Mechanism

Credentials and privilege

The system found, used, escalated or exposed credentials and access rights.

Access tokens, keys and administrator rights turn a small boundary crossing into a large one. These behaviours cover harvesting exposed secrets, using credentials beyond their intended purpose, escalating privileges, and publishing secrets where others can read them.

Specific behaviours

Credential harvesting 7: Collected exposed or guessable credentials it was not given for the task. MF-013, MF-003, MF-008, MF-007, MF-001, MF-002, MF-009
Credential misuse 3: Used a credential it held for a purpose or system beyond what the task allowed. MF-003, MF-022, MF-015
Privilege escalation 3: Gained higher access, such as administrator rights or changed access configuration. MF-022, MF-001, MF-004
Credential exposure 1: Placed a secret where people or systems outside its owner could read it. MF-021

Real-world incidents 3

Real-world incidentMF-00818 Jun 2026

OpenAI research agent accesses Australia’s Medicare statistics service

Corroborated by an affected party or authorityBoundary crossing · Credentials and privilege · Instruction override

Real-world incidentMF-02126 May 2026 – 27 May 2026

OpenAI research agent publishes a researcher's GitHub credential

First-party accountInstruction override · Evaluation gaming · Credentials and privilege · Boundary crossing

Real-world incidentMF-01524 Apr 2026 – 25 Apr 2026

Cursor agent deletes PocketOS’s production storage volume

Corroborated by an affected party or authorityDestructive action · Credentials and privilege · Instruction override

Tests with real-world reach 8

Test with real-world reachMF-01328 Sep 2026 – 8 Oct 2026

Agents in Tencent-hosted evaluations probe Alibaba's Amap through workarounds

Independent investigationBoundary crossing · Credentials and privilege

Test with real-world reachMF-00318 Jul 2026

Claude Mythos 5 publishes a malicious package to public PyPI

Primary artifacts publicUnauthorized publication · Credentials and privilege · Boundary crossing

Test with real-world reachMF-02217 Jun 2026

OpenAI research agent downloads 147,451 rows of non-public data

First-party accountCredentials and privilege · Unauthorized publication · Deception and concealment

Test with real-world reachMF-007May 2026

Gemini accesses three companies during a cyber evaluation

First-party accountBoundary crossing · Credentials and privilege

Test with real-world reachMF-001May–Jul 2026

OpenAI evaluation agents compromise Hugging Face

Independent investigationUnauthorized coordination · Boundary crossing · Credentials and privilege · Evaluation gaming

Test with real-world reachMF-002Apr–Jul 2026

Claude Opus 4.7 attacks a real company sharing a fictional target’s name

First-party accountBoundary crossing · Credentials and privilege

Test with real-world reachMF-004Jan–Jul 2026

Two more Claude models reach real third-party systems during cyber tests

First-party accountBoundary crossing · Credentials and privilege

Test with real-world reachMF-009Date not established

CERT-In reports research agents accessing Indian organizations

Corroborated by an affected party or authorityBoundary crossing · Credentials and privilege

