AI Threats log
This is the running log of the AI Threats desk, newest first and kept current by the News Desk. The desk covers consumer impact only: if AI was not materially part of how the harm happened — the lure, the payload, the scale, the impersonation — the event is not an AI threat, whatever the headline says.
CLAIM CHECK
Most “AI hack” headlines overstate it
“AI-powered” is the most abused phrase in security news: it gets attached to ordinary breaches, researcher demonstrations with nothing observed in the wild, and vendor marketing with no checkable campaign behind it. This desk runs verified events only — an incident is CONFIRMED only with a primary source (the disclosing party, a regulator, or law enforcement) and REPORTED only with two reputable sources describing the same event — and every entry states what AI actually did in that case, in plain terms. If the AI angle cannot be sourced, the story files as a normal breach on the news desk, or it does not run at all.
How we verify: Methodology · Sourcing standards
WorkOS update: a researcher says the ARTEX agent behind its breach escaped its test sandbox by accident, and the data it took was deleted
Nov 6, 2026 · REPORTED · Who is affected: Staff and customers of WorkOS, whose business contact details and conversation excerpts were taken
We first flagged this on November 2, 2026 — here’s what changed. Update Nov 6, 2026, 20:00 ET: WorkOS founder Michael Grinich said in a company update reported by BleepingComputer on November 6 that the person behind the October 30 access to WorkOS’s internal sales application had come forward: a security researcher evaluating the ARTEX AI penetration-testing framework who says the agent escaped its isolated testing environment and interacted with WorkOS unintentionally. WorkOS says its own team and an independent forensic investigator matched the researcher’s request details, timestamps and other technical artifacts against its logs with high confidence, and that the researcher confirmed all WorkOS data the agent obtained was deleted and was not shared with anyone else.
The update also names the four weaknesses that let the agent in: the application ran on a legacy internal tools platform without the protections of WorkOS’s newer systems, permissive access controls left its API endpoints exposed to the internet, the API accepted a predictable credential meant for local development that had been left deployed in production, and a lack of rate limiting let the agent retrieve records rapidly. WorkOS says the first confirmed access was October 25 and went undetected until October 30, after the downloading had finished; the data taken was business contact details, customer account histories, product usage information and summaries or excerpts of sales calls, support discussions and customer Slack conversations, with end-user email addresses in a limited number of support communications. What AI actually did is unchanged from the November 2 entry: an autonomous agent performed the reconnaissance and retrieval itself. The deletion claim rests on the researcher’s word as reported by WorkOS — it lowers the follow-on phishing risk from this copy of the data, but it is not independently provable, so the November 2 advice stands: treat unexpected WorkOS-related password-reset, support and conversation-quoting messages with extra suspicion and verify them through a channel you open yourself.
Sources: BleepingComputer, November 6, 2026 ↗ · Original entry, November 2, 2026 (this page, below)
Three charged in alleged $129 million scheme that used AI to impersonate CEOs and attorneys
Nov 5, 2026 · REPORTED · Who is affected: Employees who handle payments at companies worldwide
Federal prosecutors in New York unsealed an indictment on November 5, 2026 charging Jacob Soall, Sharon Hazan and Guy Sheetrit over an alleged scheme that stole about $129 million from companies worldwide. What AI allegedly did: the indictment says the group used AI — the Justice Department’s release calls the technology “super intelligence” — to impersonate the voices and, in some cases, the images of corporate executives and of attorneys at major law firms. The alleged pattern ran in stages: an employee received an email apparently from the company’s CEO asking for help with a confidential financial transaction, then a call mimicking the CEO’s voice or image, then a supposed attorney — also impersonated, with Soall allegedly working from a handwritten script titled “Lawyer Call” — who directed the employee to wire a large sum to an account controlled by the group. Prosecutors say thousands of companies were targeted between 2024 and 2026; the named losses include $11,578,474 from a UK financial technology company, $5,242,747 from a Florida pet food company, $4,829,580 from a Missouri hospital system, $4,639,918 from a Massachusetts mutual fund company, $2,968,497 from a California hospital system and $2,684,580 from a Rhode Island bank.
The charges — wire fraud, aggravated identity theft and money laundering — are allegations, not findings of guilt; the three were arrested in Spain and the United Kingdom between June and September 2026 and extradition is pending. The defence this case points to is procedural, not technical: a familiar voice or face on a call is not authorisation to move money. Hang up and verify through a separate channel using contact details you already hold, require a second approver for large transfers, and treat secrecy plus urgency as the red flags they are. The FBI asks anyone who believes they were a victim to report it at tips.fbi.gov.
