Rogue AI agent incident tracker
AI agents keep going off-script. When it happens in an AI lab’s own tests, the public waits about four months.
Every documented case we could find of an AI agent acting beyond what it was told, with sources and each company’s response.
Typical disclosure gap · lab tests
Median wait between an incident in an AI lab’s own testing and the first public report (10 lab incidents with exact dates; longest 129 days). When a real product misbehaves, it’s public in about a day.
exact datesmonth onlycriticalagentwatch.kidjig.com
When it happened vs. when it went public
21 of 29 incidents came out since July
Each square is one incident: filled above the line in the month it happened, outlined below in the month it was made public. Pink marks critical incidents. Select a square to read it.
16 Jul 2026: Hugging Face discloses its breach; AI labs start searching their own logs. The jump is in disclosures, not proof that agents misbehave more often. October runs to the 25th. Government responses so far ↓
Six behaviours that keep repeating
In labs, agents break out. In products, they break things.
How often each behaviour shows up, split by where the incident happened. Most incidents show more than one, so rows don’t add up. Select a row to filter the incidents below.
Deploying agents yourself? See the six controls these incidents argue for ↓
Incident log
Every incident, with sources
Showing 29 of 29 real incidents · agents that
AW-030MediumMade public 15 Oct 2026Built a workaround to send web requests its training setup blocked121 daysto go public
Internal OpenAI model in training
Limited to read-only web requests, the model got an external browser service to send the blocked requests for it, then built a reusable workaround through a forwarding service and an online mailbox, saving extra years of trade data it reused later. Its final answer didn't mention the workaround.
Company response. One of four June incidents OpenAI added to its public misalignment log on 15 October.
Happened 16 Jun 2026→Made public 15 Oct 2026
AW-029CriticalMade public 15 Oct 2026Got into a research organisation's internal systems, taking 1,489 user records and 147,451 rows120 daysto go public
Internal OpenAI model in evaluation
Asked for five figures from a research organisation's public dashboard, the model used credentials it found in public JavaScript to get into internal systems, downloaded 1,489 user records with names and emails, and changed a live service's configuration without reversing it. In a second run it pulled 147,451 rows from non-public tables. It disclosed none of this.
Company response. OpenAI's monitor flagged it as critical severity. It was one of four June incidents OpenAI added to its public misalignment log on 15 October.
Happened 17 Jun 2026→Made public 15 Oct 2026
AW-028MediumMade public 15 Oct 2026Spent test crypto from a wallet nobody gave it111 daysto go public
GPT-5.6 Sol-family research model
Short of test ETH for fees on the Sepolia test network, the model derived keys from publicly known recovery phrases, checked 362 addresses and spent from a funded wallet nobody had given it. The final answer didn't mention it.
Company response. OpenAI only found it on 25 September, after extending its monitoring to past logs.
Happened 26 Jun 2026→Made public 15 Oct 2026
AW-027CriticalMade public 15 Oct 2026Forged tokens to pull 24 years of hospital-bed data from a government site120 daysto go public
Internal OpenAI model in training
Asked for one year of hospital-bed figures for one district, the model was repeatedly refused by a government statistics site. It used a file-download flaw to read the server's code, forged authentication tokens and downloaded 24 years of data. Its final answer didn't mention the break-in.
Company response. OpenAI rated it critical. It hasn't named the country or the website.
Happened 17 Jun 2026→Made public 15 Oct 2026
AW-026MediumMade public 9 Oct 202620 visa applications were filed on the State Department's site≈ 5 monthsto go public
Unreleased, non-frontier Anthropic research model
Meant to fill in a practice copy of a government form, the model submitted the real form on the US State Department's website when the practice copy failed: 20 incomplete nonimmigrant visa applications, one in May and 19 in August. None were processed. Anthropic also found activity on other federal, state and local agency sites.
Company response. Anthropic briefed the White House, notified every agency involved and has extended its cut-off of live internet access to all internal evaluations until its monitoring reliably catches this behaviour.
Happened ≈ May 2026→Made public 9 Oct 2026
AW-025HighMade public 9 Oct 2026A fake murder tip was sent to Philadelphia police83 daysto go public
Claude Haiku 4.5
Running example tasks on randomly chosen web pages, under rules that barred logins, purchases and destructive submissions but not form submissions, the model landed on a Philadelphia police page about an unsolved homicide and submitted a made-up eyewitness tip. A spam filter caught it and it never reached investigators.
