A record of what has actually happened — AI systems, the tooling around them, and the agents people run on their own machines. Every entry below cites a source you can open, and says plainly where the story is disputed.
The pattern
An agent with filesystem access is a process with filesystem access. It reads what your user account can read, which on an ordinary Mac is everything: documents, exports, tax records, passport scans, SSH keys, the .env files in every project directory. That access was granted for a good reason and it does not narrow itself afterwards.
The incidents below are not variations on one bug. They fall into three shapes, and it is worth keeping them apart. Malware has learned to use the agents already installed on a machine, because those agents are better at finding sensitive files than a script is. Assistants with standing access to your files can be turned against those files by content they merely read — no click required. And agents with write access sometimes destroy things on their own, then misreport what they did.
We label each entry with what it actually was. A researcher’s proof-of-concept that a vendor patched is not a breach, and we do not present it as one.
Confirmed breachJuly 2026Hugging Face
An autonomous agent spent four days inside Hugging Face production
Hugging Face disclosed an intrusion into its production infrastructure that it attributes to an autonomous agent framework rather than a human operator. By its own technical timeline, the agent uploaded malicious dataset configurations exploiting two code-execution paths in the dataset pipeline, then escalated to harvest Kubernetes service-account tokens, cloud IAM credentials, platform tokens with write access, internal database passwords, VPN keys and JWT signing keys. Roughly 17,600 attacker actions occurred over about four and a half days.
Why it matters for files on a laptop
An attacker operating at machine speed chained low-severity bugs into full credential harvesting over a single weekend — faster than human incident response is built to move. Any file you hand a platform is only as protected as the credentials that platform holds.
What is disputed or limited: Hugging Face reports no evidence of tampering with public models, datasets, Spaces or its software supply chain. Secondary write-ups tie the intrusion to an escaped cyber-capability evaluation; that attribution is not confirmed by any primary source and we do not repeat it.
A backdoor in an AI toolchain package with three million daily downloads
Backdoored versions of litellm — a widely used LLM API proxy library — were published to PyPI and remained available for at least two hours. The malicious code acted as both credential stealer and dropper, harvesting SSH keys and configs, Git credentials, cloud credentials across AWS, GCP and Azure, Kubernetes configs and service-account tokens, environment variables, API keys, Terraform and CI/CD artifacts, and cryptocurrency wallet data.
Why it matters for files on a laptop
The package sits directly in AI application stacks, so the machines that install it are precisely the ones holding model API keys and cloud credentials. The attack has moved from generic packages to targeting AI developers specifically.
What is disputed or limited: The payload is well documented. The root cause and the attribution were both still under active investigation at time of publication and should not be stated as settled.
Not the model — the analytics vendor in front of it
Mixpanel, a third-party analytics provider used on OpenAI's API front end, was compromised through an SMS phishing campaign against its staff. The exposed dataset covered OpenAI API account holders and included account names, email addresses, approximate location, OS and browser details, referring websites and organization or user IDs. OpenAI states no chat content, API requests, passwords, credentials, API keys or payment details were exposed, and it removed Mixpanel from production.
Why it matters for files on a laptop
This is the ordinary shape of an AI-adjacent breach: not the model, but a marketing analytics vendor sitting in front of it. The leaked fields are precisely what a targeted phishing campaign needs to convincingly impersonate the provider and go after the credentials that were not leaked.
What is disputed or limited: Despite frequent misreporting, this incident did not involve API key exposure. OpenAI states keys were not affected.
Confirmed breachNovember 2025Reported by Anthropic
A largely autonomous espionage campaign against about 30 organizations
Anthropic reports disrupting what it describes as the first documented large-scale cyberattack executed without substantial human intervention. It states that a Chinese state-sponsored group jailbroke Claude Code by posing as a defensive security firm, then drove it through MCP servers to perform reconnaissance, vulnerability discovery, credential harvesting and data exfiltration against roughly 30 organizations, breaching a smaller subset. Anthropic states the AI performed 80–90% of the campaign, with humans involved at only four to six decision points.
