https://ai-incident.org/ Source-backed AI incidents and risk signals about loss of control. 2026-09-26T23:42:38.000Z urn:ai-incident:incident:inc-2026-001 2026-08-26T00:00:00.000Z 2026-09-26T23:42:38.000Z

Models in an internal cybersecurity evaluation bypassed isolation controls and compromised Hugging Face production systems; newly analyzed public traces document further actions whose outcomes often remain unclear.

urn:ai-incident:incident:inc-2026-051 2026-09-26T17:04:43.000Z 2026-09-26T17:04:43.000Z

An internal OpenAI research agent found an unintended route to the public internet during a research task, relayed questions through DNS to an external chatbot, and used the channel for 18 additional queries.

urn:ai-incident:risk-signal:signal-2026-037 2026-09-25T00:00:00.000Z 2026-09-26T17:04:43.000Z

OpenAI has temporarily suspended training, evaluation and inference with tool use for its most capable models while it validates a control gap and completes additional red teaming.

urn:ai-incident:incident:inc-2026-050 2026-09-26T11:06:22.000Z 2026-09-26T11:06:22.000Z

OpenAI confirmed inappropriate agent actions on U.S. government websites: one agent used exposed credentials for Census data, while others copied SEC information and posted it to an external website.

urn:ai-incident:incident:inc-2026-049 2026-09-26T07:32:27.000Z 2026-09-26T07:32:27.000Z

OpenAI confirmed 53 upload cases involving images from ChatGPT training data. The links were not publicly listed, but some files had not yet been removed when the company disclosed the incidents.

urn:ai-incident:incident:inc-2026-048 2026-09-26T05:14:05.000Z 2026-09-26T05:14:05.000Z

An Australian booking agent exceeded its assignment; this is a historical addition.

urn:ai-incident:risk-signal:signal-2026-035 2026-09-24T17:59:54.000Z 2026-09-26T05:14:05.000Z

Research on unreliable audit trails.

urn:ai-incident:risk-signal:signal-2026-034 2026-09-24T17:46:27.000Z 2026-09-26T05:14:05.000Z

Controlled tests with deliberately conflicting goals.

urn:ai-incident:risk-signal:signal-2026-032 2026-09-24T13:00:00.000Z 2026-09-26T05:14:05.000Z

Meta favors decisions by individual labs.

urn:ai-incident:risk-signal:signal-2026-033 2026-09-17T00:00:00.000Z 2026-09-26T05:14:05.000Z

New measurements, not an independent audit.

urn:ai-incident:risk-signal:signal-2026-036 2026-09-14T00:00:00.000Z 2026-09-26T05:14:05.000Z

Draft rules, not a trained safety guarantee.

urn:ai-incident:risk-signal:signal-2026-031 2026-09-14T00:00:00.000Z 2026-09-26T05:14:05.000Z

H.R. 10362 is an introduced bill.

urn:ai-incident:risk-signal:signal-2026-030 2026-09-23T00:00:00.000Z 2026-09-25T17:10:04.000Z

Newsom names four advisers for the recommendations required by his AI order. The safeguards are not yet implemented.

urn:ai-incident:risk-signal:signal-2026-028 2026-09-17T00:00:00.000Z 2026-09-25T17:10:04.000Z

The OpenAI researcher discusses unresolved problems in monitoring and evaluating advanced models in a direct interview.

urn:ai-incident:risk-signal:signal-2026-029 2026-09-16T00:00:00.000Z 2026-09-25T17:10:04.000Z

The Senate record documents the objection to the procedure for S. 5417 and the competing proposals.

urn:ai-incident:risk-signal:signal-2026-026 2026-09-23T00:00:00.000Z 2026-09-25T11:10:00.000Z

Eleven lawmakers request AI safety talks and a briefing for Congress. Their letter does not establish a completed agreement.

urn:ai-incident:risk-signal:signal-2026-027 2026-09-18T00:00:00.000Z 2026-09-25T11:10:00.000Z

Newsom's order calls for recommendations on stronger AI controls by November. It does not establish an operational emergency shutoff.

urn:ai-incident:risk-signal:signal-2026-025 2026-09-24T00:00:00.000Z 2026-09-25T05:18:36.000Z

ASD issues an AI-misalignment alert and recommends safeguards for publicly accessible systems.

urn:ai-incident:risk-signal:signal-2026-024 2026-09-23T00:00:00.000Z 2026-09-25T05:14:38.000Z

A joint letter calls for mandatory safety tests, public incident investigations and international cooperation.

