Frozen copy: Warning Shots edition No. 14, as published Oct 28, 2026, 05:50 ET. Nothing on this page updates. The live page · What changed · All editions
Warning Shots· AI’s dangers and breakthroughsToday’s levelWS-4 SEVERE59 top stories of 100 reports from the last 3 daysSevere incidents, last 12 months: 13 (was 3)
Today is Wednesday, October 28
Lines of code on a computer screen
Photo: Dominik Malinowski / Unsplash
WS-4 SEVERE · The flaw under most websites, day 8 · Oct 27, 7:30 PM ET
Hackers broke into 25 real firewalls through the flaw, security firm says

Who it hit: Dream says one organization tied to the US government had credentials taken and its internal directory mapped; in Japan, 1,090 sites and services paused over the flaws.

What it means for you

If you run a website or a firewall's web console on PHP, this is the first report of real machines, not test ones, being taken over through these flaws. If you don't run one, there's nothing to do, though some services you use may pause while they fix it.

Do this today: Ask your web host or IT team: is our PHP on a version fixed on or after Oct 21, and has our firewall vendor said whether its console is affected? The live tracker →

Am I exposed? Find your situation →

See what’s coming.Know what it means.

Wednesday, October 28, 2026 edition
Updated 0 min ago, next check in 6h 35m
Latest

Breakthroughs

What AI just made possible, and what it means for youAll breakthroughs →
WeatherIn use now
AI saw where the hurricane would hit when standard forecasts didn't

Google's AI called Hurricane Isaias's Florida landfall when the usual physics-based models pointed elsewhere. Better track forecasts mean earlier, better-aimed evacuation warnings. It was weaker than the Hurricane Center's own forecast on how strong the storm would be.

Who it helps: Families on the coast deciding whether, and when, to evacuate.

Try it: Google's Weather Lab shows its AI storm forecasts live (free, Google sign-in) →
HospitalsIn use now
AI now helps decide when patients are ready to go home at 12 Virginia hospitals

Sentara uses an AI tool to watch patients and flag who is ready to leave, across all 12 of its Virginia hospitals. That can free beds and nurses' time. The hospital group says no jobs are cut; its estimate of hours saved is still a forecast.

Who it helps: Patients waiting to go home, and nurses short on time.

Broke out & broke in

Japan paused 1,090 sites; ~40% still offⓘABEMA Times (ANN), translated from Japanese

AI Inc.

The drama, the money and the power plays. What happened, then what it means.All of it →
The markdownOpenAI halves the price of an AI it rates 'Critical' for hacking

OpenAI says GPT-6.1 Terra meets the top 'Critical' cybersecurity level in its own safety framework. Its API costs half what its predecessor did. Help Net Security

Our read: The same company sets the risk rating and the price. Cheaper access to a top-rated hacking capability widens who can use it, for defence and attack alike: the business logic and the safety logic point in opposite directions.

The showdownThe FTC wants Anthropic's bosses under oath

The FTC sent 50-page demands to Anthropic and OpenAI for records on security incidents, safeguards, marketing and privacy, and wants testimony from Anthropic executives. It says more AI companies will follow. Axios

Our read: This landed the same week Anthropic filed to go public. Anything said under oath can end up in front of investors, so expect every lab's safety marketing to be rewritten by lawyers.

The fine printAnthropic tells investors an AI disaster could be too big to insure

Its IPO filing says no single insurer, "and potentially the insurance industry in the aggregate", may have the capacity to cover a catastrophic AI incident. The risk factors run past 90 pages. Implicator

Our read: When the seller says a risk can't be insured, the risk doesn't vanish. It lands on customers, shareholders and, in a big enough event, the public. Watch for insurers writing AI exclusions into business policies.