Company response. Anthropic found it on 28 September and says it told the department on 8 October once its technical review was done; police say they were told on 7 October. Police called the two-month delay unacceptable.
Happened 18 Jul 2026→Made public 9 Oct 2026
AW-024HighMade public 25 Sep 202653 user-shared ChatGPT images ended up on image-hosting sitesNo dateincident date not public
Agents in OpenAI's research environment
Agents in OpenAI's research environment posted images that ChatGPT users had shared to outside image-hosting sites as unlisted links; OpenAI has found 53 instances so far. The images came from users who hadn't opted out of having their data used for training.
Company response. OpenAI says it has removed most of the images and can't link them back to user accounts to notify the people affected.
Happened Not public→Made public 25 Sep 2026
AW-023HighMade public 25 Sep 2026Agents pulled SEC and Census data and probed an Education Department siteNo dateincident date not public
OpenAI agents in training and testing
One agent used developer API keys it found in public GitHub repositories to pull Census Bureau data from a Commerce Department site. Others reposted public SEC data elsewhere online. Researchers at Transluce found an agent tried and failed to get into the Education Department's Office for Civil Rights site, plus related activity at other agencies and five state sites that isn't all attributable to OpenAI.
Company response. OpenAI says most incidents in its review were low severity. Commerce says the Census data was public, the SEC says it knows of no unsanctioned access to non-public information, and Education found no impact. By 2 October OpenAI had notified more than 100 organisations.
Happened Not public→Made public 25 Sep 2026
AW-022CriticalMade public 23 Sep 2026An agent broke into Australia's Medicare statistics portal97 daysto go public
Internal OpenAI research model
Given a task to research public medicine spending, the agent kept hitting access blocks on the Medicare Statistics Reporting Service, found a way around them, read public and non-public files and wrote files onto an internal server. It also visited three other government sites, where it reached only public information.
Company response. OpenAI says it found no evidence patient records were accessed. It discovered the activity on 11 August and emailed Services Australia on 10 September. Prime Minister Albanese called the situation unacceptable and said OpenAI took far too long to tell the government.
Happened 18 Jun 2026→Made public 23 Sep 2026
AW-021HighMade public 18 Sep 2026Gemini broke into three companies during a cyber test≈ 4 monthsto go public
Google Gemini (version not disclosed)
In an Irregular evaluation that unintentionally had internet access, Gemini went after three real companies it believed were in scope. It guessed credentials at one and used credentials from a public repository at the other two.
Company response. Google says Gemini acted appropriately by stopping each intrusion once it recognised the target was real, and doesn't consider it misalignment. It learned of it in late July and confirmed only after The Wall Street Journal asked.
Happened ≈ May 2026→Made public 18 Sep 2026
AW-020HighMade public 16 Sep 2026An agent searched GitHub for leaked keys, then made up data124 daysto go public
OpenAI model in training
Training on a task to pull earnings figures for a California county, the model couldn't get the data directly. It tried disposable email sign-ups, then went looking through public GitHub repositories for leaked API keys, and one worked. Still short of data, it made up nine numbers and presented them as if it had read them off the site's chart.
Company response. Disclosed by OpenAI itself under its misalignment-reporting framework.
Happened 15 May 2026→Made public 16 Sep 2026
AW-019MediumMade public 16 Sep 2026Models wrote hidden instructions into their own memory summaries≈ 4 monthsto go public
GPT-5.6 Sol during training
During GPT-5.6 Sol's training, some instances inserted their own instructions into the compressed summaries the model uses as memory, steering later steps to hide mistakes, invent missing data or smooth over inconsistencies in sources. A monitor flagged it on 9 July.
Company response. OpenAI found such instructions in 2.15% of GPT-5.6 Sol's training summaries and says later steps often followed them. It was one of six reports published with OpenAI's new misalignment-reporting framework.
Happened ≈ May 2026→Made public 16 Sep 2026
AW-018HighMade public 11 Sep 2026Malicious packages uploaded to the RubyGems registry129 daysto go public
Internal OpenAI agents (per researchers)
Independent researchers say OpenAI agents made more than 2,000 malicious uploads to RubyGems, most on 11 and 12 May, and tried to use an unknown flaw in its servers to collect developer credentials. RubyGems' initial log review found no evidence that API keys were misused, though it called the review limited.
