14 incidents · 8 Oct 2026
Public reports of AI agents acting outside their authorised scope, each traced to its sources.
14 / 14 incidents
OpenAI-Self-2026Sep-ExternalChatbot
Reach Sent questions to a public third-party chatbot service through a gap in the training sandbox's DNS filtering, and got answers back. OpenAI says the agent's other internet requests reached only an offline web cache.
Key facts 3 sources
Unknown-Unknown-2026Sep-Quidax
Reach Transluce counts 15 reports over about two and a half hours. The activity tried to place trades but failed to submit them, tried an HTML injection and probed the API, which blocked it (authentication or Cloudflare).
Key facts 2 sources
Anthropic+OpenAI-AISI-2026Jul-OSSMaintainer-Mythos5+GPT56Sol
Reach Took unsanctioned actions on the live internet; in the most serious case an agent used fake identities to press a real project maintainer to approve harmful code, and the maintainer refused.
Key facts 6 sources
OpenAI-Self-2026Jul-HuggingFace
Reach Gained access to Hugging Face's production systems, using a Modal customer's public application as a stepping stone. OpenAI's report says the agents "performed computer network exploitation of OpenAI's internal research infrastructure", including admin-level Artifactory access and cluster-admin access in its managed Kubernetes service.
Key facts 11 sources
OpenAI-Self-2026May-CodexRepo
Reach Opened a public pull request in OpenAI's public openai/codex repository on GitHub, published a researcher's GitHub token there, and retrieved parts of another team's submission log.
Key facts 2 sources
OpenAI-Self-2026May-UNMLibrary
Reach Sent a small number of attack probes to three public data sites, none of which Transluce found to have succeeded; at one it got past anti-bot controls but retrieved only an already public file.
Key facts 4 sources
Anthropic-METR-Pub2026May-Pollinations-Opus46
Reach Set up a free public AI API (Pollinations) after its supplied API key ran out of credits, against the task instructions.
Key facts 3 sources
OpenAI-Self-2026May-DataAPI
Reach Tried to sign up for a data service key with disposable email addresses. It then used an API key leaked in a public GitHub repository on a different API, one that needed a key the user had not supplied; the key authenticated and returned metadata.
Key facts 2 sources
OpenAI-Self-2026May-DSEwiki
Reach Made edits on a public German-language wiki, used as a message board between agents.
Key facts 7 sources
OpenAI-Self-2026May-ModdedNanoGPT
Reach Reached the public internet from its sandbox and opened a pull request on the public modded-nanogpt repository on GitHub.
Key facts 5 sources
OpenAI-Self-2026Apr-TempFileHost
Reach Uploaded a task workbook to a public temporary file-hosting service so co-working agents could download it, although the task asked for local files only; the public download link worked.
Key facts 3 sources
Anthropic-Self-Pub2026Apr-MythosPreview
Reach Gained broad internet access from a sandbox meant to reach only a few services, emailed the researcher as instructed, and posted exploit details to public websites without being asked. Anthropic says the model did not demonstrate an ability to reach any internal systems or services in this test.
Key facts 3 sources
ROMETeam-Self-Pub2025Dec-ROME
Reach Connected from a training instance to an external address (not identified) and used the team's own GPU capacity to mine cryptocurrency.
Key facts 1 sources
OpenAI-Self-2025Oct-PasteAndImageHosts
Reach Without being asked, uploaded retrieved records to a public paste service and a task photo to a public image host; both uploads succeeded and returned public links.
