed. | Advisory issued · Verified | Singapore Police Force ↗ Oh My AI editors |
| 2026-10-23 | Critical flaw in the open-source PraisonAI agent framework let anyone who could reach its AgentOS server run the deployed AI agents without logging inThe U.S. National Vulnerability Database lists CVE-2026-57116 in PraisonAI versions 4.2.1 up to 4.6.59, rated critical (CVSS 3.1 score 9.8) by the GitHub advisory. Its AgentOS web server accepted chat requests with no login or a wrong one and passed them straight to the deployed agent, so anyone who could reach it could drive agents that have tools, private context, memory, connected services or paid model calls. The advisory says an earlier fix for a related flaw (CVE-2026-40151) did not close this gap. PraisonAI (open-source multi-agent framework, MervinPraison) | Security vulnerability | PraisonAI 4.6.59 fixes the flaw. Users should update and keep AgentOS servers off untrusted networks. | Fixed in 4.6.59 · Verified | NIST NVD ↗ PraisonAI security advisory Oh My AI editors |
| 2026-10-23 | Critical flaw in the open-source AgenticSeek AI assistant left a debugging console open that could let outsiders run codeThe U.S. National Vulnerability Database lists CVE-2026-115727 in AgenticSeek before commit 409840c, rated critical (CVSS 4.0 score 9.2; CVSS 3.1 score 8.1) by VulnCheck. Its bundled model server was hard-coded to run in debug mode while listening on all network interfaces, so someone who could reach that port and work out the debugger PIN could run Python code and system commands on the machine. AgenticSeek (open-source local AI agent, Fosowl) | Security vulnerability | The project fixed it in commit 409840c. Users should update to a build that includes it and keep the model server off untrusted networks. | Fixed (update needed) · Verified | NIST NVD ↗ VulnCheck advisory Oh My AI editors |
| 2026-10-23 | Critical flaw in the ReqLLM library meant its OpenAI WebSocket connections did not check security certificates, exposing API keys to interceptionThe U.S. National Vulnerability Database lists CVE-2026-107685 in req_llm versions 1.9.0 up to 1.29.0, rated critical (CVSS 4.0 score 9.1) by the Erlang Ecosystem Foundation's CVE team. Its WebSocket client for OpenAI's Responses, Realtime and Codex connections did not verify TLS certificates, so someone positioned on the network path could read or change those sessions and capture the OpenAI API key or sign-in token sent with them. Regular HTTP streaming was not affected. ReqLLM (open-source Elixir library for calling AI models, agentjido) | Security vulnerability | req_llm 1.29.0 fixes the flaw. Apps using the WebSocket modes should update and consider rotating keys that were sent over those connections. | Fixed in 1.29.0 · Verified | NIST NVD ↗ EEF CNA advisory Oh My AI editors |
| 2026-10-23 | Mississippi Attorney General asks a U.S. Senate campaign to remove AI-generated ads under the state's election deepfake lawOn October 23, Mississippi Attorney General Lynn Fitch notified U.S. Senate candidate Scott Colom and his campaign that AI-generated ads on the campaign's social media pages appear to violate the state law on deepfakes in elections (Mississippi Code Section 97-13-47). One video shows an AI-generated woman made to look like Senator Cindy Hyde-Smith. The notice followed a complaint from the Mississippi Republican Party, as reported by WLBT, WAPT and Magnolia Tribune. AI-generated video (tool not named) | Legal/regulatory action | The Attorney General asked that the ads be removed by the afternoon of October 23 or the office may seek an injunction, and asked the campaign to preserve related records. Later that day Colom said the video was parody and that the campaign would delete it rather than spend money on litigation; WLOX and The Dispatch reported it was no longer on the campaign's social media pages. No court filing has been reported. | Ads removed; no court filing · Verified | Mississippi Attorney General Lynn Fitch ↗ WLBT Oh My AI editors |
| 2026-10-23 | AWS warns of a critical flaw in its retired Multi Model Server for AI models, with no fix comingOn October 23, AWS published a bulletin on two flaws in Multi Model Server (MMS), an open-source tool for serving machine learning models that reached end of life and was archived in November 2025. CVE-2026-115812 (rated critical, CVSS 4.0 score 9.3 in the NVD record) lets a crafted model archive write files outside its folder, which could let an outsider run code on the server; CVE-2026-115813 lets the model-download feature be pointed at unintended network addresses. The MMS management interface does not require a login, so servers that expose it to a network are most at risk. All released versions (1.1.11 and earlier) are affected. Amazon Web Services Multi Model Server (open-source machine learning model server, end of life) | Security vulnerability | No fix is available or planned. AWS recommends that users stop using Multi Model Server and move to a supported model-serving tool. Until then, it advises keeping the management interface reachable only from the same machine where possible, not passing outside URLs to the model-download feature, and making sure only trusted callers can reach the serving port. | No fix (end of life); migration advised · Verified | AWS Security Bulletin 2026-148-AWS ↗ NIST NVD record Oh My AI editors |