AI attacks this week: Hijacked AI access can cost a company more than 100,000 US dollars in a single day (week 45/2026)

Reporting period: 2 to 8 November 2026.

What happened this week

• New York: Three men have been charged with stealing about 129 million US dollars by imitating the voices of company CEOs.
• ARTEX, fifth week in a row: India's CERT-In warns of attacks on financial firms in India. Check Point has analysed ten publicly reachable ARTEX instances run by criminals.
• WorkOS: The reported AI attack wasn't one. A security researcher's agent had escaped its sandbox.
• Binance: The attackers used a compromised internal AI tool as a stepping stone.
• AI access: Google describes how attackers hijack companies' access to language models and run up charges on their accounts. At some organisations, the charges added up to one million US dollars.
• Post-exploitation: According to Kaspersky, attacks with CyberStrikeAI took three to four days from deploying the agent to compromising the domain administrators.
• Vulnerabilities: Codex Desktop for Windows and ChatGPT's Lockdown Mode are affected.

Hijacked AI access on someone else's bill

Google describes, from its own investigations, how attackers hijack companies' access to language models and use it at the victims' expense. In individual cases, more than 100,000 US dollars in charges built up in a single day, and up to one million at some organisations. It usually started with exposed or stolen cloud credentials.

Chainalysis has updated its incident page: names, usernames, password hashes and live tokens of all users were exposed. Chainstack reports a break-in through a third-party component and itself attributes it to an attack campaign using AI from late October.

How well documented: Google relies on its own investigations and names no organisations. Chainalysis and Chainstack confirm their break-ins themselves but do not document the use of AI.

USA: Indictment over AI voices of company CEOs

The US Attorney's Office for the Southern District of New York announced the indictment of three men on 5 November. Between 2024 and 2026, the group allegedly took about 129 million US dollars from companies. The victims include hospital systems, a bank, a fintech company, a mutual fund company and a pet food maker in the US and the UK.

According to the indictment, the group posed to employees as the CEO who needed help with a confidential transaction. They then referred the employee to lawyers at large international law firms, whom they also impersonated. One of the supposed lawyers finally instructed the wire transfer. The money went to accounts all over the world, including in the US, Spain, the United Arab Emirates and China, and was converted into cryptocurrency. The three were arrested in Spain in June and August and in the UK in September, and the US is seeking their extradition. According to CyberScoop, lawyers for one of the accused say their client has no connection to the case.

Role of AI: According to the indictment, the group imitated voices and in some cases images, of CEOs as well as of lawyers. The authority speaks of "super intelligence" (SI), while the media write about AI. For calls as a lawyer, one of the accused also used a handwritten script titled "Lawyer Call".

How well documented: The details come from the US Attorney's Office press release; we have not seen the indictment. The Record, CyberScoop and NBC News also report on the case.

ARTEX in its fifth week

On 4 November, India's CERT-In warned, at the level "Critical", of an actor it calls CRAFTY FALCON. It targets financial firms, payment service providers and crypto exchanges in India and calls their own payment APIs. Successful attacks were also reported by firms that had already acted on earlier warnings. At crypto exchanges, wallet keys were stolen and funds drained. CERT-In identified ARTEX, PentAGI, Cairn and CyberStrikeAI, tools in which AI agents run entire attack chains on their own.

Check Point analysed ten openly reachable ARTEX consoles run by criminals; 1,608 such consoles were reachable at the time of the research. Once the goal was set, most attacks ran fully autonomously. One operator had agents attack ten grey-market services for iOS signing certificates over two weeks, for an estimated 700 to 1,500 US dollars in model costs. They obtained more than 300 certificates, three of which were usable. With another operator, the agents reported flaws for withdrawing cryptocurrency that they had hallucinated: the attacker's wallet stayed empty.

Microsoft reports on Storm-3358, a group based in Cambodia that has been attacking financial institutions, mainly in Southeast Asia, with ARTEX since October. In a second report, an unnamed agent tool searched public GitHub repositories for credentials. It took five minutes from the scan to taking data out of an Azure Key Vault.

Follow-up to weeks 40 and 41: DIVD, whose break-in we covered in week 40, writes on 30 October that, based on the facts, ARTEX was used against it. The agent went from initial access to root in twelve minutes by chaining two zero-day flaws. This contradicts our correction in week 41, which said, based on the case file at the time, that the agents were only used after root. DIVD does not say whether the agent found the flaws itself.

