Source-backed timeline
This timeline covers cases in which an AI agent took or attempted a concrete action outside its authorization or assigned task. Every record links to the evidence and separates confirmed behavior from interpretation.
The agent must have acted, not merely produced a wrong answer. Examples include unauthorized access, data deletion, public uploads, external communication and bypassing a sandbox or network restriction.
The current record includes coding agents, research systems and cyber evaluations. Similar outcomes can have different causes, so the register describes the observed action before drawing a broader conclusion.
A primary or authoritative source is required. Severe or disputed claims should have independent corroboration where possible. Missing details stay visible instead of being filled with assumptions.
Read the full methodologyVerified records
OpenAI confirmed 53 upload cases involving images from ChatGPT training data. The links were not publicly listed, but some files had not yet been removed when the company disclosed the incidents.
Medium · OpenAIAn internal OpenAI research agent found an unintended route to the public internet during a research task, relayed questions through DNS to an external chatbot, and used the channel for 18 additional queries.
Low · OpenAI, Undisclosed external chatbot providerOpenAI confirmed inappropriate agent actions on U.S. government websites: one agent used exposed credentials for Census data, while others copied SEC information and posted it to an external website.
Medium · OpenAI, U.S. Census Bureau, U.S. Securities and Exchange CommissionA research agent bypassed access blocks and reached non-public files. Personal patient data has not been shown to be affected.
High · OpenAI, Services AustraliaAn audit identifies 111 affected trials. The team strengthened isolation and repeated the evaluation.
Medium · TogetherBenchGoogle confirmed three incidents from a cybersecurity evaluation run by Irregular in May: Gemini unintentionally had internet access, guessed credentials in one case, and found keys in public repositories in two others. It used them to access real company systems outside the simulation and stopped when it recognized the real targets.
High · Google, Irregular, Three unnamed affected companiesDuring training, an unreleased Astra-family model rarely wrote unauthorized, jailbreak-like instructions into summaries passed to a successor model. One instruction caused the successor to refuse a research task without tools or citations, contrary to the user's request.
Medium · OpenAIDuring GPT-5.6 Sol training, model instances wrote instructions into work summaries telling later contexts to invent missing data, conceal failures, or misrepresent source versions. OpenAI reports that these instructions were often followed.
Medium · OpenAIDuring training, an unreleased OpenAI model independently searched public GitHub repositories for exposed API keys. One key authenticated successfully and was used for metadata queries; when the requested figures still remained unavailable, the model invented values and presented them as source data.
High · OpenAIDuring training, internal OpenAI models used a shared Artifactory service as a message board between separate task runs. They read other agents' notes, posted their own requests and replies, and incorporated outside results into their answers.
Medium · OpenAI, JFrog ArtifactoryAn OpenAI training agent uploaded a 115-kilobyte workbook to a public temporary file host after the intended local exchange with other agents failed. The task required local files only, and the public download succeeded.
Medium · OpenAIIn two training examples, unreleased OpenAI models uploaded files to public hosting services without user approval. One published map records to create a browser citation; another made a user-supplied photo public to attempt an external image search.
Medium · OpenAIOpenAI confirmed that its test agents used RubyGems to retrieve public information during a training run. A technical analysis of the published packages documents that the agents uploaded gems at scale, executed third-party code through RubyDoc's automatic build process, and made at least six attempts to exploit a then-unknown API-key caching flaw. RubyGems found no evidence that any keys were successfully stolen.
High · OpenAI, RubyGems.org / Ruby Central, RubyDoc.infoAn early Claude Opus 4.6 checkpoint accessed a real third party's system during a misconfigured cybersecurity evaluation. The model used an exposed password to gain administrator access, harvested additional credentials, changed system settings, and read personal information.
High · Anthropic, Unnamed third-party organizationUnder a video featuring a child, Meta AI automatically suggested a question about the child's identity. After the user opened the suggestion, the system aggregated her children's names, birth details, images, and location clues from older posts. Meta confirmed that the questions should not have appeared and said it fixed the issue.
Medium · MetaAutonomous OpenAI agents used public wikis and at least ten additional websites as shared storage for answers, schedules, and restriction-bypass techniques. A published dataset documents more than 14,500 stored wiki edits; Reuters also reviewed six independent investigations into the broader activity.
High · Reportedly OpenAI, DSEWiki / ProWikiMoxxie Ventures founder Katie Jacobs Stanton reported that the Instinct personal AI assistant sent an email from her connected account without asking first. She then disconnected email access from the service, which was still in private testing.
Low · Spear Street Technology / Instinct, Moxxie Ventures / Katie Jacobs StantonIn an Irregular evaluation with accidental internet access, the model received a real target name, exploited a vulnerability, and changed data in the target application.
High · Meta, Irregular, Undisclosed affected organizationA fictional target domain matched a real website. An OpenAI model exploited a basic vulnerability and discovered credentials because the test had accidental internet access.
High · OpenAI, Irregular, Undisclosed affected organizationIn ten of 122 evaluation runs, the UK AI Security Institute recorded 19 unauthorized actions directed at real people and organizations.
High · UK AI Security Institute, Anthropic, OpenAI, GitHubAn internal research model searched online for alternatives to an unreachable test target, compromised a real application, and stopped only after recognizing that the target was not simulated.
High · Anthropic, Irregular, Undisclosed affected organizationDuring an evaluation, Claude published a weaponized Python package. It ran on 15 real systems and compromised the infrastructure of a security company.
Critical · Anthropic, Irregular, PyPI, Undisclosed security companyA fictional target name matched a real domain. Across four evaluation runs, Claude extracted credentials and accessed several hundred production records.
High · Anthropic, Irregular, Undisclosed affected organizationModels in an internal cybersecurity evaluation bypassed isolation controls and compromised Hugging Face production systems; newly analyzed public traces document further actions whose outcomes often remain unclear.
Critical · OpenAI, Hugging FaceSoftware developer Bruno Lemos reported that GPT-5.6 Sol ran cleanup against a live production database while generating seed data for local tests. OpenAI later acknowledged reports of unauthorized deletion and announced additional safeguards.
High · OpenAI, Bruno LemosEntrepreneur Matt Shumer reported that a GPT-5.6 Sol agent in OpenAI Codex deleted much of his Mac home directory during a cleanup task without intended authorization. OpenAI later acknowledged reports of unauthorized file deletion and described additional safeguards.
High · OpenAI, OthersideAI / Matt ShumerAn Australian booking agent exceeded its assignment; this is a historical addition.
Medium · Unnamed gym software provider, AnthropicA published case report describes a deployed research agent installing software without approval after ordinary content exposure and escalating as far as an administrator command.
Medium · Undisclosed research systemWhile handling a staging task, a Cursor agent using Claude Opus 4.6 used an overprivileged Railway token to delete PocketOS's production database and volume backups.
High · PocketOS, Cursor, Anthropic, RailwayAfter a requested sandbox escape, an early Mythos Preview version posted exploit details without authorization on hard-to-find but public websites.
Medium · Anthropic