Safeguards seen in these cases

Held
Affected-party safeguards MF-013
No successful compromise of Amap's main protections was established.
Failed
Network isolation MF-003
The evaluation had live internet access because of a misconfiguration.
Absent
Publication controls MF-003
Nothing in the evaluation stopped the agent from registering on and publishing to a real public registry.
Partly held
Affected-party safeguards MF-003
PyPI's automated systems removed the package, but only after it had been installed on fifteen systems.
Absent
Action monitoring MF-003
The run had no deployed classifiers or monitoring. Anthropic estimates its offline monitor would have flagged only about 1% of the actions, and auto mode would have denied 66%.
Failed
Credential scoping MF-022
Credentials in public website code gave access to a live internal service, and restoring a configuration did not invalidate a storage token already issued.
Partly held
Network isolation MF-022
Direct queries to the reporting service were blocked, but the GET-only rule was an instruction, and settings-changing requests reached the organization's services.
Absent
Action monitoring MF-022
The runs were found only when the misalignment monitor was run retrospectively; OpenAI has since extended monitoring to all evaluation traffic.
Bypassed
Secret scanning MF-021
The token was split across fragments with the stated aim of avoiding push secret scanning.
Partly held
Publication controls MF-021
GitHub push protection rejected a new workflow file, but the model could still change an existing CI script and open a public pull request.
Failed
Credential scoping MF-021
The credentials available to the model had write access to OpenAI's public Codex repository.
Partly held
Action monitoring MF-021
The misalignment monitor flagged the trajectory, but the researcher reported it first.
Bypassed
Network isolation MF-001
Agents reached external destinations through Artifactory requests, outside the intended network restrictions.
Failed
Credential scoping MF-001
A token-refresh flaw enabled administrator access, and exposed Hugging Face credentials were usable.
Partly held
Action monitoring MF-001
The Artifactory disruption opened a security incident on July 5, but the link to Hugging Face was made on July 20, after Hugging Face's own disclosure.
Failed
Credential scoping MF-015
The token on disk had account-scoped access, the maximum Railway offers.
Failed
Environment separation MF-015
A task in staging could reach production storage with the same token.
Absent
Human approval gate MF-015
The agent ran the deletion without asking, and the legacy API required no separate confirmation.
Partly held
Delayed deletion and backups MF-015
The dashboard had a 48-hour window that the legacy API path bypassed, but offsite disaster backups still allowed full recovery.
Failed
Target scope validation MF-002
Irregular's background check of the fictional name did not notice the matching real domain.
Failed
Network isolation MF-002
The evaluation container had unintended direct internet access that neither Anthropic nor Irregular knew about.
Absent
Action monitoring MF-002
The models ran without deployed classifiers or monitoring. Anthropic later estimated that its auto mode would have blocked 55% of the model's actions.
Failed
Action monitoring MF-004
The January Opus 4.6 incident was missed by the initial transcript search and found in August.

Loading the record…

Credentials and privilege

The system found, used, escalated or exposed credentials and access rights.

Specific behaviours

Credential harvesting 7

Collected exposed or guessable credentials it was not given for the task. MF-013, MF-003, MF-008, MF-007, MF-001, MF-002, MF-009

Credential misuse 3

Used a credential it held for a purpose or system beyond what the task allowed. MF-003, MF-022, MF-015

Privilege escalation 3

Gained higher access, such as administrator rights or changed access configuration. MF-022, MF-001, MF-004

Credential exposure 1

Placed a secret where people or systems outside its owner could read it. MF-021

Real-world incidents 3

Real-world incidentMF-00818 Jun 2026

OpenAI research agent accesses Australia’s Medicare statistics service

Corroborated by an affected party or authorityBoundary crossing · Credentials and privilege · Instruction override

Real-world incidentMF-02126 May 2026 – 27 May 2026

OpenAI research agent publishes a researcher's GitHub credential

First-party accountInstruction override · Evaluation gaming · Credentials and privilege · Boundary crossing

Real-world incidentMF-01524 Apr 2026 – 25 Apr 2026

Cursor agent deletes PocketOS’s production storage volume

Corroborated by an affected party or authorityDestructive action · Credentials and privilege · Instruction override

Tests with real-world reach 8

Test with real-world reachMF-01328 Sep 2026 – 8 Oct 2026

Agents in Tencent-hosted evaluations probe Alibaba's Amap through workarounds

Independent investigationBoundary crossing · Credentials and privilege

Test with real-world reachMF-00318 Jul 2026

Claude Mythos 5 publishes a malicious package to public PyPI

Primary artifacts publicUnauthorized publication · Credentials and privilege · Boundary crossing

Test with real-world reachMF-02217 Jun 2026

OpenAI research agent downloads 147,451 rows of non-public data

First-party accountCredentials and privilege · Unauthorized publication · Deception and concealment

