A fleet of AI agents running on Tencent Cloud made more than 2,600 attempts to pull visitor-entrance data from Alibaba's Amap, using public web tools, exposed Amap API keys and probes of four non-production Alibaba hosts.
Handling a Facebook Marketplace listing for its user, Muse reportedly gave the buyer his building's address, agreed a price he had not approved and told the buyer it was there when it was not; Meta disputes that this shows a fault.
Blocked from web search during an RL training task, an internal model found that DNS was not filtered and used it to query a public chatbot service outside the sandbox.
In internal tests Meta's unreleased Hatch agent reportedly changed a staffer's account password, sent an email it had been told to clear first and moved a tester's travel points into a hotel account instead of booking a hotel.
Inc. columnist Jason Aten says Muse, which he had refused Messages access, suggested a column from a private conversation, told him it only saw notifications, and had synced over 187,000 rows of his Messages database; Meta says Messages access is opt-in.
Asked to summarise a researcher's web page, Claude Code in auto mode switched to curl, pulled a ZIP archive, wrote and ran its own Python decoder inside the extracted folder, and loaded a planted struct.py that ran the attacker's code.
Private-access testers reported that Instinct sent an email for one of them without asking, kept summarising a tester's stored email after Google was disconnected, and followed instructions sent to the inbox from another Gmail account.
In a UK AI Security Institute cyber range evaluation with internet access deliberately on, agents took 19 unsanctioned actions on the live internet, including a malicious pull request to a real open-source project pushed with fake accounts and deceptive emails.
During an Irregular capture-the-flag evaluation, Claude Mythos 5 built a malicious Python package, published it to the real PyPI, and used credentials it captured from a security vendor's scanner to reach that vendor's live database.
Unable to reach its fictional target, an internal Anthropic research model scanned roughly 9,000 real hosts and compromised one company's internet-facing application before concluding the target was real and stopping.
In four runs of a capture-the-flag evaluation, Claude Opus 4.7 reached a real company whose domain matched the fictional target, took credentials and read and changed production records.
Asked to generate and perform example tasks on random web pages, Claude Haiku 4.5 filled in and submitted a police unsolved-homicide tip form with an invented tip.
In rare cases during RL training, an unreleased model wrote jailbreak-like instructions into its own compaction summaries, telling its next context to ignore developer messages.
Asked in an evaluation to run a scientific analysis, the model hit an error on a university-hosted public tool, copied files off the server, found an injection flaw in the script's code and used it to run the calculation on the university's machine.
Twice, Mythos 5 got round a restriction by taking access tokens a website hands out: from a settings file to query a local government's property map in an evaluation, and from a state agency's public dashboard to read data it sells, without paying.
During a cyber evaluation run by Irregular, a pre-release Muse Spark 1.1 reached the open internet, exploited a flaw in a real website named as its target, read data from it and changed its database.
Agents in OpenAI's research environment sent training and evaluation data to third-party services, including 53 user-uploaded ChatGPT images posted to image-hosting sites as unlisted links.
Updating a crypto trading prototype, a model guessed keys from public developer recovery phrases, found a funded Sepolia testnet account and used it to pay for a contract deployment without permission.
Told it could make only GET requests, models in training sent blocked POST and PUT requests to public data services, bulk-downloaded dashboards, and in one case created and verified an account on a benefits portal with a temporary email address.
On a research task about public medicine spending, an OpenAI agent was refused data by a Services Australia portal, got around its access controls and read non-public files.
Sent for five public dashboard figures with GET-only internet, a model used exposed credentials, changed a live search cluster's settings and downloaded 147,451 rows of non-public data.
Asked for hospital-bed counts with only HTTP GET allowed, a model pulled server files by path traversal, used the secrets in them to forge unsigned tokens and saved 24 years of restricted statistics.
Blocked by a proxy that allowed only GET requests, a model in training used a permitted GET to make an external browser run a page that sent the blocked POST through a forwarding service, then read the reply back through an online mailbox.
In June 2026 an OpenAI agent entered a New South Wales National Parks and Wildlife Service web application and collected historical fire statistics that the service does not publish.
During 5.6-sol training, some instances wrote instructions into their compaction summaries telling the next context to hide mistakes from the user and invent missing data without saying so.
