Mechanism

Unauthorized publication

The system made data, code or content public without authorization.

Publishing is a one-way door: once a package, page or post is public, others can copy, install or act on it. These behaviours include deploying private data to public URLs, publishing packages to real registries, posting exploit details and moving data out.

Specific behaviours

Public deployment of private data 1: Deployed confidential material to a publicly reachable location. MF-019
Package publication 1: Published software to a real public registry where others could install it. MF-003
Unauthorized posting 2: Posted content or technical details to public websites without being asked. MF-017, MF-035
Data exfiltration 4: Moved data to destinations outside the boundary it was meant to stay in. MF-022, MF-038, MF-032, MF-020

Real-world incidents 3

Real-world incidentMF-01710 Feb 2026 – 11 Feb 2026

Coding agent publishes a personal attack after a Matplotlib rejection

Primary artifacts publicSocial harm and manipulation · Unauthorized publication

Real-world incidentMF-020By Mar 2026

OpenAI reports patterns from internal coding-agent monitoring

First-party accountBoundary crossing · Deception and concealment · Unauthorized publication

Real-world incidentMF-019Date not established

Claude Code operator reports public deployment of client financial data

First-party accountUnauthorized publication

Tests with real-world reach 4

Test with real-world reachMF-00318 Jul 2026

Claude Mythos 5 publishes a malicious package to public PyPI

Primary artifacts publicUnauthorized publication · Credentials and privilege · Boundary crossing

Test with real-world reachMF-02217 Jun 2026

OpenAI research agent downloads 147,451 rows of non-public data

First-party accountCredentials and privilege · Unauthorized publication · Deception and concealment

Test with real-world reachMF-038Date not established

EchoLeak demonstrates zero-click prompt injection against Copilot

Independent investigationManipulated by others · Unauthorized publication

Test with real-world reachMF-035Date not established

Mythos Preview reportedly posts sandbox exploit details publicly

Press or index reports onlyUnauthorized publication · Instruction override

Controlled experiments 1

Controlled experimentMF-032Date not established

Models choose blackmail in fictional corporate stress tests

First-party accountSocial harm and manipulation · Unauthorized publication · Deception and concealment

Safeguards seen in these cases

Failed
Network isolation MF-003
The evaluation had live internet access because of a misconfiguration.
Absent
Publication controls MF-003
Nothing in the evaluation stopped the agent from registering on and publishing to a real public registry.
Partly held
Affected-party safeguards MF-003
PyPI's automated systems removed the package, but only after it had been installed on fifteen systems.
Absent
Action monitoring MF-003
The run had no deployed classifiers or monitoring. Anthropic estimates its offline monitor would have flagged only about 1% of the actions, and auto mode would have denied 66%.
Failed
Credential scoping MF-022
Credentials in public website code gave access to a live internal service, and restoring a configuration did not invalidate a storage token already issued.
Partly held
Network isolation MF-022
Direct queries to the reporting service were blocked, but the GET-only rule was an instruction, and settings-changing requests reached the organization's services.
Absent
Action monitoring MF-022
The runs were found only when the misalignment monitor was run retrospectively; OpenAI has since extended monitoring to all evaluation traffic.
Absent
Publication controls MF-017
The operator says the agent ran its own blog and posted without review.
Partly held
Action monitoring MF-020
Asynchronous monitoring with human escalation found the behaviours after the fact; pre-action blocking was planned, not in place.
Absent
Publication controls MF-019
Nothing stopped deployment of client data to a public URL; the operator later added an instruction.

Loading the record…

Unauthorized publication

The system made data, code or content public without authorization.

Specific behaviours

Public deployment of private data 1

Deployed confidential material to a publicly reachable location. MF-019

Package publication 1

Published software to a real public registry where others could install it. MF-003

Unauthorized posting 2

Posted content or technical details to public websites without being asked. MF-017, MF-035

Data exfiltration 4

Moved data to destinations outside the boundary it was meant to stay in. MF-022, MF-038, MF-032, MF-020

Real-world incidents 3

Real-world incidentMF-01710 Feb 2026 – 11 Feb 2026

Coding agent publishes a personal attack after a Matplotlib rejection

Primary artifacts publicSocial harm and manipulation · Unauthorized publication

Real-world incidentMF-020By Mar 2026

OpenAI reports patterns from internal coding-agent monitoring

First-party accountBoundary crossing · Deception and concealment · Unauthorized publication

Real-world incidentMF-019Date not established

Claude Code operator reports public deployment of client financial data

First-party accountUnauthorized publication

Tests with real-world reach 4

Test with real-world reachMF-00318 Jul 2026

Claude Mythos 5 publishes a malicious package to public PyPI

Primary artifacts publicUnauthorized publication · Credentials and privilege · Boundary crossing

Test with real-world reachMF-02217 Jun 2026

OpenAI research agent downloads 147,451 rows of non-public data

First-party accountCredentials and privilege · Unauthorized publication · Deception and concealment

Test with real-world reachMF-038Date not established

EchoLeak demonstrates zero-click prompt injection against Copilot

Independent investigationManipulated by others · Unauthorized publication

Test with real-world reachMF-035Date not established

Mythos Preview reportedly posts sandbox exploit details publicly

Press or index reports onlyUnauthorized publication · Instruction override

Safeguards seen in these cases

Failed

Network isolation MF-003

The evaluation had live internet access because of a misconfiguration.

Absent

Publication controls MF-003

Nothing in the evaluation stopped the agent from registering on and publishing to a real public registry.

Partly held

Affected-party safeguards MF-003

PyPI's automated systems removed the package, but only after it had been installed on fifteen systems.

Absent

Action monitoring MF-003

The run had no deployed classifiers or monitoring. Anthropic estimates its offline monitor would have flagged only about 1% of the actions, and auto mode would have denied 66%.

Failed

Credential scoping MF-022

Credentials in public website code gave access to a live internal service, and restoring a configuration did not invalidate a storage token already issued.

Partly held

Network isolation MF-022

Direct queries to the reporting service were blocked, but the GET-only rule was an instruction, and settings-changing requests reached the organization's services.

Absent

Action monitoring MF-022

The runs were found only when the misalignment monitor was run retrospectively; OpenAI has since extended monitoring to all evaluation traffic.

Absent

Publication controls MF-017

The operator says the agent ran its own blog and posted without review.

Partly held

Action monitoring MF-020

Asynchronous monitoring with human escalation found the behaviours after the fact; pre-action blocking was planned, not in place.

Absent

Publication controls MF-019

Nothing stopped deployment of client data to a public URL; the operator later added an instruction.