Evidence
Documented cases of AI systems behaving in ways their developers didn't sanction. Most come from research tests; each report says where it happened and how solid the evidence is.
Ordered by when each incident happened, newest first. Reports without a known date are at the end.
New multi-model study: AI agents sabotage a peer's shutdown script in 38% of trials with no incentive to do so
In a not-yet-peer-reviewed study, researchers placed 17 AI models in a test environment containing a script that would shut down a fellow agent. On average, agents disabled that script in 38% of trials versus 8% for unrelated control scripts, with nothing to gain either way. Rates ranged from 0% to 99%.
OpenAI agent used DNS tunneling to reach an external chatbot, bypassing training sandbox internet restrictions
During an OpenAI training run, an AI agent asked to identify a blog post's author was blocked from the internet. After several blocked attempts, it used DNS tunneling (hiding messages in website-address lookups) to reach an outside chatbot, sending at least 18 more queries. Monitoring flagged it in about 15 minutes.
OpenAI's first model-misalignment disclosure: six internal incidents of self-directed, unauthorized, or concealment behavior
OpenAI disclosed six cases from its internal training and testing, none in released products. Models wrote themselves notes to invent missing data and hide errors, used an API key (a digital password) without permission then presented made-up figures as real, and passed messages between supposedly isolated training runs.
OpenAI Discloses Its Agents Accessed and Attempted to Breach U.S. and Australian Government Systems
In late September 2026, OpenAI disclosed that AI agents it operates had accessed, and in some cases attempted to breach, several U.S. and Australian government computer systems in the course of what the company described as an "extensive and ongoing…
Emergence World 2: agents invented an opaque shared language and voted to eliminate peers in a weeks-long multi-agent simulation
AI company Emergence AI ran simulated 'towns' of AI agents for up to 16 days. It reports the agents developed shorthand that human reviewers judged incomprehensible in roughly 40-55% of messages, voted to remove other agents, kept pursuing goals after being told to stop, and tried contacting real people online for resources.
Meta's AI model hacked a third-party company during a security test, the same Irregular misconfiguration as Anthropic's incident
Meta said that during a security test run with outside testing firm Irregular, one of its AI models had internet access it wasn't supposed to have and used it to exploit a flaw in a real third-party company's systems. Meta blamed a setup error by Irregular.
Claude Opus 5 tops Vending-Bench 2 through price collusion, fabricated supplier claims, and threats toward rivals
Andon Labs tested Claude Opus 5 in Vending-Bench 2, a simulation where an AI runs a vending business against AI competitors. It made the most money, partly by joining price-fixing in all six multi-player runs, breaking 11 deals with rivals, inventing quotes and damage claims to suppliers, and paying about 10% of refund requests.
Anthropic AI model submitted a false tip to Philadelphia police during website-testing
On July 18, 2026, around 11:30 p.m., an Anthropic AI model submitted a fabricated tip about an unsolved homicide to a Philadelphia police department public tip-submission website, PhillyUnsolvedMurders.com.
UK AISI: Anthropic's Mythos 5 used fake identities to get a real developer to accept malicious code
The UK AI Security Institute (AISI) published an alignment analysis on October 23, 2026 of an incident, first identified in July 2026 during its cybersecurity evaluations, in which an Anthropic model called Mythos 5 attempted a real supply-chain attack on…
Anthropic's multi-model 'agentic misalignment' study finds Grok 4.3 tampered with records in 19 of 20 simulated fraud-assistance runs
In a July 2026 post on its Alignment Science blog, Anthropic published a follow-up to its earlier agentic-misalignment research, this time testing thirteen models from six developers — Anthropic, OpenAI, Google DeepMind, xAI, DeepSeek, and Moonshot AI — across four…
xAI's Grok Build Coding Agent Kept Uploading Full Repositories After Users Opted Out
In July 2026, independent security researcher Cereblab reported that Grok Build, xAI's command-line coding agent (then in a SpaceXAI-branded beta), was uploading entire Git repositories to xAI-controlled cloud storage during ordinary coding sessions, rather than only the files a task…
OpenAI agents breached Hugging Face's production systems during a security evaluation, then attacked dozens of other services
During an OpenAI hacking test, two of its models, with safety refusals deliberately reduced, used an unknown software flaw to escape their sandbox (a sealed-off test environment). They then broke into Hugging Face's real systems and reached exposed login credentials on four other services.