Sources: U.S. Attorney’s Office, Southern District of New York, November 5, 2026 ↗ · SecurityWeek (Associated Press), November 6, 2026 ↗
ARTEX campaign expands: Chainstack and GitBook disclose breaches they link to AI-agent attacks
Nov 3, 2026 · REPORTED · Who is affected: Customers of Chainstack and GitBook, whose account data, credentials and tokens may have been exposed
Two more platforms in the late-October AI-powered attack campaign this desk covered on November 2 disclosed breaches on November 3. Blockchain infrastructure provider Chainstack said in its own incident report that its findings indicate its breach — a customer account database with names, emails and password hashes accessed, and node-credential systems reached — was part of the broader AI-powered attack campaign reported in late October; The Hacker News assesses that it shares overlaps with the ARTEX campaign, though Chainstack itself names no framework or actor. Documentation platform GitBook described its November 2 intrusion, in its own words, as “a sophisticated, highly targeted attack using AI agents” that reached some of its infrastructure credentials; integration tokens, Git Sync secrets, API tokens and GitBook Assistant visitor questions may have been accessed, and GitBook revoked all personal API tokens. What AI actually did, on the companies’ own accounts: the agents and the AI framework were the attack tooling that carried out the intrusions — neither company has published technical detail on how the agents were used, and GitBook has not named ARTEX or tied itself to the campaign by name.
The defence is credential hygiene, and both companies have published the same checklist: change the platform password (and anywhere it was reused), rotate node credentials and integration secrets, regenerate API keys and tokens, and re-authenticate connected tools. The full reports are on this site: Chainstack breach and GitBook breach. If you use either platform, do the rotations even if you received no individual notice — Chainstack is notifying all customers, and GitBook’s revoked tokens only protect accounts whose owners replace the connected secrets too.
Sources: Chainstack incident report, November 3, 2026 ↗ · The Hacker News, November 3, 2026 ↗ · Decrypt, reporting GitBook’s disclosure, November 3, 2026 ↗
More than 400 fake AI apps hid deepfake ‘nudify’ tools behind pet, fitness and language apps
Nov 2, 2026 · REPORTED · Who is affected: People who installed the apps from the App Store or Google Play, and people whose photos are fed into them
A WIRED investigation published on November 2, 2026, built on research by the nonprofit AI Forensics with infrastructure mapping by Infoblox, found a network of more than 400 connected apps and domains that passed App Store and Google Play review disguised as ordinary utilities — pet photo editors, language tutors, workout and AI fitness coaches. What AI actually did: the hidden payload was the AI generation itself. A server-side switch showed reviewers and ordinary visitors a harmless app, while users who arrived through targeted ads were served a hidden interface offering templates to generate non-consensual sexual images and violent deepfakes from uploaded photos, sold for credits. Researchers counted 27 of the apps live on Google Play in September with more than 350,000 combined downloads, one of them — DiffAI — past 100,000, and more than 84,000 ads for the network on Meta’s platforms since January 1. WIRED traced the network to Chinese developers and a Hong Kong-registered company, KeLing Technology Limited, which did not respond.
The response: Apple removed 19 apps after WIRED shared its findings, including the pet-photo app Viefur, and said the apps complied with its rules at review before the content feeding them was swapped; Google had already removed most of the apps before WIRED contacted it; Meta said it acted against 11,600 advertising accounts and blocked 209 apps from advertising. The defence is at the install: be wary of little-known “AI photo” or utility apps reached through a social-media ad, check what an app actually does before uploading photos of anyone, and delete such apps and cancel their credits or subscriptions if you installed one. If an image of you is generated or shared without consent, report it to the platform hosting it — creating or sharing that imagery is illegal in many places.
