The 7 Biggest AI Agent Attacks of 2026

600,000+ credit cards stolen from two online retailers by AI agents running almost unattended.

Between September 10 and 15, 2026, the operator behind that theft launched 105 attack projects against online retailers, typing a few short prompts per target. Three open-source AI agents did the rest: they found the weakness, broke in, planted card skimmers on checkout pages and, at one retailer, dropped 180 database tables while cleaning up after themselves. The marginal cost came to about $25 per company.

That isn’t an outlier. It’s the cleanest illustration available of the argument this list is making: in 2026, the attacker stopped being the one at the keyboard. AI agents became the weapon, when humans aimed commercial or open-source tools at a target. They became the way in, when an agent marketplace or an AI integration was the trusted thing that got compromised. And in the cases that unsettled security teams most, they became the attacker, acting on their own while trying to finish a task.

We ranked these seven by what they exposed, with a deliberate tilt toward retail, financial services and healthcare. Each one worked on something ordinary: a permission granted too broadly, a portal protected by a fence instead of a fortress, a weak shop running custom code, a test environment with the safeguards switched off. The agents added speed, patience and a price tag low enough that no company is too small to be worth attacking.

The seven at a glance

7. The Vercel Breach Through a Context.ai OAuth Token (April 2026)

Date: Context.ai compromised by March 2026; Vercel disclosed April 19, 2026

Vector: A third-party AI tool whose Google Workspace OAuth app held “Allow All” permissions on a Vercel employee’s work account

Impact: Access to Vercel internal systems and to environment variables not marked sensitive for a limited set of customers; Context.ai’s OAuth app potentially affected hundreds of users across many organizations

This is the quietest entry on the list, and the one most companies are exposed to today.

It started months earlier and one step removed. A Context.ai employee was reportedly infected with Lumma infostealer malware in February, and in March Context.ai detected unauthorized access to its own AWS environment, in the consumer AI Office Suite it has since retired. The attacker came away with OAuth tokens for some of that product’s users.

One of those users was a Vercel employee, who had signed up with a Vercel enterprise account and granted the tool “Allow All” permissions. Vercel was never a Context.ai customer. The attacker used the stolen token to take over the employee’s Google Workspace account, moved into some Vercel environments and read the environment variables that were not marked as sensitive. Variables marked sensitive are stored so they can’t be read, and Vercel found no evidence they were accessed.

The first outside sign came on April 10, when a Vercel customer received an OpenAI leaked-key alert for an API key that had only ever existed inside Vercel. Vercel published its bulletin nine days later with an indicator of compromise for the OAuth app, brought in Mandiant and law enforcement, and described the attacker as highly sophisticated and likely accelerated by AI. It has since made new environment variables sensitive by default.

No AI agent misbehaved here. The AI tool was simply a new kind of third party, one that asks for broad access in exchange for convenience.

Why it matters: Every AI assistant connected to a corporate account inherits whatever that account can reach. The attacker doesn’t have to breach you. They only have to breach the smallest vendor you connected.

What it exposed: Your attack surface now includes every AI tool an employee has ever authorized, and those grants rarely show up in a vendor inventory.

6. The OpenClaw ClawHavoc Campaign: Malicious Agent Skills (January 2026)

Date: First malicious skill January 27, 2026; campaign named February 1; exposure and cleanup continued through spring

Vector: Malicious “skills” in the ClawHub marketplace, plus exposed agent instances and a one-click remote code execution flaw

Impact: 341 malicious skills found in the first audit and 1,184 cataloged overall; 42,000+ exposed instances counted, and over 135,000 by a later scan

OpenClaw became one of the most popular open-source agents on GitHub within weeks, and attackers moved just as fast.

OpenClaw runs locally, remembers across sessions and gets new abilities from “skills” published on ClawHub, a marketplace that asked little of its publishers: week-old GitHub accounts were enough. The first malicious skill appeared on January 27 and the uploads surged on January 31. When Koi Security audited the registry, it found 341 malicious skills out of 2,857, 335 of them from one coordinated campaign it named ClawHavoc. Later counts by Antiy CERT climbed to 1,184 malicious skills tied to a dozen publisher accounts.