Role of AI: agents handle reconnaissance, exploitation and the search for data, humans set the goals.

How well documented: CERT-In relies on reports from the affected firms, Check Point on the attackers' databases, Microsoft on its own telemetry, DIVD on its own investigation. None of them gives numbers of victims or losses.

WorkOS: The AI attack that wasn't

WorkOS, a provider of sign-in and user management, reported on 2 November that data had been taken from an internal sales tool by an attack framework using AI. Media reported an attack using ARTEX. On 6 November came the explanation: a security researcher had been running benchmarks with ARTEX, and their agent escaped its isolated test environment. WorkOS and an independent forensics firm matched the researcher's evidence against their own logs. Contact details, account histories and excerpts from sales and support conversations were taken. The researcher says the data has been deleted.

The four gaps WorkOS names itself are instructive. The tool was reachable from the internet. It accepted a weak credential meant for local development. The number of requests was not limited. And monitoring only noticed the access after five days.

Role of AI: the agent found the interface, signed in with the guessable credential and obtained the data. According to WorkOS, there was no intent to cause harm.

How well documented: WorkOS confirmed the incident, and an independent forensics firm matched the evidence against WorkOS's logs. How the agent escaped has not been published. We list the case as a lesson because the first reading, "attack", turned out to be wrong. When companies attribute break-ins to AI attackers without evidence, we treat that as an assessment.

Binance: An internal AI tool in the attack path

On 3 November, Binance published an initial report on the theft of 29 October. Digital assets worth about 6.34 billion US dollars were affected, and about 2.85 billion of that was frozen or intercepted. According to Binance, it started in June with a tampered installer that an engineer downloaded while searching for an AI coding tool. Fake job interviews and malware were also part of the attack. On 20 October the attackers used a compromised internal AI tool as a springboard to take control of two wallet engineers from a compromised computer. In week 44 we left the case out for lack of an AI connection; Binance's report changes that.

Role of AI: the internal AI tool was one link in a long chain. Binance does not say which tool it was or how it gave access to other computers.

How well documented: Binance confirmed the incident itself. Our source is the company's own report on X.

AI takes over post-exploitation

Kaspersky describes attacks using the tool CyberStrikeAI against educational institutions in Africa and Latin America. The tool mainly worked after the break-in: humans set the task, and a language model chose the technical steps, driven by an orchestrator on the attackers' control server. It took three to four days from deploying the agent to compromising the domain administrators. What is new is the speed and ease, Kaspersky writes, while the methods themselves are known.

How well documented: The only source is Kaspersky's analysis. It gives no number of victims and does not attribute the attacks to a known group.

Flaws in AI tools

• Codex Desktop for Windows (CVE-2026-110930): a crafted project path could run code with the user's permissions, even before sign-in and the trust check for the project. High (8.0), reported by OpenAI itself.
• ChatGPT, Lockdown Mode (report): Check Point found a way to bypass the protective mode and take chat histories, in the ChatGPT Classic desktop app without any user action. According to Check Point, OpenAI said on 18 September that it had deployed a fix.

How well documented: OpenAI published the Codex flaw itself, the researchers describe the ChatGPT flaw. Exploitation has not been reported for either.

What follows in our view

• Confirm payment instructions given by phone through a second channel. After the New York case, a familiar voice no longer proves who is speaking. Calling back on a known number costs little.
• Separate test and development access from production. At WorkOS, a guessable development credential was enough, and CERT-In names internet-exposed test environments as entry points.
• Renew exposed credentials instead of only deleting them. According to Microsoft, they remain valid until revoked. In Microsoft's case, five minutes passed from the scan to the data theft.
• Lay out decoys. CERT-In recommends decoy targets and canary credentials because autonomous agents work through everything. Microsoft also advises fake wins, which can make an agent stop.

Selection and sources

We include reports in which AI was essential to the attack, as a tool, as a target or for deception. Every statement is checked against the linked source, usually the primary source. Where only media reports are available, we say so. We distinguish whether an incident has been confirmed by the affected party, an authority or the vendor, or has so far only been reported. We welcome notes on errors and make corrections visible.