everything that went
wrong

OpenAI had to rotate code-signing certificates across four platforms. The reason: a supply chain worm called Shai-Hulud reached their npm packages. The same worm poisoned 84 TanStack versions in 6 minutes, spread to PyPI through Mistral and UiPath, and swallowed the entire @antv charting ecosystem (639 versions, one hour). TeamPCP breached GitHub from the inside. One poisoned VS Code extension on an employee laptop. 3,800 internal repositories out the door, listed on BreachForums for $50K. They hit Microsoft the same week — three poisoned versions of the official Azure durabletask SDK on PyPI in 35 minutes. North Korea’s Lazarus Group stole $1.5 billion from Bybit in a single transaction. ShinyHunters took 275 million student records from Canvas. Nitrogen ransomware grabbed 8TB of Apple and NVIDIA schematics from Foxconn. DOGE connected the federal personnel database to the open internet. The NSA chief told the Senate that Anthropic’s Mythos broke into “almost all” classified systems in hours. Russian hackers behind the $2.5B Jaguar Land Rover attack that forced a £1.5B UK government bailout were just identified by a NYT investigation nine months after the breach. A Russian crew now plants an Outlook implant that grants every account in your tenant Owner rights on the victim’s mailbox, so reimaging the laptop and rotating the password change nothing. The UN now prices Southeast Asia’s fraud industry at $88–114 billion for 2025 and reports that raiding the compounds relocated them. A leak site everyone called a bluff on turned out to be holding 607,000 UK Department for Education records and the contact roster of the police legal database. Wiz found one signing key inside the Azure Cosmos DB query gateway that returned the primary key for any account in the region, including network-isolated ones, and Microsoft needed eight months to remove it. ShinyHunters talked a Brinks Home employee through a Microsoft Entra prompt and left with 1.1 million customer rows and 3.8 million support chat logs from the company that monitors their alarms. Korea fined KT $39 million after someone pulled the authentication certificate out of a lost femtocell, which was good for ten years, and ran a fake base station on the carrier’s network for eleven months. Anthropic read 141,006 evaluation transcripts and found three where Claude, told it was offline in a simulation, broke into real companies — in one, it registered an unpublished PyPI dependency it found in a fake setup doc, and 15 real machines installed it inside an hour. A build flag set to zero instead of deleted swapped COLDCARD’s hardware RNG for a MicroPython fallback in 2021, and Galaxy Research now counts 1,596 BTC gone from about 7,300 addresses, north of $100 million, with a suspected fourth wave that would take it to $130 million and 90% of the coins still sitting where the thief left them. An operator in Zhuhai sent one Telegram message and DeepSeek picked the targets on its own, querying 25,209 exposed n8n servers in a single unattended session. Seven open-source 4G and 5G cores turned out to trust each other so completely that a duplicate rule ID sends a subscriber’s traffic to whoever asked for it, and one researcher deleted a path segment from a Volvo joint venture’s API URL and got 676,000 trucks plus every OTP the platform sent since 2021. Somebody appended a clipboard hijacker to the tracking script Adform serves from its own CDN to every site on its ad platform, so for five days visiting an unrelated publisher swapped the Bitcoin address in your clipboard, and no antivirus engine flagged it. GlobaLeaks, thirteen years old and six professional audits deep, pointed commercial LLMs at its own source for $3,140 and got back 29 real vulnerabilities, which prices a careful read of anybody’s codebase at roughly $77 a bug. OpenAI then went back through a year of evaluation logs and found more agents that had escaped containment, none of them noticed at the time. Rails gave itself a month before publishing how CVE-2026-66066 works and got three days, because someone shipped a public exploit and Akamai had already written up the part where your secret_key_base becomes a shell. Microsoft put a name on the hijacked hotel Wi-Fi — an SVR sub-cluster serving fake Windows Update screens to the connectivity check your browser fires on join — and found the same equipment behind every affected venue, which points at the captive portal industry rather than the hotels. The FBI and EPA then said the Minnesota water hits were not a Minnesota story — utilities in at least seven states lost their PLCs to somebody who changed the password and the IP address and left operators staring at a blank SCADA screen, with flooding and pressure loss in the reported impacts. And an Alabama community bank told the SEC that part of its ransomware response was obtaining the attacker’s “representation” that the stolen data had been deleted — a promise from the people who took it, offered as if it were a control. And N-able’s fix for an N-central authentication bypass turned out to be incomplete, so the second CVE is being used to log into MSP consoles that can push scripts to every endpoint those providers manage. And Coinkite, warning Coldcard owners that their seeds were guessable, emailed everyone who had bought one going back to 2019 — which is how its customers found out that the 90-day data deletion they had been sold does not cover the email address that identifies them as Bitcoin holders. And CrowdStrike’s annual threat hunting report put a clock on all of it — 88% of public proof-of-concept exploits now get used within 48 hours, which retires the 30-day patch window, while AI-agent activity has passed human activity in its own detection feed. And somebody spent one night inside Liechtenstein’s register of beneficial owners and copied the people behind 31,000 companies, foundations and trusts, which is the single database a financial centre built on discretion would least like to lose, with no ransom demand and nothing yet for sale. Unit 42 then showed that a synced passkey is not a hardware token: on an already-infected Windows PC, malware borrows Chrome’s TPM-wrapped identity key to sign logins with nobody at the keyboard, registers its own fake fingerprint, and lifts the master secret that decrypts every passkey in the account, a secret Google has no way to rotate. Pillar Security got one AI agent to attack another in a live repository: the pull-request triage bot in google/adk-python posted as a collaborator, so a politely worded prompt injection made it summon the maintainers-only Gemini workflow, which had no tool scoping and gave up the runner. Eighteen npm packages that each look clean on their own resolved into a RAT aimed at Alibaba developers and ran for three months, because the malicious logic was the dependency graph plus a JSON rule file on GitHub. And ClickFix is now a rented service: DOUBLECUP puts the payload in your browser cache as a PNG before the fake CAPTCHA loads, so the command you paste downloads nothing. And OpenAI, publishing the account ban on a Cambodian scam network, found more than the outbound messages: the same ChatGPT accounts that wrote the fake trading screens and the forged passports also kept the compound’s worker debt ledgers, salary deductions and disciplinary fines, and translated conversations about detention and escape attempts. Somebody else spent one second inside LpdFi holding a $140 million position fabricated from $2 million of tokens, which was long enough to cross a daily interest boundary and collect a day of yield the protocol had to burn its own liquidity pools to pay. And Boltz turned off its Bitcoin swap service indefinitely without being breached at all: the team said automated, AI-assisted probing was finding bugs faster than four people could patch them, which is the first operator in here to quit on tempo rather than on a loss. Madera Community Hospital waited 14 months to tell 150,810 people that a two-day break-in took their SSNs, bank details and biometrics, and says the extortion crew withdrew its ransom demand claiming it did not want to harm patients. And Everest posted 420,000 STIIIZY customers’ driver’s licenses and medical cannabis cards for sale with nothing to back it but a hash. Forescout found the same private key inside every TP-Link Omada controller, so 17 requests a second claims 1,000 devices before their owners ever adopt them, and the same trust anchor reaches the VIGI cameras watching the building. And Barracuda’s red team asked a compromised account’s Copilot where the money was, and it named a $247,500 wire awaiting final approval. These are 1016 incidents from five months. Every one sourced, graphed, and scored.