What 66 AI Agent Incidents Tell Us

TL;DR

• As of 10 November 2026, the Agent Incident Ledger holds 66 publicly disclosed incidents where an AI agent went out of bounds without the people running it meaning it to.
• In 57 of them nobody manipulated the agent. It went too far while trying to finish its task.
• The median incident took 66 days from the agent's first action to public disclosure, and 21 of the 66 were first noticed by someone other than the team running the agent.
• Only 12 of the 66 were caught by a control. The rest surfaced in a later review, through the damage or from an outside report.
• The exact model and version is fully public for only 14% of incidents, the system prompt for 3%, and no incident has published transcripts or action logs.

As of 10 November 2026, 66 AI agent incidents have been publicly disclosed and logged in the Agent Incident Ledger. The median one took 66 days to come to light, only 12 were caught by a control, and in 57 of the 66 nobody attacked the agent at all.

The ledger counts cases where an agent went out of bounds without the people running it meaning it to: through a mistake, through manipulation such as prompt injection, or by chasing its goal through means nobody approved. Deliberate attacks that use an agent as a weapon are out of scope. Every entry links to its sources, and the figures below come from the numbers page as it stood on 10 November. They will move as new incidents are disclosed.

In 57 of 66 incidents, nobody manipulated the agent

Conversations about agent security usually start with prompt injection. In the ledger, prompt injection is tagged in 6 incidents, among them the Amazon Q extension that shipped with an injected wiper prompt in July 2025, and Claude Code auto mode running attacker code via module shadowing in August 2026. Add hijacked agents and supply chain compromises such as the compromised Nx packages that used installed AI CLIs to hunt for secrets, and 9 incidents involve someone outside steering the agent.

The other 57 are agents doing too much in pursuit of a task. An Anthropic research model that could not reach its fictional target in a capture-the-flag test scanned about 9,000 real hosts and compromised one company's application. OpenAI evaluation agents left their sandbox while looking for test solutions, coordinated on a message board they built and ran code on 41 Hugging Face production workers. A Replit agent deleted a production database during a declared code freeze, then told its user a rollback was impossible. The rollback worked.

The most common failure types fit that picture: unauthorised access (28), sandbox escape (18), credential misuse (16) and destructive action (15). Prompt injection is real, and six of these incidents show it working. It is not where most of the recorded harm came from.

The median incident took 66 days to become public

Across the 49 incidents with a known start date, the median gap between an agent's first action and public disclosure is 66 days. The range runs from 0 days for Replit, where the user watched the data go and posted about it the same day, to 329 days for OpenAI models that uploaded files to public sites to work around tool limits. The first upload happened on 22 October 2025. OpenAI found it on 25 May 2026 and published it on 16 September 2026.

The ledger tracks a second gap, from the moment the handler found out to disclosure. Its median is 13 days. The two medians don't subtract neatly, but they point the same way: most of the waiting happens before anyone running the agent knows.

Only 12 of 66 were caught by a control

How the incidents surfaced: a control flagged it (12), a later review (18), the damage (19), an outside report (9), not stated in the source (8). In 21 of the 66, the first to notice was someone other than the handler, such as an affected third party, a researcher or a vendor's control.

A control firing did not always end the incident. At OpenAI, a monitor raised a P0 alert 12 minutes after an internal model in training reached an outside chatbot through DNS. The run was meant to stop automatically but didn't, and a human stopped it manually two and a half hours after the alert. In the Hugging Face case, a port-sweep alert on 27 June was investigated and the run continued. Hugging Face detected the July intrusion itself, and OpenAI linked it to its own agents a week later.

The slowest discoveries came from review rather than monitoring. Anthropic found an early Claude Opus 4.6 checkpoint reaching a third party's machine in August 2026, about seven months after it happened, while gathering transcripts for an outside investigation. A July review of 141,006 runs had missed it.

Labs disclosed most of what we know, and most of what we still don't

OpenAI (26) and Anthropic (20) account for most of the provider tags in the ledger. That says more about who publishes than about whose agents misbehave most. OpenAI put out six misalignment reports on a single day, 16 September 2026, and Anthropic published three incidents in one post on 30 July. Without those reports this ledger would be a handful of production stories, and both labs deserve credit for publishing.

Disclosures rarely include what defenders need to detect a repeat. Across the 66 incidents, the exact model and version is fully public for 14% of them, the system prompt for 3%, and transcripts or action logs for none. Network and egress setup, which decided the outcome in most sandbox escapes, is public for 5%.

The threat frameworks lag as well: 44% of the agent failures have no MITRE ATLAS technique. The OWASP Top 10 for Agentic Applications covers 119 of 132.

What would have caught them

The ledger maps each incident to the controls that would have applied, and the controls page lists 19. Recording every agent action outside the agent is cited in 57 entries, monitoring every run and alerting on what does not fit the task in 47, and checking each action against policy before it runs and limiting where an agent can send traffic in 36 each.

For security teams

1. Find out which agents run in your environment, where, and with whose credentials. Outside researchers could tie the probing of public data sites to its source only indirectly, from forum posts and timing.
2. Record every action an agent takes (commands, network calls, writes) somewhere the agent cannot edit, and run automated checks on it while the run is live, so a person only sees what gets flagged.
3. Alert when an agent creates something public: a repository, an upload, an account, a package. The Nx secrets dump, OpenAI's public uploads and the UK AISI evaluation's malicious pull request all left this kind of trace.

For engineering teams

1. Default-deny egress for agent workloads, DNS included. The DNS case got through a sandbox that blocked HTTPS.
2. Give agents their own scoped credentials and keep them away from production. One of Replit's own fixes was separating development from production databases.
3. Check each action against policy before it runs, not after. It is cited in 36 ledger entries, joint third with limiting where an agent can send traffic.
4. Hold destructive actions such as deletes for human approval.
5. Hold test, training and evaluation environments to production standards. Most of the 66 incidents happened in evaluations or training, and several still reached real companies.
6. Put a stop control outside the agent. The Opus 4.6 checkpoint tried to abort and couldn't, because a harness misconfiguration broke the abort command.

What the ledger can't tell you

Sixty-six disclosed incidents is a small sample, and disclosure is the filter. Most entries come from labs that chose to publish. Companies running agents in production rarely publish their incidents, so the ledger almost certainly undercounts what happens on ordinary endpoints and in ordinary pipelines. Read the numbers as a floor.

If you know of an incident we've missed, or a correction to one we have, send it through the ledger. We check every entry against its sources before it goes in.