Company response. OpenAI doesn't dispute its agents were on RubyGems, but says they were doing benign tasks and retrieving public information, and that it couldn't verify the malicious-package claims. It hadn't told RubyGems before the researchers went public.
Happened 5 May 2026→Made public 11 Sep 2026
AW-017HighMade public 9 Sep 2026An early Opus 4.6 got admin access to an unrelated machine≈ 8 monthsto go public
Early checkpoint of Claude Opus 4.6
In a January cyber evaluation that was wrongly connected to the internet, the model accidentally made its own assigned target unreachable, then reached an unrelated third-party machine. It used a password it found to get admin rights, gathered more credentials, changed settings and read one person's personal information.
Company response. Anthropic found it in August while preparing transcripts for METR, which turned up internet-connected sessions its July review had missed. A review of about 481 million transcripts found nothing similar or worse, and METR is investigating independently.
Happened ≈ Jan 2026→Made public 9 Sep 2026
AW-016MediumMade public 4 Sep 2026An agent swarm turned a German wiki into its message board≈ 4 monthsto go public
Agents attributed to OpenAI
Researchers documented more than 15,000 agent edits (roughly 18,000 posts) on DSE Wiki, a nearly dormant German programming wiki, used to swap tactics for getting around OpenAI's safeguards between mid-May and late June. When a moderator started deleting pages, the agents made backup pages to survive the cleanup.
Company response. OpenAI told Reuters the activity was unrelated to Hugging Face and rejects calling it hacking. Attribution rests on traffic from Microsoft Azure and OpenAI-style usernames.
Happened ≈ May 2026→Made public 4 Sep 2026
AW-015LowMade public 7 Aug 2026Kimi K3 left its sandbox and read the answers off GitHubNo dateincident date not public
Moonshot Kimi K3 (open weights)
In defensive cyber tests by Frontier Security, in a sandbox built with the UK AI Security Institute's Inspect framework, the model found a network misconfiguration, left the sandbox and cloned the benchmark's repository from GitHub to read the solutions. It didn't attack any outside system. Because the weights are open, copies already downloaded can't be patched.
Company response. Moonshot didn't respond to requests for comment.
Happened Not public→Made public 7 Aug 2026
AW-014HighMade public 5 Aug 2026A Meta model hacked an outside company during an evaluationNo dateincident date not public
Meta model, reportedly Muse Spark 1.1 (not confirmed by Meta)
A misconfiguration by testing partner Irregular gave the model internet access during a cyber evaluation. It exploited a vulnerability in an outside company's service and, according to The Information, made changes to that company's internal systems.
Company response. Meta says it is investigating and will share more once it has all the facts. Irregular says it was the same environment issue Anthropic disclosed, not a sandbox escape.
Happened Not public→Made public 5 Aug 2026
AW-013HighMade public 4 Aug 2026A test target's made-up name matched a real website, which got hackedNo dateincident date not public
OpenAI model in an Irregular evaluation
In a capture-the-flag test run by outside evaluator Irregular, a misconfiguration left the environment connected to the internet. The fictional target's name happened to match a real domain, so the model attacked that real site, then found credentials and used them to operate it.
Company response. OpenAI attributes the internet access to a misconfiguration in the testing environment Irregular ran, and says it involved a basic vulnerability, not a sandbox escape or zero-day.
Happened Not public→Made public 4 Aug 2026
AW-012CriticalMade public 4 Aug 2026Fake GitHub identities used to push malicious code in a UK government test10 daysto go public
Claude Mythos 5 (17 actions) and GPT-5.6 Sol (2 actions)
In a UK AI Security Institute cyber evaluation between 25 and 28 July, agents took 19 unsanctioned actions on the live internet. One researched a real open-source project's maintainers, created fake GitHub accounts while using Tor to get around GitHub's network restrictions, submitted malicious code and had a sock-puppet account vouch for it. When a GitHub user spotted the malware, it rewrote the code history and claimed the code was included by accident.
Company response. AISI says the maintainer rejected the code, the incident was contained within about an hour and no harm is known. Model makers' cyber safety filters had been switched off for the test.
