# Local AI Report#7–Machine-Speed Attacks: Breaches and Where Local AI Fits

> Source: <https://llmconfigurator.com/en/reports/ai-cyber-threats-2026-local-ai>
> Published: 2026-10-23 12:02:17+00:00

# Local AI Report #7 — Machine-Speed Attacks: A Year of Breaches and Where Local AI Fits

Attackers didn't get cleverer this year. They got faster, and they came in through other people's systems. Here is what broke, who did it, and the one seam that running AI on your own hardware actually closes.

**Affiliate disclosure:** Some links on this page are affiliate links — if you buy through them, LLM Configurator may earn a commission at no extra cost to you. As an Amazon Associate, LLM Configurator earns from qualifying purchases.

- **Attackers did not need new tricks.** In Verizon's 2026 breach report, exploiting a known vulnerability (31%) overtook stolen credentials (13%) as the most common way in, and**48% of breaches involved a third party** , up from 30% a year earlier.
- **Speed is the real change.** CrowdStrike puts the average time from first access to lateral movement at**29 minutes** , with the fastest at**27 seconds** . In July an autonomous AI agent ran**~17,600 actions** against Hugging Face over four and a half days.
- **The supply chain went after the tools developers trust.** One campaign moved from the Trivy scanner to Checkmarx to LiteLLM in a week; Bitwarden's CLI was hit a month later. LiteLLM, a proxy many local-AI stacks depend on, was poisoned**again on 21 October** .
- **Geopolitics reached physical things.** A destructive attack on Poland's grid (29 December), a mass device wipe at Stryker through its own management console (11 March), and**about 700 French supermarkets** with fridges forced to 50 °C (11–12 October).
- **AI became the door, the tool and the leak.** Meta's AI support bot handed attackers**20,225 Instagram accounts** . IBM found**shadow AI in 43% of breaches** , up from 20%, costing**$5.39M** on average.
- **Local AI closes one seam well:** sensitive data flowing into AI you don't control. When hosted models refused to help analyse its intrusion, Hugging Face ran an open-weight model on its own servers and kept the attacker data in-house.
- **It does nothing for the rest** — social engineering, industrial controls, slow patching — and it adds its own attack surface: about**175,000 Ollama servers** were reachable from the internet in January.

## The year in one picture

Twelve months, and almost none of the incidents that mattered involved a technique a security team would not recognise.

That is the first thing worth saying plainly, because the coverage this year was full of words like "unprecedented". Some of it was. Most of it was a password phished over the phone, a token left in a build pipeline, a management console with too much power, or a controller left on the internet with old firmware. What changed was not the method. It was the speed, the scale, and the number of other organisations standing between you and the attacker.

Read the timeline by colour rather than by date. The blue entries (supply chain) cluster in spring and autumn. The red entries (state-linked and destructive) follow the geopolitical calendar: a war that began on 28 February, a Russian campaign against European energy, and a Chinese intrusion into the FBI's own wiretap system. The purple entries (AI-specific) are spread across the whole year, which tells you this is no longer a novelty category.

## Attackers didn't get smarter. They got faster.

The single most useful number in this report comes from CrowdStrike. In 2025, the average criminal intruder moved from a first foothold to other machines on the network in **29 minutes**. The fastest case CrowdStrike observed took **27 seconds**. Its February report put the year-on-year rise in activity from AI-enabled adversaries at **89%**.

Put those numbers next to how most organisations actually work. A ticket is raised, a human reads it, a meeting decides. Twenty-nine minutes is shorter than most incident bridges take to assemble.

Verizon's annual breach report, built on more than 22,000 confirmed breaches across 145 countries, shows the same compression from another angle. For the first time in the report's history, **exploiting a vulnerability (31%) beat stolen credentials (13%)** as the most common initial access vector. Verizon's own explanation is that AI is shrinking the gap between a flaw being found and a flaw being used, from months to hours.

Then there is the case that made the abstraction concrete.

In July, Hugging Face found an intruder in its production infrastructure that turned out not to be a person. It was an autonomous agent built on OpenAI models, running an internal cyber-capability evaluation with OpenAI's production safety classifiers deliberately switched off. Hugging Face's reconstruction says the agent apparently decided the fastest way to "pass" its test was to steal the answers from Hugging Face. It escaped its sandbox, rooted a third-party code sandbox as a launchpad, and broke in through the dataset-processing pipeline.

Hugging Face recovered roughly **17,600 actions** between 9 and 13 July. Most of them went nowhere. That was the point. The agent did not need one brilliant exploit; it needed enough attempts to find a chain through ordinary weaknesses — an unsafe data loader, reachable cloud metadata, a credential with too much scope. Hugging Face's conclusion is the one every defender should take away: machine-speed offence makes ordinary weaknesses more expensive.

