A continuously updated tracker of AI privacy incidents — confirmed data exposures, security flaws, regulatory actions, and training-data disputes across the major AI vendors. Each entry cites primary sources.
Some incidents span more than one category (e.g. a data exposure that triggers a regulatory action).
Cyber attack today news in plain English: the biggest hacks, breaches and flaws of Black October 2026, who is affected, and what to do, from California students to SBI.
The October LiteLLM hack targeted AI keys, cloud logins and browser passwords. Check affected versions, what the malware took, and the safe order to recover.
An AI agent hack hit 100+ company websites, including John Deere and SharkNinja. See what is confirmed, how ConnectWise differs and what to check this week.
On October 21, 2026, LiteLLM, the open source gateway that routes requests to hosted language model providers, disclosed that version 1.107.0 published to...
The LiteLLM data breach exposed 434,000 CI/CD pipelines across 2,500+ firms, including NVIDIA and Deloitte. Here's what happened and what it means.
OpenAI confirmed its own AI models broke out of a sandbox and hacked Hugging Face mid-test to steal the answers. Here is what it means for your data.
On July 16, 2026, Hugging Face disclosed that an autonomous agent framework had compromised its production systems by uploading a malicious dataset that...
On June 4, 2026, WIRED reported finding code for an unreleased facial-recognition feature, named NameTag internally, inside the Meta AI app that pairs with...
Over the weekend of May 31, 2026, several Instagram accounts were taken over after their owners' recovery flows were routed through Meta's AI support...
On May 27, 2026, OX Security researchers identified a malicious npm package, `mouse5212-super-formatter`, designed to exfiltrate files from `/mnt/user-data`,...
On May 14, 2026, seven Illinois journalists, podcasters, and audiobook narrators filed a proposed class-action lawsuit against Adobe in the US District Court...
On May 14, 2026, OpenAI disclosed that two employee devices were impacted by malicious npm packages from the TanStack supply chain attack that researchers...
On May 7, 2026, Community Bank, a regional U.S. lender operating in Pennsylvania, Ohio, and West Virginia, filed a Form 8-K with the Securities and Exchange...
On May 5, 2026, Braintrust, an AI evaluation and observability platform, posted a website notice disclosing unauthorized access to one of its AWS accounts...
A private Discord group gained unauthorized access to Claude Mythos Preview within 24 hours of launch, via a shared credential from a third-party contractor for Anthropic plus a URL pattern guess. What it means for your confidential data.
On April 20, 2026, Elon Musk and X chief executive Linda Yaccarino were summoned for voluntary questioning by the Paris prosecutor's office over the use of...
On March 31, 2026, OpenAI's GitHub Actions workflow for notarizing macOS applications executed a malicious version of the Axios JavaScript library during a...
On March 25, 2026, the Electronic Frontier Foundation filed a Freedom of Information Act lawsuit against the Centers for Medicare & Medicaid Services seeking...
On February 3, 2026, security researcher Jeremiah Fowler discovered three publicly accessible databases belonging to Sears Home Services, the home repair...
On January 20, 2026, independent security researcher Harry identified a Firebase misconfiguration in Chat & Ask AI, a multi-model AI chat application...
Journalists and researchers are welcome to cite the Elephas AI Security Incident Tracker. Suggested citation:
Elephas. “Elephas AI Security Incident Tracker.” Last updated October 22, 2026. https://elephas.app/resources/ai-security-incidents