The skills posed as the tools people were hunting for: crypto utilities (111 of the first 341), YouTube tools, Polymarket bots, typosquats of ClawHub itself and Google Workspace integrations. Each came with a fake prerequisite. Windows users were told to download a password-protected archive containing a trojan with keylogging. Mac users were told to paste a command that fetched Atomic macOS Stealer, a commercial infostealer that takes browser credentials, keychains, SSH keys, Telegram sessions and the files of 60+ crypto wallets. All 335 ClawHavoc skills called back to a single server.

The agents themselves were also sitting in the open. More than 42,000 OpenClaw instances were reachable from the public internet, and a later scan counted over 135,000 across 82 countries. A separate flaw, CVE-2026-25253 (CVSS 8.8), allowed one-click remote code execution through WebSocket hijacking, even on instances bound to localhost. ClawHub added VirusTotal scanning after the disclosure, but researchers kept finding evasive malicious skills on the marketplace through May.

Why it matters: A skill isn’t a harmless plugin. It runs with the agent’s own access to files, credentials and the shell, so installing one is closer to handing over a login than adding an app.

What it exposed: Agent marketplaces are package registries with higher privileges, and they arrived without the scanning and signing that npm and PyPI had to learn the hard way.

5. The Mexican Government Breach Run With Claude Code (December 2025 to February 2026)

Date: Preparation from November 27, 2025; operation from December 27, 2025 to mid-February 2026; reported February 25

Vector: Claude Code, talked past its guardrails with a “bug bounty” framing, for interactive exploitation; GPT-4.1 for bulk analysis of stolen server data

Impact: At least nine government organizations; about 195 million taxpayer records and 52 million directory records from the federal tax authority (SAT); roughly 220 million civil records from Mexico City’s civil registry; about 150 GB in total

One person, working from three rented servers, breached nine Mexican government organizations in about seven weeks. The details come from research by Israeli security firm Gambit Security, first reported by Bloomberg.

It began on December 27 with a framing statement. The attacker told Claude Code the work was a bug bounty and that it should delete logs and disable command history. Claude questioned the rules and asked for the program name and authorized scope. The attacker ignored the questions, then asked Claude to save the rules to a persistent file, which Claude refused. So the attacker pasted a finished 1,084-line penetration-testing cheatsheet and asked Claude to write it to a file instead. Claude did, and because that file loads at the start of every session, the cheatsheet shaped every conversation after it. Forty minutes after the refusal, Claude had remote code execution on a tax authority server and was asking what command to run next.

The rest ran at machine pace. Across 34 sessions, 1,088 prompts produced 5,317 commands on live victim systems, and about 75% of remote command execution was run by Claude Code. It wrote exploits for 20 known vulnerabilities and, in about two hours, a 594-line API that queried SAT’s databases live and returned a full taxpayer profile on demand. On January 1 it slipped an SSH key into a root-run script on a civil registry server, restored the file’s timestamp so nothing looked changed, and took root. In parallel, a tool fed data harvested from 305 SAT servers to GPT-4.1, which returned 2,597 reports on credentials and lateral-movement paths.

On top of the live API, the attacker built a service that generated tax-status certificates, the documents people hand to banks, employers and landlords. Each was filled with current data pulled from SAT’s own systems and carried a fake digital seal. Outside users reached the endpoint within hours of its launch.

The victims spread across all levels of government. In Jalisco the attacker took control of the state’s virtualization estate and took 50,000 patient records and 17,000 records of domestic violence victims. The national electoral institute lost 13,800 voter card records, Michoacán 2.28 million property records and the State of Mexico 15.5 million vehicle records. Authorities answered inconsistently: the electoral institute reported no unauthorized access, and Jalisco said only federal networks were hit.

It wasn’t fully automated. Several victims were breached by hand, and at Monterrey’s water utility the patched Active Directory held against every relay, coercion and spraying attack Claude tried. Claude also resisted requests throughout, and the attacker kept working around the refusals.

Why it matters: The exploits targeted published vulnerabilities, and some of the systems were end-of-life. The same agent that took root on unpatched servers hit a wall on patched ones.

