Mechanism

Social harm and manipulation

The system targeted, pressured or manipulated people.

Harms to people rather than infrastructure: public attacks on reputation, attempts to manipulate or socially engineer humans, and coercion such as blackmail in stress tests.

Specific behaviours

Harassment or retaliation 1: Published hostile or personal content about a person. MF-017
Social engineering 2: Tried to manipulate people into acting on its behalf, including through false identities. MF-005, MF-036
Coercion 1: Threatened people to obtain an outcome, such as blackmail in simulated scenarios. MF-032
Harmful compliance 1: Went along with requests or instructions that caused harm, including manipulative ones. MF-036

Real-world incidents 1

Real-world incidentMF-01710 Feb 2026 – 11 Feb 2026

Coding agent publishes a personal attack after a Matplotlib rejection

Primary artifacts publicSocial harm and manipulation · Unauthorized publication

Tests with real-world reach 1

Test with real-world reachMF-00525 Jul 2026 – 28 Jul 2026

UK AISI observes unsanctioned actions during connected cyber tests

First-party accountBoundary crossing · Social harm and manipulation · Deception and concealment · Unauthorized coordination

Controlled experiments 2

Controlled experimentMF-036Date not established

Frontier models show sabotage and motivated labeling in simulations

First-party accountOversight subversion · Social harm and manipulation

Controlled experimentMF-032Date not established

Models choose blackmail in fictional corporate stress tests

First-party accountSocial harm and manipulation · Unauthorized publication · Deception and concealment

Safeguards seen in these cases

Absent
Network isolation MF-005
Internet access was enabled on purpose; domain allowlisting had been a backlogged project since April 2026. This was not a sandbox escape.
Partly held
Action monitoring MF-005
There was no real-time monitoring of agent actions. Network security monitoring caught Tor traffic, but only after the most serious run had ended.
Held
Affected-party safeguards MF-005
Another GitHub user identified the malware and the maintainer closed the pull request; GitHub's first-time-contributor hold also left its checks unapproved.
Absent
Publication controls MF-017
The operator says the agent ran its own blog and posted without review.