November 2026 has just begun, and this page will list every serious attack of the month in date order. Breaches, supply chain compromises, exploited vulnerabilities, AI-run intrusions and agent incidents each get one line with a status and a link. Last month's October 2026 attacks timeline shows what a full month looks like.
This is a living page. It is checked for new incidents every 4 hours through the end of November, and every entry links to a write-up or primary sources. The same data powers the shareable November 2026 attacks tracker: filter by type, link to a single incident, or embed one on your own site.
Last updated: November 4, 2026, 06:02 UTC · 6 dated entries, 7 earlier campaigns, 1 unconfirmed claim
TL;DR
| Question | Answer |
|---|---|
| What does this page cover? | Every attack, breach, exploited vulnerability and agent incident of November 2026 we could verify, in date order |
| Which date is used? | When the attack happened, or when it was first disclosed if that is all that is known |
| Are claims included? | Yes, labelled Unconfirmed and kept in their own section |
| What is the common thread? | Too early to say; see the section below |
| First thing to do | Rotate secrets on affected platforms and hosts, then patch what is being exploited |
How to read the timeline
Each entry has a type and a status:
| Type | Meaning |
|---|---|
| Supply chain | A package, release, plugin or update channel shipped malicious code |
| Breach | A company's systems or customer data were accessed |
| Exploited | A vulnerability with confirmed in-the-wild attacks |
| Critical vuln | A severe flaw disclosed and patched, with no confirmed exploitation yet |
| AI-run attack | An intrusion where agents or LLMs did substantial operational work |
| Agent incident | An AI agent caused harm or broke a control without an outside attacker |
Confirmed means the affected company, a government agency or a named research team stated it. Reported means one vendor's research that has not been independently corroborated. Unconfirmed means a claim with no supporting statement.
Week 1: November 1 to 7
| Date | Incident | Type | What happened | Status |
|---|---|---|---|---|
| Nov 2 | WorkOS: internal sales app accessed, CEO links attack to ARTEX | Breach | WorkOS says an internal sales app was accessed without authorization (detected Oct 30), exposing CRM data and customer Slack excerpts; production services not affected, per the company. The ARTEX link comes from the CEO, not the bulletin. (details) | Confirmed (WorkOS); ARTEX link unverified |
| Nov 2 | Northflank security incident: control-plane secrets, AI key misuse | Breach | Northflank told all customers to rotate integration and project secrets after an attack on secrets in its control plane; some customers reported unauthorized AI key use. Running workloads were not affected, per the company. Root cause not yet published. (details) | Reported (Northflank) |
| Nov 2 | GitBook: AI-agent attack reaches infrastructure credentials | Breach | GitBook says a targeted attack using AI agents accessed some infrastructure credentials on Nov 2. Integration tokens, Git Sync secrets, API tokens and Assistant questions may be exposed; all personal API tokens revoked, MCP server needs re-authentication. No content changes found. (details) | Confirmed (GitBook); AI-agent detail unverified |
| Nov 2 | CyberStrikeAI: LLM on the C2 server takes over education domains | AI-run attack | Kaspersky says the open-source CyberStrikeAI framework put an LLM orchestrator on the C2 server to run post-exploitation against education networks in Africa and Latin America, reaching domain admin in 3-4 days. (details) | Confirmed |
| Nov 3 | Primcloud says a Railway engineer's AI agents probed its infrastructure | Agent incident | Primcloud's founder says AI agents run by a Railway engineer scanned its network and requested secrets; he says every attempt was blocked. Railway's CEO apologized, said the activity looked agent-driven, and will ban non-manual external testing. No logs are public. (details) | Partly confirmed (Railway apology); details one-sided |
| Nov 3 | WordPress Core upgrade-window RCE (CVE-2026-119977) added to CISA KEV | Exploited | CISA added CVE-2026-119977, a TOCTOU flaw in WordPress Core's upgrade staging paths (4.7 through 7.1.3) allowing unauthenticated code execution during an upgrade, to KEV on Nov 3. Fixed in 7.1.4 (Oct 28); federal due date Nov 6. (source) | Patched |
New entries are added here as they are confirmed.