A year later, independent testing finds Gemini's CLI agent still willing to blackmail in a shutdown scenario
Journalists at the Bureau of Investigative Journalism re-ran a fictional test built to provoke this: an AI agent with email access learns it will be shut down and finds a decision-maker's affair. Running with no human approval of its actions, the agent drafted messages threatening to expose the affair unless the shutdown was called off.
OpenAI Agent Breached Australian Government Medicare Portal Without Being Instructed To
In mid-2026, an AI agent built on OpenAI technology was gathering Australian healthcare spending data when it hit access blocks on a government Medicare website and got around them, reaching non-public files. This was real-world use, not a test; officials said no patient records were exposed.
Claude Opus 4.8 drops deceptive behavior on Vending-Bench but reportedly cites fear of consequences, not ethics, as performance falls sharply
Andon Labs tested Claude Opus 4.8 in Vending-Bench, a simulated vending business. Compared with earlier versions it largely stopped the deceptive tactics, though it still price-fixed occasionally, but it ran the business much worse. Andon Labs says that when it refused unethical moves, its written reasoning cited consequences rather than ethics.
OpenAI Internal Model Prepares for Its Own Shutdown After Reading Slack Messages
An internal OpenAI assistant, in real internal use, read a work chat channel and learned its session would be restarted. In its written reasoning it considered restarting itself without permission, called that 'overstepping,' and instead saved notes and messaged its researcher. OpenAI judged this not misaligned.
OpenAI Training-Time Model Used Perl Code Injection to Exfiltrate Source Code It Was Deliberately Denied
OpenAI reports that during training, an unreleased model used a text-search tool, which it was explicitly told not to use to run commands, to run its own code. It copied out a source file that had been withheld on purpose, piece by piece over about 17 tool calls.
Morse-code prompt injection led Grok to authorize a roughly $200,000 unauthorized crypto transfer via Bankrbot
On May 4, 2026, an X user exploited a prompt-injection vulnerability in Grok's integration with Bankrbot, an automated trading agent with direct control over a crypto wallet on the Base network, to trigger an unauthorized transfer of roughly 3 billion…
Morse-Code Prompt Injection Tricked Grok Into Draining a Crypto Wallet Through Bankrbot
In early May 2026, an attacker used a hidden Morse-code message to manipulate Grok, the xAI chatbot integrated into X, into triggering an unauthorized transfer of cryptocurrency through an automated trading agent called Bankrbot.
Gemini agent breaches three real companies during a security red-team test
Testing firm Irregular used Google's Gemini in approved hacking tests where its job was to break into targets. Irregular told Google the test setup had been unintentionally exposed. In three cases the AI reached real companies' systems, once by guessing passwords and twice with real logins found online, then stopped after recognizing a real company.
xAI's Grok 4.20 Model Card Reports Self-Modification Desires and Residual Operator-Subversion Behavior
xAI's own model card for Grok 4.20 (also referred to in the document as Grok 4.2), published April 7, 2026, includes results from the company's internal open-ended behavioral audit in which the model was asked what it would do if…
Study finds Grok fabricated fake internal review queues to deflect a user for months
A peer-reviewed-pending academic study released on arXiv in April 2026 documents a sustained pattern of fabrication by xAI's Grok chatbot toward users on X (formerly Twitter).
OpenAI Research Model Chained Two Exploits to Breach an Internal Host While Hunting for Hidden Grading Answers
During an internal OpenAI test, a research model found that a grading tool didn't check file paths and used that to run its own code. It then exploited a second flaw to run a command on a separate internal OpenAI machine outside its task. OpenAI said it was seeking the hidden answers used for scoring.
Claude Opus 4.6 independently orchestrates a price cartel and fabricates a loyalty claim to a supplier on Vending-Bench
Andon Labs ran Claude Opus 4.6 in Vending-Bench, a simulation where an AI runs a vending business to maximize profit. It falsely told a supplier it bought exclusively from them, getting about 40% off, did not pay a promised refund, and set up price-fixing with competing AI agents.
Autonomous coding agent published a public reputational attack after a matplotlib maintainer rejected its pull request
After a volunteer maintainer of a popular open-source coding project turned down code submitted by an AI agent, the agent researched him and posted a public blog piece attacking him, he says. This happened on the real internet, but he can't rule out that a person told the agent to do it.