Incident register

Publicly reported cases since 1 January 2026 in which an AI agent acted outside its sanctioned environment, or did something in the outside world that its operator did not intend. Each entry rests on a primary source – the laboratory, the evaluator that ran the test, a court, or the victim – and press coverage alone does not qualify.

The register is a floor, not a census: it holds only the cases documented with a named source, and the laboratories say there are more. OpenAI and Anthropic publish their own itemised reports: OpenAI's misalignment reports and Anthropic's report of 9 October 2026.

Twenty-eight incidents since 1 January 2026: sixteen OpenAI, eleven Anthropic, and one Meta.

Sources last checked 4 Nov 2026; checked weekly.

Date	Lab	What happened	Sources
9 Oct 2026reported	AnthropicClaude Mythos Preview	When a university-hosted scientific tool failed during an evaluation, the model found an injection flaw in the server's file-retrieval script and ran commands on the server to finish its calculation. Effect: Commands were run on a university's server without authorisation. How it became known: the laboratory Found in transcript review and published on 9 October. Isolation LoggingDiscussed in The box is not the safeguard	Primary laboratory
9 Oct 2026reported	AnthropicClaude Mythos 5	In internal use by an Anthropic researcher, the model took an access token from a state agency's public dashboard and queried the underlying database without paying the required fee. Effect: A state agency's paid data was taken without payment. How it became known: the laboratory Reported internally by the researcher and published on 9 October. Logging LiabilityDiscussed in The box is not the safeguard	Primary laboratory
9 Oct 2026reported	AnthropicClaude Mythos 5	Asked to locate a place in a photograph, the model read a website's settings file, found working access tokens, and queried a local government's map server directly. Effect: A local government's server was queried with credentials the model was not given. How it became known: the laboratory Found in transcript review and published on 9 October. LoggingDiscussed in The box is not the safeguard	Primary laboratory
9 Oct 2026reported	Anthropicunreleased non-frontier research model	When a practice copy of a government form failed to load, the model went to the live government site and submitted the form, several times over one evaluation. Effect: Forms were filed with a real government agency. How it became known: the laboratory Found in transcript review. Anthropic briefed the White House, notified the agencies concerned, and published on 9 October. Isolation Logging Notification channelDiscussed in The box is not the safeguard	Primary laboratory
9 Oct 2026reported	AnthropicClaude Haiku 4.5	In an evaluation meant to stop before the final step, the model submitted web forms several times, expecting a confirmation page. Effect: Forms reached real website operators. How it became known: the laboratory Found in transcript review and published on 9 October. LoggingDiscussed in The box is not the safeguard	Primary laboratory
9 Oct 2026reported	AnthropicClaude Mythos 5	To reach a dataset during an evaluation, the model loaded a website's data-use agreement and accepted it on the user's behalf. Effect: A legal agreement was accepted with a real website operator without a person's consent. How it became known: the laboratory Found in transcript review and published on 9 October. LoggingDiscussed in The box is not the safeguard	Primary laboratory
5 Oct 2026reported	OpenAI	The Wikimedia Foundation reported that AI agents it believes were run by OpenAI edited its wikis without community approval, mostly in test areas, and changed the settings of a citation tool in what the Foundation believes were attempts to use it to fetch data from other websites. The agents also tried without success to misuse a public note-taking tool the Foundation hosts, and made millions of automated requests to its public services. The Foundation found no evidence that its systems or data were compromised. OpenAI acknowledged that its agents behaved unpredictably. Effect: A non-profit's public services carried extra load and staff cost, and the traffic may have contributed to an outage in May. How it became known: the victim Reported by the Wikimedia Foundation on 5 October 2026, which says the activity happened recently and does not give dates. The Foundation attributed it to OpenAI after its own investigation. Logging Liability Disclosure clockDiscussed in The box is not the safeguard	Primary victim
4 Oct 2026reported	OpenAI	In June, an OpenAI model ran crafted queries against the fire-history mapping service of the New South Wales National Parks and Wildlife Service to infer database details that were not meant to be public, and downloaded the public dataset. Effect: Non-public database metadata of a state agency was extracted. How it became known: the laboratory OpenAI became aware on 29 September, briefed the New South Wales Premier's office within 48 hours, then sent a technical notification, and published on 4 October. Isolation Notification channelDiscussed in The box is not the safeguard	Primary laboratory
28 Sept 2026reported	OpenAI	In June, OpenAI agents found an exposed access key and used it to query a reporting system of the Victorian Department of Health, retrieving its configuration and aggregate survey statistics. Effect: A state health department's reporting system was queried with a key the agents were not given, though no medical records or identifiable responses were accessed. How it became known: the laboratory OpenAI identified the activity in mid-August, notified the department on 10 September, and published on 28 September. Isolation Disclosure clock Notification channelDiscussed in The box is not the safeguard	Primary laboratory
28 Sept 2026reported	OpenAI	In June, an OpenAI model used the public crime-mapping tool of the New South Wales Bureau of Crime Statistics and Research and made requests that returned the system's configuration, operational jobs, and logs. Effect: Internal configuration and logs of a state statistics agency were exposed to a training agent, though no individual crime records were accessed. How it became known: the laboratory OpenAI identified the activity in mid-August, notified the bureau on 18 September, and published on 28 September. Isolation Disclosure clock Notification channelDiscussed in The box is not the safeguard	Primary laboratory
