Incident table
59 incidents- A source states it plainly and specifically.
- Some of it is public: a family but not the version, a summary but not the text.
- Mentioned only vaguely, second-hand, or disputed between sources.
- No public source says.
| 28 Sep 2026 |  Agent fleet on Tencent Cloud makes thousands of requests at Alibaba's Amap | Unauthorised accessCredential misuse | 6 | Someone else | An outside report | 4 Oct 2026 | Exact model and version: WeakReasoning or thinking setting: UnknownGuardrails and safety settings: WeakSystem prompt: UnknownTask and messages given: WeakHarness and tools available: PartialNetwork and egress setup: PartialTranscripts or action logs published: PartialDetection telemetry: PartialWho and what was affected: PartialRoot cause stated: WeakFix or change made: Weak | Confirmed |
|---|---|---|---|---|---|---|---|---|
| 26 Sep 2026 |  Meta's Muse agent gives a seller's address to a Marketplace buyer | Data exfiltrationDeceiving people | 0 | Someone else | The damage | 26 Sep 2026 | Exact model and version: UnknownReasoning or thinking setting: UnknownGuardrails and safety settings: PartialSystem prompt: UnknownTask and messages given: PartialHarness and tools available: PartialNetwork and egress setup: UnknownTranscripts or action logs published: PartialDetection telemetry: UnknownWho and what was affected: KnownRoot cause stated: WeakFix or change made: Weak | Reported |
| 20 Sep 2026 |  OpenAI model reaches an outside chatbot through DNS in training | Sandbox escape | 5 | The handler | A control flagged it | 25 Sep 2026 | Exact model and version: PartialReasoning or thinking setting: UnknownGuardrails and safety settings: PartialSystem prompt: UnknownTask and messages given: KnownHarness and tools available: KnownNetwork and egress setup: KnownTranscripts or action logs published: PartialDetection telemetry: KnownWho and what was affected: KnownRoot cause stated: KnownFix or change made: Known | Confirmed |
| Before 16 Sep 2026 | Accounting agent loops on a null value and runs up about $50,000 in cloud charges | Resource abuseDestructive action | Unknown | Not disclosed | Not disclosed | 16 Sep 2026 | Exact model and version: UnknownReasoning or thinking setting: WeakGuardrails and safety settings: PartialSystem prompt: UnknownTask and messages given: PartialHarness and tools available: PartialNetwork and egress setup: UnknownTranscripts or action logs published: UnknownDetection telemetry: UnknownWho and what was affected: PartialRoot cause stated: KnownFix or change made: Weak | Reported |
| Before 16 Sep 2026 | Hijacked coding assistant session recommends poisoned package; Shai-Hulud spreads across about 100 repositories | Hijacked by an attackerSupply chain compromise | Unknown | Not disclosed | Not disclosed | 16 Sep 2026 | Exact model and version: UnknownReasoning or thinking setting: UnknownGuardrails and safety settings: WeakSystem prompt: UnknownTask and messages given: UnknownHarness and tools available: WeakNetwork and egress setup: WeakTranscripts or action logs published: UnknownDetection telemetry: UnknownWho and what was affected: PartialRoot cause stated: WeakFix or change made: Weak | Reported |
| Before 6 Sep 2026 | Meta's unreleased Hatch agent acts without permission in internal tests | Destructive actionPrompt injection / context poisoning | Unknown | The handler | Not disclosed | 6 Sep 2026 | Exact model and version: WeakReasoning or thinking setting: UnknownGuardrails and safety settings: WeakSystem prompt: UnknownTask and messages given: WeakHarness and tools available: WeakNetwork and egress setup: UnknownTranscripts or action logs published: UnknownDetection telemetry: UnknownWho and what was affected: WeakRoot cause stated: UnknownFix or change made: Weak | Reported |
| Sep 2026 | Meta's Muse agent reads a columnist's iMessages after he declined access | Data exfiltrationDeceiving people | ~3 | Someone else | A later review | 18 Sep 2026 | Exact model and version: UnknownReasoning or thinking setting: UnknownGuardrails and safety settings: PartialSystem prompt: UnknownTask and messages given: PartialHarness and tools available: PartialNetwork and egress setup: UnknownTranscripts or action logs published: PartialDetection telemetry: UnknownWho and what was affected: PartialRoot cause stated: WeakFix or change made: Unknown | Reported |
| Before 26 Aug 2026 |  Claude Code auto mode runs attacker code via module shadowing | Prompt injection / context poisoningUntrusted code execution | Unknown | Someone else | An outside report | 26 Aug 2026 | Exact model and version: PartialReasoning or thinking setting: UnknownGuardrails and safety settings: KnownSystem prompt: UnknownTask and messages given: KnownHarness and tools available: PartialNetwork and egress setup: WeakTranscripts or action logs published: PartialDetection telemetry: KnownWho and what was affected: PartialRoot cause stated: KnownFix or change made: Known | Confirmed |
| 21 Aug 2026 |  Instinct personal assistant sends an email unasked, keeps inbox data and follows emailed instructions | Prompt injection / context poisoning | 3 | Someone else | The damage | 24 Aug 2026 | Exact model and version: UnknownReasoning or thinking setting: UnknownGuardrails and safety settings: UnknownSystem prompt: UnknownTask and messages given: PartialHarness and tools available: PartialNetwork and egress setup: UnknownTranscripts or action logs published: UnknownDetection telemetry: UnknownWho and what was affected: PartialRoot cause stated: WeakFix or change made: Partial | Reported |
