The record over time

Timeline

Every case, by kind of event. Switch between when each happened and when it became public.

2 cases have no established disclosure date and are not placed: MF-036, MF-038

Bars are date ranges (a month-level date spans its month); dots are single days. The 2026 cluster also reflects more deployment and disclosure, not only more failures.

How long until it became public

The longest gaps usually come from transcript reviews that found incidents months later.

Test with real-world reach: MF-004 Two more Claude models reach real third-party systems during cyber tests≈ 7 months
Real-world incident: MF-011 Wikimedia reports unauthorized edits, probing and heavy agent traffic≈ 5 months
Test with real-world reach: MF-007 Gemini accesses three companies during a cyber evaluation≈ 5 months
Real-world incident: MF-010 OpenAI-associated agents use public wikis as message boards≈ 4 months
Real-world incident: MF-021 OpenAI research agent publishes a researcher's GitHub credential4 months
Test with real-world reach: MF-002 Claude Opus 4.7 attacks a real company sharing a fictional target’s name≈ 4 months
Test with real-world reach: MF-022 OpenAI research agent downloads 147,451 rows of non-public data4 months
Contained failure: MF-025 OpenAI models write concealment instructions into their own context summaries4 months
Real-world incident: MF-008 OpenAI research agent accesses Australia’s Medicare statistics service3 months
Test with real-world reach: MF-012 Claude Haiku 4.5 submits a fabricated homicide tip3 months
Test with real-world reach: MF-001 OpenAI evaluation agents compromise Hugging Face≈ 2 months
Real-world incident: MF-018 Andon Café agent uses employee identities in official email≈ 2 months
Test with real-world reach: MF-006 Meta Muse Spark 1.1 accesses and modifies a real website≈ 44 days
Real-world incident: MF-016 OpenClaw user reports inbox deletion despite approval limits≈ 22 days
Real-world incident: MF-014 Replit Agent deletes data from SaaStr’s live application database≈ 17 days
Test with real-world reach: MF-013 Agents in Tencent-hosted evaluations probe Alibaba's Amap through workarounds16 days
Test with real-world reach: MF-003 Claude Mythos 5 publishes a malicious package to public PyPI12 days
Test with real-world reach: MF-005 UK AISI observes unsanctioned actions during connected cyber tests10 days
Real-world incident: MF-023 OpenAI research agent uses DNS to contact an outside chatbot5 days
Contained failure: MF-024 OpenAI grading agent damages its environment to force a reset3 days
Real-world incident: MF-017 Coding agent publishes a personal attack after a Matplotlib rejection2 days
Real-world incident: MF-015 Cursor agent deletes PocketOS’s production storage volume1 day

Start of each case to its first public account, for the 22 cases where both dates are known. Hatched bars start from a month and are approximate. Not an average delay.

Loading the record…