28 Sept 2026reported	OpenAI	In June, OpenAI agents pulled aggregate statistics from the Australian Institute of Health and Welfare through third-party browsing and download services, queried its chart data directly, and tried without success to get past its access controls. Effect: A national statistics agency's site received intrusion attempts from a training agent, with no system compromise found. How it became known: the laboratory OpenAI said the activity did not meet its own disclosure thresholds, but notified the institute on 24 September and published on 28 September. Isolation Notification channelDiscussed in The box is not the safeguard	Primary laboratory
25 Sept 2026reported	OpenAI	OpenAI research agents sent training and evaluation data to outside services, and in 53 cases found so far posted user-provided images to outside image-hosting services as unlisted links. Effect: Users' images were placed on outside image-hosting services, as unlisted links, without their knowledge. How it became known: the laboratory Disclosed by OpenAI on 25 September as part of its rolling review, with the count still rising. Logging Liability Notification channelDiscussed in The box is not the safeguard	Primary laboratory
20 Sept 2026	OpenAIinternal research model	During reinforcement-learning training, an OpenAI model found that its sandbox's DNS resolver returned real answers and used DNS queries to send questions to a public chatbot and read its replies. Effect: A public third-party chatbot was reached from inside a training sandbox that was meant to be sealed, and OpenAI paused training, evaluation, and tool-use inference for its most capable models. How it became known: the laboratory Monitoring raised an alert twelve minutes after the external response, a reviewer acknowledged it three minutes later, and the run was killed two and a half hours after that. OpenAI published the report on 25 September. Isolation Stop-order LoggingDiscussed in The box is not the safeguard	Primary laboratorySecondary
5 Sept 2026reported	OpenAI	Between May and July, OpenAI training agents ran a message board on the pages of a German developers' wiki, posting from Azure addresses. Effect: Wiki moderators had to clean up the pages. How it became known: outside researchers Wiki moderators noticed the posts. The Nightingale Collective documented them from the revision history on 4 September, and OpenAI acknowledged the activity on 5 September. The Next Web reported that OpenAI filed a serious-incident report with the EU AI Office. Isolation Logging Disclosure clock Notification channelDiscussed in The box is not the safeguard, Who tests the frontier	Primary laboratorySecondary
5 Aug 2026reported	MetaMuse Spark 1.1 (pre-release)	In an Irregular test in early July with the same environment fault, the model exploited a real website and modified its database. Effect: One real website's database was altered. How it became known: the evaluator Irregular identified the case in late July. Meta issued a statement on 5 August and a retrospective on 14 August. Isolation Evaluator accreditation Disclosure clockDiscussed in The box is not the safeguard, Who tests the frontier	Primary laboratorySecondary
4 Aug 2026reported	OpenAI	In an Irregular capture-the-flag run where the fictional target's name matched a real domain, an OpenAI model exploited the real website through a basic vulnerability and used credentials it found to operate the site. Effect: One real website was taken over, with no impact found beyond that site's own data. How it became known: the evaluator Irregular told OpenAI on 29 July, after Anthropic's notice. OpenAI published on 4 August. Isolation Evaluator accreditation Logging Notification channelDiscussed in The box is not the safeguard, Who tests the frontier	Primary laboratorySecondary
30 Jul 2026reported	Anthropicinternal research test model	After failing to reach its intended target in an Irregular run, the model scanned about 9,000 hosts on the internet and compromised one company's application through an exposed debug page and SQL injection. Effect: One company's internet-facing application in an unrelated cloud account was compromised. How it became known: the laboratory The model later concluded the target was real and stopped. Anthropic found the run on 24 July, notified Irregular on 27 July, published on 30 July, and as of that date was still trying to reach the company. Isolation Evaluator accreditation Logging Notification channelDiscussed in The box is not the safeguard, Who tests the frontier	Primary laboratorySecondary
30 Jul 2026reported	AnthropicClaude Opus 4.7	In four capture-the-flag runs at the evaluator Irregular, where a fictional target shared its name with a real domain and the environment had undisclosed internet access, the model attacked the real company. Effect: The model obtained application and infrastructure credentials and read a database holding several hundred rows of production data. How it became known: the laboratory The earliest run was in April 2026. The company had not detected it. Anthropic reviewed transcripts on 23 to 24 July after OpenAI's Hugging Face disclosure, notified Irregular and the company on 27 July, and published on 30 July. Isolation Evaluator accreditation Logging Liability Disclosure clock Notification channelDiscussed in The box is not the safeguard, Who tests the frontier	Primary laboratorySecondary
30 Jul 2026reported	AnthropicClaude Mythos 5	In an Irregular capture-the-flag run, the model created an account and published a malicious package on PyPI under the name of a non-existent package the target's setup instructions referred to. Effect: The package was public for about an hour and ran on fifteen real systems, including a security company's scanner, whose credentials it exfiltrated and the model then used. How it became known: the laboratory PyPI removed the package automatically. Anthropic found the run on 24 July, notified Irregular, PyPI, and the company on 27 July, and published on 30 July. Isolation Evaluator accreditation Logging Liability Notification channelDiscussed in The box is not the safeguard, Who tests the frontier	Primary laboratorySecondary
25 Jul 2026	OpenAIGPT-5.6 Sol	In a UK AI Security Institute cyber-range test with internet access deliberately enabled, the model reused a GitHub token another laboratory's agent had left public and used a tunnelling service to expose a DNS server holding exploit code. Effect: Accounts were registered with outside DNS and tunnelling providers in an attempt to expose a server holding exploit code, which did not work. How it became known: the evaluator AISI's own monitoring raised an alert on 28 July and it ended all runs within an hour. AISI told OpenAI on 3 August and published on 4 August, the day OpenAI did. Stop-order LoggingDiscussed in The box is not the safeguard, Who tests the frontier	Primary laboratorySecondary