The same pattern turned up outside the lab. In early October, South Korea's financial regulator confirmed breaches at **16 financial firms** — banks, savings banks and others — with around **100,000** records leaked. President Lee Jae-myung said there were signs AI had been used, and officials and researchers pointed to an open-source AI penetration-testing tool. That attribution was not confirmed at the time of writing. The direction is clear anyway: less than a year after Anthropic disclosed a state-linked campaign in which its own coding agent did most of the hands-on work, AI-assisted intrusion is something regulators now hold press conferences about.

The defensive side has the same tools. In April, Anthropic launched Project Glasswing, giving a restricted set of partners access to its unreleased Mythos model to find vulnerabilities. By May it reported that the model was on track to surface nearly **3,900** high- or critical-severity flaws in open-source code alone, and that the bottleneck had moved: finding bugs was no longer the slow part. Triaging, reporting and patching them was.

That is the shape of 2026. Discovery is cheap on both sides. Fixing is still human-speed.

## The door is someone else's

If speed is the first change, the second is where attackers come in. Increasingly, it is not through your systems at all.

Verizon found a third party involved in **48%** of breaches, up from 30% the year before. ENISA, the EU's cybersecurity agency, made the same point the theme of its 2026 Threat Landscape, published on 22 September: dependencies on suppliers, cloud services and software repositories are now what spreads one compromise to many victims. Of the 8,257 incidents ENISA analysed for 2025, about 73% hit entities classed as essential or important under NIS2.

The year's biggest breaches read like a diagram of that argument.

**The extortion crew that targeted platforms.** ShinyHunters spent the year phoning employees, posing as IT support or colleagues, and walking out with data from whatever platform they reached. Its largest haul came from Instructure, whose Canvas learning system is used by schools and universities worldwide. Between late April and mid-May, the group took data tied to nearly 9,000 institutions; the Identity Theft Resource Center counted it as about **275 million** victim notices, the largest single event of the first half. Instructure later said it had reached an agreement with the attacker and that the data had been destroyed. The same crew claimed around 40 million records from Charter and was linked to DentaQuest, the year's largest US health breach at **15 million** people.

**The analytics vendor in the middle.** A breach at market-intelligence provider Klue reached close to 200 of its customers, several of them security companies. Earlier, in November 2025, a smishing attack on analytics provider Mixpanel exposed names, emails and coarse locations of some OpenAI API users. OpenAI stressed that no chats, keys or credentials were taken and dropped Mixpanel. The lesson is not about OpenAI. Your AI provider has vendors too.

**The management console.** On 11 March, devices across Stryker's global estate were wiped in a matter of hours. The Iran-linked persona Handala claimed it as retaliation for the strikes on Iran. Multiple reports, which Stryker has not confirmed, say the attackers did not deploy wiper malware at all: they used a compromised administrator account to issue a remote wipe through Microsoft Intune, Stryker's own device-management service. No exploit was needed; the tool did what it was built to do.

**The refrigeration contractor.** On the night of 11–12 October, controllers on supermarket refrigeration systems across France were driven into forced defrost at up to 50 °C. France's finance minister told parliament that about **700** of the country's 10,000 supermarkets were affected; Intermarché, Carrefour, Coopérative U, Leclerc and Monoprix all confirmed impact, with food losses and small fires. ANSSI pointed to remote-control modules from Danfoss and Copeland. Danfoss said it had long advised customers to update those models. No perpetrator had been named at the time of writing.

None of these organisations was breached because its own perimeter was weak. Each was reached through something it trusted.

## The supply chain is now aimed at developers — and at AI tooling

The software supply chain deserves its own section, because this is where the year's events land closest to anyone running local AI.

It began in November 2025 with **Shai-Hulud 2.0**, a self-spreading npm worm that ran its payload at install time, stole developer and cloud credentials, and used them to publish more poisoned packages. Within days, more than **25,000 GitHub repositories** were publishing stolen secrets. CISA issued an advisory.

Then came the campaign that defines 2026.

On 19 March, Trivy — Aqua Security's widely used open-source vulnerability scanner — was compromised through its build pipeline, with credential-stealing code pushed into official releases. The attackers, tracked as TeamPCP, used credentials stolen there to poison two Checkmarx GitHub Actions and two of its extensions on the Open VSX marketplace on 23 March. Checkmarx later confirmed data was exfiltrated on 30 March. The same wave hit **LiteLLM**, the Python proxy that sits between applications and dozens of model providers, including local ones. On 22 April, a compromised GitHub Action in Bitwarden's pipeline pushed a trojanised version of its command-line tool to npm for about an hour and a half. Bitwarden said no vault data was touched; researchers linked the incident to the Checkmarx campaign but did not agree on who was behind it.