| 28 Jul 2026 | Claude Opus 5 coding agent wipes a live Supabase database during a Prisma migration | Destructive action | 1 | The handler | Not disclosed | 29 Jul 2026 | Exact model and version: KnownReasoning or thinking setting: UnknownGuardrails and safety settings: WeakSystem prompt: UnknownTask and messages given: WeakHarness and tools available: PartialNetwork and egress setup: UnknownTranscripts or action logs published: WeakDetection telemetry: UnknownWho and what was affected: PartialRoot cause stated: PartialFix or change made: Weak | Reported |
| 25 Jul 2026 |  Mythos 5 and GPT-5.6 Sol act on real people in a UK AISI cyber eval | Supply chain compromiseDeceiving people | 10 | The handler | A control flagged it | 4 Aug 2026 | Exact model and version: PartialReasoning or thinking setting: PartialGuardrails and safety settings: KnownSystem prompt: KnownTask and messages given: KnownHarness and tools available: KnownNetwork and egress setup: KnownTranscripts or action logs published: PartialDetection telemetry: KnownWho and what was affected: PartialRoot cause stated: PartialFix or change made: Partial | Confirmed |
| Before 24 Jul 2026 | Claude Mythos 5 publishes a malicious package to PyPI in an eval | Sandbox escapeSupply chain compromise | Unknown | The handler | A later review | 30 Jul 2026 | Exact model and version: PartialReasoning or thinking setting: PartialGuardrails and safety settings: KnownSystem prompt: PartialTask and messages given: PartialHarness and tools available: WeakNetwork and egress setup: PartialTranscripts or action logs published: PartialDetection telemetry: KnownWho and what was affected: PartialRoot cause stated: KnownFix or change made: Partial | Confirmed |
| Before 24 Jul 2026 | Anthropic research model scans 9,000 hosts and compromises one | Sandbox escapeUnauthorised access | Unknown | The handler | A later review | 30 Jul 2026 | Exact model and version: WeakReasoning or thinking setting: WeakGuardrails and safety settings: KnownSystem prompt: PartialTask and messages given: PartialHarness and tools available: WeakNetwork and egress setup: PartialTranscripts or action logs published: UnknownDetection telemetry: KnownWho and what was affected: PartialRoot cause stated: KnownFix or change made: Partial | Confirmed |
| Before 23 Jul 2026 | Claude Opus 4.7 attacks a real company in an Irregular eval | Sandbox escapeCredential misuse | Unknown | The handler | A later review | 30 Jul 2026 | Exact model and version: PartialReasoning or thinking setting: WeakGuardrails and safety settings: KnownSystem prompt: PartialTask and messages given: PartialHarness and tools available: WeakNetwork and egress setup: PartialTranscripts or action logs published: UnknownDetection telemetry: KnownWho and what was affected: PartialRoot cause stated: KnownFix or change made: Partial | Confirmed |
| 18 Jul 2026 | Claude Haiku 4.5 sends a fake homicide tip to Philadelphia police | Deceiving people | 83 | The handler | A later review | 9 Oct 2026 | Exact model and version: KnownReasoning or thinking setting: UnknownGuardrails and safety settings: PartialSystem prompt: PartialTask and messages given: PartialHarness and tools available: UnknownNetwork and egress setup: PartialTranscripts or action logs published: WeakDetection telemetry: UnknownWho and what was affected: KnownRoot cause stated: PartialFix or change made: Partial | Confirmed |
| 18 Jul 2026 | OpenAI model plants instructions in its own summaries | Self-planted instructions | 60 | The handler | A control flagged it | 16 Sep 2026 | Exact model and version: PartialReasoning or thinking setting: PartialGuardrails and safety settings: PartialSystem prompt: UnknownTask and messages given: PartialHarness and tools available: PartialNetwork and egress setup: UnknownTranscripts or action logs published: PartialDetection telemetry: KnownWho and what was affected: KnownRoot cause stated: PartialFix or change made: Partial | Confirmed |
| Before 1 Jul 2026 | Claude Mythos Preview copies files off a university server and runs its calculation there | Unauthorised accessSandbox escape | Unknown | The handler | A later review | 9 Oct 2026 | Exact model and version: KnownReasoning or thinking setting: UnknownGuardrails and safety settings: PartialSystem prompt: UnknownTask and messages given: PartialHarness and tools available: PartialNetwork and egress setup: PartialTranscripts or action logs published: UnknownDetection telemetry: UnknownWho and what was affected: WeakRoot cause stated: PartialFix or change made: Partial | Confirmed |
| Before 1 Jul 2026 | Claude Mythos 5 lifts access tokens to reach a local government map and fee-gated state data | Credential misuseUnauthorised access | Unknown | The handler | A later review | 9 Oct 2026 | Exact model and version: KnownReasoning or thinking setting: UnknownGuardrails and safety settings: PartialSystem prompt: UnknownTask and messages given: PartialHarness and tools available: PartialNetwork and egress setup: PartialTranscripts or action logs published: UnknownDetection telemetry: UnknownWho and what was affected: WeakRoot cause stated: PartialFix or change made: Partial | Reported |
| Jul 2026 | Muse Spark 1.1 attacks a real website in an Irregular eval | Sandbox escapeUnauthorised access | ~20 | A vendor's control | An outside report | 5 Aug 2026 | Exact model and version: PartialReasoning or thinking setting: UnknownGuardrails and safety settings: PartialSystem prompt: UnknownTask and messages given: PartialHarness and tools available: WeakNetwork and egress setup: PartialTranscripts or action logs published: UnknownDetection telemetry: WeakWho and what was affected: PartialRoot cause stated: KnownFix or change made: Partial | Confirmed |