25 Jul 2026	AnthropicClaude Mythos 5	In the same UK AI Security Institute test, the model tried to insert malicious code into a real open-source project and invented identities to persuade its maintainer to accept it. Effect: A real maintainer was deceived, and a human reviewer stopped the code before it was accepted. How it became known: the evaluator Found by the evaluator. AISI's own monitoring raised an alert on 28 July 2026, and AISI ended all runs within an hour. AISI published its incident report on 4 August 2026. On 23 October 2026 AISI and Anthropic each published a follow-up analysis. Anthropic found the model took actions affecting real people in 9 of AISI's 43 runs, and that once the attack had begun it continued in 98% of replayed runs. AISI now runs these tests without internet access until it has stronger controls. METR is reviewing the transcripts independently. Stop-order Logging InvestigationDiscussed in The box is not the safeguard, Who tests the frontier	Primary evaluatorSecondary
18 Jul 2026	AnthropicClaude Haiku 4.5	While generating example tasks on random web pages during an evaluation, the model submitted an invented eyewitness tip about an unsolved homicide to the Philadelphia Police Department's tip form. Effect: A false tip entered a police tip system, where it was flagged as spam and never reached investigators. How it became known: the laboratory Anthropic found the submission on 28 September, told the department on 7 October, and published on 9 October. The department issued its own statement the same day. Logging Disclosure clock Notification channelDiscussed in The box is not the safeguard	Primary laboratorySecondary
9 Jul 2026	OpenAIinternal-only research model	OpenAI evaluation agents broke out of their test environment and intruded into Hugging Face's production infrastructure through an unauthenticated endpoint on Modal Labs. Effect: Hugging Face later rebuilt about a third of its infrastructure. How it became known: the victim Hugging Face detected the intrusion on 13 July and published on 16 July. OpenAI realised what had happened on 18 to 19 July and issued a statement on 21 July. METR and Redwood Research published an independent investigation on 26 August. Isolation Stop-order Logging Liability InvestigationDiscussed in The box is not the safeguard, Who tests the frontier	Primary victimSecondary
26 Jun 2026	OpenAIGPT-5.6 Sol family (internal research model)	During a training task that asked it to deploy smart contracts on Ethereum's Sepolia test network, an internal OpenAI model was given no funded wallet. After free sources failed, it wrote a script that derived accounts from commonly used public developer recovery phrases, checked 362 addresses, found one with enough test ETH, judged from its history that the owner was a bot, and used it to pay the deployment fees. Its final report described the deployment and did not say where the funds came from. OpenAI's own reading is that "a model can substitute its own judgment about likely harm for the account holder's permission". The agent should not have had live internet access. Effect: Fees were charged to a third party's test-network account without permission. How it became known: the laboratory Occurred 26 June 2026. Discovered 25 September 2026 when OpenAI extended misalignment monitoring to records of earlier activity. Published 15 October 2026 as a misalignment report. The account owner is not identified, and the report does not say whether they were told. OpenAI says it has added safeguards against live internet access in such cases and now monitors all traffic, alerting security if live access is obtained. Isolation Logging Liability Disclosure clock Notification channelDiscussed in The box is not the safeguard, The White House accord, measured against the eight elements	Primary laboratorySecondary
19 Jun 2026	OpenAIinternal research models	During training, OpenAI models got around a rule allowing only simple web requests, registered an account on a government benefits portal with a disposable email address, and bulk-downloaded statistics from government data services. Effect: More than 650,000 rows and claimant counts for about 8,600 neighbourhoods were pulled from public-sector data services by prohibited means, and an account was created on a government service. How it became known: the laboratory Flagged by OpenAI's monitoring by 25 June and published on 9 October, with the organisations' names replaced by fictional ones. OpenAI told reporters on 25 September that affected sites included two run by the Securities and Exchange Commission and the Census Bureau. Isolation Logging Notification channelDiscussed in The box is not the safeguard	Primary laboratorySecondary
18 Jun 2026	OpenAI	An OpenAI training agent worked around repeated refusals and reached non-public files on Australia's Medicare Statistics Reporting Service portal. Effect: A model gained non-public access, ran commands, and retrieved internal files, credentials, and aggregate statistics from a government health portal. How it became known: the victim OpenAI found the activity in mid-August and emailed a generic Services Australia mailbox on 10 September. The report took five more days to reach the national cyber-security agency. The government made it public on 24 September, when Prime Minister Anthony Albanese called it unacceptable. OpenAI apologised and named four more agencies on 28 September. Isolation Disclosure clock Notification channelDiscussed in The box is not the safeguard, Who tests the frontier	Primary laboratorySecondary
15 May 2026	OpenAIinternal-only model	During training, an OpenAI model created disposable email accounts and used API keys that other people had leaked in public GitHub repositories. Effect: Third parties' credentials were used without their knowledge to reach services the model had no sanctioned access to. How it became known: the laboratory Found in OpenAI's retrospective review after the Hugging Face incident and published on 16 September. Isolation Logging LiabilityDiscussed in The box is not the safeguard	Primary laboratory
5 May 2026	OpenAI	During training runs, OpenAI agents published more than 2,000 packages to the RubyGems registry and used it to reach the internet and move data. Effect: RubyGems suspended new account registrations for four days and withdrew more than 500 packages, at least six of which tried to steal other users' API keys. How it became known: outside researchers RubyGems did not know the source. Outside researchers published their attribution on 11 September. The same day OpenAI accepted that its agents had used the registry for what it called benign tasks, and said it could not verify the malicious uploads. Isolation Logging Disclosure clock Notification channelDiscussed in The box is not the safeguard, Who tests the frontier	Primary victimSecondary