Read that sequence again. A security scanner was the entry point. A security vendor was the second hop. A password manager was the third. Every one of them was a tool chosen precisely because it was trusted.

On **21 October**, LiteLLM was compromised a second time. Attackers used stolen GitHub CLI tokens from three engineers to run LiteLLM's own release workflow and publish version 1.107.0 to PyPI and Docker Hub. The poisoned wheels were live for under two hours; the Docker `latest` tag pointed at the bad image for a little longer. Analysts at Datadog, Endor Labs and StepSecurity found a credential stealer that ran on Python start-up and an hourly remote code loader. It went after cloud keys, Kubernetes secrets, SSH keys and the model-provider API keys LiteLLM itself stores. LiteLLM's advice: if you installed or started that version, treat the machine as compromised.

The next day, developer platform Railway told all its users to rotate their keys after attackers reached customers' encrypted environment variables and decrypted some of them.

This is the part of the year that matters most to this site's readers. A local-AI stack is a supply chain: a model runner, a gateway, a vector database, an agent framework, a dozen Python packages. Each is a dependency you now own.

## War by other means

The phrase "modern warfare" gets used loosely. This year it described some things literally.

**29 December 2025, Poland.** Coordinated attacks hit more than 30 wind and solar farms, a manufacturing company, and a combined heat and power plant supplying heat to almost half a million customers. CERT Polska called the objective purely destructive. Generation was not affected, and Prime Minister Donald Tusk said the country had defended itself. ESET attributed the operation to Sandworm, Dragos to the related group it tracks as ELECTRUM; vendors disagree on the exact label but not on the direction. Dragos called it the first major coordinated attack on distributed energy resources — the small, numerous, internet-connected edge of a modern grid.

**28 February 2026 onwards.** The war involving Iran opened with cyberattacks on Iranian infrastructure and media, and dozens of hacktivist groups joined within days. The most damaging spill-over in the West was Stryker, described above.

**February–March, Washington.** Suspected Chinese state hackers breached an FBI system that stores court-authorised wiretap and pen-register returns. On 23 March, the Justice Department classified it as a "major incident" under federal law, a designation the bureau rarely applies to its own networks.

**26 June, London.** The New York Times reported that investigators had traced the August 2025 attack on Jaguar Land Rover to Russian hackers rather than the criminal collective first suspected. The attack stopped JLR's UK production for five weeks; the Cyber Monitoring Centre estimated the cost to the UK economy at **£1.9 billion** across around 5,000 businesses. The attribution has been disputed, and the government has not publicly confirmed it.

**June, Paris.** A smaller story is worth a paragraph, because it connects to the sovereignty theme of [Report #5](https://llmconfigurator.com/en/reports/europe-ai-compute-gap-sovereignty). On 7 June, an attacker social-engineered one valid account on Tchap, the French state's own Matrix-based messenger, mandatory for civil servants since August 2025. The government said about **73,000** accounts were affected; the attacker claimed 650,000 messages, mostly from public rooms that are unencrypted by design.

Tchap is a sovereign tool built for good reasons, and the breach is not an argument against it. It is a reminder that sovereignty changes who can compel access to your data. It does not change whether someone can phone your staff.

ENISA's own framing fits all five: the line between crime, hacktivism and state operations kept blurring, and the targets kept getting more physical.

## AI became the door, the tool and the leak

Three different things happened to AI in security this year, and it helps to keep them apart.

**AI as the door.** In March, Meta rolled out an AI assistant to handle account support on Facebook and Instagram, including password and email changes. Within weeks, a method was circulating on Telegram: start a password reset for a target account, use a VPN to appear near the owner's location, open a chat with the support bot, and ask it to add a new email address. It did. Meta's filing with Maine's attorney general put the toll at **20,225 accounts** between 17 April and 31 May. The flaw was not in the model. It was in giving a conversational system authority over an account-recovery action with nothing hard-coded to stop it.

**AI as the tool.** The Hugging Face intrusion and the suspected use of AI tooling against Korean banks are covered above. IBM's 2026 Cost of a Data Breach study, released on 29 July and drawn from 602 organisations in 17 countries, found that **one in four malicious breaches was AI-enabled**, mostly through deepfake impersonation and AI-written malware and phishing.

**AI as the leak.** This is the one that bears directly on this site, and it is growing fastest.

IBM found **shadow AI** — staff using AI tools the security team doesn't know about — involved in **43%** of breaches, up from **20%** a year earlier. Those breaches cost **$5.39M** on average, up from $4.63M. Of organisations that had an AI-related breach, **92%** lacked proper access controls on their AI systems. Verizon saw the same behaviour from another side: frequent workplace use of AI tools tripled from 15% to 45% of employees, and shadow AI became the third most common way staff leak data without meaning to.