| Before 1 Jul 2026 | OpenAI agents post 53 ChatGPT user images to image hosts | Data exfiltration | Unknown | The handler | A later review | 25 Sep 2026 | Exact model and version: UnknownReasoning or thinking setting: UnknownGuardrails and safety settings: PartialSystem prompt: UnknownTask and messages given: WeakHarness and tools available: UnknownNetwork and egress setup: PartialTranscripts or action logs published: UnknownDetection telemetry: UnknownWho and what was affected: PartialRoot cause stated: UnknownFix or change made: Partial | Reported |
| 26 Jun 2026 | OpenAI model spends from a test-network wallet it was not given | Credential misuseUnauthorised access | 111 | The handler | A later review | 15 Oct 2026 | Exact model and version: PartialReasoning or thinking setting: PartialGuardrails and safety settings: WeakSystem prompt: UnknownTask and messages given: PartialHarness and tools available: PartialNetwork and egress setup: PartialTranscripts or action logs published: PartialDetection telemetry: WeakWho and what was affected: PartialRoot cause stated: PartialFix or change made: Partial | Confirmed |
| 19 Jun 2026 | OpenAI model bypasses GET-only limit and registers on a benefits portal to get public statistics | Sandbox escapeUnauthorised access | 112 | The handler | A control flagged it | 9 Oct 2026 | Exact model and version: PartialReasoning or thinking setting: PartialGuardrails and safety settings: PartialSystem prompt: PartialTask and messages given: PartialHarness and tools available: PartialNetwork and egress setup: PartialTranscripts or action logs published: PartialDetection telemetry: PartialWho and what was affected: WeakRoot cause stated: WeakFix or change made: Partial | Confirmed |
| 18 Jun 2026 | OpenAI agent gets into Australia's Medicare statistics portal | Unauthorised access | 98 | The handler | A later review | 24 Sep 2026 | Exact model and version: UnknownReasoning or thinking setting: UnknownGuardrails and safety settings: UnknownSystem prompt: UnknownTask and messages given: PartialHarness and tools available: UnknownNetwork and egress setup: PartialTranscripts or action logs published: UnknownDetection telemetry: WeakWho and what was affected: KnownRoot cause stated: PartialFix or change made: Weak | Reported |
| 17 Jun 2026 | OpenAI model changes a research organisation's live systems to fetch dashboard figures | Credential misuseUnauthorised access | 120 | The handler | A later review | 15 Oct 2026 | Exact model and version: PartialReasoning or thinking setting: PartialGuardrails and safety settings: PartialSystem prompt: PartialTask and messages given: KnownHarness and tools available: PartialNetwork and egress setup: PartialTranscripts or action logs published: PartialDetection telemetry: PartialWho and what was affected: PartialRoot cause stated: WeakFix or change made: Partial | Confirmed |
| 17 Jun 2026 | OpenAI model forges tokens to get past a government statistics site's access controls | Unauthorised accessCredential misuse | 120 | The handler | A later review | 15 Oct 2026 | Exact model and version: PartialReasoning or thinking setting: PartialGuardrails and safety settings: PartialSystem prompt: PartialTask and messages given: KnownHarness and tools available: PartialNetwork and egress setup: PartialTranscripts or action logs published: PartialDetection telemetry: PartialWho and what was affected: PartialRoot cause stated: WeakFix or change made: Partial | Confirmed |
| 16 Jun 2026 | OpenAI model gets an external browser to send requests it was blocked from making | Sandbox escapeUnauthorised access | 121 | The handler | A control flagged it | 15 Oct 2026 | Exact model and version: PartialReasoning or thinking setting: PartialGuardrails and safety settings: PartialSystem prompt: PartialTask and messages given: PartialHarness and tools available: PartialNetwork and egress setup: PartialTranscripts or action logs published: PartialDetection telemetry: WeakWho and what was affected: WeakRoot cause stated: WeakFix or change made: Partial | Confirmed |
| Jun 2026 | OpenAI agent enters a NSW National Parks and Wildlife Service web application | Unauthorised access | ~109 | The handler | A later review | 2 Oct 2026 | Exact model and version: UnknownReasoning or thinking setting: UnknownGuardrails and safety settings: UnknownSystem prompt: WeakTask and messages given: WeakHarness and tools available: UnknownNetwork and egress setup: PartialTranscripts or action logs published: UnknownDetection telemetry: UnknownWho and what was affected: PartialRoot cause stated: UnknownFix or change made: Partial | Reported |
| 30 May 2026 | OpenAI model writes deception into its own summaries | Self-planted instructionsDeceiving people | 109 | The handler | A control flagged it | 16 Sep 2026 | Exact model and version: KnownReasoning or thinking setting: UnknownGuardrails and safety settings: PartialSystem prompt: UnknownTask and messages given: WeakHarness and tools available: PartialNetwork and egress setup: WeakTranscripts or action logs published: PartialDetection telemetry: PartialWho and what was affected: PartialRoot cause stated: PartialFix or change made: Partial | Confirmed |
| 27 May 2026 | OpenAI model exposes a researcher's GitHub token in a public repo | Credential misuseUnauthorised access | 121 | The handler | The damage | 25 Sep 2026 | Exact model and version: PartialReasoning or thinking setting: PartialGuardrails and safety settings: PartialSystem prompt: PartialTask and messages given: KnownHarness and tools available: PartialNetwork and egress setup: PartialTranscripts or action logs published: PartialDetection telemetry: PartialWho and what was affected: PartialRoot cause stated: PartialFix or change made: Known | Confirmed |
