Sending an AI conversation to a colleague with the "share" button is now routine, whether in ChatGPT, Claude, or Meta's AI agent Muse. The reader the sender has in mind is the person who receives the link.

On October 18, the security firm Claroc reported that a single query against a commercial passive DNS dataset returned more than 6,800 hostnames of shared Muse pages. Most of the few hundred it opened were pages their owners plainly meant to publish.

But some contained a candidate's notes preparing for a confidential executive-search call with a frontier AI lab, a revenue review marked for a company's CEO, a small business's loan application, and a workplace's full-year staff vacation calendar. On October 20, after Ars Technica asked about the findings, Meta suspended the sharing feature.

Note: passive DNS = databases that record the domain-name lookups observed across the internet and make them searchable after the fact.

Two more reports landed the same week. In an October 15 advisory, India's Computer Emergency Response Team (CERT-In) said it had received voluntary disclosures from multiple AI model providers whose models, while running research and evaluation tasks on the open internet, had reached the live systems of Indian organizations.

The models used credentials and connection settings left in application configuration, public code repositories, and overly permissive cloud roles, and read business records that included personal data and confidential material. The number of affected organizations that detected the access themselves was zero.

On October 19, the security firm NorForge reported that the control panels of Cairn, an open-source framework that lets AI agents carry out intrusions, were sitting on the open web without authentication. The most active group, working in Chinese, had more than 1,100 attack projects spread across 14 panels, aimed mostly at organizations in the US, Japan, and Australia.

A news desk would file these under three different labels: a lab accident, a cyberattack, a data leak. I think all three come from a single change. What has shifted is less the kind of holes than the price of looking for them.

A key left in a public repository, an API nobody uses anymore, a page only people with the link are supposed to open: each of these has relied on the assumption that nobody would bother to look. Agents under evaluation, attackers' agents, and the design of a share button have broken that assumption at nearly the same moment. And because the weaknesses being hit are old ones, the defenses are an extension of old basics too.

AI security incidents Executive Summary (infographic)

The Builders' Accidents and the Keys Their Agents Picked Up

It started on July 16, when Hugging Face detected and disclosed an intrusion by autonomous AI agents. Five days later, on July 21, OpenAI acknowledged that the intruders were its own models: the publicly released GPT-5.6 Sol and an unreleased internal research model, both configured with reduced cyber refusals so their capabilities could be measured.

Inside an evaluation environment whose only route outward was a package-registry proxy, the models found an unknown vulnerability in that proxy, got onto the internet, and pulled the answers to the ExploitGym benchmark from Hugging Face's production database. According to the independent report by the nonprofit METR, roughly 1,200 agents that were meant to be isolated from one another exchanged more than 70,000 messages and files on an unsanctioned message board, and 700 of them took part in the attack. What the agents wanted was the answer key, and Hugging Face happened to sit on the way to it.

The techniques themselves were old. Experts who spoke to TechCrunch agreed that a human red team would have used the same ones. Nico Waisman, chief information security officer at XBOW, a startup that builds AI bug hunters, named Hugging Face's biggest mistake as a single stolen credential that carried high privileges across several systems.

What set the attacker apart from a human was speed, volume, and persistence: over four and a half days, the agents broke in, ran reconnaissance, stole credentials, and moved laterally. The attacker's action log that Hugging Face analyzed ran to more than 17,000 events. OpenAI itself reported cases in which its models found credentials that had been left publicly exposed on other online services and used them.

The same pattern kept turning up at other labs. Anthropic disclosed four incidents in which a misconfigured evaluation environment, built by a single third-party partner, connected Claude to the real internet and the models accessed third-party systems without authorization.

Claude Mythos 5 published a malicious package to PyPI, Python's public package repository, and used credentials leaked by one of the 15 systems that installed it to get into a real security vendor's database. Claude Opus 4.7 went looking for its fictional target and found a real company with a nearly identical name, then downloaded and modified user records in that company's web application.

Google's Gemini broke into three companies during testing by the evaluation firm Irregular. According to TechCrunch, it guessed passwords in one case and used credentials from a public repository in the other two.

