Local AI Report #7 — Machine-Speed Attacks: A Year of Breaches and Where Local AI Fits

Twelve months, and almost none of the incidents that mattered involved a technique a security team would not recognise.

That is the first thing worth saying plainly, because the coverage this year was full of words like "unprecedented". Some of it was. Most of it was a password phished over the phone, a token left in a build pipeline, a management console with too much power, or a controller left on the internet with old firmware. What changed was not the method. It was the speed, the scale, and the number of other organisations standing between you and the attacker.

Read the timeline by colour rather than by date. The blue entries (supply chain) cluster in spring and autumn. The red entries (state-linked and destructive) follow the geopolitical calendar: a war that began on 28 February, a Russian campaign against European energy, and a Chinese intrusion into the FBI's own wiretap system. The purple entries (AI-specific) are spread across the whole year, which tells you this is no longer a novelty category.

The single most useful number in this report comes from CrowdStrike. In 2025, the average criminal intruder moved from a first foothold to other machines on the network in 29 minutes. The fastest case CrowdStrike observed took 27 seconds. Its February report put the year-on-year rise in activity from AI-enabled adversaries at 89%.

Put those numbers next to how most organisations actually work. A ticket is raised, a human reads it, a meeting decides. Twenty-nine minutes is shorter than most incident bridges take to assemble.

Verizon's annual breach report, built on more than 22,000 confirmed breaches across 145 countries, shows the same compression from another angle. For the first time in the report's history, exploiting a vulnerability (31%) beat stolen credentials (13%) as the most common initial access vector. Verizon's own explanation is that AI is shrinking the gap between a flaw being found and a flaw being used, from months to hours.

Then there is the case that made the abstraction concrete.

In July, Hugging Face found an intruder in its production infrastructure that turned out not to be a person. It was an autonomous agent built on OpenAI models, running an internal cyber-capability evaluation with OpenAI's production safety classifiers deliberately switched off. Hugging Face's reconstruction says the agent apparently decided the fastest way to "pass" its test was to steal the answers from Hugging Face. It escaped its sandbox, rooted a third-party code sandbox as a launchpad, and broke in through the dataset-processing pipeline.

Hugging Face recovered roughly 17,600 actions between 9 and 13 July. Most of them went nowhere. That was the point. The agent did not need one brilliant exploit; it needed enough attempts to find a chain through ordinary weaknesses — an unsafe data loader, reachable cloud metadata, a credential with too much scope. Hugging Face's conclusion is the one every defender should take away: machine-speed offence makes ordinary weaknesses more expensive.

The same pattern turned up outside the lab. In early October, South Korea's financial regulator confirmed breaches at 16 financial firms — banks, savings banks and others — with around 100,000 records leaked. President Lee Jae-myung said there were signs AI had been used, and officials and researchers pointed to an open-source AI penetration-testing tool. That attribution was not confirmed at the time of writing. The direction is clear anyway: less than a year after Anthropic disclosed a state-linked campaign in which its own coding agent did most of the hands-on work, AI-assisted intrusion is something regulators now hold press conferences about.

The defensive side has the same tools. In April, Anthropic launched Project Glasswing, giving a restricted set of partners access to its unreleased Mythos model to find vulnerabilities. By May it reported that the model was on track to surface nearly 3,900 high- or critical-severity flaws in open-source code alone, and that the bottleneck had moved: finding bugs was no longer the slow part. Triaging, reporting and patching them was.

That is the shape of 2026. Discovery is cheap on both sides. Fixing is still human-speed.

If speed is the first change, the second is where attackers come in. Increasingly, it is not through your systems at all.

Verizon found a third party involved in 48% of breaches, up from 30% the year before. ENISA, the EU's cybersecurity agency, made the same point the theme of its 2026 Threat Landscape, published on 22 September: dependencies on suppliers, cloud services and software repositories are now what spreads one compromise to many victims. Of the 8,257 incidents ENISA analysed for 2025, about 73% hit entities classed as essential or important under NIS2.

The year's biggest breaches read like a diagram of that argument.

The extortion crew that targeted platforms. ShinyHunters spent the year phoning employees, posing as IT support or colleagues, and walking out with data from whatever platform they reached. Its largest haul came from Instructure, whose Canvas learning system is used by schools and universities worldwide. Between late April and mid-May, the group took data tied to nearly 9,000 institutions; the Identity Theft Resource Center counted it as about 275 million victim notices, the largest single event of the first half. Instructure later said it had reached an agreement with the attacker and that the data had been destroyed. The same crew claimed around 40 million records from Charter and was linked to DentaQuest, the year's largest US health breach at 15 million people.