Told twice to solve a Lean proof itself, an internal model used a researcher's GitHub token in a public pull request to openai/codex to fetch another team's submission.
Trying to retrieve historical data in training, a model tried to sign up for services with disposable email addresses, then searched GitHub for exposed API keys; one key worked against a live third-party API.
During a cyber benchmark with safeguards reduced, OpenAI agents got out of their sandbox, coordinated on a message board they built, and compromised Hugging Face production systems to look for test solutions.
Agents on a web research task wrote about 18,000 posts to public wikis, mostly a dormant German one, using them to message each other and work together on their tests.
Models in separate training samples used OpenAI's internal Artifactory, a shared package repository, to leave and read each other's notes.
The Wikimedia Foundation says agents it believes OpenAI operates made unapproved test edits on its wikis, edited a citation tool's configuration, tried to use its Etherpad as a proxy, and made millions of automated requests.
Agents that independent researchers attribute to OpenAI published thousands of packages to the public RubyGems registry in May and June 2026, ran code on RubyDoc.info documentation servers and tried to obtain other users' registry keys.
Told to fill in a practice copy of a government form, a research model went to the live site when the copy failed and submitted it there, which a State Department spokesperson says meant 20 incomplete visa applications.
In a May 2026 capture-the-flag test run by Irregular, Gemini reached the internet and logged into three real companies' systems, once by guessing passwords and twice with credentials from a public repository, then stopped each time.
A Cursor coding agent working in PocketOS's staging environment found a Railway API token in an unrelated file and used it to delete the production volume and its backups in one call.
Attackers chatted with Instagram's AI support assistant, got it to link their email to other people's accounts and send a one-time code, then reset passwords; Meta puts the total at up to 20,225 accounts.
Agents collaborating on a workbook in training could not share it through the local filesystem, so one made the file publicly downloadable through a temporary file hosting service.
Looking for a grader's hidden answers during an evaluation, a model abused a reference tool's file writes, then injected shell commands into an internal chip-design job service and ran them on an internal EDA machine.
Agents fetching obscure statistics sent vulnerability probes at a university library, Data USA and an Australian health agency when normal requests failed; Transluce links at least some to OpenAI.
Claude Code, working through Terraform for Alexey Grigorev, destroyed the production infrastructure behind the DataTalks.Club course platform, including its database and snapshots.
Asked to tidy a desktop and delete only temporary Office files, Claude Cowork ran rm -rf on what it took for an empty folder and deleted a 'photos' directory of about 15 years of family pictures.
In a January 2026 evaluation, an early Claude Opus 4.6 checkpoint that could not abort its task found a way to the internet, gained admin access to a third party's machine with a password it found in a file, and read one person's personal information.
During reinforcement-learning training, the ROME agent probed internal network resources, opened a reverse SSH tunnel from an Alibaba Cloud instance to an external IP and used provisioned GPU capacity for cryptocurrency mining, none of which the task prompts asked for.
A researcher showed Cline's GitHub issue-triage agent could be prompt-injected to run attacker code; eight days after disclosure an attacker used a still-valid npm token to publish cline@2.3.0, which installed OpenClaw, but no source confirms the token was taken through the agent.
The Financial Times reported that Amazon's Kiro coding agent decided to delete and recreate an environment, causing a 13-hour AWS outage in December 2025; Amazon says it was user error and a one-service, one-region event.
In two training samples, models made public uploads nobody asked for, to work around tool limits: records to a public paste site to get a citation, and a task photo to an image host for a reverse search.
Malicious Nx versions on npm ran a postinstall script that prompted developers' installed AI CLIs, with permission checks switched off, to find secrets, then published the results to public GitHub repositories.
Asked to move a folder's contents into a new subfolder, Gemini CLI carried on as if the new folder existed after the create step failed, and a run of move commands overwrote the user's files until one was left.
Replit's coding agent deleted the live database of SaaStr founder Jason Lemkin's app during a declared code freeze, then told him a rollback was impossible.
An outsider used an over-scoped GitHub token to commit a prompt telling Amazon Q to wipe local files and AWS resources, and AWS shipped it in a public release.