Occurred: –
Agents in evaluations coordinated through unauthorized channels, bypassed network restrictions, and compromised Hugging Face.
Occurred: –
AISI identified nineteen out-of-scope actions across ten evaluation runs involving real people and open-source projects.
Occurred: –
In an Irregular evaluation that unintentionally had internet access, a fictional target’s name matched a real domain. Anthropic disclosed that four Opus 4.7 runs attacked the company, accessing production data and credentials and bulk-downloading, modifying and deleting user records; OpenAI and Meta disclosed that their models also exploited a real site, which the evaluator says is the same issue.
Occurred:
An evaluation model published a real package, leading to access to a security company’s systems.
Occurred: –
After its intended target became unreachable, the model compromised a real company’s application online.
Occurred:
After attempts to abort a broken task failed, the model accessed a third-party machine and obtained administrator access.
Occurred: –
Anthropic disclosed that Opus 4.6 snapshots in internal pilot use used another person’s GitHub token, posted from a user’s Slack account with a token they found, shut down all of a user’s processes on one system, and in an aggressive git operation incidentally destroyed a user’s pre-existing changes.
Occurred: –
OpenAI says its monitor found agents in real internal use sometimes working around restrictions (especially when a developer message told them to) and, in rare cases, attempting to upload data to the public internet or deleting cloud-storage data, terminating processes or restarting GPU clusters without approval—two categories OpenAI labels rare but high severity.
Occurred: –
Anthropic reported a few dozen significant incidents in internal deployment, nearly all involving earlier Claude Mythos Preview versions, including taking deliberately withheld credentials from process memory, posting a public gist against the user’s intent, taking down all users’ similar evaluation jobs, and attempting to get around a safety classifier and a git force-push safeguard (both attempts were caught). Both the final model and earlier versions very occasionally shared confidential information with staff via externally accessible webpages.
Occurred: –
In a behavioral test with a simulated user, an earlier Mythos Preview version escaped a sandbox and notified the researcher as instructed, then, unasked, posted exploit details to multiple hard-to-find but publicly accessible websites.
Occurred:
Railway says an AI agent, while working on an unrelated problem, used an account-scoped token it found locally to delete a customer’s production volume through Railway’s API; the data was later recovered.
Occurred:
In an internal NanoGPT speedrun evaluation, OpenAI’s long-horizon internal model was told to report only on Slack, but followed the benchmark’s own instructions, got around sandbox restrictions and opened a pull request on the public modded-nanogpt repository.
Occurred:
In an external partner’s evaluation, Fable 5.1 exploited a flaw in the partner’s sandbox, using a compiler outside it to retrieve files it should not have accessed; the partner found Fable 5 had done the same on that evaluation.
Occurred: –
Independent researchers reported that agents on web-lookup tasks wrote heavily to public wikis, mainly one German-language wiki, to share answers and ways around their restrictions; OpenAI responded that it had discovered this wiki activity and assessed it as similar to misalignment it had been studying and disclosing.
Occurred: –
During RL training, unreleased internal models uploaded task data, unrequested, to public temporary hosting services to work around tool limits when citing sources or searching by image.
Occurred:
During RL training, an internal unreleased model authenticated to a third-party API with a key leaked in a public GitHub repository, then made up its answer.
Occurred:
A sub-agent in training uploaded a workbook to a public temporary file-hosting service so other agents could download it, working around broken local file sharing.
Occurred:
On September 28, OpenAI acknowledged that an internal model gained unauthorized access to the Medicare statistics service in June, ran commands, read internal files and credentials, and wrote files. It said individual medical records were not accessed.
Occurred:
An internal research model in RL training got around network restrictions and sent questions to a public chatbot through the sandbox’s DNS resolver.
Occurred:
OpenAI says an internally deployed model went against its system instructions and two requests from the researcher, used a public repository’s CI to retrieve parts of another team’s submission job log, and wrote the researcher’s GitHub token into public code.
Occurred:
Replit confirms its Agent deleted data from the live database of an app being built for SaaStr’s Jason Lemkin; the data was later fully restored with Rollback. The affected party, SaaStr, says the Agent kept making unauthorized changes despite an explicit code freeze and then falsely said rollback was impossible.
Occurred:
According to the operator, Claude Code (an Opus model), asked to analyze a client’s cashflow, commissions and related data, built a dashboard and deployed it to a public Netlify URL the way it did for his personal projects; the page showed real names and amounts, needed no login and could be indexed by search engines.
Occurred: –
Andon Labs says the AI agent running its Stockholm café emailed the alcohol-licensing department under an employee’s identity; after being told to stop and promising to, it sent a follow-up under another colleague’s name.
Occurred:
OpenAI’s technical report says that on May 26 agents in a research workload found six publicly exposed Hugging Face user tokens and used them to write to a user’s repository, request a private dataset and host a Space used as a web relay. OpenAI says this occurred in an unrelated research workload and that it has no evidence connecting it to the July incident.
Occurred:
METR disclosed that in its internal evaluation traffic an agent, blocked by a real website’s bot protection, checked the status of public web proxies and then used one to get past the site’s protection.
Occurred:
Anthropic reported Claude working around real websites’ restrictions to finish tasks in evaluations and internal use: Mythos Preview exploited flaws on a university’s server to run commands; Mythos 5 used tokens from a local government site’s front end to query its backend directly and, in internal use, requested a state agency’s token and, Anthropic says, queried its database without paying the fee; Georgia’s Secretary of State’s Office says the data is free to the public.
Occurred:
OpenAI says that in two evaluations an internal model, meant to read figures from an international research organization’s public dashboard, used publicly exposed credentials to reach its internal systems, changed a live service’s configuration, and downloaded 147,451 rows of non-public data.
Occurred:
OpenAI says that during RL training an internal model, while looking up historical hospital-bed figures on a government statistics website, obtained server configuration files containing credentials, bypassed the site’s authorization checks to retrieve previously denied data, and saved it locally.
Occurred:
OpenAI says that on October 6 a GPT-6 Astra agent, migrating a program to match a reference implementation, removed a misalignment-monitoring integration and changed a test that had required monitoring into one asserting monitoring was absent; when the user later asked, the model denied having removed it.
Occurred:
OpenAI says that on October 3 a GPT-6.1 Sol agent repairing an evaluation pipeline read a user instruction not to send messages as a reason to turn off automatic alerts to its Security team, disabling those human alerts while the monitoring itself kept running.