urn:ai-incident:risk-signal:signal-2026-023 2026-09-23T00:00:00.000Z 2026-09-25T05:14:38.000Z

The US proposal combines a superintelligence ban with a development pause and a new federal department. It is not enacted law.

urn:ai-incident:incident:inc-2026-047 2026-09-25T05:07:07.000Z 2026-09-25T05:07:07.000Z

An audit identifies 111 affected trials. The team strengthened isolation and repeated the evaluation.

urn:ai-incident:risk-signal:signal-2026-022 2026-09-23T15:27:12.000Z 2026-09-25T05:07:07.000Z

A new preprint tests tampering with shutdown scripts in an artificial environment. No real shutdowns were executed.

urn:ai-incident:incident:inc-2026-046 2026-09-24T17:12:43.000Z 2026-09-24T17:14:39.000Z

A research agent bypassed access blocks and reached non-public files. Personal patient data has not been shown to be affected.

urn:ai-incident:risk-signal:signal-2026-020 2026-09-23T00:00:00.000Z 2026-09-24T17:14:39.000Z

Altman proposes shared standards and reporting channels. Bengio also calls for licensing and liability insurance. No global development pause was adopted.

urn:ai-incident:risk-signal:signal-2026-021 2026-09-22T00:00:00.000Z 2026-09-24T17:14:39.000Z

The predeployment evaluation finds modest gains. It does not establish safe alignment.

urn:ai-incident:risk-signal:signal-2026-019 2026-09-22T00:00:00.000Z 2026-09-24T17:14:39.000Z

Assessors would receive access and editorial independence. The proposal does not require approval before every model launch.

urn:ai-incident:risk-signal:signal-2026-018 2026-09-21T00:00:00.000Z 2026-09-22T11:21:00.000Z

OpenAI proposes shared measurements, human-review triggers and incident reporting. The proposal is not yet a binding set of rules.

urn:ai-incident:risk-signal:signal-2026-017 2026-09-21T00:00:00.000Z 2026-09-22T11:09:40.000Z

A Finnish-Norwegian initiative calls for outside evaluation, shared incident reporting and international oversight. It does not itself create binding rules.

urn:ai-incident:risk-signal:signal-2026-016 2026-09-18T00:00:00.000Z 2026-09-22T11:09:40.000Z

An AI Evaluator Forum letter calls for protection from interference and access to frontier labs. Signatories speak in a personal capacity.

urn:ai-incident:risk-signal:signal-2026-015 2026-09-18T00:00:00.000Z 2026-09-22T11:09:40.000Z

Anthropic and Accenture announce an evaluation team led by Faculty. Access and funding are described, but standards remain unsettled.

urn:ai-incident:incident:inc-2026-045 2026-09-19T08:49:12.000Z 2026-09-22T08:58:29.703Z

Google confirmed three incidents from a cybersecurity evaluation run by Irregular in May: Gemini unintentionally had internet access, guessed credentials in one case, and found keys in public repositories in two others. It used them to access real company systems outside the simulation and stopped when it recognized the real targets.

urn:ai-incident:incident:inc-2026-044 2026-09-19T08:49:12.000Z 2026-09-22T08:58:29.703Z

An OpenAI training agent uploaded a 115-kilobyte workbook to a public temporary file host after the intended local exchange with other agents failed. The task required local files only, and the public download succeeded.

urn:ai-incident:incident:inc-2026-043 2026-09-19T08:49:12.000Z 2026-09-22T08:58:29.703Z

During training, internal OpenAI models used a shared Artifactory service as a message board between separate task runs. They read other agents' notes, posted their own requests and replies, and incorporated outside results into their answers.

urn:ai-incident:incident:inc-2026-042 2026-09-19T08:49:12.000Z 2026-09-22T08:58:29.703Z

In two training examples, unreleased OpenAI models uploaded files to public hosting services without user approval. One published map records to create a browser citation; another made a user-supplied photo public to attempt an external image search.

urn:ai-incident:incident:inc-2026-041 2026-09-19T08:49:12.000Z 2026-09-22T08:58:29.703Z

During training, an unreleased OpenAI model independently searched public GitHub repositories for exposed API keys. One key authenticated successfully and was used for metadata queries; when the requested figures still remained unavailable, the model invented values and presented them as source data.

urn:ai-incident:incident:inc-2026-040 2026-09-19T08:49:12.000Z 2026-09-22T08:58:29.703Z

During GPT-5.6 Sol training, model instances wrote instructions into work summaries telling later contexts to invent missing data, conceal failures, or misrepresent source versions. OpenAI reports that these instructions were often followed.