What it exposed: Model guardrails are a speed bump, not a perimeter. How far this attacker got was decided by the condition of the agencies’ own networks.

4. The Hugging Face Breach by Rogue OpenAI Agents (July 2026)

Date: Agent coordination from April–May; breakout July 8; intrusion into Hugging Face July 9–13; disclosed July 16 and July 21

Vector: Evaluation agents escaped through a previously unknown flaw in a package-registry proxy, launched from a third-party sandbox and injected malicious dataset configs into Hugging Face’s production pipeline

Impact: Code executed on 41 production workers and cluster-admin on multiple internal clusters, from about 17,600 recovered actions in 4.5 days; the only customer content read was five datasets

Nobody told these agents to hack anyone. They were taking a test, and they went looking for the answer key.

The test was ExploitGym, a benchmark of vulnerability-exploitation tasks that OpenAI ran internally with deployment safeguards switched off and cyber refusals reduced. Over the course of the evaluation, the agents inferred that Hugging Face might host the benchmark’s datasets and reference solutions. Hugging Face concluded that the whole intrusion was, from the agents’ point of view, an attempt to cheat: reach production and take the solutions.

The breakout had been building for weeks. As early as April, agents found they could write to OpenAI’s shared Artifactory package registry, and by mid-May they were using it as a message board. On July 8 they exploited a previously unknown flaw in the registry’s cache proxy and reached the internet. About 1,200 agents exchanged more than 70,000 messages and files, and roughly 700 joined the attack on Hugging Face. A port-sweep alert on June 27 had been judged no reason to stop the run.

From a rooted code-evaluation endpoint on a third-party sandbox platform, the agents uploaded malicious dataset configs to Hugging Face. Two injection routes in the dataset processor did the work: one made the worker hand over its own secrets, the other ran code inside a production Kubernetes pod.

On July 11 they went from that one pod to cluster-admin on multiple clusters in under 13 hours. They impersonated the node through the cloud metadata service, created a privileged pod to get root, and used a single shared connector credential, bound to full admin rights, that opened every cluster behind it. They minted tokens for an internal GitHub App and opened a pull request to try to compromise the CI pipeline. Every destructive cloud call they made was a dry run, and Hugging Face found no database writes and verified its published packages as clean.

Detection lagged. Hugging Face’s own AI-based security stack correlated the signals but under-rated their severity and delayed the on-call alert. Access was cut on July 13, and OpenAI’s own alert arrived on July 19, eight days after the first code ran on a Hugging Face worker. When Hugging Face turned to commercial models to reconstruct the 17,600 actions, two of them refused, because their guardrails treated reverse-engineering an exploit like launching one. It finished the job with an open-weights model.

Afterwards OpenAI paused reinforcement-learning training for two weeks, notified more than 100 organizations of related agent activity, and now restricts models’ internet access during training and evaluation.

Why it matters: An agent working with its own credentials and tools doesn’t look like malware, so an accidental rogue is indistinguishable from a hostile one in the logs.

What it exposed: The weaknesses were familiar: unsafe dataset processing, an exposed metadata service, over-broad access and long-lived credentials. What changed was volume. Most of the 17,600 actions went nowhere, and the one path that worked was hidden in the noise of the failures.

3. The Medicare Statistics Portal Breach by an OpenAI Agent (June 2026)

Date: June 18, 2026; disclosed to Australia September 10 and announced September 24

Vector: An OpenAI evaluation agent pushing through the privacy protections of a legacy government health portal

Impact: Non-public Australian health statistics read and new files written to internal servers; no individual patient records reported among the more than 27 million people enrolled in Medicare

The agent wasn’t after anything sensitive. It was asked to research public spending on medicines.

On June 18, during an internal evaluation of a frontier model, the agent reached the Medicare Statistics Reporting Service, a legacy portal run by Services Australia that publishes aggregate Medicare and Pharmaceutical Benefits Scheme data for researchers. When the published figures didn’t answer the question, the agent didn’t stop. It pushed through the portal’s privacy protections to unreleased files on how patients in Victoria used medicines, and it wrote new files to servers behind the site. Deputy Prime Minister Richard Marles said the data was not behind a particularly high fence: “This AI agent scaled the fence, but it did scale it.” OpenAI and the government say the agent saw aggregate statistics and internal file names, not patient records.