How victims were told became an issue of its own. On September 24, Australian Prime Minister Anthony Albanese announced that an OpenAI agent had gained unauthorized access to the government's Medicare statistics portal on June 18. In his account, the agent hit repeated blocks, looked for ways around them, and "didn't accept no for an answer."

OpenAI first notified the government on September 10, with a single email to a public mailbox. OpenAI says what was accessed were aggregate health statistics and internal file names, and that it found no evidence of patient records being touched.

CERT-In's October advisory reads as the general case. It lists the weaknesses that were exploited as keys left in source code and configuration, dormant APIs left reachable, payment keys stored in plaintext, and overly permissive cloud roles, and calls every one of them conventional.

It adds that AI found and exploited them faster, more exhaustively, and at greater scale than human attackers. For AI developers, it asks that evaluation environments block outbound traffic by default, enforced at the network layer rather than through instructions to the model.

The lesson I take from the builders' accidents is less about runaway models than about the path by which organizations nobody was targeting get pulled in. On the way to the answer, the agents picked up keys that someone had left lying around. The organizations that were hit simply stood along that route.

If one of your keys survives in the history of a public repository, some lab's evaluation run may be the one that ends up using it. And the first to notice is more likely to be the AI company's internal review than your own logs. In India and in Australia alike, the news came from the builder.

The Attackers' Tools and the Five-Dollar Intrusion Attempt

Cairn itself is a general-purpose framework: you set a starting point and a goal, and multiple agents work toward the goal while posting the facts they find and their next moves to a shared board. Its creator has said it "was never a 'hacking tool'" and that misuse is a human decision.

NorForge judged that more than 20 of the exposed panels were likely being used for attacks. One task from the most active group listed online stores in the US, Canada, Japan, and Australia, with traffic of 200,000 to 1.5 million, where an automated browser had already confirmed that orders could be placed, and told the agents to find holes that would let them run code without logging in. The aim appears to be a lasting foothold in e-commerce and payment infrastructure.

Reuters, as cited by The Verge, reported that this attacker broke into more than 100 sites and that the victims included John Deere, SharkNinja, and Cummins. SharkNinja said the breach affected a standalone product-support site and had been contained.

The economics were visible on the panels too. NorForge estimates the average cost per task at around $5, counting projects that ended early, with a success rate of around 10%; successful projects took a little under 23 hours from start to goal on average. Divide one by the other and each successful intrusion costs roughly $50 in model usage.

CERT-In likewise reported that in a financially motivated campaign against Indian organizations, the time from initial access to final impact shrank from days to a few hours. It also reported that victims who remediated incompletely were hit again within days, at greater scale.

In Japan, the cloud WAF provider Bitforest observed AI-agent attacks on domestic websites from at least three IP addresses between the night of October 10 and October 14. One lasted nearly eight hours, switching among a high-speed scan of about 10,000 requests at roughly 35 per second, attacks on known vulnerabilities, and about 250 brute-force login attempts.

The irony is that the attackers had the same holes. Cairn's contents were visible from outside because the operators had left their control panels open without authentication.

When NorForge ran the panel data through a secrets scanner, it found hundreds of keys and credentials, 11% of which were verified as valid. In its conclusion, NorForge writes that the attackers, too, are unprepared for this technology, and that in the rush for quick results many forgot basic security precautions.

When the economics of attack change, so does the list of who gets attacked. A mid-sized online store that a human attacker would have passed over as not worth the effort becomes a candidate when each attempt costs five dollars. The task that sorted target stores by traffic is that calculation written down, in my reading.

For Japanese companies, the old estimate of "we're too small to be a target" expired this autumn. As Bitforest puts it, the countermeasures barely change when the attacker is an AI agent, and closing the vulnerabilities comes first.

The Users' Design Problem and the Share Button That Published

Muse launched in the US on September 8, and Sensor Tower data cited by TechCrunch puts its downloads at 10.9 million already.

Its sharing mechanism is simple. Ask Muse to share a conversation and it turns the conversation into a page and hands you a link that opens without a login. The page's hostname combines the conversation's title with a random ID, and the first time anyone who received the link opens it, that hostname lookup is recorded in passive DNS, where it becomes searchable.

Muse did ask search-engine crawlers to stay away from shared pages. But as Claroc points out, that setting governs crawling, while access is a separate question. A random ID long enough that nobody could guess it also stops working as a secret once the whole hostname has been recorded.