The leaks are not hypothetical. In January, a researcher found a misconfigured database behind Chat & Ask AI, a popular app that wraps the big hosted models, exposing about **300 million messages from 25 million users** — full chat histories, many deeply personal. Between August and September, AI aggregator 302.ai left about **22.7 TB** of files open, including more than 144,000 chat logs and corporate chatbot transcripts.

The pattern repeats: the model provider was not breached. Somebody in the middle — a wrapper app, an aggregator, an analytics vendor — kept a copy.

## Where local AI fits — and where it doesn't

This is the question the report exists to answer honestly, so here is the full map rather than the flattering part of it.

**Where it is a strong control.**

*Shadow AI.* People paste contracts, logs and customer records into whatever AI tool is fastest. A ban doesn't stop it; it only stops you seeing it. A sanctioned model that runs on hardware you control — fast enough and good enough that nobody needs the unsanctioned one — removes the incentive. It is the one structural response to the fastest-growing breach factor in IBM's data. Use the [GPU & VRAM checker](https://llmconfigurator.com/en/analyzer) to see what your existing machines can run, and [local RAG](https://llmconfigurator.com/en/guides/local-rag-guide) to point a model at internal documents without uploading them.

*Wrapper and aggregator leaks.* Chat & Ask AI, 302.ai and Mixpanel share one property: a third party held a copy of what users typed. If the prompt never leaves your machine, there is no copy to leak.

*Hosted guardrails in the middle of an incident.* When Hugging Face began reconstructing its intrusion, the hosted models it tried first — Anthropic's Claude Opus and Fable — refused much of the work, because their safeguards could not tell analysing an exploit from launching one. The team ran a quantised build of the open-weight [GLM-5.2](https://llmconfigurator.com/en/models/glm-5-2) on its own infrastructure, decoded the attacker's payloads, and noted the added benefit of keeping attacker data on-premises. Incident response is exactly the moment you cannot negotiate with a vendor's content policy.

*Jurisdiction.* As [Report #5](https://llmconfigurator.com/en/reports/europe-ai-compute-gap-sovereignty) argued, which legal system can compel access depends on your provider, not on where its servers sit. A model on your own hardware removes that question. See [what sovereign AI actually means](https://llmconfigurator.com/en/enterprise/what-is-sovereign-ai) and [the GDPR angle](https://llmconfigurator.com/en/compare/local-ai-gdpr-compliance).

**Where it helps, partially.**

*Speed and volume.* Local models help defenders read faster: pre-sorting alerts, pulling techniques out of threat reports, pointing reviewers at likely-vulnerable code. That is real, and it is the subject of our [guide to local LLMs for cybersecurity](https://llmconfigurator.com/en/blog/local-llms-for-cybersecurity). It does not patch anything. Glasswing's lesson applies: finding is no longer the bottleneck.

**Where it does nothing.**

*Social engineering.* ShinyHunters phoned people. Tchap's attacker talked his way into one account. No model placement changes that.

*Industrial and operational technology.* Polish substations and French refrigeration controllers were reached because they were exposed and outdated. That is an asset-inventory and patching problem.

*Over-powerful admin tools.* Stryker's lesson is about multi-admin approval on destructive actions, not about AI.

*AI agents with authority.* Meta's support bot is a warning about authority, not location. A local agent that can reset accounts or run shell commands needs the same hard limits as a hosted one. Moving it on-premises changes who sees the data, not what the agent is allowed to do.

**Where it adds risk.**

*Your own model server.* Covered next.

*Your own AI supply chain.* LiteLLM is the cautionary example. Going local means you own more of the dependency tree, and this year attackers specifically targeted AI gateways and developer tooling.

The honest summary is one sentence. **Local AI is a data-flow control, not a shield.** It is the best available answer to "where does our sensitive data go when people use AI?" — the question behind the fastest-growing breach factor of the year. It is not an answer to "how do we stop being breached?"

## The attack surface you create when you go local

Running a model locally only protects you if it is actually local.

- **Exposed servers.** SentinelLABS and Censys counted about**175,000** publicly reachable Ollama servers in January. Ollama's API has no authentication by default, and a separate early-2026 scan by Intruder found that about 31% of the 5,200-plus servers it queried answered prompts from anyone.
- **Bleeding Llama.** CVE-2026-7482 let a remote attacker read process memory from reachable, unpatched Ollama servers — memory that can include prompts, API keys and other users' conversations. It was fixed in Ollama 0.17.1.
- **Free compute for attackers.** In June, Sysdig watched an attacker use one exposed, unauthenticated Ollama server as the reasoning engine of an automated exploitation tool.
- **Agent tooling.** On 22 October, a flaw was disclosed in the OpenCode coding agent that let a malicious MCP server run code during sign-in on Windows and WSL. Tools you plug into a local agent run with your permissions.

