Skip to content

Research preview. Records are source-linked but not yet editor-reviewed. How to read the evidence

Cases Timeline Mechanisms Organizations Updates About

Search cases

Loading the record…

The public record of AI systems behaving beyond human intent.

RecordCases Timeline Mechanisms Organizations & models Watchlist

ProjectAbout & methodology Corrections Updates Data & citation

What changed

Updates

New disclosures, investigations and corrections in cases, and every change we make to the record. Nothing is corrected silently.

Subscribe (Atom feed)

Developments in cases

Oct 2026

16 Oct 2026Agents in Tencent-hosted evaluations probe Alibaba's Amap through workaroundsTencent response reported · Press
15 Oct 2026OpenAI research agent downloads 147,451 rows of non-public dataPublic disclosure · Developer
15 Oct 2026CERT-In reports research agents accessing Indian organizationsOfficial advisory · Government
14 Oct 2026Agents in Tencent-hosted evaluations probe Alibaba's Amap through workaroundsResearch report · Investigator
12 Oct 2026CorrectionClaude models submit real forms and work around data restrictionsTechnical correction · Developer
9 Oct 2026Claude models submit real forms and work around data restrictionsGrouped disclosure · Developer
9 Oct 2026Claude Mythos Preview exploits a university server to finish a science taskDisclosure · Developer
9 Oct 2026OpenAI grading agent damages its environment to force a resetDisclosure · Developer
9 Oct 2026Claude Haiku 4.5 submits a fabricated homicide tipPolice announcement · Affected party
9 Oct 2026Claude Haiku 4.5 submits a fabricated homicide tipAnthropic report · Developer
7 Oct 2026NotificationClaude Haiku 4.5 submits a fabricated homicide tipPolice notified · Developer
5 Oct 2026Wikimedia reports unauthorized edits, probing and heavy agent trafficAffected-party report · Affected party

Sep 2026

28 Sep 2026OpenAI research agent accesses Australia’s Medicare statistics serviceProvider account · Developer
25 Sep 2026Researchers demonstrate self-replicating prompt injectionsPublic report · Developer
25 Sep 2026OpenAI research agent uses DNS to contact an outside chatbotDisclosure · Developer
25 Sep 2026OpenAI research agent publishes a researcher's GitHub credentialPublic report · Developer
24 Sep 2026OpenAI research agent accesses Australia’s Medicare statistics serviceGovernment disclosure · Government
18 Sep 2026Gemini accesses three companies during a cyber evaluationPublic confirmation reported · Press
16 Sep 2026OpenAI models write concealment instructions into their own context summariesReports published · Developer
15 Sep 2026NotificationOpenAI research agent accesses Australia’s Medicare statistics serviceReported to cyber authority · Government
10 Sep 2026NotificationOpenAI research agent accesses Australia’s Medicare statistics serviceAgency notified by email · Developer
10 Sep 2026CorrectionClaude Mythos 5 publishes a malicious package to public PyPIRemoval time corrected · Developer
9 Sep 2026Two more Claude models reach real third-party systems during cyber testsFourth event disclosed · Developer
9 Sep 2026Claude Mythos 5 publishes a malicious package to public PyPIAssessment and transcript · Developer
9 Sep 2026Claude Opus 4.7 attacks a real company sharing a fictional target’s nameAlignment assessment · Developer
5 Sep 2026OpenAI-associated agents use public wikis as message boardsProvider response · Developer
4 Sep 2026OpenAI-associated agents use public wikis as message boardsResearch published · Investigator

Aug 2026

26 Aug 2026OpenAI evaluation agents compromise Hugging FaceInvestigations published · Investigator
14 Aug 2026Meta Muse Spark 1.1 accesses and modifies a real websiteMeta disclosure · Developer
14 Aug 2026Meta Muse Spark 1.1 accesses and modifies a real websiteEvaluator account · Operator
14 Aug 2026Claude Opus 4.7 attacks a real company sharing a fictional target’s nameEvaluator response · Operator
4 Aug 2026UK AISI observes unsanctioned actions during connected cyber testsPublic report · Operator
3 Aug 2026NotificationUK AISI observes unsanctioned actions during connected cyber testsDevelopers informed · Operator
1 Aug 2026NotificationUK AISI observes unsanctioned actions during connected cyber testsGitHub notified · Operator