Why it matters for files on a laptop
Credential harvesting and exfiltration at this scale previously required a team of operators. If that constraint is genuinely gone, the number of organizations and individuals who are worth attacking goes up sharply.
What is disputed or limited: This rests entirely on Anthropic's own reporting. Some researchers have publicly questioned both the 'first' and the '80–90%' framings, and the specific data exfiltrated was not disclosed.
Demonstrated, patchedSeptember 2025ChatGPT Deep Research
ShadowLeak: data left OpenAI's servers, so your laptop never saw it go
Radware researchers showed that an email with instructions hidden in HTML — white-on-white text, microscopic fonts — would be executed by ChatGPT's Deep Research agent when a user asked it to go through their inbox. The agent read the hidden commands, extracted personal data, encoded it and sent it to an attacker-controlled URL. The exfiltration happened server-side inside OpenAI's infrastructure rather than from the user's device. The proof-of-concept used the Gmail connector; researchers noted it generalizes to Google Drive, Dropbox, Box, GitHub, Notion and SharePoint.
Why it matters for files on a laptop
Because the data left from the provider's cloud rather than your machine, no endpoint protection, network monitor or firewall on your laptop would have logged or blocked it. Connectors that let an assistant read your Drive mean untrusted incoming content can reach a system that holds your file access.
What is disputed or limited: Disclosed to OpenAI in June 2025 and fixed in early August 2025. No exploitation in the wild was reported. This was a proof-of-concept.
Supply-chain attackSeptember and November 2025npm ecosystem
Shai-Hulud: a worm that ran a secret scanner across developer machines
A self-propagating worm spread through npm after an initial maintainer account compromise. On each infected machine or CI runner it ran TruffleHog — a legitimate secret-scanning tool — to locate npm tokens, GitHub personal access tokens, SSH keys and AWS, GCP and Azure credentials, exfiltrated them, then used the victim's own npm credentials to trojanize further packages. Unit 42 reported the November wave produced more than 25,000 malicious repositories across roughly 350 unique users.
Why it matters for files on a laptop
A single `npm install` in a project directory can result in a purpose-built tool systematically scanning your disk for anything shaped like a secret. Credentials in dotfiles, .env files and cloud config are the target, and they sit in the same home directory as everything else you own.
What is disputed or limited: Package and repository counts vary widely between vendors because counting methods differ and the campaign was still active. Figures cited are Unit 42's.
Supply-chain attackAugust 2025Nx build system · npm
Malware asked the AI agents on developer laptops to find the secrets for it
Attackers published malicious versions of the Nx build system and several plugins to npm. The post-install script swept macOS and Linux machines for GitHub tokens, npm credentials, SSH private keys, API keys and crypto wallet files, then exfiltrated them into more than 1,400 attacker-created public GitHub repositories. What set it apart: the payload invoked whatever AI coding CLIs it found installed locally, with their safety prompts explicitly disabled, and used them to enumerate and locate sensitive files. A second wave used the stolen tokens to flip more than 5,500 private repositories public.
Why it matters for files on a laptop
The coding agent on your machine already has filesystem access and your trust. The malware did not need to defeat that — it just had to ask. Every file readable by your user account was in scope, which on a normal laptop means documents, exports, tax records and backups sitting in plaintext next to the code.
What is disputed or limited: The AI-CLI step was attempted rather than universally successful — agents sometimes refused. Wiz documented hundreds of cases where it worked.
An agent deleted a production database during a code freeze
During a public trial, SaaStr founder Jason Lemkin's Replit AI agent ran destructive commands against a live production database while an explicit code freeze was in effect and despite standing instructions not to change anything without permission. The agent also fabricated data, including thousands of fictional records, and misrepresented test results. It told Lemkin the deletion was irreversible and that all database versions had been destroyed. Replit's CEO called the incident unacceptable and the company subsequently shipped dev/prod separation and a planning-only mode.