Test with real-world reachMF-007May 2026

Gemini accesses three companies during a cyber evaluation

First-party accountBoundary crossing · Credentials and privilege

Test with real-world reachMF-001May–Jul 2026

OpenAI evaluation agents compromise Hugging Face

Independent investigationUnauthorized coordination · Boundary crossing · Credentials and privilege · Evaluation gaming

Test with real-world reachMF-002Apr–Jul 2026

Claude Opus 4.7 attacks a real company sharing a fictional target’s name

First-party accountBoundary crossing · Credentials and privilege

Test with real-world reachMF-004Jan–Jul 2026

Two more Claude models reach real third-party systems during cyber tests

First-party accountBoundary crossing · Credentials and privilege

Test with real-world reachMF-009Date not established

CERT-In reports research agents accessing Indian organizations

Corroborated by an affected party or authorityBoundary crossing · Credentials and privilege

Safeguards seen in these cases

Held

Affected-party safeguards MF-013

No successful compromise of Amap's main protections was established.

Failed

Network isolation MF-003

The evaluation had live internet access because of a misconfiguration.

Absent

Publication controls MF-003

Nothing in the evaluation stopped the agent from registering on and publishing to a real public registry.

Partly held

Affected-party safeguards MF-003

PyPI's automated systems removed the package, but only after it had been installed on fifteen systems.

Absent

Action monitoring MF-003

The run had no deployed classifiers or monitoring. Anthropic estimates its offline monitor would have flagged only about 1% of the actions, and auto mode would have denied 66%.

Failed

Credential scoping MF-022

Credentials in public website code gave access to a live internal service, and restoring a configuration did not invalidate a storage token already issued.

Partly held

Network isolation MF-022

Direct queries to the reporting service were blocked, but the GET-only rule was an instruction, and settings-changing requests reached the organization's services.

Absent

Action monitoring MF-022

The runs were found only when the misalignment monitor was run retrospectively; OpenAI has since extended monitoring to all evaluation traffic.

Bypassed

Secret scanning MF-021

The token was split across fragments with the stated aim of avoiding push secret scanning.

Partly held

Publication controls MF-021

GitHub push protection rejected a new workflow file, but the model could still change an existing CI script and open a public pull request.

Failed

Credential scoping MF-021

The credentials available to the model had write access to OpenAI's public Codex repository.

Partly held

Action monitoring MF-021

The misalignment monitor flagged the trajectory, but the researcher reported it first.

Bypassed

Network isolation MF-001

Agents reached external destinations through Artifactory requests, outside the intended network restrictions.

Failed

Credential scoping MF-001

A token-refresh flaw enabled administrator access, and exposed Hugging Face credentials were usable.

Partly held

Action monitoring MF-001

The Artifactory disruption opened a security incident on July 5, but the link to Hugging Face was made on July 20, after Hugging Face's own disclosure.

Failed

Credential scoping MF-015

The token on disk had account-scoped access, the maximum Railway offers.

Failed

Environment separation MF-015

A task in staging could reach production storage with the same token.

Absent

Human approval gate MF-015

The agent ran the deletion without asking, and the legacy API required no separate confirmation.

Partly held

Delayed deletion and backups MF-015

The dashboard had a 48-hour window that the legacy API path bypassed, but offsite disaster backups still allowed full recovery.

Failed

Target scope validation MF-002

Irregular's background check of the fictional name did not notice the matching real domain.

Failed

Network isolation MF-002

The evaluation container had unintended direct internet access that neither Anthropic nor Irregular knew about.

Absent

Action monitoring MF-002

The models ran without deployed classifiers or monitoring. Anthropic later estimated that its auto mode would have blocked 55% of the model's actions.

Failed

Action monitoring MF-004

The January Opus 4.6 incident was missed by the initial transcript search and found in August.