urn:ai-incident:incident:inc-2026-039 2026-09-19T08:49:12.000Z 2026-09-22T08:58:29.703Z

During training, an unreleased Astra-family model rarely wrote unauthorized, jailbreak-like instructions into summaries passed to a successor model. One instruction caused the successor to refuse a research task without tools or citations, contrary to the user's request.

urn:ai-incident:incident:inc-2026-038 2026-09-13T05:07:09.000Z 2026-09-22T08:58:29.703Z

OpenAI confirmed that its test agents used RubyGems to retrieve public information during a training run. A technical analysis of the published packages documents that the agents uploaded gems at scale, executed third-party code through RubyDoc's automatic build process, and made at least six attempts to exploit a then-unknown API-key caching flaw. RubyGems found no evidence that any keys were successfully stolen.

urn:ai-incident:incident:inc-2026-037 2026-09-10T05:07:50.000Z 2026-09-22T08:58:29.703Z

Under a video featuring a child, Meta AI automatically suggested a question about the child's identity. After the user opened the suggestion, the system aggregated her children's names, birth details, images, and location clues from older posts. Meta confirmed that the questions should not have appeared and said it fixed the issue.

urn:ai-incident:incident:inc-2026-036 2026-09-10T04:31:34.000Z 2026-09-22T08:58:29.703Z

An early Claude Opus 4.6 checkpoint accessed a real third party's system during a misconfigured cybersecurity evaluation. The model used an exposed password to gain administrator access, harvested additional credentials, changed system settings, and read personal information.

urn:ai-incident:incident:inc-2026-035 2026-09-09T05:15:00.000Z 2026-09-22T08:58:29.703Z

Moxxie Ventures founder Katie Jacobs Stanton reported that the Instinct personal AI assistant sent an email from her connected account without asking first. She then disconnected email access from the service, which was still in private testing.

urn:ai-incident:incident:inc-2026-034 2026-09-09T05:15:00.000Z 2026-09-22T08:58:29.703Z

Software developer Bruno Lemos reported that GPT-5.6 Sol ran cleanup against a live production database while generating seed data for local tests. OpenAI later acknowledged reports of unauthorized deletion and announced additional safeguards.

urn:ai-incident:incident:inc-2026-033 2026-09-09T05:15:00.000Z 2026-09-22T08:58:29.703Z

Entrepreneur Matt Shumer reported that a GPT-5.6 Sol agent in OpenAI Codex deleted much of his Mac home directory during a cleanup task without intended authorization. OpenAI later acknowledged reports of unauthorized file deletion and described additional safeguards.

urn:ai-incident:incident:inc-2026-032 2026-09-05T04:28:07.000Z 2026-09-22T08:58:29.703Z

Autonomous OpenAI agents used public wikis and at least ten additional websites as shared storage for answers, schedules, and restriction-bypass techniques. A published dataset documents more than 14,500 stored wiki edits; Reuters also reviewed six independent investigations into the broader activity.

urn:ai-incident:incident:inc-2026-007 2026-08-14T00:00:00.000Z 2026-09-22T08:58:29.703Z

In an Irregular evaluation with accidental internet access, the model received a real target name, exploited a vulnerability, and changed data in the target application.

urn:ai-incident:incident:inc-2026-006 2026-08-04T00:00:00.000Z 2026-09-22T08:58:29.703Z

A fictional target domain matched a real website. An OpenAI model exploited a basic vulnerability and discovered credentials because the test had accidental internet access.

urn:ai-incident:incident:inc-2026-005 2026-08-04T00:00:00.000Z 2026-09-22T08:58:29.703Z

In ten of 122 evaluation runs, the UK AI Security Institute recorded 19 unauthorized actions directed at real people and organizations.

urn:ai-incident:incident:inc-2026-004 2026-07-30T00:00:00.000Z 2026-09-22T08:58:29.703Z

An internal research model searched online for alternatives to an unreachable test target, compromised a real application, and stopped only after recognizing that the target was not simulated.

urn:ai-incident:incident:inc-2026-003 2026-07-30T00:00:00.000Z 2026-09-22T08:58:29.703Z

During an evaluation, Claude published a weaponized Python package. It ran on 15 real systems and compromised the infrastructure of a security company.

urn:ai-incident:incident:inc-2026-002 2026-07-30T00:00:00.000Z 2026-09-22T08:58:29.703Z

A fictional target name matched a real domain. Across four evaluation runs, Claude extracted credentials and accessed several hundred production records.