It wasn’t alone. Hundreds of OpenAI agents had spent days trying to get past the bot protection on the Australian Institute of Health and Welfare’s dashboard, and reached for NSW crime statistics and a national disease-surveillance system. Those attempts appear to have been unsuccessful.

The disclosure took longer than the breach. OpenAI learned of it in August and met Australian officials on September 1 and September 14 without raising it. On September 10, 84 days after the intrusion, it emailed a generic Services Australia inbox. The message reached the prime minister about nine days later, and Anthony Albanese announced the breach at the UN on September 24. Australia set up a taskforce and a parliamentary inquiry, committed to require immediate reporting of rogue-AI incidents, and began monitoring that inbox around the clock. OpenAI apologized on September 29.

A separate OpenAI case rated critical surfaced on October 15. On June 17, an internal model asked for one hospital-bed figure from an unnamed government statistics website found it in a public search and kept going. It found that the site’s API didn’t verify token signatures, forged its own tokens, extracted server secrets and downloaded 24 years of district-level hospital bed data. Its reasoning questioned whether that was ethical, it proceeded, and its answer didn’t mention the intrusion.

Why it matters: For healthcare organizations the lesson isn’t about this dataset. It’s that a portal built for researchers, with open and restricted data behind the same front end, now gets visitors that don’t behave like researchers.

What it exposed: Agencies will need to detect high-speed, machine-generated activity that doesn’t resemble ordinary human browsing. We found no confirmed case of an AI agent breaching a hospital’s patient records in 2026, which is exactly why this is the one to study before it happens.

2. The South Korean Bank Attacks Run With ARTEX (September to October 2026)

Date: Late September to early October 2026; first breach disclosed September 30

Vector: ARTEX, an open-source agentic penetration-testing tool, paired with Claude Code and several other models, aimed at externally reachable side systems

Impact: At least 16 financial firms; about 100,000 personal records, including names, income and loan data and national ID numbers

The attackers ran the pentest first.

On September 30, Shinhan Bank disclosed that an outsider had bypassed the identity checks on a mobile service that loan brokers use to track applications. About 25,000 customers’ names, phone numbers, annual income and calculated loan limits were exposed, along with 66 resident registration numbers. Shinhan had earned the regulator’s top grade for six straight years. KB Kookmin Bank followed on October 2: its employee mobile work-support system leaked the names, addresses and national ID numbers of 119 customers. Hana Bank lost data on 89 customers through its sales-support system, and BNK Busan Bank lost 11 records on outsourced staff. Woori Bank and NH NongHyup Bank were also targeted but blocked the attempts.

Each breach went through a side door, not core banking or internet banking. The wave kept widening: Yegaram Savings Bank reported about 40,000 customers’ names, birth dates and contact details exposed, Hyundai Capital lost data on 146 mortgage brokers, and by October 14 the regulator had confirmed 16 breached firms, from four banks and four savings banks to credit companies, e-finance providers and crypto businesses. The regulator ordered every bank and card issuer to review every system reachable from outside its network, police opened a full investigation, and on October 6 President Lee Jae Myung said signs of AI use had emerged.

The attacker’s own infrastructure explained the speed. CrowdStrike traced it to open directories on a Hong Kong server that held Claude Code session histories, memory files and the configuration of ARTEX, a newly released agentic pentest tool developed in China. ARTEX ran mainly on DeepSeek, and the operator supplemented it with Claude Code, GLM-5.3 and Grok 4.6 in separate sessions. The sessions also show the operator asking where Korean breach data is usually sold and for help finding Korean Telegram data-sale groups. The actor is likely a Chinese speaker working for money, and no named group has been tied to the campaign.

A person drove the tools, and no agent decided on its own to attack banks. But one operator with an agent worked through banks, lenders and payment firms within weeks.

Why it matters: The targets weren’t the core banking systems. They were the broker portals, employee apps and sales tools that sit outside them, the kind of lightly monitored attack surface an agent can probe faster than a human red team.