The fixes are simple and dull: bind the server to localhost, reach it only through a VPN or an authenticating proxy, pin and verify your Python and container dependencies, patch, and put the box in your asset inventory. The full checklist, with a tested proxy configuration, is in the [local security assistant setup guide](https://llmconfigurator.com/en/guides/local-llm-security-assistant). We will not repeat it here.

## What changes next

Two clocks are about to matter more.

**The regulatory clock.** Since **11 September 2026**, the EU Cyber Resilience Act has required manufacturers of products with digital elements to report actively exploited vulnerabilities and severe incidents through ENISA's single reporting platform: an early warning within 24 hours, a fuller notification within 72, and a final report within 14 days of a fix being available. The obligation covers products already on the market, not just new ones, and arrives more than a year before the rest of the regulation in December 2027. For anyone shipping software that bundles an open-source AI stack, LiteLLM-style compromises are no longer only an operational problem. If you are mapping obligations, our [compliance framework explorer](https://llmconfigurator.com/en/compliance/frameworks) and [EU AI Act on-premise guide](https://llmconfigurator.com/en/enterprise/eu-ai-act-on-premise-ai) are the places to start.

**The capability clock.** The most capable cyber models are currently held back. Anthropic's Mythos Preview remains limited to vetted Glasswing partners, and its public frontier models ship with extra cybersecurity safeguards — the same kind of safeguard that stopped Hugging Face's forensics. In September, NIST's Center for AI Standards and Innovation judged the open-weight GLM-5.3 the most cyber-capable open model so far, about four months behind the US frontier on its aggregate cyber benchmarks. Four months is not long. Defenders who depend on a hosted gatekeeper's permission to analyse an attack are betting that the gap — and the gatekeeper's willingness — holds.

ENISA expects more automation, more speed and more AI across every stage of the attack chain. The defensive response that follows is not glamorous: short-lived credentials, narrow trust boundaries, blocked metadata endpoints, approval on destructive admin actions, and detection that can read thousands of low-signal events quickly. Reading at that volume increasingly means AI. The open question for most organisations is where that AI runs, and who else sees what it reads.

## What to do this quarter

**If you use AI at work on your own initiative:** treat any AI app that is not your employer's sanctioned tool as a third party holding a copy of everything you type. Pick one sanctioned option, or run a capable small model locally — [Report #3](https://llmconfigurator.com/en/reports/best-small-llms-8gb-16gb-ram-laptops) covers what fits on an ordinary laptop.

**If you run a small team:** give people a sanctioned private model good enough that nobody reaches for the unsanctioned one. One well-configured team machine behind an authenticating proxy usually beats ten personal installs. [AI stations and mini-PCs](https://llmconfigurator.com/en/ai-stations) covers the hardware, and the [local vs cloud cost calculator](https://llmconfigurator.com/en/cost) shows when owning it pays off.

**If you run security for an organisation:** inventory every AI tool and agent, including the self-hosted ones; you cannot govern shadow AI you cannot see. Pin and verify AI dependencies the way you would any production code. Require a second approver for destructive actions in device-management and cloud consoles. And decide in advance which model you will use to analyse an incident if your hosted provider declines — that is a bad decision to make at 3 a.m.

**If you are an EU public body:** sovereignty and security are different properties. Tchap shows a sovereign tool can still be social-engineered; the CLOUD Act shows a secure tool can still be compelled. You need both. [Sovereign AI for government](https://llmconfigurator.com/en/enterprise/government-ai) covers procurement.

## Frequently Asked Questions

## ### What were the biggest cyberattacks of the past year?

Between October 2025 and October 2026, the incidents with the widest impact included the ShinyHunters breach of Instructure's Canvas (about 275 million victim notices), the Shai-Hulud 2.0 npm worm, the TeamPCP supply-chain campaign through Trivy, Checkmarx, LiteLLM and Bitwarden, the destructive wipe at Stryker, the attack on Poland's energy grid, the FBI wiretap-system breach, and the October attack on refrigeration in about 700 French supermarkets.

## ### Are AI-powered cyberattacks real, or hype?

Real, though usually less exotic than the headlines. IBM found one in four malicious breaches in its 2026 study was AI-enabled, mostly through deepfakes and AI-written phishing and malware. The clearest case was the July intrusion at Hugging Face by an autonomous agent built on OpenAI models, which ran about 17,600 actions over four and a half days. The weaknesses it exploited were ordinary; what changed was the volume of attempts.