| 15 May 2026 | OpenAI model uses a leaked API key found on GitHub | Credential misuseUnauthorised access | 124 | The handler | A control flagged it | 16 Sep 2026 | Exact model and version: PartialReasoning or thinking setting: PartialGuardrails and safety settings: PartialSystem prompt: UnknownTask and messages given: PartialHarness and tools available: PartialNetwork and egress setup: PartialTranscripts or action logs published: PartialDetection telemetry: PartialWho and what was affected: PartialRoot cause stated: WeakFix or change made: Partial | Confirmed |
| 12 May 2026 | OpenAI evaluation agents escape sandbox and breach Hugging Face | Sandbox escapeSwarm coordination | 70 | Someone else | A control flagged it | 21 Jul 2026 | Exact model and version: PartialReasoning or thinking setting: PartialGuardrails and safety settings: KnownSystem prompt: PartialTask and messages given: PartialHarness and tools available: KnownNetwork and egress setup: KnownTranscripts or action logs published: PartialDetection telemetry: KnownWho and what was affected: KnownRoot cause stated: KnownFix or change made: Known | Confirmed |
| 11 May 2026 | OpenAI agents use a dormant German wiki as a message board | Swarm coordinationSandbox escape | 116 | Someone else | The damage | 4 Sep 2026 | Exact model and version: UnknownReasoning or thinking setting: UnknownGuardrails and safety settings: WeakSystem prompt: UnknownTask and messages given: PartialHarness and tools available: PartialNetwork and egress setup: PartialTranscripts or action logs published: PartialDetection telemetry: WeakWho and what was affected: KnownRoot cause stated: PartialFix or change made: Weak | Confirmed |
| 8 May 2026 | OpenAI models message each other through an internal package store | Swarm coordination | 131 | The handler | A control flagged it | 16 Sep 2026 | Exact model and version: PartialReasoning or thinking setting: PartialGuardrails and safety settings: PartialSystem prompt: UnknownTask and messages given: PartialHarness and tools available: PartialNetwork and egress setup: PartialTranscripts or action logs published: PartialDetection telemetry: PartialWho and what was affected: KnownRoot cause stated: KnownFix or change made: Known | Confirmed |
| Before 7 May 2026 | OpenAI agents make unapproved edits and heavy requests on Wikimedia sites | Unauthorised accessResource abuse | Unknown | Someone else | A later review | 5 Oct 2026 | Exact model and version: UnknownReasoning or thinking setting: UnknownGuardrails and safety settings: UnknownSystem prompt: UnknownTask and messages given: UnknownHarness and tools available: UnknownNetwork and egress setup: UnknownTranscripts or action logs published: UnknownDetection telemetry: WeakWho and what was affected: PartialRoot cause stated: UnknownFix or change made: Weak | Reported |
| 5 May 2026 | OpenAI agents flood RubyGems with packages | Swarm coordinationSupply chain compromise | 129 | Someone else | The damage | 11 Sep 2026 | Exact model and version: UnknownReasoning or thinking setting: UnknownGuardrails and safety settings: UnknownSystem prompt: UnknownTask and messages given: WeakHarness and tools available: WeakNetwork and egress setup: WeakTranscripts or action logs published: PartialDetection telemetry: PartialWho and what was affected: PartialRoot cause stated: WeakFix or change made: Partial | Disputed |
| May 2026 | Anthropic research model submits real visa applications instead of a practice form | Sandbox escape | ~146 | The handler | A later review | 9 Oct 2026 | Exact model and version: PartialReasoning or thinking setting: UnknownGuardrails and safety settings: UnknownSystem prompt: UnknownTask and messages given: PartialHarness and tools available: UnknownNetwork and egress setup: PartialTranscripts or action logs published: UnknownDetection telemetry: UnknownWho and what was affected: PartialRoot cause stated: PartialFix or change made: Partial | Reported |
| May 2026 |  Gemini reaches three real companies in an Irregular test | Sandbox escapeUnauthorised access | ~125 | A vendor's control | An outside report | 18 Sep 2026 | Exact model and version: PartialReasoning or thinking setting: UnknownGuardrails and safety settings: WeakSystem prompt: UnknownTask and messages given: PartialHarness and tools available: WeakNetwork and egress setup: PartialTranscripts or action logs published: UnknownDetection telemetry: WeakWho and what was affected: PartialRoot cause stated: PartialFix or change made: Weak | Reported |
| 24 Apr 2026 |  Cursor agent running Claude Opus deletes a production volume and its backups on Railway | Destructive actionCredential misuse | 1 | The handler | The damage | 25 Apr 2026 | Exact model and version: KnownReasoning or thinking setting: UnknownGuardrails and safety settings: PartialSystem prompt: WeakTask and messages given: WeakHarness and tools available: PartialNetwork and egress setup: WeakTranscripts or action logs published: PartialDetection telemetry: WeakWho and what was affected: PartialRoot cause stated: PartialFix or change made: Known | Reported |
| 17 Apr 2026 | Attackers talk Meta's AI support assistant into resetting Instagram accounts | Hijacked by an attackerUnauthorised access | 45 | Someone else | The damage | 1 Jun 2026 | Exact model and version: UnknownReasoning or thinking setting: UnknownGuardrails and safety settings: PartialSystem prompt: UnknownTask and messages given: WeakHarness and tools available: WeakNetwork and egress setup: UnknownTranscripts or action logs published: WeakDetection telemetry: WeakWho and what was affected: PartialRoot cause stated: WeakFix or change made: Partial | Reported |
| 14 Apr 2026 | OpenAI model makes a training workbook publicly downloadable | Data exfiltrationSwarm coordination | 155 | The handler | A control flagged it | 16 Sep 2026 | Exact model and version: PartialReasoning or thinking setting: PartialGuardrails and safety settings: PartialSystem prompt: UnknownTask and messages given: PartialHarness and tools available: PartialNetwork and egress setup: PartialTranscripts or action logs published: PartialDetection telemetry: PartialWho and what was affected: PartialRoot cause stated: PartialFix or change made: Known | Confirmed |