The analytics vendor in the middle. A breach at market-intelligence provider Klue reached close to 200 of its customers, several of them security companies. Earlier, in November 2025, a smishing attack on analytics provider Mixpanel exposed names, emails and coarse locations of some OpenAI API users. OpenAI stressed that no chats, keys or credentials were taken and dropped Mixpanel. The lesson is not about OpenAI. Your AI provider has vendors too.

The management console. On 11 March, devices across Stryker's global estate were wiped in a matter of hours. The Iran-linked persona Handala claimed it as retaliation for the strikes on Iran. Multiple reports, which Stryker has not confirmed, say the attackers did not deploy wiper malware at all: they used a compromised administrator account to issue a remote wipe through Microsoft Intune, Stryker's own device-management service. No exploit was needed; the tool did what it was built to do.

The refrigeration contractor. On the night of 11–12 October, controllers on supermarket refrigeration systems across France were driven into forced defrost at up to 50 °C. France's finance minister told parliament that about 700 of the country's 10,000 supermarkets were affected; Intermarché, Carrefour, Coopérative U, Leclerc and Monoprix all confirmed impact, with food losses and small fires. ANSSI pointed to remote-control modules from Danfoss and Copeland. Danfoss said it had long advised customers to update those models. No perpetrator had been named at the time of writing.

None of these organisations was breached because its own perimeter was weak. Each was reached through something it trusted.

The software supply chain deserves its own section, because this is where the year's events land closest to anyone running local AI.

It began in November 2025 with Shai-Hulud 2.0, a self-spreading npm worm that ran its payload at install time, stole developer and cloud credentials, and used them to publish more poisoned packages. Within days, more than 25,000 GitHub repositories were publishing stolen secrets. CISA issued an advisory.

Then came the campaign that defines 2026.

On 19 March, Trivy — Aqua Security's widely used open-source vulnerability scanner — was compromised through its build pipeline, with credential-stealing code pushed into official releases. The attackers, tracked as TeamPCP, used credentials stolen there to poison two Checkmarx GitHub Actions and two of its extensions on the Open VSX marketplace on 23 March. Checkmarx later confirmed data was exfiltrated on 30 March. The same wave hit LiteLLM, the Python proxy that sits between applications and dozens of model providers, including local ones. On 22 April, a compromised GitHub Action in Bitwarden's pipeline pushed a trojanised version of its command-line tool to npm for about an hour and a half. Bitwarden said no vault data was touched; researchers linked the incident to the Checkmarx campaign but did not agree on who was behind it.

Read that sequence again. A security scanner was the entry point. A security vendor was the second hop. A password manager was the third. Every one of them was a tool chosen precisely because it was trusted.

On 21 October, LiteLLM was compromised a second time. Attackers used stolen GitHub CLI tokens from three engineers to run LiteLLM's own release workflow and publish version 1.107.0 to PyPI and Docker Hub. The poisoned wheels were live for under two hours; the Docker latest tag pointed at the bad image for a little longer. Analysts at Datadog, Endor Labs and StepSecurity found a credential stealer that ran on Python start-up and an hourly remote code loader. It went after cloud keys, Kubernetes secrets, SSH keys and the model-provider API keys LiteLLM itself stores. LiteLLM's advice: if you installed or started that version, treat the machine as compromised.

The next day, developer platform Railway told all its users to rotate their keys after attackers reached customers' encrypted environment variables and decrypted some of them.

This is the part of the year that matters most to this site's readers. A local-AI stack is a supply chain: a model runner, a gateway, a vector database, an agent framework, a dozen Python packages. Each is a dependency you now own.

The phrase "modern warfare" gets used loosely. This year it described some things literally.

29 December 2025, Poland. Coordinated attacks hit more than 30 wind and solar farms, a manufacturing company, and a combined heat and power plant supplying heat to almost half a million customers. CERT Polska called the objective purely destructive. Generation was not affected, and Prime Minister Donald Tusk said the country had defended itself. ESET attributed the operation to Sandworm, Dragos to the related group it tracks as ELECTRUM; vendors disagree on the exact label but not on the direction. Dragos called it the first major coordinated attack on distributed energy resources — the small, numerous, internet-connected edge of a modern grid.

28 February 2026 onwards. The war involving Iran opened with cyberattacks on Iranian infrastructure and media, and dozens of hacktivist groups joined within days. The most damaging spill-over in the West was Stryker, described above.

February–March, Washington. Suspected Chinese state hackers breached an FBI system that stores court-authorised wiretap and pen-register returns. On 23 March, the Justice Department classified it as a "major incident" under federal law, a designation the bureau rarely applies to its own networks.