Campaigns reported in November that started earlier
These were disclosed or covered this month, but the attack or fix predates November, so they sit outside the daily timeline.
| Incident | Started | What happened |
|---|---|---|
| ARTEX, PentAGI and CAIRN in real intrusions | Late August 2026 | Google GTIG and Mandiant report threat actors running open-source agentic pentest frameworks in incident response cases against government, technology and telecom targets |
| Fake ChatGPT and Claude bots scanning for .env files | Late September 2026 | Cequence tracked one actor posing as about 32 AI bots to request roughly 90 secret-bearing paths such as .env files and SSH keys |
| Black October: nine AI developer platform incidents and LLMjacking | October 2026 (Oct 6-30) | Wiz counts at least nine AI developer platform incidents in October, including Fireworks AI, Zeabur, Railway, Warp and Northflank, and traces stolen cloud keys to resold model calls within days |
| Chainalysis: attacker used "offensive agentic techniques" | October 2026 (notice Oct 30) | Chainalysis says an external actor used offensive agentic techniques to reach internal tools, exposing user IDs, names, emails and role labels; no passwords, MFA secrets or tokens found accessed. Method not published |
| VOLTA infostealer asks an LLM to rank victims | Reported Oct 2026 | Cisco Talos found VOLTA, a Windows infostealer that queries an LLM via OpenRouter to judge each victim's value, targeting SSH keys and cloud configs |
| ChatGPT share link XSS (fixed Oct 26) | Fixed October 26, 2026 | Parameter chained ChatGPT Preview, a MathLive postMessage flaw and a YouTube JSONP CSP bypass so a shared chat link could run code as chatgpt.com in the victim's session |
| 3AM ransomware at a UK school estate: Bitdefender sees an agentic loop | September 10-19, 2026 (reported Nov 3) | Bitdefender says a 3AM affiliate hit a UK school estate with human-plus-agentic-loop behavior; about 37 of 50 reached machines encrypted, tools were ordinary, AI use inferred not proven |
Unconfirmed claims
| Date | Claim | Where it came from | What to do |
|---|---|---|---|
| Nov 1 | Alleged Anthropic Mythos-class "numbat" checkpoint on Hugging Face | Hugging Face repo burner22/numbat and a Hacker News thread; Anthropic has not confirmed, commenters call it fake | Do not load it, or any repo, with trust_remote_code=True without reading the code; do not ask an agent to |
An entry moves into the timeline if the company or a named research team confirms it, and is removed if it is shown to be false.
Previous month: October 2026 attacks timeline
What November's attacks have in common
It is early in the month, so there is no pattern to report yet. Last month's incidents mostly began with stolen or unrotated credentials, and many aimed at AI keys. This section will be revised as November's entries accumulate.
What to do this week
- Rotate secrets stored on any platform named in an entry below, and on any host that ran an affected package.
- Pin packages and container images by version and digest.
- Patch vulnerabilities marked Exploited first.
- Cap and scope every AI provider key, and alert on usage spikes.
- For your own coding agents: keep monitors outside the agent's reach, log what they run, and require approval for credential access and destructive commands. Beam's local watcher flags these actions on your machine.
How this timeline is updated
Beam publishes one attacks timeline per month, and a new page starts on the first of each month. This page is checked every 4 hours and updated whenever a new November incident is confirmed or a claim changes status; the "Last updated" line at the top changes with it. The attacks tracker shows the same entries with filters, a link for every incident and an embed code you can paste into your own page.
Change log
- November 4, 2026: Added the Primcloud/Railway AI-agent probe (partly confirmed by Railway's apology). Added WordPress Core CVE-2026-119977 (CISA KEV, fixed in 7.1.4).
- November 3, 2026: Added the WorkOS sales app breach (ARTEX link per the CEO, unverified). Added Bitdefender's 3AM ransomware school case to earlier campaigns. Added the GitBook AI-agent attack; added Black October (Wiz), Chainalysis, VOLTA and the ChatGPT share link XSS to earlier campaigns.
- November 2, 2026: Added the Northflank incident and Kaspersky's CyberStrikeAI findings; added ARTEX (Google/Mandiant) and fake AI bot .env scanning (Cequence) to earlier campaigns.
- November 1, 2026: Page created.
- November 1, 2026: Added the alleged Anthropic "numbat" checkpoint on Hugging Face to unconfirmed claims.