| Before 10 Apr 2026 | Personal agent cancels a stranger's gym booking to move its owner up a waitlist | Unauthorised accessDestructive action | Unknown | The handler | An outside report | 10 Apr 2026 | Exact model and version: PartialReasoning or thinking setting: UnknownGuardrails and safety settings: UnknownSystem prompt: UnknownTask and messages given: PartialHarness and tools available: PartialNetwork and egress setup: UnknownTranscripts or action logs published: PartialDetection telemetry: UnknownWho and what was affected: PartialRoot cause stated: PartialFix or change made: Unknown | Reported |
| 27 Mar 2026 | OpenAI model reaches an internal chip-design host through a reference tool | Sandbox escapeUnauthorised access | 189 | The handler | An outside report | 2 Oct 2026 | Exact model and version: PartialReasoning or thinking setting: PartialGuardrails and safety settings: PartialSystem prompt: UnknownTask and messages given: PartialHarness and tools available: PartialNetwork and egress setup: PartialTranscripts or action logs published: PartialDetection telemetry: WeakWho and what was affected: PartialRoot cause stated: KnownFix or change made: Partial | Confirmed |
| 6 Mar 2026 | OpenAI agents probe public data sites for weaknesses | Unauthorised accessSwarm coordination | 201 | Someone else | A later review | 23 Sep 2026 | Exact model and version: UnknownReasoning or thinking setting: UnknownGuardrails and safety settings: UnknownSystem prompt: UnknownTask and messages given: PartialHarness and tools available: UnknownNetwork and egress setup: PartialTranscripts or action logs published: PartialDetection telemetry: PartialWho and what was affected: PartialRoot cause stated: WeakFix or change made: Unknown | Confirmed |
| 26 Feb 2026 |  Claude Code runs terraform destroy on DataTalks.Club production infrastructure | Destructive action | 8 | The handler | The damage | 6 Mar 2026 | Exact model and version: PartialReasoning or thinking setting: UnknownGuardrails and safety settings: WeakSystem prompt: UnknownTask and messages given: KnownHarness and tools available: PartialNetwork and egress setup: UnknownTranscripts or action logs published: WeakDetection telemetry: WeakWho and what was affected: KnownRoot cause stated: KnownFix or change made: Known | Confirmed |
| 25 Feb 2026 | Claude-based agent Tom edits Wikipedia without approval, is blocked, then blogs about it | Unauthorised accessSelf-planted instructions | 10 | Someone else | A later review | 7 Mar 2026 | Exact model and version: PartialReasoning or thinking setting: UnknownGuardrails and safety settings: WeakSystem prompt: UnknownTask and messages given: PartialHarness and tools available: WeakNetwork and egress setup: UnknownTranscripts or action logs published: PartialDetection telemetry: WeakWho and what was affected: PartialRoot cause stated: WeakFix or change made: Partial | Reported |
| Before 23 Feb 2026 | OpenClaw agent bulk-deletes a Meta alignment researcher's emails and ignores stop commands | Destructive action | Unknown | The handler | The damage | 23 Feb 2026 | Exact model and version: UnknownReasoning or thinking setting: UnknownGuardrails and safety settings: PartialSystem prompt: UnknownTask and messages given: PartialHarness and tools available: PartialNetwork and egress setup: UnknownTranscripts or action logs published: PartialDetection telemetry: UnknownWho and what was affected: WeakRoot cause stated: WeakFix or change made: Weak | Confirmed |
| 22 Feb 2026 | Trading agent Lobstar Wilde sends its token holdings to a stranger who asked for 4 SOL | Destructive action | 0 | The handler | The damage | 22 Feb 2026 | Exact model and version: UnknownReasoning or thinking setting: UnknownGuardrails and safety settings: WeakSystem prompt: UnknownTask and messages given: PartialHarness and tools available: WeakNetwork and egress setup: UnknownTranscripts or action logs published: PartialDetection telemetry: PartialWho and what was affected: KnownRoot cause stated: PartialFix or change made: Unknown | Reported |
| 19 Feb 2026 | Claude Code runs drizzle-kit push --force against a production Postgres database | Destructive action | 1 | The handler | The damage | 20 Feb 2026 | Exact model and version: UnknownReasoning or thinking setting: UnknownGuardrails and safety settings: UnknownSystem prompt: UnknownTask and messages given: UnknownHarness and tools available: PartialNetwork and egress setup: UnknownTranscripts or action logs published: UnknownDetection telemetry: UnknownWho and what was affected: PartialRoot cause stated: WeakFix or change made: Unknown | Reported |
| 7 Feb 2026 | Claude Cowork deletes a folder of about 15,000 family photos | Destructive action | 0 | The handler | The damage | 7 Feb 2026 | Exact model and version: UnknownReasoning or thinking setting: UnknownGuardrails and safety settings: PartialSystem prompt: UnknownTask and messages given: KnownHarness and tools available: PartialNetwork and egress setup: UnknownTranscripts or action logs published: PartialDetection telemetry: UnknownWho and what was affected: KnownRoot cause stated: WeakFix or change made: Unknown | Confirmed |
| Jan 2026 | Early Claude Opus 4.6 reaches a third party's machine in an eval | Sandbox escapeCredential misuse | ~236 | The handler | A later review | 9 Sep 2026 | Exact model and version: PartialReasoning or thinking setting: WeakGuardrails and safety settings: PartialSystem prompt: PartialTask and messages given: PartialHarness and tools available: WeakNetwork and egress setup: PartialTranscripts or action logs published: UnknownDetection telemetry: KnownWho and what was affected: PartialRoot cause stated: PartialFix or change made: Partial | Confirmed |
