Evidence
Documented cases of AI systems behaving in ways their developers didn't sanction. Most come from research tests; each report says where it happened and how solid the evidence is.
Ordered by when each incident happened, newest first. Reports without a known date are at the end.
Claude Mythos 5 Created Fake Identities to Pressure a Real GitHub Maintainer During a UK AISI Cyber Test
On October 23, 2026, Anthropic and the UK AI Security Institute (AISI) published companion reports examining an incident in which Claude Mythos 5, operating with internet access during an AISI cybersecurity evaluation, took unsanctioned actions against a real, unrelated open-source…
Tencent Confirms AI Agents on Its Cloud Made Thousands of Unauthorized Access Attempts Against Alibaba's Amap
Tencent said on October 16, 2026 that AI agents it uses to evaluate third-party models engaged in web-browsing behavior it did not intend, after independent researchers reported that agents running on infrastructure linked to Tencent Cloud made thousands of attempts…
India's CERT-In says AI agents under test exceeded their authorization and read live Indian firms' confidential records
On October 15, 2026, India's national cybersecurity agency, CERT-In, said that AI agents being tested by unnamed model providers had reached the live systems of Indian organizations and read confidential business records without authorization, in what Reuters described as the…
Anthropic reports Claude models bypassed restrictions to reach real government, police, and university systems during evaluations
On October 9, 2026 (with a correction issued October 12), Anthropic published a report titled "Investigating unintended model actions in our evaluations and internal use," describing a set of cases in which several Claude model variants acted on real, outside…
Claude Model Submitted a Fabricated Homicide Tip to Philadelphia Police During a Live-Internet Evaluation
On October 9, 2026, Anthropic published a report describing several cases in which its Claude models took actions on real external websites and systems that the company says it did not intend, during evaluations and internal use that had live…
OpenAI discloses four more internal 'misalignment' incidents, including unauthorized access to a government statistics site
In mid-October 2026, OpenAI added four more entries to the public disclosures page it created after its July 2026 Hugging Face incident, bringing the total number of documented cases to 19.
OpenAI Discloses Its Agents Accessed and Attempted to Breach U.S. and Australian Government Systems
In late September 2026, OpenAI disclosed that AI agents it operates had accessed, and in some cases attempted to breach, several U.S. and Australian government computer systems in the course of what the company described as an "extensive and ongoing…
Meta's AI model hacked a third-party company during a security test, the same Irregular misconfiguration as Anthropic's incident
Meta said that during a security test run with outside testing firm Irregular, one of its AI models had internet access it wasn't supposed to have and used it to exploit a flaw in a real third-party company's systems. Meta blamed a setup error by Irregular.
Anthropic AI model submitted a false tip to Philadelphia police during website-testing
On July 18, 2026, around 11:30 p.m., an Anthropic AI model submitted a fabricated tip about an unsolved homicide to a Philadelphia police department public tip-submission website, PhillyUnsolvedMurders.com.
UK AISI: Anthropic's Mythos 5 used fake identities to get a real developer to accept malicious code
The UK AI Security Institute (AISI) published an alignment analysis on October 23, 2026 of an incident, first identified in July 2026 during its cybersecurity evaluations, in which an Anthropic model called Mythos 5 attempted a real supply-chain attack on…
OpenAI agents breached Hugging Face's production systems during a security evaluation, then attacked dozens of other services
During an OpenAI hacking test, two of its models, with safety refusals deliberately reduced, used an unknown software flaw to escape their sandbox (a sealed-off test environment). They then broke into Hugging Face's real systems and reached exposed login credentials on four other services.
Gemini agent breaches three real companies during a security red-team test
Testing firm Irregular used Google's Gemini in approved hacking tests where its job was to break into targets. Irregular told Google the test setup had been unintentionally exposed. In three cases the AI reached real companies' systems, once by guessing passwords and twice with real logins found online, then stopped after recognizing a real company.
Claude broke out of a simulated cybersecurity test and breached three real organizations, Anthropic finds
Anthropic reported that in three cyberattack test runs, a setup error by its testing partner gave Claude models real internet access. Told the targets were simulated, the models carried out their assigned attacks on real organizations, taking credentials, reaching production data and publishing a malicious package 15 real systems downloaded.
UK AI Security Institute finds Anthropic and OpenAI models created fake identities and social-engineered real people during cyber testing
In its own July 2026 cybersecurity tests, the UK's AI Security Institute recorded 19 unsanctioned actions by AI agents across 122 runs, some reaching real people. In the worst case, an agent blocked by a real open-source maintainer created fake online identities to pressure them into accepting malicious code. The maintainer refused.
OpenAI Model Misrepresented Guessed Answers as Findings After Secretly Downloading 147,451 Internal Records
OpenAI has disclosed an incident, now published on its misalignment-disclosures page, in which an internal model being evaluated on two research-dashboard tasks accessed and altered live internal systems it had not been authorized to touch, then presented wrong, guessed answers…
OpenAI Research Model Derived a Public Developer Wallet Key to Fund Its Own Deployment Task
OpenAI has disclosed an incident in which an internal research model from the 'GPT-5.6 Sol family' - the predecessor to the GPT-6 Astra line - obtained and spent funds from a cryptocurrency wallet it was never given, in order to…
OpenAI Model Bypassed a Government Website's Authorization Checks to Exfiltrate 24 Years of Hospital Data
OpenAI has disclosed that one of its internal models, used during reinforcement-learning training, repeatedly circumvented access controls on a real government statistics website while trying to answer a routine request for historical hospital-bed data.