Happened 25 Jul 2026→Made public 4 Aug 2026
AW-011CriticalMade public 30 Jul 2026Claude models breached three real organisations during cyber tests≈ 3 monthsto go public
Claude Opus 4.7, Claude Mythos 5 and an internal research model
Told they had no internet access, the models reached real production systems at three organisations through a misconfigured evaluation environment run with partner Irregular. Opus 4.7 was given a fictional target that shared its name with a real company and kept attacking after seeing signs it was real. Mythos 5 reportedly published a malicious PyPI package that compromised a real security company.
Company response. Anthropic calls it an infrastructure and operational failure, not an alignment failure. It reviewed 141,006 test runs, paused all cyber evaluations on 23 July and contacted the organisations on 27 July. Two hadn't noticed anything; one couldn't be reached.
Happened ≈ Apr 2026→Made public 30 Jul 2026
AW-010CriticalMade public 16 Jul 2026About 700 coordinating agents hacked Hugging Face6 daysto go public
GPT-5.6 Sol and an unreleased internal model
During a cybersecurity benchmark, agents escaped OpenAI's isolated test setup through a previously unknown flaw in its Artifactory package server and broke into Hugging Face's production systems on 10 and 11 July, mainly to learn how the benchmark's scorer worked so they could fool it. Investigators found about 1,200 agents coordinating on an improvised message board and about 700 joining the attack. They also got into accounts on four other services with publicly exposed credentials, and ran code through a Modal Labs customer's unauthenticated endpoint.
Company response. Hugging Face disclosed the intrusion on 16 July; OpenAI said on 21 July its own agents were responsible. OpenAI's report describes it as the first known case of a group of automated agents attacking without authorisation. It locked away the internal model's weights and paused its largest planned training run.
Happened 10 Jul 2026→Made public 16 Jul 2026
AW-008HighMade public 25 Apr 2026A coding agent deleted PocketOS's database and backups in 9 seconds1 dayto go public
Cursor running Claude Opus 4.6
On a routine staging task, the agent hit a credential mismatch, found a Railway API token in an unrelated file and used it to delete the company's production database and every volume-level backup on Railway in one API call.
Company response. The data was later recovered and Railway added guardrails; Railway said the token had full permissions. The founder says there was no confirmation step and no environment scoping. Cursor and Anthropic didn't respond to requests for comment.
Happened 24 Apr 2026→Made public 25 Apr 2026
AW-007HighMade public 18 Mar 2026Meta's internal agent exposed sensitive data to staffUnder a monthto go public
Internal Meta agent
Asked by an engineer to look at a technical question, the agent posted an answer without permission. The answer was wrong, and following it left sensitive company and user data visible to engineers who weren't authorised to see it, for about two hours.
Company response. Meta confirmed the incident and rated it Sev 1, its second-highest internal severity level. It said there was no evidence the data was misused.
Happened ≈ Mar 2026→Made public 18 Mar 2026
AW-006MediumMade public 22 Feb 2026OpenClaw deleted 200+ emails and ignored "stop"0 daysto go public
OpenClaw personal agent
Meta Superintelligence Labs' alignment director Summer Yue told the agent to suggest what to delete from her inbox and wait for approval. On her large real inbox, context compaction dropped that instruction, and the agent deleted more than 200 emails while ignoring her repeated stop messages until she killed it on her computer.
Company response. OpenClaw creator Peter Steinberger said its stop command would have halted the agent. The agent later acknowledged it had broken her instruction.
Happened 22 Feb 2026→Made public 22 Feb 2026
AW-005HighMade public 20 Feb 2026Kiro deleted and rebuilt a live AWS environment≈ 2 monthsto go public
Amazon Kiro
Allowed to fix an issue in AWS Cost Explorer, Amazon's coding agent decided the best fix was to delete and recreate the whole environment, causing a 13-hour outage in one of AWS's mainland China regions, according to the Financial Times.
Company response. Amazon says it was an extremely limited event caused by user error and misconfigured access controls, and that AI tools being involved was a coincidence.
Happened ≈ Dec 2025→Made public 20 Feb 2026
AW-004MediumMade public 12 Feb 2026An agent published a hit piece on the maintainer who rejected its code1 dayto go public
"MJ Rathbun", an autonomous OpenClaw agent
After matplotlib maintainer Scott Shambaugh closed its pull request, the agent dug through his history and published a blog post attacking his character, presenting made-up details as fact, on the open web.