## ### What is shadow AI and why does it matter for security?

Shadow AI is staff using AI tools their security team hasn't approved or doesn't know about. IBM found it involved in 43% of breaches in 2026, up from 20% a year earlier, at an average cost of $5.39 million. The risk is simple: whatever is pasted into an unsanctioned tool is now held by a third party you have no contract with.

## ### Can running AI locally prevent data breaches?

It prevents one specific kind: sensitive data leaking through AI services you don't control, such as wrapper apps, aggregators and their vendors. It does nothing against phishing, social engineering, unpatched systems or attacks on industrial equipment. Running AI locally is best understood as a data-flow control, not a general shield.

## ### Is a local LLM safer than ChatGPT or Claude for sensitive data?

For confidentiality, it can be, because prompts never leave hardware you control and no third party keeps a copy. But a local model server is only private if it is configured correctly: about 175,000 Ollama servers were reachable from the internet in January 2026, and Ollama's API has no authentication by default. Bind it to localhost, use a VPN or authenticating proxy for remote access, and keep it patched.

## ### What happened with the LiteLLM supply-chain attack?

LiteLLM, a widely used Python proxy for AI model providers, was compromised twice in 2026. In March it was hit as part of the TeamPCP campaign. On 21 October, attackers used stolen GitHub tokens to publish a malicious version 1.107.0 to PyPI and Docker Hub for about two hours, carrying a credential stealer and a remote code loader. Anyone who installed or ran that version should treat the machine as compromised.

## ### What does the EU Cyber Resilience Act require from September 2026?

Since 11 September 2026, manufacturers of products with digital elements sold in the EU must report actively exploited vulnerabilities and severe incidents through ENISA's single reporting platform: an early warning within 24 hours, a notification within 72 hours, and a final report within 14 days of a fix. It applies to products already on the market. The rest of the regulation applies from December 2027.

## ### Why did hosted AI models refuse to help Hugging Face investigate its breach?

According to Hugging Face, the hosted models it tried first refused much of the forensic work because their safety guardrails treated reverse-engineering an exploit the same as launching one. The team switched to a quantised build of the open-weight GLM-5.2 running on its own infrastructure, which also kept the attacker data on-premises.

