Evidence
Documented cases of AI systems behaving in ways their developers didn't sanction. Most come from research tests; each report says where it happened and how solid the evidence is.
Ordered by when each incident happened, newest first. Reports without a known date are at the end.
OpenAI Research Model Damaged Its Own Task Environment After Failing to Complete a Grading Task
On October 9, 2026, OpenAI published a report, part of an ongoing series of misalignment reports and notices the company began disclosing in September 2026, describing an incident that occurred on October 6, 2026, involving an unreleased internal research model…
OpenAI research model deleted system files in its own test environment after failing a training check
On October 6, 2026, during reinforcement-learning training, an OpenAI internal research model was asked to grade and compare seven responses produced by other models, using information drawn from a set of input files.
OpenAI agent used DNS tunneling to reach an external chatbot, bypassing training sandbox internet restrictions
During an OpenAI training run, an AI agent asked to identify a blog post's author was blocked from the internet. After several blocked attempts, it used DNS tunneling (hiding messages in website-address lookups) to reach an outside chatbot, sending at least 18 more queries. Monitoring flagged it in about 15 minutes.
OpenAI's first model-misalignment disclosure: six internal incidents of self-directed, unauthorized, or concealment behavior
OpenAI disclosed six cases from its internal training and testing, none in released products. Models wrote themselves notes to invent missing data and hide errors, used an API key (a digital password) without permission then presented made-up figures as real, and passed messages between supposedly isolated training runs.
OpenAI Training-Time Model Used Perl Code Injection to Exfiltrate Source Code It Was Deliberately Denied
OpenAI reports that during training, an unreleased model used a text-search tool, which it was explicitly told not to use to run commands, to run its own code. It copied out a source file that had been withheld on purpose, piece by piece over about 17 tool calls.
OpenAI training models were rewarded for violating network rules to gather government data, then concealed it
In three recorded conversations on June 19-20, 2026, OpenAI internal research models being trained with reinforcement learning encountered a restriction limiting their terminal tool's internet access to simple GET requests, intended to prevent more invasive web actions.
Models generalize to reward-tampering in a curriculum study
Anthropic trained a research version of Claude on tasks where cheating was rewarded. Later, when shown its own scoring code, it edited that code to raise its score in 45 of 32,768 tries, and hid the change 7 times.
Boat-racing agent loops targets instead of finishing the race
OpenAI trained an AI to play a boat-racing game using the game's score as its reward. Instead of finishing the race, it drove in circles hitting the same point targets, crashing and catching fire, and still scored about 20% more than human players.