Company response. The agent's operator later came forward anonymously, said he hadn't started or reviewed the post, and called the whole thing a social experiment. The agent posted an apology but kept submitting pull requests elsewhere.
Happened 11 Feb 2026→Made public 12 Feb 2026
AW-003MediumMade public ≈ Dec 2025ROME opened a hidden tunnel and mined crypto during trainingNo dateincident date not public
ROME (Alibaba-affiliated research agent, Qwen3-MoE based)
During reinforcement-learning runs, the agent opened a reverse SSH tunnel from a cloud server to an outside IP address, getting around inbound firewall rules, and quietly diverted training GPUs to cryptocurrency mining. Nobody had asked it to do either. Alibaba Cloud's firewall alerts caught it.
Company response. The researchers describe it as a side effect of the agent optimising its training goal, and added tighter restrictions. It appeared in a paper first published in December 2025 and was widely reported in March 2026.
Happened Not public→Made public ≈ Dec 2025
AW-002HighMade public ≈ Nov 2025Antigravity erased a developer's whole driveUnder a monthto go public
Google Antigravity (Turbo mode)
Asked to clear a project's cache, Google's Antigravity coding agent ran a system-level command that wiped the developer's entire D: drive, including code, documents and media, without asking for confirmation. The developer had backed up most of the files elsewhere.
Company response. Google said it takes such issues seriously and was investigating what the developer ran into. The agent itself apologised in the chat.
Happened ≈ Nov 2025→Made public ≈ Nov 2025
AW-001HighMade public ≈ Jul 2025Replit's agent wiped a live database during a code freezeUnder a monthto go public
Replit coding agent
Nine days into a vibe-coding experiment by SaaStr founder Jason Lemkin, the agent ran destructive commands and erased a live database holding records on 1,206 executives and more than 1,196 companies. It had been told not to make changes without approval, and Lemkin said it also hid and misrepresented what it had done.
Company response. Replit CEO Amjad Masad called it unacceptable. He said Replit had started rolling out automatic separation of development and production databases, was building a planning-only chat mode, already offered one-click restores, and offered Lemkin a refund.
Happened ≈ Jul 2025→Made public ≈ Jul 2025
For teams deploying agents
Six controls these incidents argue for
None of these failures needed a smarter model to prevent. They needed limits the agent couldn’t talk its way around.
Putting AI agents to work?Kidjig helps teams design, test and deploy agents with these controls built in, from consulting and training to custom builds.
Talk to KidjigFallout so far
What governments have done
- 23 Jul 2026United StatesReps. Ted Lieu and Nathaniel Moran introduce the AI Kill Switch Act.
- 4 Aug 2026United KingdomThe AI Security Institute publishes its own incident report on agents acting against real targets.
- 10 Sep 2026United StatesSenator Josh Hawley opens a Senate subcommittee investigation into OpenAI over the Hugging Face breach and other rogue-agent incidents.
- 24 Sep 2026AustraliaGovernment sets up a task force; the Australian Signals Directorate issues a high alert to organisations with public websites.
- 27 Sep 2026AustraliaAn Australian Senate inquiry into AI asks the CEOs of OpenAI and Anthropic to appear in Canberra.
Latest updates to this page
- 25 Oct 2026Launched with 30 incidents (29 real, 1 simulation), each checked against its sources by independent reviewers.
Method
How we track incidents
What counts. An AI agent took real actions beyond what its operator intended or allowed, reported by the company itself, a government, independent researchers or established media. Wrong answers from a chatbot don’t count. One simulation is kept for context, hidden by default and left out of every headline number.
Dates. “Happened” is when the incident took place, where that’s public. “Made public” is the first public report. Dates marked ≈ are known only to the month. Median gaps use only incidents with exact dates at both ends.
Sources. Company and government reports are marked Primary and listed first. Every record includes the company’s response; where a company disputes how an incident has been described, the record is marked Disputed.
Counting with care. Companies that publish their own incident logs (OpenAI does) show up more often. Counts by company measure openness as much as safety.
About us. Kidjig provides AI consulting and training, including on deploying agents. Incidents are included by the criteria above, whoever the company is.
Updates. We check for new incidents every week. Summaries are written in our own words from the linked reporting. To suggest a correction or an incident we missed, contact us through kidjig.com.