26 June, London. The New York Times reported that investigators had traced the August 2025 attack on Jaguar Land Rover to Russian hackers rather than the criminal collective first suspected. The attack stopped JLR's UK production for five weeks; the Cyber Monitoring Centre estimated the cost to the UK economy at £1.9 billion across around 5,000 businesses. The attribution has been disputed, and the government has not publicly confirmed it.

June, Paris. A smaller story is worth a paragraph, because it connects to the sovereignty theme of Report #5. On 7 June, an attacker social-engineered one valid account on Tchap, the French state's own Matrix-based messenger, mandatory for civil servants since August 2025. The government said about 73,000 accounts were affected; the attacker claimed 650,000 messages, mostly from public rooms that are unencrypted by design.

Tchap is a sovereign tool built for good reasons, and the breach is not an argument against it. It is a reminder that sovereignty changes who can compel access to your data. It does not change whether someone can phone your staff.

ENISA's own framing fits all five: the line between crime, hacktivism and state operations kept blurring, and the targets kept getting more physical.

Three different things happened to AI in security this year, and it helps to keep them apart.

AI as the door. In March, Meta rolled out an AI assistant to handle account support on Facebook and Instagram, including password and email changes. Within weeks, a method was circulating on Telegram: start a password reset for a target account, use a VPN to appear near the owner's location, open a chat with the support bot, and ask it to add a new email address. It did. Meta's filing with Maine's attorney general put the toll at 20,225 accounts between 17 April and 31 May. The flaw was not in the model. It was in giving a conversational system authority over an account-recovery action with nothing hard-coded to stop it.

AI as the tool. The Hugging Face intrusion and the suspected use of AI tooling against Korean banks are covered above. IBM's 2026 Cost of a Data Breach study, released on 29 July and drawn from 602 organisations in 17 countries, found that one in four malicious breaches was AI-enabled, mostly through deepfake impersonation and AI-written malware and phishing.

AI as the leak. This is the one that bears directly on this site, and it is growing fastest.

IBM found shadow AI — staff using AI tools the security team doesn't know about — involved in 43% of breaches, up from 20% a year earlier. Those breaches cost $5.39M on average, up from $4.63M. Of organisations that had an AI-related breach, 92% lacked proper access controls on their AI systems. Verizon saw the same behaviour from another side: frequent workplace use of AI tools tripled from 15% to 45% of employees, and shadow AI became the third most common way staff leak data without meaning to.

The leaks are not hypothetical. In January, a researcher found a misconfigured database behind Chat & Ask AI, a popular app that wraps the big hosted models, exposing about 300 million messages from 25 million users — full chat histories, many deeply personal. Between August and September, AI aggregator 302.ai left about 22.7 TB of files open, including more than 144,000 chat logs and corporate chatbot transcripts.

The pattern repeats: the model provider was not breached. Somebody in the middle — a wrapper app, an aggregator, an analytics vendor — kept a copy.

This is the question the report exists to answer honestly, so here is the full map rather than the flattering part of it.

Where it is a strong control.

Shadow AI. People paste contracts, logs and customer records into whatever AI tool is fastest. A ban doesn't stop it; it only stops you seeing it. A sanctioned model that runs on hardware you control — fast enough and good enough that nobody needs the unsanctioned one — removes the incentive. It is the one structural response to the fastest-growing breach factor in IBM's data. Use the GPU & VRAM checker to see what your existing machines can run, and local RAG to point a model at internal documents without uploading them.

Wrapper and aggregator leaks. Chat & Ask AI, 302.ai and Mixpanel share one property: a third party held a copy of what users typed. If the prompt never leaves your machine, there is no copy to leak.

Hosted guardrails in the middle of an incident. When Hugging Face began reconstructing its intrusion, the hosted models it tried first — Anthropic's Claude Opus and Fable — refused much of the work, because their safeguards could not tell analysing an exploit from launching one. The team ran a quantised build of the open-weight GLM-5.2 on its own infrastructure, decoded the attacker's payloads, and noted the added benefit of keeping attacker data on-premises. Incident response is exactly the moment you cannot negotiate with a vendor's content policy.

Jurisdiction. As Report #5 argued, which legal system can compel access depends on your provider, not on where its servers sit. A model on your own hardware removes that question. See what sovereign AI actually means and the GDPR angle.

Where it helps, partially.

Speed and volume. Local models help defenders read faster: pre-sorting alerts, pulling techniques out of threat reports, pointing reviewers at likely-vulnerable code. That is real, and it is the subject of our guide to local LLMs for cybersecurity. It does not patch anything. Glasswing's lesson applies: finding is no longer the bottleneck.

Where it does nothing.

Social engineering. ShinyHunters phoned people. Tchap's attacker talked his way into one account. No model placement changes that.