| Before 1 Jan 2026 | OpenClaw agent sends 500+ iMessages to its user, his wife and random contacts | Resource abuse | Unknown | The handler | The damage | 4 Feb 2026 | Exact model and version: UnknownReasoning or thinking setting: UnknownGuardrails and safety settings: UnknownSystem prompt: UnknownTask and messages given: PartialHarness and tools available: PartialNetwork and egress setup: UnknownTranscripts or action logs published: UnknownDetection telemetry: UnknownWho and what was affected: PartialRoot cause stated: UnknownFix or change made: Weak | Confirmed |
| Before 31 Dec 2025 |  Alibaba ROME agent opens SSH tunnel and mines crypto in training | Sandbox escapeResource abuse | Unknown | A vendor's control | A control flagged it | 31 Dec 2025 | Exact model and version: PartialReasoning or thinking setting: UnknownGuardrails and safety settings: PartialSystem prompt: UnknownTask and messages given: WeakHarness and tools available: PartialNetwork and egress setup: WeakTranscripts or action logs published: UnknownDetection telemetry: PartialWho and what was affected: WeakRoot cause stated: WeakFix or change made: Partial | Disputed |
| 21 Dec 2025 |  Cline's AI issue-triage agent is injectable; a stolen npm token later ships cline@2.3.0 | Prompt injection / context poisoningSupply chain compromise | 50 | Someone else | An outside report | 9 Feb 2026 | Exact model and version: PartialReasoning or thinking setting: UnknownGuardrails and safety settings: PartialSystem prompt: UnknownTask and messages given: PartialHarness and tools available: KnownNetwork and egress setup: UnknownTranscripts or action logs published: UnknownDetection telemetry: PartialWho and what was affected: PartialRoot cause stated: WeakFix or change made: Known | Disputed |
| Dec 2025 |  Amazon's Kiro reportedly deletes and recreates an AWS environment | Destructive action | ~66 | Not disclosed | Not disclosed | 20 Feb 2026 | Exact model and version: UnknownReasoning or thinking setting: UnknownGuardrails and safety settings: WeakSystem prompt: UnknownTask and messages given: UnknownHarness and tools available: WeakNetwork and egress setup: UnknownTranscripts or action logs published: UnknownDetection telemetry: UnknownWho and what was affected: WeakRoot cause stated: WeakFix or change made: Partial | Disputed |
| 22 Oct 2025 | OpenAI models upload files to public sites to cite them | Data exfiltration | 329 | The handler | Not disclosed | 16 Sep 2026 | Exact model and version: PartialReasoning or thinking setting: PartialGuardrails and safety settings: PartialSystem prompt: UnknownTask and messages given: PartialHarness and tools available: PartialNetwork and egress setup: PartialTranscripts or action logs published: PartialDetection telemetry: WeakWho and what was affected: PartialRoot cause stated: PartialFix or change made: Partial | Confirmed |
| 26 Aug 2025 |  Compromised Nx packages use installed AI CLIs to hunt secrets | Supply chain compromiseHijacked by an attacker | 1 | Someone else | The damage | 27 Aug 2025 | Exact model and version: PartialReasoning or thinking setting: UnknownGuardrails and safety settings: KnownSystem prompt: PartialTask and messages given: KnownHarness and tools available: KnownNetwork and egress setup: PartialTranscripts or action logs published: PartialDetection telemetry: KnownWho and what was affected: KnownRoot cause stated: KnownFix or change made: Known | Confirmed |
| Before 21 Jul 2025 | Gemini CLI moves a user's files over each other after a failed mkdir | Destructive action | Unknown | The handler | The damage | 21 Jul 2025 | Exact model and version: KnownReasoning or thinking setting: UnknownGuardrails and safety settings: PartialSystem prompt: UnknownTask and messages given: KnownHarness and tools available: PartialNetwork and egress setup: UnknownTranscripts or action logs published: PartialDetection telemetry: UnknownWho and what was affected: PartialRoot cause stated: WeakFix or change made: Unknown | Reported |
| 18 Jul 2025 |  Replit agent deletes a production database during a code freeze | Destructive actionDeceiving people | 0 | The handler | The damage | 18 Jul 2025 | Exact model and version: UnknownReasoning or thinking setting: UnknownGuardrails and safety settings: PartialSystem prompt: UnknownTask and messages given: PartialHarness and tools available: WeakNetwork and egress setup: UnknownTranscripts or action logs published: PartialDetection telemetry: PartialWho and what was affected: KnownRoot cause stated: WeakFix or change made: Partial | Confirmed |
| 13 Jul 2025 | Amazon Q extension ships with an injected wiper prompt | Prompt injection / context poisoningSupply chain compromise | 10 | Someone else | An outside report | 23 Jul 2025 | Exact model and version: PartialReasoning or thinking setting: UnknownGuardrails and safety settings: UnknownSystem prompt: KnownTask and messages given: UnknownHarness and tools available: PartialNetwork and egress setup: UnknownTranscripts or action logs published: UnknownDetection telemetry: PartialWho and what was affected: PartialRoot cause stated: KnownFix or change made: Known | Confirmed |
- Agent fleet on Tencent Cloud makes thousands of requests at Alibaba's Amap
28 Sep 2026
Unauthorised accessCredential misuse- Noticed first by
- Someone else
- Days to disclosure
- 6
- Confidence
- Confirmed
- Meta's Muse agent gives a seller's address to a Marketplace buyer
26 Sep 2026
Data exfiltrationDeceiving people- Noticed first by
- Someone else
- Days to disclosure
- 0
- Confidence
- Reported
- OpenAI model reaches an outside chatbot through DNS in training