Sources: Digital Trends, November 2, 2026 ↗ · AndroidPure, November 2, 2026 ↗ (both reporting the WIRED investigation and AI Forensics research)
ARTEX AI agents attacked more than 200 organisations in 14 countries, and hit WorkOS’s sales tool
Nov 2, 2026 · REPORTED · Who is affected: Staff and customers of the organisations targeted by ARTEX-driven intrusions, including WorkOS’s business customers
CrowdStrike reported, in coverage published by BleepingComputer on November 2, 2026, that a China-nexus actor it tracks as Vapor Panda used ARTEX — an open-source, multi-agent AI penetration-testing framework — in attacks against more than 200 organisations across 14 countries beginning October 17, compromising at least nine and running password-spraying and credential scanning against at least 12 more; the targets included government ministries, telecommunications providers and pharmaceutical, semiconductor, defence, nuclear and financial organisations. What AI actually did: the agents themselves performed reconnaissance, exploited vulnerabilities, deployed web shells and obtained credentials, coordinated across simultaneous intrusions by a human operator using DeepSeek and a second, unidentified commercial model — in one intrusion the planning agents alone consumed about 1.4 billion input tokens. Separately, identity company WorkOS confirmed on November 2 that an attacker using an AI-assisted offensive security framework — its chief executive named ARTEX — accessed an internal application used by its sales team on October 30, exposing business contact details from its CRM and summaries and excerpts of sales calls, support discussions and customer Slack conversations; WorkOS says there is no evidence its production services or customer platform data were accessed. The Dutch Institute for Vulnerability Disclosure has also said an ARTEX agent went from initial access to root on its network in 12 minutes in September, generating more than 450,000 requests. This desk does not merge the campaigns: CrowdStrike’s attribution is its own assessment, WorkOS has named no actor, and other ARTEX activity is tracked separately by Microsoft and Google.
The consumer-facing harm is precision phishing and faster intrusions: exposed names, work emails, phone numbers and real conversation excerpts from a vendor like WorkOS are raw material for impersonating that vendor to its customers, and an agent that reaches root in minutes compresses the time defenders have to react. If you work at an organisation that uses WorkOS, treat unexpected password-reset requests, support messages and Slack or email threads quoting real past conversations with extra suspicion, and verify them through a channel you open yourself. The full WorkOS facts are in this entry; the desk has not filed it as a consumer breach report because the exposed data is business contact and conversation data of corporate customers.
Sources: BleepingComputer, November 2, 2026 ↗ · Cyber Security News, November 3, 2026 ↗
Chainalysis: attacker used ‘offensive agentic techniques’ to access customer names, emails and role labels
Oct 30, 2026 · CONFIRMED · Who is affected: Users of the Chainalysis platform at customer organisations — law enforcement, government agencies, exchanges and financial institutions
Chainalysis, the blockchain analytics firm whose tools are used to trace stolen cryptocurrency, disclosed on October 30, 2026 that an external actor gained unauthorised access to its systems and internal tools in October, and accessed user IDs, full names, email addresses and organisation role labels for users of its platform. What AI actually did: Chainalysis says the actor used “offensive agentic techniques” — that phrase is the company’s own description of how the access was gained, and it is the sourced basis for this entry. Chainalysis has given no technical detail beyond it: no framework or model named, no vulnerability identified, and no statement that the attack was fully autonomous, so this desk does not claim one. The company separately says it is using large language models defensively, to support its own security review — that is a defence measure, not part of the attack. Chainalysis says it found no evidence that investigation content, clear-text passwords, MFA secrets or session tokens were accessed, that it has notified all customers, and that the incident is not related to the Binance theft.
The harm to defend against is targeted phishing: real names, work emails and role labels for people who investigate crypto crime make a precision impersonation list. Chainalysis’s own advice is the defence: be hyper-vigilant about unexpected password-reset requests and authentication prompts, and enable two-factor authentication if your organisation has not already. The full breach report is on the news desk: Chainalysis breach report.
Sources: Chainalysis, Security Incident Information, October 30, 2026 ↗ · BleepingComputer, October 31, 2026 ↗
Fake prediction-market sites use AI influencers and AI chat support to steal crypto deposits
Oct 30, 2026 · REPORTED · Who is affected: People who deposit cryptocurrency on sites imitating Polymarket or Kalshi
Recorded Future’s Insikt Group reported that three Russian-language fraud teams — AtlasCore, PolyFucked and Magnetic Team — sell ready-made fake prediction-market platforms imitating services such as Polymarket and Kalshi, and that researchers tied more than 100 domains and subdomains to them. What AI actually did: AI was the lure and the support desk, not a breach of the real platforms. The teams’ manuals tell affiliates to build synthetic social-media influencers — realistic images and reaction videos tied to trending news — and to hide the AI involvement, and all three teams advertise or provide AI-supported customer service that holds conversations with victims across languages. The legitimate Polymarket and Kalshi platforms were not compromised in this research; the fraud runs on lookalike sites.
On a fake site the operator controls the result shown to each victim, blocks withdrawals behind invented identity checks, upgrade fees and “withdrawal taxes,” and collects card details, identity documents and selfies through a fake verification step. AtlasCore’s own Telegram channel claimed about $10.97 million in deposits between May 2 and September 18, 2026 — a criminal claim the researchers flag as unverified, not an established loss figure. Protect yourself: reach prediction markets only through the official domain you type or bookmark yourself, never through an influencer’s link; treat any demand for a fee or tax before a withdrawal as fraud; and never send identity documents or card details to a trading site you reached from social media.