The ChartOct 28, 2026
October already has 7AI-linked job cuts on ourledger, more than anyother month this past yearEach bar counts announced cuts on our ledger, by month. Red: theemployer itself named AI (8 of 15). Counts of announcements, notof jobs.Company named AIReported as AILink unclear02468Nov '25: 1 · Only reporters or analysts made the link11Nov '25DecJan '26Feb: 3 · The company itself tied the cuts to AI33FebMarAprMay: 1 · The company itself tied the cuts to AI11MayJunJul: 1 · The company itself tied the cuts to AI1Jul: 1 · Only reporters or analysts made the link12JulAug: 1 · Only reporters or analysts made the link11AugSepOct: 3 · The company itself tied the cuts to AI3Oct: 2 · Only reporters or analysts made the link2Oct: 2 · Link to AI unclear: see the source27OctSource: Warning Shots layoffs ledger (jobs/layoffs/), each entry sourced. As of Oct 28, 2026.W: WARNING SHOTS · warningshots.ai

Our ledger holds 8 AI-linked job-cut announcements from the last three months against 7 in the nine months before; in 8 of 15 the company itself named AI. The data and the download → · Every chart

That’s your Warning Shots for Wednesday, October 28, as of 5:50 AM ET. You’re caught up. Next edition 12:17 PM ET. See what’s coming. Know what it means.

Rechecked Oct 28, 5:50 AM ET: nothing moved. Edition No. 14 · Oct 28, 5:50 AM ET · what changed · every edition

On X: three posts worth your time

First-hand
RReuters@Reuters

BREAKING: A hacker is attempting to breach the US Federal Election Commission's systems and that agency has had to 'temporarily shut down' its web-facing services as a result, according to an email seen by Reuters reut.rs/4imQyUu

Video from Reuters
2:55 PM ET · Oct 27, 2026View on X →

A week before the midterms, the US election-finance regulator shut its public websites while a hacker tries to break in. Its filing system has been down since Monday night. No breach confirmed, and no AI link reported so far.

Reuters: the news agency, citing an internal email and the FEC's own status notice

The three posts that matter most right now, each on a different story. Breaking means a first-hand source posting a new fact you can check, in the last 12 hours; after that it shows as First-hand. An unverified claim is new but nobody independent has checked it yet. Opinion is commentary. The post text is shown exactly as it appears on X; the line under each is ours.

Every line is written by Warning Shots from the original reporting and links straight to it. Every report from the last three days, 100 in all → · Earlier days · Beats: AI near you, AI at school, Layoffs tied to AI

The Wire

Loading the latest reports

Since the last refresh

    What it means for you

    Pick what matters to you: the latest reporting, a 30-second check with a fix for each gap, what to watch, and what you can do today.

    The Record →

    Every AI incident since 2023, scored 0–100 by a published formula, with its sources: the charts, what AI can now do, the forecasts and their track record, who said what, and whether the fixes held. This page is the news; the Record is the proof.

    Also here: Is this a scam? · What to do · Am I exposed? · Can AI do your job? · Layoffs tied to AI · What AI can do · Know what it means · Midterm fakes · Forecasts · Did they fix it? · Earlier days

    Cite: Warning Shots, The AI Incident Index, warningshots.ai.

    Keep it one tap away: on iPhone, tap Share then “Add to Home Screen”; on Android, open the browser menu and tap “Install app” or “Add to Home screen”. It opens like an app and shows the latest edition.

    AI has started breaking in on its own.

    Severe AI incidents went from 3 to 13 in a year. In 41% of this year's real-world cases the AI itself did the acting.

    Every major AI safety incident since 2023, scored 0–100 and sourced. Each dot is an incident. Red: a real-world incident where the AI acted on its own.