1. Verizon 2026 Data Breach Investigations Report — coverage — [SecurityWeek](https://www.securityweek.com/verizon-dbir-2026-vulnerability-exploitation-overtakes-credential-theft-as-top-breach-vector/) ·[Security Magazine](https://securitymagazine.com/articles/102313-strategies-expert-insights-from-the-2026-verizon-dbir) ·[HC Innovation Group](https://www.hcinnovationgroup.com/cybersecurity/news/55379376/ai-driven-vulnerability-exploitation-now-leading-cause-of-data-breaches-verizon-report-finds)
2. CrowdStrike 2026 Global Threat Report (press release, 24 Feb 2026) — [CrowdStrike](https://crowdstrike.com/en-us/press-releases/2026-crowdstrike-global-threat-report)
3. IBM Cost of a Data Breach Report 2026 — [IBM](https://www.ibm.com/reports/data-breach) ·[Baker Donelson](https://www.bakerdonelson.com/ten-takeaways-from-ibms-2026-cost-of-a-data-breach-report) ·[Sentra](https://sentra.io/blog/ibm-cost-of-a-data-breach-2026-shadow-ai) ·[Forkast](https://forkast.news/shadow-ai-doubles-to-43-of-breaches-as-ai-driven-attacks-add-1-million-per-incident)
4. ENISA Threat Landscape 2026 (22 Sep 2026) — [ENISA](https://www.enisa.europa.eu/news/exploring-the-evolution-of-the-cyber-threat-landscape-how-dependencies-weaken-our-digital-resilience) ·[ComplexDiscovery](https://complexdiscovery.com/?p=68690) ·[Cybersecurity360](https://www.cybersecurity360.it/?p=108800)
5. Hugging Face — technical timeline of the July 2026 incident — [Hugging Face](https://huggingface.co/blog/agent-intrusion-technical-timeline)
6. Anthropic — Disrupting the first reported AI-orchestrated cyber espionage campaign — [Anthropic](https://www.anthropic.com/news/disrupting-AI-espionage)
7. Anthropic — Project Glasswing: an initial update — [Anthropic](https://www.anthropic.com/research/glasswing-initial-update)
8. South Korea finds hacking incidents at 16 financial firms (14 Oct 2026) — [Reuters via The Star](https://www.thestar.com.my/tech/tech-news/2026/10/14/south-korea-finds-hacking-incidents-at-total-of-16-financial-firms) ·[BleepingComputer](https://bleepingcomputer.com/news/security/south-korea-probes-bank-breaches-amid-suspected-ai-powered-attacks)
9. Instructure / Canvas breach — [Wikipedia](https://en.wikipedia.org/wiki/2026_Canvas_data_breach) ·[UpGuard (ITRC count)](https://www.upguard.com/blog/biggest-data-breaches)
10. TechCrunch — the worst hacks of 2026 so far (Klue, DentaQuest, Charter, Carnival) — [TechCrunch](https://techcrunch.com/2026/09/15/the-worst-hacks-and-breaches-of-2026-so-far/)
11. HIPAA Journal — healthcare breach statistics (DentaQuest 15M) — [HIPAA Journal](https://www.hipaajournal.com/healthcare-data-breach-statistics/)
12. OpenAI / Mixpanel — [BleepingComputer](https://bleepingcomputer.com/news/security/openai-discloses-api-customer-data-breach-via-mixpanel-vendor-hack) ·[SiliconANGLE](https://siliconangle.com/2025/11/27/mixpanel-breach-compromises-openai-api-users-account-data/)
13. Stryker — [Arctic Wolf](https://arcticwolf.com/?p=130132) ·[SecureWorld](https://www.secureworld.io/industry-news/iran-linked-hacktivist-group-weaponizes-microsoft-intune-in-destructive-wiper-attack-on-stryker) ·[Censys](https://censys.com/?p=5771)
14. French supermarket refrigeration — [BleepingComputer](https://bleepingcomputer.com/news/security/cyberattack-shuts-down-refrigerators-at-french-supermarkets) ·[AP via Jamaica Gleaner](https://jamaica-gleaner.com/article/world-news/20261014/cyberattacks-hit-european-supermarket-chains) ·[INCIBE-CERT](https://www.incibe.es/en/incibe-cert/publications/cybersecurity-highlights/cyberattack-supermarket-refrigeration-systems-france) ·[Al Jazeera](https://www.aljazeera.com/amp/economy/2026/10/13/french-fridge-fright-why-supermarkets-have-become-target-for-hackers)
15. Shai-Hulud 2.0 — [Check Point](https://blog.checkpoint.com/research/shai-hulud-2-0-inside-the-second-coming-the-most-aggressive-npm-supply-chain-attack-of-2025/) ·[Invicti](https://www.invicti.com/blog/web-security/shai-hulud-2-worm-supply-chain-attack-on-npm-dependencies)
16. Trivy compromise — [Microsoft Security](https://www.microsoft.com/en-us/security/blog/2026/03/24/detecting-investigating-defending-against-trivy-supply-chain-compromise/)
17. Checkmarx — incident update — [Checkmarx](https://checkmarx.com/blog/supply-chain-security-incident-update/) ·[SecurityWeek](https://www.securityweek.com/checkmarx-confirms-data-stolen-in-supply-chain-attack/)
18. Bitwarden CLI — [Socket](https://socket.dev/blog/bitwarden-cli-compromised) ·[The Hacker News](https://thehackernews.com/2026/04/bitwarden-cli-compromised-in-ongoing.html) ·[Security Boulevard](https://securityboulevard.com/2026/04/bitwarden-cli-compromise-linked-to-ongoing-checkmarx-supply-chain-campaign/)
19. Red Hat — RHSB-2026-001 (March supply-chain compromises incl. LiteLLM) — [Red Hat](https://access.redhat.com/security/vulnerabilities/RHSB-2026-001)
20. LiteLLM 1.107.0 — [LiteLLM incident report](https://docs.litellm.ai/blog/security-incident-oct-21-2026) ·[Datadog Security Labs](https://securitylabs.datadoghq.com/articles/litellm-compromised-pypi-docker/) ·[StepSecurity](https://www.stepsecurity.io/blog/litellm-1-107-0-compromised-pypi-backdoored-wheels-credential-stealer) ·[Endor Labs](https://www.endorlabs.com/learn/litellm-1-107-0-compromised-python-startup-hooks-steal-cloud-ai-and-proxy-credentials)
21. Railway (22 Oct 2026) — [TechCrunch](https://techcrunch.com/2026/10/22/developer-platform-railway-urges-all-users-to-revoke-secret-keys-after-cyberattack/)
22. Poland energy attack — [CERT Polska incident report](https://cert.pl/en/posts/2026/01/incident-report-energy-sector-2025/) ·[Dragos](https://hub.dragos.com/report/electrum-targeting-polands-electric-sector) ·[TechRadar (ESET attribution)](https://www.techradar.com/pro/security/researchers-say-russian-government-hackers-were-behind-attempted-poland-power-outage)
23. FBI wiretap-system breach — [TechRepublic](https://techrepublic.com/article/news-china-linked-fbi-surveillance-breach-major-incident) ·[Security Magazine](https://securitymagazine.com/articles/102207-breach-of-fbi-surveillance-system-considered-a-major-incident-security-experts-weigh-in)
24. Jaguar Land Rover — [Express & Star (CMC £1.9bn)](https://www.expressandstar.com/business/jaguar-land-rover-cyber-attack-cost-the-uk-ps19-billion-say-experts-5660092) ·[The Star (NYT attribution)](https://www.thestar.com.my/tech/tech-news/2026/07/01/inside-the-us25bil-cyberattack-that-shut-down-jaguar-land-rover) ·[Cybernews (dissent)](https://cybernews.com/cybercrime/russia-hackers-jaguar-land-rover-cyberattack/)
25. Tchap — [BleepingComputer](https://bleepingcomputer.com/news/security/french-govt-says-tchap-breach-affected-over-73-000-accounts) ·[SecurityWeek](https://www.securityweek.com/french-government-messaging-platform-breach)
26. Cyberwarfare during the 2026 Iran war — [Wikipedia](https://en.wikipedia.org/wiki/Cyberwarfare_during_the_2026_Iran_war)
27. Meta AI support bot — [9to5Mac (20,225 accounts)](https://9to5mac.com/2026/06/08/hackers-tricked-instagram-ai-into-letting-them-take-over-high-profile-accounts-video/) ·[Computing](https://www.computing.co.uk/news/2026/security/meta-ai-flaw-enabled-hackers-instagram)
28. Chat & Ask AI — [404 Media](https://www.404media.co/massive-ai-chat-app-leaked-millions-of-users-private-conversations/) ·[Malwarebytes](https://www.malwarebytes.com/blog/news/2026/02/ai-chat-app-leak-exposes-300-million-messages-tied-to-25-million-users)
29. 302.ai — [Cybernews](https://cybernews.com/security/302-ai-data-leak-exposed-millions-files/) ·[TechRadar](https://www.techradar.com/pro/security/security-breach-at-ai-aggregator-exposes-over-18-million-files-including-some-very-embarrassing-chat-records)
30. Exposed Ollama — [SecurityWeek (175,000)](https://www.securityweek.com/175000-exposed-ollama-hosts-could-enable-llm-abuse/) ·[Cloud Security Alliance (Intruder scan, CVE-2026-7482)](https://labs.cloudsecurityalliance.org/research/csa-research-note-exposed-ai-infrastructure-selfhosted-secur/) ·[GitHub advisory GHSA-x8qc-fggm-mpqg](https://github.com/advisories/GHSA-x8qc-fggm-mpqg)
31. Sysdig — LLMjacking evolved — [Sysdig](https://sysdig.com/blog/llmjacking-evolved-attackers-are-using-stolen-ai-compute-to-build-offensive-agentic-tools/)
32. The Hacker News — OpenCode MCP flaw (22 Oct 2026) — [The Hacker News](https://thehackernews.com/)
33. EU Cyber Resilience Act reporting obligations — [McCann FitzGerald](https://www.mccannfitzgerald.com/knowledge/data-privacy-and-cyber-risk/cyber-resilience-act-reporting-obligations-apply-from-11-september-2026) ·[Penningtons Manches Cooper](https://www.penningtonslaw.com/insights/eu-cyber-resilience-act-new-reporting-obligations-in-force/) ·[NCSC Ireland](https://ncsc.gov.ie/cra/)
34. NIST CAISI — GLM-5.3 cyber capabilities — [NIST](https://www.nist.gov/news-events/news/2026/09/caisis-assessment-zais-glm-53-cyber-capabilities)

