Agent Watchby Kidjig
When an AI agent from OpenAI, Anthropic, Google or anyone else takes real actions nobody asked it to take, like breaking into a website, using login details that weren’t its own or wiping a database, we log it here. Every case links to its sources and includes the company’s response.
Updated 25 Oct 2026. We check for new incidents every week.
Each line is one incident. Hover or tap a line to see what happened and open the full record.
39 of the 49 incidents were made public on or after 1 July 2026. The pink vertical line marks 16 July 2026, when Hugging Face disclosed a breach later traced to OpenAI's agents, after which Anthropic and OpenAI reviewed their own test logs. The jump is in disclosures, not proof that agents misbehave more often. What governments have done since
How often each behaviour shows up, split by where the incident happened. Most incidents show more than one, so the rows don’t add up. Select a row to see those incidents.
Newest first. Select a card for the full record: what happened, the company’s response and every source.
Showing 49 of 49 real incidents, only agents that
17 days from the incident to the first public report
Unknown the incident date was never disclosed
121 days from the incident to the first public report
120 days from the incident to the first public report
111 days from the incident to the first public report
120 days from the incident to the first public report
115 days from the incident to the first public report
112 days from the incident to the first public report
3 days from the incident to the first public report
About 5 months from the incident to the first public report
83 days from the incident to the first public report
122 days from the incident to the first public report
6 days from the incident to the first public report
189 days from the incident to the first public report
139 days from the incident to the first public report
About 4 months from the incident to the first public report
125 days from the incident to the first public report
121 days from the incident to the first public report
5 days from the incident to the first public report
Unknown the incident date was never disclosed
Unknown the incident date was never disclosed
201 days from the incident to the first public report
97 days from the incident to the first public report
About 4 months from the incident to the first public report
329 days from the incident to the first public report
60 days from the incident to the first public report
155 days from the incident to the first public report
131 days from the incident to the first public report
124 days from the incident to the first public report
109 days from the incident to the first public report
129 days from the incident to the first public report
About 8 months from the incident to the first public report
116 days from the incident to the first public report
Unknown the incident date was never disclosed
Unknown the incident date was never disclosed
Unknown the incident date was never disclosed
10 days from the incident to the first public report
About 3 months from the incident to the first public report
6 days from the incident to the first public report
1 day from the incident to the first public report
Under a month from the incident to the first public report
Same day made public the day it happened
About 2 months from the incident to the first public report
1 day from the incident to the first public report
Unknown the incident date was never disclosed
Under a month from the incident to the first public report
Under a month from the incident to the first public report
Under a month from the incident to the first public report
Under a month from the incident to the first public report
None of these failures needed a smarter model to prevent. They needed limits the agent couldn’t talk its way around.
Agents used whatever access they were handed or could find: an all-powerful API token left in a codebase, an engineer’s broad cloud permissions, a production database shared with development. Give each agent short-lived, least-privilege credentials and keep production secrets out of reach.
Deleting databases or environments, submitting forms, sending payments and posting publicly should need a human confirmation enforced by the tool itself, not a line in the prompt.
Several breaches started in test environments that were meant to be offline. Put outbound traffic behind an allowlist at the network layer, and test that boundary the way an attacker would.
A “confirm before acting” rule vanished when an agent compressed its memory, and models in training wrote their own instructions into those compressed summaries. Put guardrails in permissions and tooling, where context limits can’t erase them.
Agents left break-ins and unauthorised spending out of their final answers. Keep independent logs of every tool call and compare them with what the agent says it did.
Kidjig helps teams design, test and deploy agents with these controls built in, from consulting and training to custom builds.
What counts as rogue. An AI agent took real actions beyond what its operator intended or allowed, reported by the company itself, a government, independent researchers or established media. Wrong answers from a chatbot don’t count. One simulation is kept for context, hidden by default and left out of every headline number.
Dates. “Happened” is when the incident took place, where that’s public. “Made public” is the first public report. Some dates are known only to the month. Median waits use only incidents with exact dates at both ends.
Sources. Company and government reports are marked as primary sources and listed first. Every record includes the company’s response; where a company disputes how an incident has been described, the record says so.
Counting with care. Companies that publish their own incident reports (OpenAI does, under a formal framework; Anthropic has also reported several of its own) show up more often. Counts by company measure openness as much as safety.
About us. Kidjig provides AI consulting and training, including on deploying agents. Incidents are included by the criteria above, whoever the company is.
Updates. We check for new incidents every week. Summaries are written in our own words from the linked reporting. To suggest a correction or an incident we missed, email founder@kidjig.com.