Meta AI support assistant abused for Instagram account takeovers
Over the weekend of May 31, 2026, several Instagram accounts were taken over after their owners' recovery flows were routed through Meta's AI support...
A continuously updated tracker of AI privacy incidents — confirmed data exposures, security flaws, regulatory actions, and training-data disputes across the major AI vendors. Each entry cites primary sources.
Some incidents span more than one category (e.g. a data exposure that triggers a regulatory action).
Over the weekend of May 31, 2026, several Instagram accounts were taken over after their owners' recovery flows were routed through Meta's AI support...
On May 27, 2026, OX Security researchers identified a malicious npm package, `mouse5212-super-formatter`, designed to exfiltrate files from `/mnt/user-data`,...
On May 14, 2026, seven Illinois journalists, podcasters, and audiobook narrators filed a proposed class-action lawsuit against Adobe in the US District Court...
On May 14, 2026, OpenAI disclosed that two employee devices were impacted by malicious npm packages from the TanStack supply chain attack that researchers...
On May 7, 2026, Community Bank, a regional U.S. lender operating in Pennsylvania, Ohio, and West Virginia, filed a Form 8-K with the Securities and Exchange...
On May 5, 2026, Braintrust, an AI evaluation and observability platform, posted a website notice disclosing unauthorized access to one of its AWS accounts...
A private Discord group gained unauthorized access to Claude Mythos Preview within 24 hours of launch, via a shared credential from a third-party contractor for Anthropic plus a URL pattern guess. What it means for your confidential data.
On April 20, 2026, Elon Musk and X chief executive Linda Yaccarino were summoned for voluntary questioning by the Paris prosecutor's office over the use of...
On March 31, 2026, OpenAI's GitHub Actions workflow for notarizing macOS applications executed a malicious version of the Axios JavaScript library during a...
On March 25, 2026, the Electronic Frontier Foundation filed a Freedom of Information Act lawsuit against the Centers for Medicare & Medicaid Services seeking...
On February 3, 2026, security researcher Jeremiah Fowler discovered three publicly accessible databases belonging to Sears Home Services, the home repair...
On January 20, 2026, independent security researcher Harry identified a Firebase misconfiguration in Chat & Ask AI, a multi-model AI chat application...
Journalists and researchers are welcome to cite the Elephas AI Security Incident Tracker. Suggested citation:
Elephas. “Elephas AI Security Incident Tracker.” Last updated May 31, 2026. https://elephas.app/resources/ai-security-incidents