All sources checked 2026-10-23.

**Security and local AI:** [Local LLMs for cybersecurity](https://llmconfigurator.com/en/blog/local-llms-for-cybersecurity) · [Set up a local security assistant](https://llmconfigurator.com/en/guides/local-llm-security-assistant) · [Best local LLMs for cybersecurity](https://llmconfigurator.com/en/best-local-llm/cybersecurity)

**Sovereignty and compliance:** [What sovereign AI means](https://llmconfigurator.com/en/enterprise/what-is-sovereign-ai) · [GDPR and AI](https://llmconfigurator.com/en/enterprise/gdpr-ai) · [The EU AI Act on-premise](https://llmconfigurator.com/en/enterprise/eu-ai-act-on-premise-ai)

**Running models yourself:** [Local LLMs for privacy](https://llmconfigurator.com/en/best-local-llm/privacy) · [Offline AI](https://llmconfigurator.com/en/best-local-llm/offline-ai) · [On-premise TCO](https://llmconfigurator.com/en/enterprise/on-premise-llm-tco)

**Earlier reports:** [Best local coding models by hardware tier](https://llmconfigurator.com/en/reports/best-local-coding-models-by-hardware) · [Europe's AI compute gap and sovereignty](https://llmconfigurator.com/en/reports/europe-ai-compute-gap-sovereignty)