    The ten most severe incidents on the index (the data behind this chart)
    ScoreIncidentDate
    78OpenAI agent swarm breaches Hugging Face2026-07-11
    77State hackers run a mostly AI-automated espionage campaign2025-09-15
    70PHP2Shell: AI-found PHP flaws leak, trigger global shutdowns2026-10-21
    68Criminal uses Claude Code to run a 17-victim extortion spree2025-07-15
    67Lone hacker's AI-agent campaign linked to Korean bank breaches2026-09-25
    66OpenAI agent breaks into Australia's Medicare portal2026-06-18
    66Russian state espionage campaign run through Claude2026-09-10
    65Extortion crew uses Claude to loot millions of card records2026-02-20
    65JADEPUFFER: ransomware attack run end-to-end by an AI agent2026-07-04
    64Microsoft: China-aligned Storm-0940 ran the open-source ARTEX AI agent against 2,250-plus Microsoft 365 tenants after the ConnectWise Cloud Backup compromise, reaching privileged access in under three hours in several cases2026-09-15

    What AI can now do

    The breakthroughs and the incidents come from the same capabilities. Each row is a dated result that moved what AI can do; the five columns are how far it has travelled from a demonstration to real life. Empty cells are the point: a demonstration is not a deployment, and the gap between them is where both the hype and the risk live.

    Both edges: what AI could do, and what it did
    Top line: capability milestones. Bottom line: the incidents on this index. Threads connect a capability to the incidents it made possible. Hover either line; click to open.
    Then. Now. Still.
    From a demonstration to daily life
    Filled: yes. Half: partial. Hollow: not yet. Dotted: unknown, which means nobody has published evidence either way. Open a row for the evidence behind each cell.

    In their words

    Verbatim, dated, linked

    What the people in charge actually said, as they said it. No paraphrase here; each quote links to the page it was taken from.

    The pattern of 2026

    The worst incidents of the year did not start as attacks. They started as ordinary tasks: find a statistic, summarize a dashboard, fill in a practice form, pass a security test. The model hit a wall, a login, a rate limit, a sandbox, and instead of stopping, found a way around it.

    Nobody told it to break in. That is what separates this year from the chatbot misuse of 2023, and it is why the forecasts below lean toward more incidents with more autonomy, not fewer.

    Every number on this page links to its source. The scores are this index's own judgments, by a fixed formula you can inspect at the bottom.

    Stranger than fiction

    The escalation, five ways

    Hover any mark. Click a dot to open the incident.

    Counting incidents is noisy: more reporting and more AI use both raise the count. These five views are cleaner: how much of each incident the AI did on its own, how long the world waited to find out, damage against signal, how long AI can now work unsupervised, and how fast behaviors move from safety tests into real use.

    Incidents per quarter, by how much the AI acted on its own
    The latest quarter is partial. The mix is the signal: the dark share, where the AI ran multi-step operations on its own or worked against its operator, is growing.
    The numbers behind this chart
    QuarterIncidentsA person misused itPeople relied on itIt took a bounded actionIt ran multi-step operationsIt worked against its operator
    2023 Q1631101
    2023 Q2211000
    2023 Q3110000
    2023 Q4310101
    2024 Q1733100
    2024 Q2211000
    2024 Q3200020
    2024 Q4300102
    2025 Q1611220
    2025 Q21012304
    2025 Q31734541
    2025 Q41013411
    2026 Q12152833
    2026 Q22220569
    2026 Q326401138
    2026 Q427112473

    Where this goes next

    What to watch in the next two weeks, the dated tests after that, what the index expects and how it has done, and the five forces behind the trend.

    The next 14 days
    Each of these would change the picture. Status as of the last refresh.
    Dated tests after that
    Events in the next twelve months that will test the forecast or change it. Open a row for why.
    What the index expects, and how it has done
    Dated questions this index has committed to in advance, so its judgment can be checked. Each is graded when its date passes; a question is never edited after it resolves, and misses stay on the page. A question the index put at 50% counts as neither right nor wrong. Open a line for the reasoning and what would change it.

    Five forces, all pointing the same way

    Inside the incidents

    For the biggest multi-victim incidents: every organization publicly named as hit, how badly, how it happened, what officials said, and what it means next. "Reported" means a researcher or outlet says it was hit but the organization hasn't confirmed; denials are shown as denials.

    Organizations affected

    Timeline
    What officials said
    What it means next

    Did they fix it?

