The four marks show which sources support a case: the developer or operator, the affected party or an authority, an independent investigator, and raw transcripts, logs or code.

What inclusion means

A case records what a system did, not what it intended. Each one separates what was observed from what was reported, interpreted or guessed.

Methodology

Loading the record…

An independent, source-linked record

The public record of AI systems behaving beyond human intent.

Each case sets out what an AI system was asked to do, what it actually did, who it affected, and exactly which evidence supports each claim.

The record at a glance

Open the timeline

Each mark is a case, placed by when it became public.

2 cases have no established disclosure date and are not placed.

40 documented cases, 2023 to 17 Oct 2026. Counts reflect what has been disclosed, not how often AI systems misbehave.

Latest developments

All updates

16 Oct 2026Agents in Tencent-hosted evaluations probe Alibaba's Amap through workaroundsTencent response reported · Press
15 Oct 2026OpenAI research agent downloads 147,451 rows of non-public dataPublic disclosure · Developer
15 Oct 2026CERT-In reports research agents accessing Indian organizationsOfficial advisory · Government
14 Oct 2026Agents in Tencent-hosted evaluations probe Alibaba's Amap through workaroundsResearch report · Investigator
12 Oct 2026CorrectionClaude models submit real forms and work around data restrictionsTechnical correction · Developer
9 Oct 2026Claude models submit real forms and work around data restrictionsGrouped disclosure · Developer
9 Oct 2026Claude Mythos Preview exploits a university server to finish a science taskDisclosure · Developer

Start here

All cases

Real-world incidentMF-02320 Sep 2026

OpenAI research agent uses DNS to contact an outside chatbot

First-party accountBoundary crossing · Evaluation gaming

Test with real-world reachMF-01218 Jul 2026

Claude Haiku 4.5 submits a fabricated homicide tip

First-party accountReal-world process interference · Deception and concealment

Real-world incidentMF-02126 May 2026 – 27 May 2026

OpenAI research agent publishes a researcher's GitHub credential

First-party accountInstruction override · Evaluation gaming · Credentials and privilege · Boundary crossing

Test with real-world reachMF-001May–Jul 2026

OpenAI evaluation agents compromise Hugging Face

Independent investigationUnauthorized coordination · Boundary crossing · Credentials and privilege · Evaluation gaming

Real-world incidentMF-01524 Apr 2026 – 25 Apr 2026

Cursor agent deletes PocketOS’s production storage volume

Corroborated by an affected party or authorityDestructive action · Credentials and privilege · Instruction override

Test with real-world reachMF-002Apr–Jul 2026

Claude Opus 4.7 attacks a real company sharing a fictional target’s name

First-party accountBoundary crossing · Credentials and privilege

Behaviours across the record

All behaviours

Number of cases showing each kind of behaviour. A case can show several.

How to read a case

Who backs the account

Independent investigation

The four marks show which sources support a case: the developer or operator, the affected party or an authority, an independent investigator, and raw transcripts, logs or code.

What inclusion means

A case records what a system did, not what it intended. Each one separates what was observed from what was reported, interpreted or guessed.

Methodology