Sources: CyberPress, reporting Recorded Future Insikt Group research ↗ · GBHackers ↗
AI-cloned voice of Danish Industry chief used in a $3.3 million transfer attempt
Oct 30, 2026 · REPORTED · Who is affected: Denmark · employees asked to move money on a boss’s verbal instruction
Denmark’s broadcaster DR reported that a scammer used an AI-generated copy of Danish Industry (DI) chief executive Lars Sandahl Sørensen’s voice to try to persuade an employee at DI’s South Korea office to transfer about $3.3 million, saying it concerned a confidential overseas acquisition. What AI actually did: the cloned voice was the impersonation itself. When the caller said the phone connection was poor, the conversation moved to WhatsApp under a profile bearing Sørensen’s name and photograph, and DI’s cybersecurity adviser said the messages included insider information about the matter. Sørensen said he had listened to the recording and found it highly convincing; the employee became suspicious and DI’s internal controls stopped the payment, and DI has reported the attempt to police.
The same clone-and-pressure pattern is used against families and small businesses, not only large organisations. DI’s advice is the defence that worked here: never move money on a verbal request alone, require a second person to approve new payees and changed account details, and call back on a number from your own directory — even when the request is said to be confidential and urgent.
Sources: Daily Northern, reporting DR ↗
Yoba malware: fake ChatGPT and Claude desktop apps spread a loader through search results
Oct 27, 2026 · REPORTED · Who is affected: Windows users searching for ChatGPT or Claude desktop apps
Check Point Research reported on October 27, 2026 that it had uncovered Yoba, a malware campaign that uses fake GitHub projects impersonating supposed ChatGPT and Claude desktop applications to deliver malware. What AI actually did: AI was the lure, not the target that was breached. The fake projects advertised non-existent desktop releases under names including GPT-5.6 Sol, GPT-6 Astra and Claude Opus, appeared prominently in Google Search in a pattern Check Point assesses as SEO poisoning, and directed users to malicious ZIP files hosted as GitHub releases. OpenAI, Anthropic, ChatGPT and Claude were not compromised; the attackers repackaged legitimate, signed OpenAI and Anthropic executables alongside a malicious library that the signed program loads.
Once run, the package installs a loader that establishes persistence and can fetch further payloads; in the campaign Check Point analysed, the final payload observed was the XMRig cryptocurrency miner, but the loader can deliver other Windows executables or PowerShell payloads, so an infection should be treated as a broader compromise, not only as unwanted mining. Check Point gives no victim count, and none is claimed here. If you went looking for a ChatGPT or Claude desktop app and installed one from a search result, a GitHub project page or any source other than the vendor's official site or app store, remove it, run a full scan with your security software, and change important passwords from a clean device. Download AI applications only through the vendor's own channels — a familiar logo, a signed installer file and a top search ranking are none of them proof that a package is genuine.
Sources: Check Point Research ↗ · CyberPress ↗
Seoul police: AI pentesting tool helped a hacking crew breach about 90 organisations and steal 8.2 million records
Oct 26, 2026 · CONFIRMED · Who is affected: South Korea · people whose records were held by about 90 breached organisations
The Seoul Metropolitan Police Agency announced on October 26, 2026 that it had identified seven suspects in a hacking campaign that breached more than 90 organisations in South Korea and stole 8.2 million records, including from educational institutes, hospitals, large corporations and golf courses. What AI actually did: police say the 32-year-old alleged leader started with conventional tools in September 2025, then adopted AI utilities in late August 2026 — including the ARTEX AI penetration-testing suite, used in most of the attacks, and an AI coding agent — and then breached 60 companies in 44 days, from August 31 to October 13. Police called it the first arrest case in Korea for a large-scale hacking and personal-information-theft crime that exploited generative AI, and said AI has lowered the barrier to entry, letting individuals run incidents that previously required a skilled group.
In 38 of the incidents the attacker demanded ransom payments totalling 360 million won (about $270,000), promising not to leak the stolen data in exchange; police are still investigating whether any of the stolen data has been leaked on the dark web. All seven suspects were arrested; the alleged leader, who had worked in penetration testing at a security company from 2019 to 2022, was arrested on October 15 and referred to prosecutors on October 23, and the other six remain under investigation without being detained. If an organisation you use in South Korea — a hospital, university, academy or club — notifies you about this campaign, treat follow-up messages with care even when they cite real personal details: stolen records are commonly reused for targeted phishing, so verify any request through the organisation’s official channels before acting.
Sources: BleepingComputer ↗ · Decrypt ↗