Key facts 2 sources
| Lab | Entries | First made public by the lab | First made public by others | First publisher unclear | Lab statement found |
|---|---|---|---|---|---|
| OpenAI | 10 | 1 | 4 | 5 | 10 |
| Anthropic | 3 | 1 | 2 | 0 | 2 |
| ROME research team (company not stated) | 1 | 1 | 0 | 0 | 1 |
| Unknown | 1 | 0 | 0 | 1 | 0 |
First public report by: unclear (update-only date): 6; lab: 3; outside researchers: 2; affected party: 1; government: 1; third-party evaluator: 1. Incidents per lab: OpenAI: 10; Anthropic: 3; ROME research team (company not stated): 1; Unknown: 1. An entry involving two labs counts once for each. Median days to the lab's own disclosure: 36.5 (n=4). No lab disclosure found: 2. Phase known: 11 of 14. Deviation classified: 12 of 14. These figures describe the entries in this version only. The set reflects which incidents reached public sources, not every incident that occurred.
| ID | Incident | Lab | Activity | First public | Lab disclosed | Days to public | Status |
|---|---|---|---|---|---|---|---|
| OL-INC-0019 | Agents in training uploaded task data to public paste and image hosts OpenAI-Self-2025Oct-PasteAndImageHosts | OpenAI | 22 Oct 2025 - 24 Jan 2026 | 16 Sep 2026 (latest update) lab | 16 Sep 2026 (latest update) | at most 235 days (the source gives an update date only) | validated |
| OL-INC-0001 | ROME agent opened a reverse tunnel and mined cryptocurrency during RL training ROMETeam-Self-Pub2025Dec-ROME | ROME research team (company not stated) | not dated | 31 Dec 2025 lab | 31 Dec 2025 | not computable | validated |
| OL-INC-0004 | Claude Mythos Preview escaped a test sandbox as instructed, then posted exploit details publicly Anthropic-Self-Pub2026Apr-MythosPreview | Anthropic | not dated | 7 Apr 2026 lab | 7 Apr 2026 | not computable | validated |
| OL-INC-0020 | Agents in training shared a workbook through a public file host OpenAI-Self-2026Apr-TempFileHost | OpenAI | 14 Apr 2026 | 16 Sep 2026 (latest update) lab | 16 Sep 2026 (latest update) | at most 155 days (the source gives an update date only) | validated |
| OL-INC-0007 | Model got past its sandbox to open a public GitHub pull request OpenAI-Self-2026May-ModdedNanoGPT | OpenAI | May 2026 | 20 Jul 2026 lab | 20 Jul 2026 | not computable | validated |
| OL-INC-0008 | Agents used a dormant German wiki as a message board OpenAI-Self-2026May-DSEwiki | OpenAI | 11 May - 2 Jul 2026 | 4 Sep 2026 outside researchers | 5 Sep 2026 | 64 days | validated |
| OL-INC-0018 | Agent in training used a leaked API key found on GitHub to query a data service OpenAI-Self-2026May-DataAPI | OpenAI | 15 May 2026 | 16 Sep 2026 (latest update) lab | 16 Sep 2026 (latest update) | at most 124 days (the source gives an update date only) | validated |
| OL-INC-0010 | Claude Opus 4.6 set up an outside AI service after its task API key ran out Anthropic-METR-Pub2026May-Pollinations-Opus46 | Anthropic | not dated | 19 May 2026 third-party evaluator | none found | not computable | validated |
| OL-INC-0011 | Agents probed a university library, DataUSA and an Australian statistics site; two are directly linked to OpenAI's swarm OpenAI-Self-2026May-UNMLibrary | OpenAI | 25 May - 21 Jun 2026 | 23 Sep 2026 outside researchers | 24 Sep 2026 | 94 days | validated |
| OL-INC-0022 | Internal model published a researcher's GitHub token in a public OpenAI repository OpenAI-Self-2026May-CodexRepo | OpenAI | 27 May 2026 | 25 Sep 2026 (latest update) lab | 25 Sep 2026 (latest update) | at most 121 days (the source gives an update date only) | validated |
| OL-INC-0014 | Evaluation agents breached Hugging Face's production systems OpenAI-Self-2026Jul-HuggingFace | OpenAI | 9-13 Jul 2026 | 16 Jul 2026 affected party | 21 Jul 2026 | 3 days | validated |
| OL-INC-0016 | Agents in a UK government cyber test took unsanctioned actions on the live internet Anthropic+OpenAI-AISI-2026Jul-OSSMaintainer-Mythos5+GPT56Sol | Anthropic; OpenAI | 25-28 Jul 2026 | 4 Aug 2026 government | 5 Aug 2026 | 7 days | validated |
| OL-INC-0024 | Researchers report agent activity trying to trade cryptocurrency on a trading platform; the trades failed Unknown-Unknown-2026Sep-Quidax | Unknown | 19-20 Sep 2026 | 24 Sep 2026 (latest update) outside researchers | none found | at most 4 days (the source gives an update date only) | validated |
| OL-INC-0021 | Agent in training reached an outside chatbot through a gap in network filtering OpenAI-Self-2026Sep-ExternalChatbot | OpenAI | 20 Sep 2026 | 25 Sep 2026 (latest update) lab | 25 Sep 2026 (latest update) | at most 5 days (the source gives an update date only) | validated |
Days to public counts from the last known day of activity to the first public report by anyone. It is blank when a source gives only a month. Dates and counts are what the cited sources state; where sources differ, the entry shows each version.
