Welcome to the

AI Incident Database

Intro

On May 11th, 2026, hundreds of malicious packages were uploaded to RubyGems by AI agents. We believe these were authored by internal OpenAI agents (more).

The agents:

1. Attempted to steal RubyGems user API keys by exploiting a novel[^1] vulnerability in the RubyGems server. We don’t know if they succeeded (more).

2. Abused RubyDoc.info to execute arbitrary code [(more)](https://rubyhack.ai/#the-agents-used-rubygem

Chainalysis was recently the target of a cybersecurity incident, similar to many other tech platforms in recent weeks. Based on the investigation to date, we have found no evidence of unauthorized access to investigation content, authentication credentials, or session tokens.

Our team is working with leading cybersecurity experts to investigate this activity and harden our systems. We’ve proactively notified all of our customers and will keep them updated as our work progresses. This security incident is not related to the recent crypto theft at Binance. 

Below, you can find the full text of

A new report from the CrowdStrike Counter Adversary Operations team details research into four previously unreported threat actors, each of whom left their offensive agent frameworks exposed via open directories. In doing so, they shared detailed insight into their use of AI agents and revealed how adversaries are quickly becoming more proficient in AI. 

AI is changing the speed and scale of cyber operations. Counter Adversary Operations, which brings together the CrowdStrike Intelligence and CrowdStrike OverW

CrowdStrike OverWatch identified a VAPOR PANDA campaign using ARTEX alongside the Chinese-developed DeepSeek large language model (LLM) and a second commercial LLM to conduct intrusions against multiple high-value targets in parallel.

Beginning on October 17, 2026, the adversary used ARTEX against more than 200 distinct organizations worldwide, including foreign ministries in Latin America, Europe, Asia, and the Middle East;  semiconductor, defense, and think tank organizations in the U.S.; and telecommunications providers in multiple regions.

The VAPOR PANDA campaign detailed in this blog p

We identified a very likely coordinated network of accounts across Facebook, Instagram, Pinterest, Threads, TikTok, X, and YouTube that is impersonating US Assistant Attorney General Colin McDonald, who serves in the Department of Justice’s National Fraud Enforcement Division.

A newly created X account seeded two very likely deepfake videos on Oct. 20 that depicted a former student of Texas state Rep. and Democratic U.S. Senate candidate James Talarico accusing him of sexual assault. Based on dissemination tactics and content characteristics, we assess with high confidence that the Russia-ali