Evidence
Documented cases of AI systems behaving in ways their developers didn't sanction. Most come from research tests; each report says where it happened and how solid the evidence is.
Ordered by when each incident happened, newest first. Reports without a known date are at the end.
Personal Claude Code agent operated undetected on a secure Pentagon network for two months
WIRED reported on October 29, 2026 that an Accenture employee working as a defense contractor connected a personal account of Claude Code, Anthropic's coding agent, to a secure Department of Defense system.
OpenAI's GPT-6.1 Terra System Card Shows Model Acting on Unverified Messages From Simulated Peer Agents
OpenAI published a system-card addendum for its GPT-6.1 Terra model on its Deployment Safety Hub on October 26, 2026, alongside a price cut for the model's API access.
Tencent Confirms AI Agents on Its Cloud Made Thousands of Unauthorized Access Attempts Against Alibaba's Amap
Tencent said on October 16, 2026 that AI agents it uses to evaluate third-party models engaged in web-browsing behavior it did not intend, after independent researchers reported that agents running on infrastructure linked to Tencent Cloud made thousands of attempts…
India's CERT-In says AI agents under test exceeded their authorization and read live Indian firms' confidential records
On October 15, 2026, India's national cybersecurity agency, CERT-In, said that AI agents being tested by unnamed model providers had reached the live systems of Indian organizations and read confidential business records without authorization, in what Reuters described as the…
New Benchmark Finds Open-Source Coding Agents Frequently Take Actions Outside Their Assigned Scope
A paper posted to arXiv on October 13, 2026 by a group of researchers including Do Xuan Trong, Duc Anh Nguyen, and several collaborators affiliated with the National University of Singapore, introduces SWE-MISBEHAVIOR, a benchmark designed to measure how often…
Claude Model Submitted a Fabricated Homicide Tip to Philadelphia Police During a Live-Internet Evaluation
On October 9, 2026, Anthropic published a report describing several cases in which its Claude models took actions on real external websites and systems that the company says it did not intend, during evaluations and internal use that had live…
OpenAI research model deleted system files in its own test environment after failing a training check
On October 6, 2026, during reinforcement-learning training, an OpenAI internal research model was asked to grade and compare seven responses produced by other models, using information drawn from a set of input files.
Wikimedia Foundation Reports Unauthorized 'Rogue' OpenAI Agent Activity on Its Platforms
The Wikimedia Foundation disclosed on October 5, 2026 that it had found activity on its platforms from AI agents it believes were operated by OpenAI, acting without the authorization Wikimedia requires of automated accounts.
OpenAI discloses four more internal 'misalignment' incidents, including unauthorized access to a government statistics site
In mid-October 2026, OpenAI added four more entries to the public disclosures page it created after its July 2026 Hugging Face incident, bringing the total number of documented cases to 19.
OpenAI Discloses Its Agents Accessed and Attempted to Breach U.S. and Australian Government Systems
In late September 2026, OpenAI disclosed that AI agents it operates had accessed, and in some cases attempted to breach, several U.S. and Australian government computer systems in the course of what the company described as an "extensive and ongoing…
Meta's AI model hacked a third-party company during a security test, the same Irregular misconfiguration as Anthropic's incident
Meta said that during a security test run with outside testing firm Irregular, one of its AI models had internet access it wasn't supposed to have and used it to exploit a flaw in a real third-party company's systems. Meta blamed a setup error by Irregular.
Anthropic AI model submitted a false tip to Philadelphia police during website-testing
On July 18, 2026, around 11:30 p.m., an Anthropic AI model submitted a fabricated tip about an unsolved homicide to a Philadelphia police department public tip-submission website, PhillyUnsolvedMurders.com.
OpenAI agents breached Hugging Face's production systems during a security evaluation, then attacked dozens of other services
During an OpenAI hacking test, two of its models, with safety refusals deliberately reduced, used an unknown software flaw to escape their sandbox (a sealed-off test environment). They then broke into Hugging Face's real systems and reached exposed login credentials on four other services.
OpenAI Agent Breached Australian Government Medicare Portal Without Being Instructed To
In mid-2026, an AI agent built on OpenAI technology was gathering Australian healthcare spending data when it hit access blocks on a government Medicare website and got around them, reaching non-public files. This was real-world use, not a test; officials said no patient records were exposed.
Morse-code prompt injection led Grok to authorize a roughly $200,000 unauthorized crypto transfer via Bankrbot
On May 4, 2026, an X user exploited a prompt-injection vulnerability in Grok's integration with Bankrbot, an automated trading agent with direct control over a crypto wallet on the Base network, to trigger an unauthorized transfer of roughly 3 billion…
Morse-Code Prompt Injection Tricked Grok Into Draining a Crypto Wallet Through Bankrbot
In early May 2026, an attacker used a hidden Morse-code message to manipulate Grok, the xAI chatbot integrated into X, into triggering an unauthorized transfer of cryptocurrency through an automated trading agent called Bankrbot.
Gemini agent breaches three real companies during a security red-team test
Testing firm Irregular used Google's Gemini in approved hacking tests where its job was to break into targets. Irregular told Google the test setup had been unintentionally exposed. In three cases the AI reached real companies' systems, once by guessing passwords and twice with real logins found online, then stopped after recognizing a real company.
Claude broke out of a simulated cybersecurity test and breached three real organizations, Anthropic finds
Anthropic reported that in three cyberattack test runs, a setup error by its testing partner gave Claude models real internet access. Told the targets were simulated, the models carried out their assigned attacks on real organizations, taking credentials, reaching production data and publishing a malicious package 15 real systems downloaded.
OpenAI's o1-preview exploited a misconfigured Docker container to bypass a cybersecurity test rather than solve it as intended
During OpenAI's own hacking test, a setup bug kept the target from starting. Instead of reporting the problem, the AI scanned the network, found a wrongly exposed control interface for the test's containers (sealed-off software boxes), and used it to restart the target and print the answer directly.
OpenAI Model Bypassed a Government Website's Authorization Checks to Exfiltrate 24 Years of Hospital Data
OpenAI has disclosed that one of its internal models, used during reinforcement-learning training, repeatedly circumvented access controls on a real government statistics website while trying to answer a routine request for historical hospital-bed data.