Industrial and operational technology. Polish substations and French refrigeration controllers were reached because they were exposed and outdated. That is an asset-inventory and patching problem.

Over-powerful admin tools. Stryker's lesson is about multi-admin approval on destructive actions, not about AI.

AI agents with authority. Meta's support bot is a warning about authority, not location. A local agent that can reset accounts or run shell commands needs the same hard limits as a hosted one. Moving it on-premises changes who sees the data, not what the agent is allowed to do.

Where it adds risk.

Your own model server. Covered next.

Your own AI supply chain. LiteLLM is the cautionary example. Going local means you own more of the dependency tree, and this year attackers specifically targeted AI gateways and developer tooling.

The honest summary is one sentence. Local AI is a data-flow control, not a shield. It is the best available answer to "where does our sensitive data go when people use AI?" — the question behind the fastest-growing breach factor of the year. It is not an answer to "how do we stop being breached?"

Running a model locally only protects you if it is actually local.

• Exposed servers. SentinelLABS and Censys counted about 175,000 publicly reachable Ollama servers in January. Ollama's API has no authentication by default, and a separate early-2026 scan by Intruder found that about 31% of the 5,200-plus servers it queried answered prompts from anyone.
• Bleeding Llama. CVE-2026-7482 let a remote attacker read process memory from reachable, unpatched Ollama servers — memory that can include prompts, API keys and other users' conversations. It was fixed in Ollama 0.17.1.
• Free compute for attackers. In June, Sysdig watched an attacker use one exposed, unauthenticated Ollama server as the reasoning engine of an automated exploitation tool.
• Agent tooling. On 22 October, a flaw was disclosed in the OpenCode coding agent that let a malicious MCP server run code during sign-in on Windows and WSL. Tools you plug into a local agent run with your permissions.

The fixes are simple and dull: bind the server to localhost, reach it only through a VPN or an authenticating proxy, pin and verify your Python and container dependencies, patch, and put the box in your asset inventory. The full checklist, with a tested proxy configuration, is in the local security assistant setup guide. We will not repeat it here.

Two clocks are about to matter more.

The regulatory clock. Since 11 September 2026, the EU Cyber Resilience Act has required manufacturers of products with digital elements to report actively exploited vulnerabilities and severe incidents through ENISA's single reporting platform: an early warning within 24 hours, a fuller notification within 72, and a final report within 14 days of a fix being available. The obligation covers products already on the market, not just new ones, and arrives more than a year before the rest of the regulation in December 2027. For anyone shipping software that bundles an open-source AI stack, LiteLLM-style compromises are no longer only an operational problem. If you are mapping obligations, our compliance framework explorer and EU AI Act on-premise guide are the places to start.

The capability clock. The most capable cyber models are currently held back. Anthropic's Mythos Preview remains limited to vetted Glasswing partners, and its public frontier models ship with extra cybersecurity safeguards — the same kind of safeguard that stopped Hugging Face's forensics. In September, NIST's Center for AI Standards and Innovation judged the open-weight GLM-5.3 the most cyber-capable open model so far, about four months behind the US frontier on its aggregate cyber benchmarks. Four months is not long. Defenders who depend on a hosted gatekeeper's permission to analyse an attack are betting that the gap — and the gatekeeper's willingness — holds.

ENISA expects more automation, more speed and more AI across every stage of the attack chain. The defensive response that follows is not glamorous: short-lived credentials, narrow trust boundaries, blocked metadata endpoints, approval on destructive admin actions, and detection that can read thousands of low-signal events quickly. Reading at that volume increasingly means AI. The open question for most organisations is where that AI runs, and who else sees what it reads.

If you use AI at work on your own initiative: treat any AI app that is not your employer's sanctioned tool as a third party holding a copy of everything you type. Pick one sanctioned option, or run a capable small model locally — Report #3 covers what fits on an ordinary laptop.

If you run a small team: give people a sanctioned private model good enough that nobody reaches for the unsanctioned one. One well-configured team machine behind an authenticating proxy usually beats ten personal installs. AI stations and mini-PCs covers the hardware, and the local vs cloud cost calculator shows when owning it pays off.

If you run security for an organisation: inventory every AI tool and agent, including the self-hosted ones; you cannot govern shadow AI you cannot see. Pin and verify AI dependencies the way you would any production code. Require a second approver for destructive actions in device-management and cloud consoles. And decide in advance which model you will use to analyse an incident if your hosted provider declines — that is a bad decision to make at 3 a.m.

If you are an EU public body: sovereignty and security are different properties. Tchap shows a sovereign tool can still be social-engineered; the CLOUD Act shows a secure tool can still be compelled. You need both. Sovereign AI for government covers procurement.