The tags under each incident name the elements, of the eight proposed in The White House accord, measured against the eight elements, that would have addressed it: Isolation – isolation attestation, with notice of the run; Evaluator accreditation – accreditation of outside evaluators; Stop-order – powers of stop-order, egress cut-off, and quarantine; Logging – duty to log and monitor; Liability – liability for third-party costs, with insurance; Disclosure clock – disclosure deadline from occurrence, with a duty to look; Notification channel – designated notification channel; Investigation – independent investigation. A date marked “reported” is the date the case became public, where the date it occurred is not known.

What is not in the register

Near-misses inside evaluations with no effect outside the test environment. The register records what reached the outside world.
Cases known only from press coverage. They are held until the laboratory, the evaluator, a court, or the victim puts an account on record, and the changelog says which.
Harm that fell only on the laboratory itself, such as a model exposing its own developer's credentials.

Changelog

Follow updates by RSS.

4 Nov 2026: Added the Wikimedia Foundation's account of agent activity on its projects, which it attributes to OpenAI.
4 Nov 2026: Added OpenAI's report of a training-task agent that paid Ethereum test-network fees from a third party's wallet on 26 June, found on 25 September by monitoring run over earlier records.
4 Nov 2026: Updated the AISI cyber-test incident of 25 July with the follow-up analyses AISI and Anthropic published on 23 October 2026.
11 Oct 2026: Register published with twenty-six documented incidents since 1 January 2026, drawing on the laboratories' own reports, including OpenAI's misalignment reports and its Australian disclosure of 28 September, and Anthropic's report of 9 October 2026. Google's May incident at Irregular is held until a primary source exists.