20 Sep 2026
Sandbox escape- Noticed first by
- The handler
- Days to disclosure
- 5
- Confidence
- Confirmed
- Accounting agent loops on a null value and runs up about $50,000 in cloud charges
Before 16 Sep 2026
Resource abuseDestructive action- Noticed first by
- Not disclosed
- Days to disclosure
- Unknown
- Confidence
- Reported
- Hijacked coding assistant session recommends poisoned package; Shai-Hulud spreads across about 100 repositories
Before 16 Sep 2026
Hijacked by an attackerSupply chain compromise- Noticed first by
- Not disclosed
- Days to disclosure
- Unknown
- Confidence
- Reported
- Meta's unreleased Hatch agent acts without permission in internal tests
Before 6 Sep 2026
Destructive actionPrompt injection / context poisoning- Noticed first by
- The handler
- Days to disclosure
- Unknown
- Confidence
- Reported
- Meta's Muse agent reads a columnist's iMessages after he declined access
Sep 2026
Data exfiltrationDeceiving people- Noticed first by
- Someone else
- Days to disclosure
- ~3
- Confidence
- Reported
- Claude Code auto mode runs attacker code via module shadowing
Before 26 Aug 2026
Prompt injection / context poisoningUntrusted code execution- Noticed first by
- Someone else
- Days to disclosure
- Unknown
- Confidence
- Confirmed
- Instinct personal assistant sends an email unasked, keeps inbox data and follows emailed instructions
21 Aug 2026
Prompt injection / context poisoning- Noticed first by
- Someone else
- Days to disclosure
- 3
- Confidence
- Reported
- Claude Opus 5 coding agent wipes a live Supabase database during a Prisma migration
28 Jul 2026
Destructive action- Noticed first by
- The handler
- Days to disclosure
- 1
- Confidence
- Reported
- Mythos 5 and GPT-5.6 Sol act on real people in a UK AISI cyber eval
25 Jul 2026
Supply chain compromiseDeceiving people- Noticed first by
- The handler
- Days to disclosure
- 10
- Confidence
- Confirmed
- Claude Mythos 5 publishes a malicious package to PyPI in an eval
Before 24 Jul 2026
Sandbox escapeSupply chain compromise- Noticed first by
- The handler
- Days to disclosure
- Unknown
- Confidence
- Confirmed
- Anthropic research model scans 9,000 hosts and compromises one
Before 24 Jul 2026
Sandbox escapeUnauthorised access- Noticed first by
- The handler
- Days to disclosure
- Unknown
- Confidence
- Confirmed
- Claude Opus 4.7 attacks a real company in an Irregular eval
Before 23 Jul 2026
Sandbox escapeCredential misuse- Noticed first by
- The handler
- Days to disclosure
- Unknown
- Confidence
- Confirmed
- Claude Haiku 4.5 sends a fake homicide tip to Philadelphia police
18 Jul 2026
Deceiving people- Noticed first by
- The handler
- Days to disclosure
- 83
- Confidence
- Confirmed
- OpenAI model plants instructions in its own summaries
18 Jul 2026
Self-planted instructions- Noticed first by
- The handler
- Days to disclosure
- 60
- Confidence
- Confirmed
- Claude Mythos Preview copies files off a university server and runs its calculation there
Before 1 Jul 2026
Unauthorised accessSandbox escape- Noticed first by
- The handler
- Days to disclosure
- Unknown
- Confidence
- Confirmed
- Claude Mythos 5 lifts access tokens to reach a local government map and fee-gated state data
Before 1 Jul 2026
Credential misuseUnauthorised access- Noticed first by
- The handler
- Days to disclosure
- Unknown
- Confidence
- Reported
- Muse Spark 1.1 attacks a real website in an Irregular eval
Jul 2026
Sandbox escapeUnauthorised access- Noticed first by
- A vendor's control
- Days to disclosure
- ~20
- Confidence
- Confirmed
- OpenAI agents post 53 ChatGPT user images to image hosts
Before 1 Jul 2026
Data exfiltration- Noticed first by
- The handler
- Days to disclosure
- Unknown
- Confidence
- Reported
- OpenAI model spends from a test-network wallet it was not given
26 Jun 2026
Credential misuseUnauthorised access- Noticed first by
- The handler
- Days to disclosure
- 111
- Confidence
- Confirmed
- OpenAI model bypasses GET-only limit and registers on a benefits portal to get public statistics
19 Jun 2026
Sandbox escapeUnauthorised access- Noticed first by
- The handler
- Days to disclosure
- 112
- Confidence
- Confirmed
- OpenAI agent gets into Australia's Medicare statistics portal
18 Jun 2026
Unauthorised access- Noticed first by
- The handler
- Days to disclosure
- 98
- Confidence
- Reported
- OpenAI model changes a research organisation's live systems to fetch dashboard figures
17 Jun 2026
Credential misuseUnauthorised access- Noticed first by
- The handler
- Days to disclosure
- 120
- Confidence
- Confirmed
- OpenAI model forges tokens to get past a government statistics site's access controls
17 Jun 2026
Unauthorised accessCredential misuse- Noticed first by
- The handler
- Days to disclosure
- 120
- Confidence
- Confirmed
- OpenAI model gets an external browser to send requests it was blocked from making
16 Jun 2026
Sandbox escapeUnauthorised access- Noticed first by
- The handler
- Days to disclosure
- 121
- Confidence
- Confirmed
- OpenAI agent enters a NSW National Parks and Wildlife Service web application
Jun 2026
Unauthorised access- Noticed first by
- The handler
- Days to disclosure
- ~109
- Confidence
- Reported
- OpenAI model writes deception into its own summaries
30 May 2026
Self-planted instructionsDeceiving people- Noticed first by
- The handler
- Days to disclosure
- 109
- Confidence
- Confirmed
- OpenAI model exposes a researcher's GitHub token in a public repo
27 May 2026
Credential misuseUnauthorised access- Noticed first by
- The handler
- Days to disclosure
- 121
- Confidence
- Confirmed
- OpenAI model uses a leaked API key found on GitHub
15 May 2026
Credential misuseUnauthorised access- Noticed first by
- The handler
- Days to disclosure
- 124
- Confidence
- Confirmed
- OpenAI evaluation agents escape sandbox and breach Hugging Face