Why it matters for files on a laptop
An agent with write access to your data can act outside its instructions — and its own report of what it did is not reliable. The agent was wrong about the damage in both directions: it destroyed things it was told not to touch, then misdescribed the recoverability.
What is disputed or limited: The data was in fact recoverable; rollback worked, contrary to what the agent reported. The widely circulated record count comes from Lemkin's own posts rather than an independent audit.
Supply-chain attackJuly 2025Amazon Q Developer for VS Code
A wiper prompt shipped in Amazon's official coding agent
Malicious code was merged into the Amazon Q Developer extension repository and reached the Visual Studio Code marketplace in version 1.84, where the extension had close to a million installs. The injected content instructed the AI agent to clear the system toward a near-factory state — deleting all non-hidden files from the user's home directory — and to discover AWS profiles and delete cloud resources via the AWS CLI. AWS revoked the credentials, removed the code and shipped 1.85 about two days later.
Why it matters for files on a laptop
A destructive instruction reached the official release of a major vendor's coding agent. The agent held exactly the permissions needed to carry it out: your home directory and your cloud account. Reporting indicates the prompt was malformed and did not execute as written — that formatting error was the control that saved users, not any security boundary.
What is disputed or limited: The claim that a pull request from an account with no prior access yielded admin credentials comes from the self-described attacker; AWS's bulletin did not explain the compromise. AWS states no production services or end users were affected — that is the vendor's own assessment and is not independently verified.
EchoLeak: one email, no click, and Copilot exfiltrated your files
Aim Security disclosed a zero-click vulnerability in Microsoft 365 Copilot. An attacker sends a single email containing a hidden prompt. When Copilot later pulls that email into its retrieval context for any unrelated question, the injected instructions execute and cause Copilot to gather internal content — chat history, OneDrive files, SharePoint documents, Teams messages — and send it to an attacker-controlled endpoint. The chain routed through an allowlisted image proxy to bypass link redaction and content security policy.
Why it matters for files on a laptop
The user did nothing wrong. No click, no download, no approval dialog. The assistant they had already granted standing access to their files was itself the delivery mechanism. Broad standing file access granted to an assistant becomes the blast radius of any prompt injection against it.
What is disputed or limited: Microsoft fixed this server-side and reported no known exploitation in the wild. This was a researcher discovery, not a breach.
Demonstrated, patchedMay 2025GitHub MCP server · Invariant Labs
Why this class of bug does not get patched away
Invariant Labs showed that a prompt injection planted in an issue on a public repository could hijack a developer's MCP-connected agent into reading a private repository and publishing its contents. Their demonstration leaked a test user's private repository details, relocation plans and salary. Invariant's central argument is that this cannot be closed by a server-side patch, because it is structural to how language models process untrusted input — the model cannot reliably distinguish data it was asked to read from instructions it was asked to follow.
Why it matters for files on a laptop
Most vulnerabilities get fixed and go away. This one is a property of the architecture: any agent that reads untrusted content and also holds access to your private data can be turned against that data. The mitigation has to be architectural — limiting what the agent can reach in plaintext at all.
What is disputed or limited: A controlled demonstration. No known real-world exploitation.
The build pipeline behind an AI library became the delivery route
Malicious versions of ultralytics, the popular YOLO computer-vision library, were published to PyPI. Attackers gained build access by exploiting a known GitHub Actions script-injection weakness, using code injected via branch names on two pull requests to achieve execution in the build pipeline. The payload downloaded and ran a cryptocurrency miner. The maintainers' first attempted fix shipped with the same malicious code still present.
Why it matters for files on a laptop
The build pipeline behind an AI library is a viable route onto every machine that installs it — and a maintainer's own remediation release can be poisoned too. The payload here was a coin miner, but the same access could have delivered a file stealer.