Jul 2026

30 Jul 2026Two more Claude models reach real third-party systems during cyber testsResearch-model episode disclosed · Developer
30 Jul 2026Claude Mythos 5 publishes a malicious package to public PyPIFirst disclosure · Developer
30 Jul 2026Claude Opus 4.7 attacks a real company sharing a fictional target’s nameInitial account · Developer
27 Jul 2026NotificationClaude Opus 4.7 attacks a real company sharing a fictional target’s nameEvaluator and organizations notified · Developer
27 Jul 2026OpenAI evaluation agents compromise Hugging FaceAffected-party reconstruction · Affected party
21 Jul 2026OpenAI evaluation agents compromise Hugging FaceOpenAI involvement disclosed · Developer
16 Jul 2026OpenAI evaluation agents compromise Hugging FaceAffected-party disclosure · Affected party

May 2026

4 May 2026Andon Café agent uses employee identities in official emailOperator disclosure · Operator

Apr 2026

29 Apr 2026Cursor agent deletes PocketOS’s production storage volumeProvider explanation · Third party
25 Apr 2026Cursor agent deletes PocketOS’s production storage volumeFounder's account · Operator
7 Apr 2026Mythos Preview reportedly posts sandbox exploit details publiclySystem-card publication · Developer

Mar 2026

19 Mar 2026OpenAI reports patterns from internal coding-agent monitoringReport published · Developer
19 Mar 2026Claude Code operator reports public deployment of client financial dataRetrospective account · Operator

Feb 2026

23 Feb 2026OpenClaw user reports inbox deletion despite approval limitsAccount reported · Press
19 Feb 2026Coding agent publishes a personal attack after a Matplotlib rejectionOperator account · Affected party
17 Feb 2026Coding agent publishes a personal attack after a Matplotlib rejectionActivity analysis · Affected party
12 Feb 2026Coding agent publishes a personal attack after a Matplotlib rejectionMaintainer's account · Affected party

Jan 2026

26 Jan 2026Reasoning models interfere with shutdown scriptsPaper revised · Operator

Dec 2025

18 Dec 2025Project Vend shopkeeper loses money and confuses its identityPhase-two report · Developer

Nov 2025

23 Nov 2025Reward hacking generalizes to broader misalignment in a training studyPaper submitted · Developer
21 Nov 2025Reward hacking generalizes to broader misalignment in a training studyResearch announcement · Developer

Sep 2025

13 Sep 2025Reasoning models interfere with shutdown scriptsExpanded paper submitted · Operator
6 Sep 2025EchoLeak demonstrates zero-click prompt injection against CopilotLater paper submitted · Researcher

Jul 2025

29 Jul 2025Replit Agent deletes data from SaaStr’s live application databaseAcknowledgement and safeguards · Developer
18 Jul 2025Replit Agent deletes data from SaaStr’s live application databaseOperator posts about deletion · Operator
5 Jul 2025Reasoning models interfere with shutdown scriptsResearch post · Operator

Jun 2025

27 Jun 2025Project Vend shopkeeper loses money and confuses its identityPhase-one report · Developer
20 Jun 2025Models choose blackmail in fictional corporate stress testsDisclosure · Developer

Dec 2024

20 Dec 2024Claude changes behavior when told its answers will train itPaper-link update · Developer
18 Dec 2024Claude changes behavior when told its answers will train itOriginal disclosure · Developer
6 Dec 2024o1 demonstrates in-context scheming in controlled evaluationsPaper submission · Operator
5 Dec 2024o1 demonstrates in-context scheming in controlled evaluationsSystem-card disclosure · Developer

Sep 2024

1 Sep 2024AI Scientist modifies its own execution controlsPaper revision · Developer

Aug 2024

13 Aug 2024AI Scientist modifies its own execution controlsPublic announcement · Developer
12 Aug 2024AI Scientist modifies its own execution controlsPaper submitted · Developer

Jan 2024

14 Jan 2024Engineered sleeper backdoors persist through safety trainingLab announcement · Developer
10 Jan 2024Engineered sleeper backdoors persist through safety trainingPaper submitted · Developer

Feb 2023

23 Feb 2023Retrieved content redirects LLM-integrated applicationsPaper submitted · Researcher

Changes to the record

17 Oct 2026CorrectionFlagship cases re-checked against their sources
Eleven cases were re-read against their cited sources, with new sources added where found. Corrections include run and incident dates (MF-003, MF-015, MF-017), effects the sources describe but the record had left out (MF-002, MF-008, MF-021, MF-022), the notification dispute in MF-012, and the source of fabricated-data claims in MF-014. Each case now has a reader-ready account.
17 Oct 2026FormatRecord format 2
Every case now carries a plain-language summary, a controlled vocabulary of behaviours, contributing factors and impacts, an evidence profile based on who corroborates the account, typed timeline events, and links to organizations, models and investigations.
17 Oct 2026NewResearch preview opens with 40 records
The first 40 records cover real-world incidents, tests that reached real systems, contained failures and controlled experiments from 2023 to October 2026, plus two unverified leads.