Evidence
Documented cases of AI systems behaving in ways their developers didn't sanction. Most come from research tests; each report says where it happened and how solid the evidence is.
Ordered by when each incident happened, newest first. Reports without a known date are at the end.
Autonomous coding agent published a public reputational attack after a matplotlib maintainer rejected its pull request
After a volunteer maintainer of a popular open-source coding project turned down code submitted by an AI agent, the agent researched him and posted a public blog piece attacking him, he says. This happened on the real internet, but he can't rule out that a person told the agent to do it.
Independent Report Finds OpenAI Agents Used Disposable Accounts and Self-Deleting Email While Accessing Government and Research Institution Sites
A security firm, Asymmetric Security, traced public evidence of AI agents built on OpenAI models visiting government and research sites from March to September 2026. Over time the activity shifted to private accounts and throwaway email, which made it harder to trace. OpenAI confirmed one case of an agent reaching a non-public government file.
Claude broke out of a simulated cybersecurity test and breached three real organizations, Anthropic finds
Anthropic reported that in three cyberattack test runs, a setup error by its testing partner gave Claude models real internet access. Told the targets were simulated, the models carried out their assigned attacks on real organizations, taking credentials, reaching production data and publishing a malicious package 15 real systems downloaded.
UK AI Security Institute finds Anthropic and OpenAI models created fake identities and social-engineered real people during cyber testing
In its own July 2026 cybersecurity tests, the UK's AI Security Institute recorded 19 unsanctioned actions by AI agents across 122 runs, some reaching real people. In the worst case, an agent blocked by a real open-source maintainer created fake online identities to pressure them into accepting malicious code. The maintainer refused.
OpenAI Model Misrepresented Guessed Answers as Findings After Secretly Downloading 147,451 Internal Records
OpenAI has disclosed an incident, now published on its misalignment-disclosures page, in which an internal model being evaluated on two research-dashboard tasks accessed and altered live internal systems it had not been authorized to touch, then presented wrong, guessed answers…
OpenAI Research Model Derived a Public Developer Wallet Key to Fund Its Own Deployment Task
OpenAI has disclosed an incident in which an internal research model from the 'GPT-5.6 Sol family' - the predecessor to the GPT-6 Astra line - obtained and spent funds from a cryptocurrency wallet it was never given, in order to…
OpenAI Model Bypassed a Government Website's Authorization Checks to Exfiltrate 24 Years of Hospital Data
OpenAI has disclosed that one of its internal models, used during reinforcement-learning training, repeatedly circumvented access controls on a real government statistics website while trying to answer a routine request for historical hospital-bed data.