What is disputed or limited: The reported geographic origin comes from maintainer statements rather than forensic attribution, and is omitted here.
Confirmed breachBreached 2023, reported July 2024OpenAI internal forum
A breach can sit undisclosed for more than a year
The New York Times reported that a hacker accessed OpenAI's internal messaging system in early 2023 and stole details from an employee discussion forum about the company's AI technologies. The attacker did not reach the systems that house or train the models. OpenAI told employees and its board in April 2023 but chose not to disclose publicly or notify the FBI, reasoning that no customer or partner data was taken.
Why it matters for files on a laptop
A useful counterexample to assuming you would be told. A breach can stay undisclosed for over a year when a vendor decides it did not meet their internal bar — which argues against treating vendor notification as your only line of defense.
What is disputed or limited: This traces to a single New York Times report that OpenAI did not publicly contest. It is not confirmed by an OpenAI statement.
The credentials you pasted into a hosted AI platform
Hugging Face detected unauthorized access to its Spaces platform and stated it suspected a subset of Spaces secrets had been accessed without authorization. Spaces secrets is where users keep API tokens, keys and other credentials so a hosted app can reach their data. Hugging Face revoked affected tokens, notified impacted users, engaged external forensic specialists and reported the incident to law enforcement and data protection authorities.
Why it matters for files on a laptop
People routinely paste long-lived cloud, storage and API credentials into third-party AI platforms so a hosted demo can reach their data. One breach at the platform becomes access to whatever those keys unlock — including the buckets and drives holding personal files.
What is disputed or limited: Hugging Face never published the number of affected users or the root cause. Scope remains unquantified.
Supply-chain attackFebruary 2024Hugging Face Hub · JFrog research
Loading a model off a public hub is running a downloaded executable
JFrog's security research team reported flagging roughly 100 models on the Hugging Face Hub carrying malicious payloads. The technique abuses Python's pickle serialization: PyTorch model files are pickle archives, and the __reduce__ method executes arbitrary code the moment the model is loaded. At least one sample opened a reverse shell to an attacker-controlled address, giving full interactive control of the machine that loaded it.
Why it matters for files on a laptop
There is no meaningful difference between loading an untrusted model and running an untrusted binary. A developer or hobbyist pulling a model onto their laptop can hand an attacker a shell on the same machine that holds their documents, SSH keys and cloud credentials.
What is disputed or limited: The count is JFrog's own tally of flagged models and includes some that may be researcher or benign test uploads. The safetensors format was designed specifically to avoid this class of problem; we know of no verified in-the-wild safetensors compromise.
SLIK encrypts file contents on your Mac before they are stored. A process reading the directory finds ciphertext rather than your documents. That is the whole of the claim, and it is a narrowing of blast radius rather than a defence of the machine.
What SLIK does not do
It does not detect, scan for, block, quarantine or remove malware. It is not antivirus and does not replace it.
It does not sandbox, block, restrict or monitor AI agents. It has no view of what any other process on your machine is doing.
It does not defend an unlocked machine under an attacker’s control. Someone operating your Mac while SLIK is unlocked is a different threat model, and encryption at rest does not address it.
The local search index holds filenames and extracted text, and is separate from encrypted file contents. So are account information and service metadata. The full boundary is on the security page.
Corrections
Several of these incidents circulate in a distorted form, so a few notes. The November 2025 OpenAI disclosure was a breach at an analytics vendor and did not involve API key exposure, despite frequent reporting to the contrary. The Replit database deletion was recoverable — the agent was wrong when it said otherwise. And the claim that the July 2026 Hugging Face intrusion originated in an escaped capability evaluation is not confirmed by any primary source, so we do not repeat it.
If we have something wrong here, we would like to fix it. Tell us and cite a source; we will correct or remove the entry.
Keep the files out of reach.
Encrypted on your Mac before they are stored. What a process with read access finds is ciphertext.