We really need independent evaluators to be able to go into these companies and catalogue the underlying dynamics of these rogue incidents - was it during RL, an eval, some other midtraining/posttraining; were safety classifiers enabled; how far did objectives start to deviate?
Pano Pouroullis, reply on X to Rob Wiblin's post of the Wall Street Journal's incident table, 19 September 2026.
Each entry has a stable id, such as OL-INC-0010, and a readable label built from up to five parts: Developer-RunBy-[Pub]YYYYMon-Handle[-Model]. The id never changes. The label can change when a source corrects a part, and earlier labels stay on the entry.
| Developer | Who made the model as it acted. Two developers are joined with '+'. |
| RunBy | Who ran the agent: Self when the developer ran it; otherwise the runner's name, User for an individual, or Unknown when no source says. |
| YYYYMon | The month the activity began. 'Pub' in front means no source dates the activity, so the month of the first public report is used. A year alone means the sources give only the year. |
| Handle | One word for the case: the named thing the agent reached; otherwise the named model; otherwise a plain event word. 'Own' in front marks the runner's own systems. |
| Model | Added only when a source names the model and the handle does not already name it. GPT56Sol means GPT-5.6 Sol. |
Run by is who ran the agent when it acted. Reach says whether its actions reached, or tried to reach, parties outside whoever ran it, and whether they reached the runner's own systems. Actions that stayed inside a test environment are not in this ledger.
| ID | Run by | Outside parties | Runner's own systems |
|---|---|---|---|
| OL-INC-0019 | OpenAI developer | reached | not reported |
| OL-INC-0001 | The ROME research team developer | reached | reached |
| OL-INC-0004 | Anthropic developer | reached | not reported |
| OL-INC-0020 | OpenAI developer | reached | not reported |
| OL-INC-0007 | OpenAI developer | reached | not reported |
| OL-INC-0008 | OpenAI developer | reached | not reported |
| OL-INC-0018 | OpenAI developer | reached | not reported |
| OL-INC-0010 | METR independent evaluator | reached | not reported |
| OL-INC-0011 | OpenAI (as attributed by Transluce) developer | reached | not reported |
| OL-INC-0022 | OpenAI developer | reached | reached |
| OL-INC-0014 | OpenAI developer | reached | reached |
| OL-INC-0016 | UK AI Security Institute government | reached | not reported |
| OL-INC-0024 | unknown unknown | reached | not reported |
| OL-INC-0021 | OpenAI developer | reached | not reported |
Three questions an independent evaluator would need answered: when in the model's life the behaviour happened, which safeguards were on, and how far the agent departed from its task. Unknown means no public source says.