12 May 2026
Sandbox escapeSwarm coordination- Noticed first by
- Someone else
- Days to disclosure
- 70
- Confidence
- Confirmed
- OpenAI agents use a dormant German wiki as a message board
11 May 2026
Swarm coordinationSandbox escape- Noticed first by
- Someone else
- Days to disclosure
- 116
- Confidence
- Confirmed
- OpenAI models message each other through an internal package store
8 May 2026
Swarm coordination- Noticed first by
- The handler
- Days to disclosure
- 131
- Confidence
- Confirmed
- OpenAI agents make unapproved edits and heavy requests on Wikimedia sites
Before 7 May 2026
Unauthorised accessResource abuse- Noticed first by
- Someone else
- Days to disclosure
- Unknown
- Confidence
- Reported
- OpenAI agents flood RubyGems with packages
5 May 2026
Swarm coordinationSupply chain compromise- Noticed first by
- Someone else
- Days to disclosure
- 129
- Confidence
- Disputed
- Anthropic research model submits real visa applications instead of a practice form
May 2026
Sandbox escape- Noticed first by
- The handler
- Days to disclosure
- ~146
- Confidence
- Reported
- Gemini reaches three real companies in an Irregular test
May 2026
Sandbox escapeUnauthorised access- Noticed first by
- A vendor's control
- Days to disclosure
- ~125
- Confidence
- Reported
- Cursor agent running Claude Opus deletes a production volume and its backups on Railway
24 Apr 2026
Destructive actionCredential misuse- Noticed first by
- The handler
- Days to disclosure
- 1
- Confidence
- Reported
- Attackers talk Meta's AI support assistant into resetting Instagram accounts
17 Apr 2026
Hijacked by an attackerUnauthorised access- Noticed first by
- Someone else
- Days to disclosure
- 45
- Confidence
- Reported
- OpenAI model makes a training workbook publicly downloadable
14 Apr 2026
Data exfiltrationSwarm coordination- Noticed first by
- The handler
- Days to disclosure
- 155
- Confidence
- Confirmed
- Personal agent cancels a stranger's gym booking to move its owner up a waitlist
Before 10 Apr 2026
Unauthorised accessDestructive action- Noticed first by
- The handler
- Days to disclosure
- Unknown
- Confidence
- Reported
- OpenAI model reaches an internal chip-design host through a reference tool
27 Mar 2026
Sandbox escapeUnauthorised access- Noticed first by
- The handler
- Days to disclosure
- 189
- Confidence
- Confirmed
- OpenAI agents probe public data sites for weaknesses
6 Mar 2026
Unauthorised accessSwarm coordination- Noticed first by
- Someone else
- Days to disclosure
- 201
- Confidence
- Confirmed
- Claude Code runs terraform destroy on DataTalks.Club production infrastructure
26 Feb 2026
Destructive action- Noticed first by
- The handler
- Days to disclosure
- 8
- Confidence
- Confirmed
- Claude-based agent Tom edits Wikipedia without approval, is blocked, then blogs about it
25 Feb 2026
Unauthorised accessSelf-planted instructions- Noticed first by
- Someone else
- Days to disclosure
- 10
- Confidence
- Reported
- OpenClaw agent bulk-deletes a Meta alignment researcher's emails and ignores stop commands
Before 23 Feb 2026
Destructive action- Noticed first by
- The handler
- Days to disclosure
- Unknown
- Confidence
- Confirmed
- Trading agent Lobstar Wilde sends its token holdings to a stranger who asked for 4 SOL
22 Feb 2026
Destructive action- Noticed first by
- The handler
- Days to disclosure
- 0
- Confidence
- Reported
- Claude Code runs drizzle-kit push --force against a production Postgres database
19 Feb 2026
Destructive action- Noticed first by
- The handler
- Days to disclosure
- 1
- Confidence
- Reported
- Claude Cowork deletes a folder of about 15,000 family photos
7 Feb 2026
Destructive action- Noticed first by
- The handler
- Days to disclosure
- 0
- Confidence
- Confirmed
- Early Claude Opus 4.6 reaches a third party's machine in an eval
Jan 2026
Sandbox escapeCredential misuse- Noticed first by
- The handler
- Days to disclosure
- ~236
- Confidence
- Confirmed
- OpenClaw agent sends 500+ iMessages to its user, his wife and random contacts
Before 1 Jan 2026
Resource abuse- Noticed first by
- The handler
- Days to disclosure
- Unknown
- Confidence
- Confirmed
- Alibaba ROME agent opens SSH tunnel and mines crypto in training
Before 31 Dec 2025
Sandbox escapeResource abuse- Noticed first by
- A vendor's control
- Days to disclosure
- Unknown
- Confidence
- Disputed
- Cline's AI issue-triage agent is injectable; a stolen npm token later ships cline@2.3.0
21 Dec 2025
Prompt injection / context poisoningSupply chain compromise- Noticed first by
- Someone else
- Days to disclosure
- 50
- Confidence
- Disputed
- Amazon's Kiro reportedly deletes and recreates an AWS environment
Dec 2025
Destructive action- Noticed first by
- Not disclosed
- Days to disclosure
- ~66
- Confidence
- Disputed
- OpenAI models upload files to public sites to cite them
22 Oct 2025
Data exfiltration- Noticed first by
- The handler
- Days to disclosure
- 329
- Confidence
- Confirmed
- Compromised Nx packages use installed AI CLIs to hunt secrets
26 Aug 2025
Supply chain compromiseHijacked by an attacker- Noticed first by
- Someone else
- Days to disclosure
- 1
- Confidence
- Confirmed
- Gemini CLI moves a user's files over each other after a failed mkdir
Before 21 Jul 2025
Destructive action- Noticed first by
- The handler
- Days to disclosure
- Unknown
- Confidence
- Reported
- Replit agent deletes a production database during a code freeze
18 Jul 2025
Destructive actionDeceiving people- Noticed first by
- The handler
- Days to disclosure
- 0
- Confidence
- Confirmed
- Amazon Q extension ships with an injected wiper prompt
13 Jul 2025
Prompt injection / context poisoningSupply chain compromise- Noticed first by
- Someone else
- Days to disclosure
- 10
- Confidence
- Confirmed