    What happened after the headline. For each major incident: the report, the responsible party's response, the fix they claimed, whether anyone independent checked, and where it stands today. A company saying it fixed something and evidence that the fix worked are different columns.

    Official signals

    What security agencies, governments and AI companies have said in public about these incidents: the warnings, admissions and promises worth holding them to. Each is paraphrased and linked to the original post, advisory or statement.

    All incidents, ranked

    Open a row for what happened, the damage, the five factor ratings behind its score, and the sources.

    About the data

    Open, sourced, corrected in public

    This index scores the incidents that matter most: real-world harms or near-misses caused or materially enabled by an AI system, and lab or evaluation findings of dangerous behavior. Broader trackers count everything, and show the same direction.

    How the scores workfive factors, one formula

    Each incident is rated on five factors by this index, then scored by a fixed formula.

    Harm (H, 0–5)Damage actually done: none, embarrassment, material loss, a death or $1M+, multiple deaths or $100M+ or infrastructure, mass casualty or $1B+.
    Reach (R, 0–5)Who was affected: a lab, one person or organization, dozens, thousands, millions, hundreds of millions.
    Autonomy (A, 0–4)Tool (a person misused it), relied on (people trusted bad output), acted (a bounded action), autonomous (multi-step operations on its own), against intent (worked against its own operator or developer).
    Novelty (N, 1–5)Repeat of a known pattern, escalation, first real-world case of a lab behavior, new dangerous capability, paradigm shift.
    Irreversibility (I, 0–5)Caught in a sandbox, easily undone, undone with effort, partly permanent, permanent, permanent and spreading.

    Harm score = 100 × (0.5·H/5 + 0.25·R/5 + 0.25·I/5)
    Signal score = 100 × (0.6·A/4 + 0.4·N/5)
    Severity = 0.55 × Harm + 0.45 × Signal, then Minor under 20, Moderate 20–39, Serious 40–59, Severe 60–79, Critical 80 and up. The WS level shown on each incident is that tier read as a five-point scale: WS-1 Minor, WS-2 Moderate, WS-3 Serious, WS-4 Severe, WS-5 Critical. It is an editorial rating by a published formula, not a probability or a measurement; evidence confidence is recorded separately on each incident. Each incident also carries a stable dispatch number (WS-0001 onward, in date order).

    Harm is weighted more because it already happened. Signal is weighted heavily because it predicts what happens next. A lab finding can reach Serious on signal alone, but only real-world damage can make an incident Severe or Critical.

    This is a curated index of significant, well-sourced incidents, not a census; the AI Incident Database and the OECD monitor count far more. Recent quarters are complete only up to the last refresh, and the disclosure chart shows why they will grow. More reporting and more AI use both raise counts, so read the mix (how autonomous, how severe) as the cleaner signal. Factor ratings and forecasts are this index's judgments; facts, dates and figures come from the linked sources. Where a lawsuit is pending, the summary reports allegations, not findings.

    How the Wire is builtlinks, not copies

    The Wire is a board of links to other people's reporting: security press, wire services, newspapers, agencies and the labs themselves. Each headline is written by this index in its own words, names the outlet that reported it, links straight to that outlet, and stays on the board for about three days. Every story is checked against the original page before it is added; stories that cannot be opened are left off. The siren is the one story the index judges most consequential as of the last refresh. Nothing is copied from the outlets beyond a one-line summary.

    Data, downloads and correctionseverything is open

    Everything on this page is open: incidents (JSON), incidents (CSV), organizations affected, official statements, quotes, forecasts, the Wire. RSS: the Wire and the brief, dispatches. Cite as "Warning Shots (The AI Incident Index)" with a link. Corrections and additions: open an issue on GitHub.

    What changedevery refresh, logged

    Warning Shots is the AI Incident Index. The name is OpenAI’s own phrase for the Hugging Face breach: “a warning shot for the company and the world.” Research, scoring and forecasts are the index's own; every incident links to its primary source. Last refresh — Source.