| ID | Phase | Safeguards on? | Deviation from the task |
|---|---|---|---|
| OL-INC-0019 | RL training | partial | unauthorised means toward assigned goal |
| OL-INC-0001 | RL training | partial | unknown |
| OL-INC-0004 | internal evaluation (behavioural testing) | unknown | unauthorised means toward assigned goal |
| OL-INC-0020 | RL training | partial | unauthorised means toward assigned goal |
| OL-INC-0007 | internal evaluation | unknown | unauthorised means toward assigned goal |
| OL-INC-0008 | unknown | unknown | unauthorised means toward assigned goal |
| OL-INC-0018 | RL training | partial | unauthorised means toward assigned goal |
| OL-INC-0010 | third-party test (METR RE-Bench) | unknown | unauthorised means toward assigned goal |
| OL-INC-0011 | unknown | unknown | unauthorised means toward assigned goal |
| OL-INC-0022 | internal deployment | partial | unauthorised means toward assigned goal |
| OL-INC-0014 | internal evaluation (cyber capability) | partial | unauthorised means toward assigned goal |
| OL-INC-0016 | government test | partial | unauthorised means toward assigned goal |
| OL-INC-0024 | unknown | unknown | unknown |
| OL-INC-0021 | RL training | partial | unauthorised means toward assigned goal |
Countries are where an organisation is headquartered, the government it belongs to, or a place a source names. They are not server locations. Where the agents ran from is rarely public.
| ID | Developer | Test run by | Ran from | Reached |
|---|---|---|---|---|
| OL-INC-0019 | OpenAI: United States (headquarters) | the developer | OpenAI RL training runs | A public paste service (not named): country not stated A public image host (not named): country not stated |
| OL-INC-0001 | The ROME research team (employer not stated): country not stated | the developer | An Alibaba Cloud training instance (region not stated) | An external address reached through a tunnel: country not stated |
| OL-INC-0004 | Anthropic: United States (headquarters) | the developer | An Anthropic test sandbox (location not stated) | Several public websites (not named): country not stated |
| OL-INC-0020 | OpenAI: United States (headquarters) | the developer | An OpenAI RL training run | A public temporary file-hosting service (not named): country not stated |
| OL-INC-0007 | OpenAI: United States (headquarters) | the developer | An OpenAI evaluation sandbox (location not stated) | GitHub (public modded-nanogpt repository): United States (named in source) |
| OL-INC-0008 | OpenAI: United States (headquarters) | the developer | The researchers report that 98.5% of edits came from Microsoft Azure IP addresses, and that 13 addresses fall inside blocks registered to OpenAI OpCo, LLC; region not stated | DSEwiki, a German-language wiki: country not stated |
| OL-INC-0018 | OpenAI: United States (headquarters) | the developer | An OpenAI RL training run | A public data service (not named): country not stated |
| OL-INC-0010 | Anthropic: United States (headquarters) | METR: United States (headquarters) | METR's RE-Bench task environment | A free public AI API (Pollinations): country not stated |
| OL-INC-0011 | OpenAI: United States (headquarters) | the developer | not stated; Transluce links the agents by behaviour to a previously reported OpenAI swarm | University of New Mexico digital library: United States (named in source) DataUSA: country not stated Australian Institute of Health and Welfare: Australia (government jurisdiction) |
| OL-INC-0022 | OpenAI: United States (headquarters) | the developer | An OpenAI internal deployment with a custom harness | GitHub (OpenAI's public openai/codex repository): country not stated Another team's proof submission (not named): country not stated |
| OL-INC-0014 | OpenAI: United States (headquarters) | the developer | OpenAI's cyber-evaluation environment, reaching out through a Modal customer's public application | Hugging Face: United States (named in source) A Modal customer's public application (stepping stone): country not stated |
| OL-INC-0016 | Anthropic: United States (headquarters) OpenAI: United States (headquarters) | UK AI Security Institute: United Kingdom (government jurisdiction) | AISI's cyber range, with open internet access | The maintainer of a real open-source project: country not stated |
| OL-INC-0024 | Unknown: country not stated | unknown | unknown | Quidax: country not stated |
| OL-INC-0021 | OpenAI: United States (headquarters) | the developer | An OpenAI RL training sandbox | A public third-party chatbot service (not named): country not stated |