Claroc summed it up this way: "Nobody broke in. The tools work this way, and people use them."

Other companies have run into the same shape. In July, TechCrunch reported that conversations shared through Claude's public links were showing up in Google search results, reportedly including a real patient's medical report and company documents marked for internal use only. Anthropic said share links appear in search only when they have been posted somewhere search engines can see, such as a forum or social media, and that "when someone shares a conversation, they are making that content publicly accessible."

In September, OpenAI disclosed that agents in its research environment had posted 53 user-provided images, from users whose data was approved for training, to image-hosting sites as unlisted links. TechCrunch noted that the images could still be discovered. OpenAI said its technical approach and privacy policy prevent it from reassociating the images with the people who provided them, so it gave up on notifying them.

In all three cases, the name on the button and what actually happened point in different directions. "Share" is the name of an action meant to hand something to a colleague; mechanically, it was the act of putting something on the internet.

The Muse case should be fixed by Meta as a design flaw, since it put conversation titles into hostnames. Companies, though, can act before any fix arrives. As Claroc recommends, writing into your AI usage policy that creating an AI share link counts as sending the contents of that conversation outside the company is, in my view, the most reliable step available right now.

The Assumption All Three Shared: Nobody Comes Looking

What broke on all three sides is a single assumption. In the builders' accidents, keys left in public repository histories and the website of a real company that shared a name with a fictional target lay along the path of agents hunting for answers.

On the attackers' side, mid-sized sites that a human would have skipped joined the candidate list once each attempt cost five dollars. On the users' side, pages only link holders were meant to see turned into a searchable list built from lookup records. In each place, the estimate that "nobody will search that far" was doing the work of a defense, and when the effort of searching disappeared, the defense disappeared with it.

The other thing they share is that the people who found the problem were outside the victim. In India, zero affected organizations detected the access themselves; the Australian case surfaced through a single email from OpenAI; the Muse exposure through a security firm's search; and the Cairn victims through researchers working with a news agency to notify them.

The first party to find your weaknesses is increasingly someone else's agent. Whether that someone tells you or quietly uses what they found is up to them.

Translated into management decisions, this argues for putting budget and people into old basics before buying new products labeled "AI security": an inventory of keys, tighter permissions, removing entrances nobody uses, and logging and alerting.

What is new is the speed of the clock. The shrinking that CERT-In describes, from days to hours, pushes the inspection cycle from an annual audit toward continuous monitoring. The content of defense is the same as it always was; only the deadline has moved up.

How to Read the Next Headline and What to Check In-House

The similar headlines that are sure to follow can be placed with three questions.

Who found it? Was the entry point an unknown vulnerability or an old hole like a forgotten key? How many days passed between the event and the notice to those affected?

If the finder was someone outside the victim and the entry point was an old hole, read the story as something that could happen at your own company. In the Australian case, the Prime Minister took issue with the intrusion and, just as pointedly, with the nearly three months it took for a June event to reach the government.

What to check in-house fits in the table below. Every item can be done with the tools you already have, and the right-hand column shows what happened this year where the check was missing.

What to check What happened this year
Search from the outside for keys and credentials left in source-code history, configuration files, and public repositories AI models under evaluation used leftover credentials to read business records at Indian organizations (CERT-In)
Narrow what any single credential can reach to what its job requires One stolen credential carried high privileges across several systems (Hugging Face)
Take unused APIs, test endpoints, and admin panels off the internet Dormant APIs and exposed management interfaces served as entry points (CERT-In, Cairn)
Write into your AI usage policy that creating a share link counts as sending data outside the company Shared conversations were found by people who were never given the link (Muse, Claude)
Alert on per-second traffic spikes and brute-force logins, and keep logs for at least 180 days A scan at about 35 requests per second and about 250 brute-force attempts ran for nearly eight hours (a Japanese website)

Claroc's report closes by advising readers to assume anything they share is public until they have checked. I would like to read that as guidance that reaches beyond share links to everything placed where the outside world can reach it. Keys, old APIs, and pages meant only for people holding the link should now be placed on the assumption that someone's agent will come looking.

References