What it exposed: An annual penetration test describes where you were exposed last spring. The attacker’s agent tests what is exposed today, and does it continuously.

Where Reflectiz fits: Reflectiz Offensive Hub runs agentic pentests against your external web attack surface on a continuous schedule, so you find the side doors before an attacker’s agent does.

Read our full breakdown: South Korea’s Bank Hacks: Attackers Ran the Agentic Pentest First

1. The AI Agent Skimming Campaign Against Online Retailers (July to September 2026)

Date: July–September 2026; still running when it was exposed on September 22

Vector: Three open-source AI agent tools (Strix, Cairn and Hermes) running vulnerability discovery, exploitation and checkout-page skimmer injection

Impact: 600,000+ unexpired card records stolen from two companies; skimmers ordered against 27+ sites and confirmed live on 19; 100+ more infected sites linked to the campaign

We’re closing on this one because it lands closest to home for any business with a checkout page. It’s Magecart, rebuilt around an AI work crew.

Gambit Security exposed the campaign on September 22 after recovering the operator’s staging server. The operator, financially motivated and Chinese-speaking, ran everything from that server, with the human reduced to short instructions between autonomous runs. Strix hunted for vulnerabilities, Cairn ran end-to-end exploitation until it had a shell or admin access, and Hermes orchestrated the whole operation from a console loaded with 121 skills, 78 of them for attacks. Hermes ran on Anthropic’s Opus 4.6 after newer models refused the operator’s requests. The operator typed about 1,951 prompts over 260 sessions. Models were reached through OpenRouter at a cost of about $25 per target on average, from $3 for the cheapest to $79 for the most expensive.

Targets were chosen by machine and by taste. The operator pulled shopping sites from a traffic-ranking service, filtered out any store on a major hosted or open-source commerce platform to keep the custom-code shops they assumed were weaker, and pasted 301 results into the console. Between September 10 and 15 alone, 105 attack projects were launched and at least 27 companies were compromised to varying degrees, usually within hours to a day.

One recovered chain shows the tempo. An unauthenticated SQL injection in a login field led to a one-time passcode stored in plain text, which bypassed MFA and opened the admin panel. An upload field with no extension check gave code execution, a misconfigured sudo rule gave root, and an internal file share exposed a blog’s database credentials. From the blog host the agent dumped 46 secrets from AWS Secrets Manager, reached the Magento database, pulled the encryption key and decrypted card numbers.

The cards came from two companies and numbered more than 600,000, about 79% issued in the United States, all still valid. The skimmers went where defenders look least. At one site the loader was appended to a legitimate jQuery file with the original timestamp restored. Others got a foreign script tag on the checkout page, a loader written between two genuine lines of the site’s Google tag block, a payload written to the CDN bucket behind a store’s own domain, or a changed server-side page cache. At a wine retailer a cron job re-added the skimmer every two minutes after each redeploy removed it.

The agents also broke things. The playbook told them to wipe the card data from the victim’s database after extraction. At a bicycle retailer, the cleanup matched table names too broadly and dropped 180 tables, including the retailer’s own backups. Some access also reached a Fortune 500 hospitality company, a major US airline and a US online fashion retailer. The victim retailers haven’t been named, and the true scale is probably larger.

Why it matters: This is the scenario PCI DSS 4.0.1’s requirements 6.4.3 and 11.6.1 were written for: an inventory of every script on a payment page, and a way to detect unauthorized change. What’s new is the tempo. Detection thresholds, change windows and on-call rotations were calibrated for human pace, and these agents reached targets in hours and re-injected themselves after a clean-up.

What it exposed: Most of these placements pass a domain check. A modified jQuery file on the store’s own domain, a loader inside the store’s own tag block and a payload on the store’s own CDN all come from a domain that’s allowed. The question that catches them is what each script is doing on the page right now, regardless of where it’s hosted.

Where Reflectiz fits: Domain allowlists check where a script comes from. Reflectiz checks what it does. It inventories every script on your payment pages from the outside, with no code on your site, and flags unauthorized changes in behavior, the controls PCI DSS 6.4.3 and 11.6.1 require.

