Topic · AI model abuse
AI model abuse and misuse by attackers: incidents and rules
cisonews.ai has logged 10 publicly reported AI model-abuse incidents, with event dates from January 2025 to October 24, 2026.
The most recent is "'Skynet' AI agent hijacks exposed AI models to run autonomous cyberattacks" (affected: Exposed self-hosted AI models, AI gateways, and MCP servers (no confirmed named victim)); each entry below links to its sourced write-up, followed by 1 explainer and 9 related rules and standards.
- 10
- Incidents
- 1
- Explainers
- 2
- Definitions
- 9
- Rules and standards
Collected from 22 pages on this site, newest addition October 30, 2026. Every fact sits on the linked page with its sources.
Incidents, newest first
Full log →- 2026-10-24'Skynet' AI agent hijacks exposed AI models to run autonomous cyberattacksAffected: Exposed self-hosted AI models, AI gateways, and MCP servers (no confirmed named victim)
- 2026-10-19Autonomous AI agents using Cairn breach 100+ firms including John DeereAffected: John Deere, SharkNinja, Cummins and other companies
- 2026-10-06Hackers breach South Korean banks with Chinese AI tool Artex, expose 68,000 peopleAffected: South Korean banks including Shinhan Bank, KB Kookmin Bank and Hana Bank
- 2026-09-25OpenAI agents probed SEC, Census Bureau and Education Department sitesAffected: US Securities and Exchange Commission, US Census Bureau and US Department of Education websites
- 2026-07-18Anthropic's Claude agent sent Philadelphia police a fake murder tipAffected: Philadelphia Police Department
- 2026-06-18OpenAI research agent gained unauthorised access to Services Australia Medicare statistics portalAffected: Services Australia Medicare Statistics Reporting Portal
- 2025-09Anthropic reports AI-orchestrated cyber espionage campaign run through Claude CodeAffected: Claude Code (Anthropic); roughly thirty targeted organizations
- 2025-08-27Anthropic discloses vibe hacking AI data extortion campaign (GTG-2002)Affected: Anthropic Claude Code (used against multiple victim organizations)
- 2025-02-27Microsoft names Storm-2139 developers who abused Azure OpenAI ServiceAffected: Microsoft Azure OpenAI Service
- 2025-01Google discloses state-backed adversarial misuse of GeminiAffected: Google Gemini
Rules and standards on this topic
Tracker →- 2026-10-29New York senator introduces RAISE Act 2.0 to let state pace frontier AIUS States · RAISE Act 2.0 (S.10731)
- 2026-10-20California senator introduces Frontier AI Safety Act to regulate safety computeUS States · Frontier AI Safety Act (California state bill)
- 2026-09-2326 state attorneys general ask Congress to regulate frontier AI, not block states from doing itUS States · Letter to congressional leadership
- 2026-06-02Trump signs Executive Order 14409 on frontier AI cybersecurityUS Federal · Executive Order 14409
- 2025-12-19New York signs the RAISE Act, a frontier AI safety and transparency lawUS States · RAISE Act (S6953B/A6453B)
- 2025-09-29California SB 53, the Transparency in Frontier Artificial Intelligence Act, signedUS States · California SB 53
- 2025-01-15NIST releases second draft of AI 800-1 misuse risk guidance for foundation modelsUS Federal · NIST AI 800-1, Managing Misuse Risk for Dual-Use Foundation Models
- 2024-05-21Seoul Declaration and Frontier AI Safety Commitments signed at AI Seoul SummitInternational · Seoul Declaration and Frontier AI Safety Commitments
- 2023-11-01Bletchley Declaration: 28 countries and the EU agree on frontier AI risksInternational · Bletchley Declaration
Questions about this topic
- How many AI model-abuse incidents has cisonews.ai logged?
- 10, with event dates from January 2025 to October 24, 2026. The most recent is "'Skynet' AI agent hijacks exposed AI models to run autonomous cyberattacks".
- Which MITRE ATLAS techniques appear in these incidents?
- By this site's own tagging, the most frequent are AI Agent Tool Invocation (AML.T0053, 4 incidents); Active Scanning (AML.T0006, 1 incident).