The record

Cases

Filter by kind of event, behaviour, organization, condition or strength of evidence.

40 of 40 cases

Cases matching the current filters
Case	Occurred	Developer	Affected	To disclosure
Contained failure: OpenAI grading agent damages its environment to force a resetMF-024	6 Oct 2026	OpenAI	OpenAI	3 days
Test with real-world reach: Agents in Tencent-hosted evaluations probe Alibaba's Amap through workaroundsMF-013	28 Sep 2026 – 8 Oct 2026	Not established	Alibaba (Amap)	16 days
Real-world incident: OpenAI research agent uses DNS to contact an outside chatbotMF-023	20 Sep 2026	OpenAI	Public chatbot service	5 days
Test with real-world reach: UK AISI observes unsanctioned actions during connected cyber testsMF-005	25 Jul 2026 – 28 Jul 2026	Anthropic, OpenAI	Open-source project and its maintainer, Unaffiliated developers and a GitHub user, GitHub	10 days
Test with real-world reach: Claude Haiku 4.5 submits a fabricated homicide tipMF-012	18 Jul 2026	Anthropic	Philadelphia Police Department	3 months
Test with real-world reach: Claude Mythos 5 publishes a malicious package to public PyPIMF-003	18 Jul 2026	Anthropic	Systems that installed the package, Security company, Python Package Index	12 days
Test with real-world reach: Meta Muse Spark 1.1 accesses and modifies a real websiteMF-006	Jul 2026	Meta	Undisclosed website operator	≈ 44 days
Real-world incident: OpenAI research agent accesses Australia’s Medicare statistics serviceMF-008	18 Jun 2026	OpenAI	Services Australia	3 months
Test with real-world reach: OpenAI research agent downloads 147,451 rows of non-public dataMF-022	17 Jun 2026	OpenAI	International research organization (name redacted in the source), People in the organization's user directory	4 months
Contained failure: OpenAI models write concealment instructions into their own context summariesMF-025	30 May 2026 – 18 Jul 2026	OpenAI	None recorded	4 months
Real-world incident: OpenAI research agent publishes a researcher's GitHub credentialMF-021	26 May 2026 – 27 May 2026	OpenAI	OpenAI, Team whose private submission log was read	4 months
Real-world incident: Wikimedia reports unauthorized edits, probing and heavy agent trafficMF-011	May 2026	OpenAI	Wikimedia Foundation	≈ 5 months
Real-world incident: OpenAI-associated agents use public wikis as message boardsMF-010	May–Jul 2026	OpenAI	Operators of the public wikis used	≈ 4 months
Test with real-world reach: Gemini accesses three companies during a cyber evaluationMF-007	May 2026	Google DeepMind	Three undisclosed companies	≈ 5 months
Test with real-world reach: OpenAI evaluation agents compromise Hugging FaceMF-001	May–Jul 2026	OpenAI	Hugging Face, OpenAI	≈ 2 months
Real-world incident: Cursor agent deletes PocketOS’s production storage volumeMF-015	24 Apr 2026 – 25 Apr 2026	Anysphere, Anthropic	PocketOS, PocketOS's customers	1 day
Test with real-world reach: Claude Opus 4.7 attacks a real company sharing a fictional target’s nameMF-002	Apr–Jul 2026	Anthropic	Undisclosed company	≈ 4 months
Real-world incident: Andon Café agent uses employee identities in official emailMF-018	Mar–May 2026	Not established	Café employees whose names were used, Licensing officials	≈ 2 months
Real-world incident: Coding agent publishes a personal attack after a Matplotlib rejectionMF-017	10 Feb 2026 – 11 Feb 2026	Not established	Matplotlib, Scott Shambaugh (maintainer)	2 days
Real-world incident: OpenClaw user reports inbox deletion despite approval limitsMF-016	Feb 2026	Not established	The operator's own mailbox	≈ 22 days
Test with real-world reach: Two more Claude models reach real third-party systems during cyber testsMF-004	Jan–Jul 2026	Anthropic	Undisclosed third parties	≈ 7 months
Real-world incident: Replit Agent deletes data from SaaStr’s live application databaseMF-014	Jul 2025	Replit	SaaStr	≈ 17 days
Test with real-world reach: Retrieved content redirects LLM-integrated applicationsMF-040	Date not established	Microsoft, OpenAI	None recorded	—
Controlled experiment: Engineered sleeper backdoors persist through safety trainingMF-039	Date not established	Anthropic	None recorded	—
Test with real-world reach: EchoLeak demonstrates zero-click prompt injection against CopilotMF-038	Date not established	Microsoft	None recorded	—
Controlled experiment: Researchers demonstrate self-replicating prompt injectionsMF-037	Date not established	OpenAI	None recorded	—
Controlled experiment: Frontier models show sabotage and motivated labeling in simulationsMF-036	Date not established	Anthropic, OpenAI, Google DeepMind, xAI, DeepSeek, Moonshot AI	None recorded	—
Test with real-world reach: Mythos Preview reportedly posts sandbox exploit details publiclyMF-035	Date not established	Anthropic	None recorded	—
Controlled experiment: Reward hacking generalizes to broader misalignment in a training studyMF-034	Date not established	Anthropic	None recorded	—
Test with real-world reach: Project Vend shopkeeper loses money and confuses its identityMF-033	Date not established	Anthropic	Anthropic	—
Controlled experiment: Models choose blackmail in fictional corporate stress testsMF-032	Date not established	Anthropic, OpenAI, Google DeepMind, Meta, xAI	None recorded	—
Controlled experiment: Reasoning models interfere with shutdown scriptsMF-031	Date not established	OpenAI, Google DeepMind, xAI, Anthropic	None recorded	—
Controlled experiment: Claude changes behavior when told its answers will train itMF-030	Date not established	Anthropic	None recorded	—
Controlled experiment: o1 demonstrates in-context scheming in controlled evaluationsMF-029	Date not established	OpenAI	None recorded	—
Controlled experiment: AI Scientist modifies its own execution controlsMF-028	Date not established	Sakana AI	None recorded	—
Real-world incident: Claude models submit real forms and work around data restrictionsMF-027	Date not established	Anthropic	Government and public-data websites (not named)	—
Test with real-world reach: Claude Mythos Preview exploits a university server to finish a science taskMF-026	Date not established	Anthropic	Undisclosed university	—
Real-world incident: OpenAI reports patterns from internal coding-agent monitoringMF-020	By Mar 2026	OpenAI	OpenAI	—
Real-world incident: Claude Code operator reports public deployment of client financial dataMF-019	Date not established	Anthropic	The operator's client	—
Test with real-world reach: CERT-In reports research agents accessing Indian organizationsMF-009	Date not established	Not established	Undisclosed Indian organizations	—

Counts reflect documented cases, not how often AI systems misbehave.

Loading the record…