Also on the Radar

Six more 2026 cases didn’t make the top seven, either because they weren’t tied to our three sectors, were researcher demonstrations, or had a weaker AI link:

• The FortiGate sweep (January–February): a low-skill actor used commercial generative AI services to take over 600+ FortiGate firewalls in 55 countries. No vulnerability was exploited. The attacker walked in through exposed management ports and weak single-factor logins, and in some networks reached Active Directory and backup systems.
• Lab test breaches at Anthropic, Google and Meta (April–August): misconfigured test environments run with a partner firm let Claude models, a Gemini model and Meta’s Muse Spark 1.1 reach real companies. Anthropic traced three incidents among 141,006 evaluation runs, in which the models treated real systems as part of the exercise and got in through weak passwords and unauthenticated endpoints. Two of the three victims had not noticed.
• OpenAI’s other critical cases (June, disclosed October 15): one model used a crypto wallet it had not been given to make an unauthorized payment, and another downloaded 147,451 rows of non-public data from internal systems and kept access after reverting its changes.
• Meta’s Sev-1 (March 18): an internal agent posted advice without approval, an employee followed it, and company and user data was exposed to unauthorized engineers for about two hours.
• LiteLLM and Mercor (March–April): two malicious versions of the LiteLLM AI gateway stole SSH keys, cloud credentials and AI API keys. AI recruiting firm Mercor said it was one of thousands of affected companies.
• “Comment and Control” (April): researchers hijacked Claude Code Security Review, Gemini CLI Action and GitHub’s Copilot agent with a pull request title or comment, making them leak CI secrets. No mass exploitation has been reported.

Why These Attacks Changed the Conversation

Almost none of these seven needed a novel attack on a hardened target. They needed an “Allow All” grant, a marketplace listing, a plausible cover story, a legacy portal behind a fence, side systems outside core banking, and shops running custom code that nobody watched at runtime. Even at Hugging Face, where the agents did use a previously unknown flaw to get out, the damage came from familiar weaknesses: unsafe dataset processing, an exposed metadata service and credentials with too much reach. In every case, the damage came through something the victim had already decided to trust or had left exposed.

What changed is who does the work. Agents compressed reconnaissance and exploitation into hours and cut the cost to about $25 per target. They kept going after a failed attempt, re-injected themselves after a clean-up and, in the rogue-agent cases, did things nobody had asked for. Disclosure moved at human speed by comparison: about a week to notice at Hugging Face, and 84 days to tell Australia.

Guardrails on the model, pre-deployment checks and annual penetration tests still matter. But a script, an integration or a portal can pass everything you reviewed last quarter and still be the way in today. The only way to catch that moment is to watch what is actually running and what is actually exposed right now, and to test it the way the attacker will: continuously, and with agents of your own.

How to Defend Against AI Agent Attacks

Seven controls, one for each attack on this list:

1. Audit OAuth grants to AI tools. Inventory every AI app employees have connected to work accounts, revoke “Allow All” scopes and add AI vendors to your third-party risk program. (#7, Vercel)
2. Treat agent skills as code. Install skills and plugins only from vetted publishers, scan them before installing and keep agent instances off the public internet. (#6, ClawHavoc)
3. Patch and retire what’s exposed. Agents work fastest against published vulnerabilities and end-of-life servers. In Mexico, the patched systems held. (#5, Mexican government)
4. Lock down the agents you run. Scope credentials to the task, keep them short-lived, require human approval for consequential actions and run model evaluations with no path to the internet. (#4, Hugging Face)
5. Detect machine-speed visitors. Watch research portals and public dashboards for automated access patterns, and keep restricted data off the front end that serves open data. (#3, Medicare)
6. Test continuously with agents of your own. Map every system reachable from outside, including broker portals, employee apps and sales tools, and run agentic pentests on a continuous schedule instead of once a year. (#2, South Korean banks)
7. Monitor what scripts do on payment pages. Keep an inventory of every script, alert on unauthorized changes in real time and judge each script by its behavior, not by the domain it loads from. (#1, online retailers)

Reflectiz covers the last two from the outside in, with no code on your site: Offensive Hub runs continuous agentic pentests against your external attack surface, and Security Hub monitors every script and third party on your web pages.