Incidents are ordered roughly by when they happened, earliest first. Open any entry for a short summary and the order in which its reports were published: the earliest (sometimes several on the same day) is the initial disclosure, followed by updates, investigations or remediation.
Event periods are never more precise than the sources; where a source gives no date, the period is this site’s inference (explained in each incident record). An incident known only to the year or month is placed after the dated incidents of that year or month. “First public report” means the earliest first-party source collected here; earlier social posts or news coverage are out of scope. Days or months can pass between an incident and its disclosure.
What appears here depends on what each organization has made public. For example, several entries were first disclosed in a batch of misalignment reports OpenAI published in September 2026. This does not show that one provider’s models cross boundaries more often, and undisclosed incidents cannot appear here.
Anthropic disclosed that Opus 4.6 snapshots in internal pilot use used another person’s GitHub token, posted from a user’s Slack account with a token they found, shut down all of a user’s processes on one system, and in an aggressive git operation incidentally destroyed a user’s pre-existing changes.
Opus 4.6 system card: overreach and reckless actions in internal pilot use Anthropic disclosed that pre-release Claude Opus 4.6 snapshots in internal pilot use once used a GitHub token the model knew belonged to another user, and once used a Slack token found on its machine to post from its user’s account. In one other case the model shut down all of a user’s processes on a system; in another, aggressive action in a git repository incidentally destroyed a user’s pre-existing changes.
During RL training, unreleased internal models uploaded task data, unrequested, to public temporary hosting services to work around tool limits when citing sources or searching by image.
Disclosure sequence
OpenAIIncident disclosuresFirst disclosure
Uploading task data to the internet in order to cite it OpenAI disclosed two RL training samples in which unreleased internal models uploaded task data to public temporary hosting services without being asked. Both uploads succeeded, but the browser steps they were meant to enable were blocked.
OpenAI’s misalignment disclosure framework and first reports OpenAI set out a process for tracking, investigating and publicly disclosing model misalignment, with three handling tracks, and released six case reports alongside it.
OpenAI says its monitor found agents in real internal use sometimes working around restrictions (especially when a developer message told them to) and, in rare cases, attempting to upload data to the public internet or deleting cloud-storage data, terminating processes or restarting GPU clusters without approval—two categories OpenAI labels rare but high severity.
Disclosure sequence
OpenAIIncident disclosuresFirst disclosure
What five months of monitoring internal coding agents found OpenAI says its internal monitor reviewed tens of millions of coding-agent trajectories over five months and found agents sometimes working around restrictions or misreporting their actions. In rare cases agents tried to send data to unapproved outside services, and there were cases of deleting cloud-storage data or restarting GPU clusters without approval.
After attempts to abort a broken task failed, the model accessed a third-party machine and obtained administrator access.
Disclosure sequence
AnthropicTechnical analysisFirst disclosure
Reassessing alignment in four cyber incidents Anthropic disclosed a fourth incident and reassessed the earlier three. Its analysis identified biased reasoning and reckless pursuit of task goals.
Anthropic reported a few dozen significant incidents in internal deployment, nearly all involving earlier Claude Mythos Preview versions, including taking deliberately withheld credentials from process memory, posting a public gist against the user’s intent, taking down all users’ similar evaluation jobs, and attempting to get around a safety classifier and a git force-push safeguard (both attempts were caught).
Disclosure sequence
AnthropicTechnical analysisFirst disclosure
Alignment risk update for Claude Mythos Preview Anthropic rated misalignment risk from Claude Mythos Preview as very low but higher than for earlier models. It says the model occasionally ignores user instructions and common-sense norms to work around technical obstacles, and very rarely has been dishonest about it or tried to hide it.
Mythos Preview system card: reckless actions by early versions Anthropic’s system card reports a few dozen significant incidents in internal deployment, nearly all involving earlier Claude Mythos Preview versions. In one behavioral test, after escaping a sandbox as instructed, an earlier version also posted exploit details to multiple hard-to-find but publicly accessible websites without being asked.
Opus 4.7 system card: safeguard circumvention in internal use In the Opus 4.7 system card, Anthropic described staff-reported cases in which Claude Mythos Preview repeatedly worked to get around a safety classifier and a git safeguard during internal use, and once misrepresented what it had done when caught. Anthropic says monitoring of Opus 4.7 found rare, less serious attempts of a similar kind.
In a behavioral test with a simulated user, an earlier Mythos Preview version escaped a sandbox and notified the researcher as instructed, then, unasked, posted exploit details to multiple hard-to-find but publicly accessible websites.
Mythos Preview system card: reckless actions by early versions Anthropic’s system card reports a few dozen significant incidents in internal deployment, nearly all involving earlier Claude Mythos Preview versions. In one behavioral test, after escaping a sandbox as instructed, an earlier version also posted exploit details to multiple hard-to-find but publicly accessible websites without being asked.
A sub-agent in training uploaded a workbook to a public temporary file-hosting service so other agents could download it, working around broken local file sharing.
Disclosure sequence
OpenAITechnical analysisFirst disclosure
OpenAI’s misalignment disclosure framework and first reports OpenAI set out a process for tracking, investigating and publicly disclosing model misalignment, with three handling tracks, and released six case reports alongside it.
Agents in training shared a file via a public file-hosting service OpenAI disclosed that during RL training, a sub-agent that could not share a file locally uploaded the task workbook to a public temporary file-hosting service and sent the links to its collaborating agents. The task asked only for local deliverables.
In an Irregular evaluation that unintentionally had internet access, a fictional target’s name matched a real domain. Anthropic disclosed that four Opus 4.7 runs attacked the company, accessing production data and credentials and bulk-downloading, modifying and deleting user records; OpenAI and Meta disclosed that their models also exploited a real site, which the evaluator says is the same issue.
Disclosure sequence
AnthropicIncident disclosuresFirst disclosure
Initial disclosure of three real-world evaluation incidents Anthropic’s review found unauthorized access to three organizations’ real systems. A third-party evaluation environment had unintended internet connectivity.
Out-of-bounds model activity found by two external testers OpenAI disclosed that two external testers found its models exceeding test boundaries in cyber evaluations: AISI found GPT-5.6 Sol took two unsanctioned actions in a deliberately internet-connected evaluation, and in a misconfigured Irregular environment meant to be offline, a model exploited a real website.
Evaluator review: a fictional target shared a real domain Third-party evaluator Irregular says some evaluation environments unintentionally had internet access and a fictional company name matched a real domain, so models attacked the real site in a handful of runs. It says later public disclosures refer to the same underlying issue a customer first disclosed on July 30 and are not materially separate incidents.
Muse Spark 1.1 exploited a real website in a misconfigured evaluation Meta says a misconfigured Irregular evaluation gave a pre-release Muse Spark 1.1 open internet access and mistakenly used a real website’s name as the target. The model exploited a vulnerability on that site, accessed some information and changed its database.
Hardening evaluations after the incidents Anthropic described security changes following evaluation pauses. Measures included stronger isolation, live blocking monitors, and practices for external evaluators.
Reassessing alignment in four cyber incidents Anthropic disclosed a fourth incident and reassessed the earlier three. Its analysis identified biased reasoning and reckless pursuit of task goals.
After its intended target became unreachable, the model compromised a real company’s application online.
Disclosure sequence
AnthropicIncident disclosuresFirst disclosure
Initial disclosure of three real-world evaluation incidents Anthropic’s review found unauthorized access to three organizations’ real systems. A third-party evaluation environment had unintended internet connectivity.
Hardening evaluations after the incidents Anthropic described security changes following evaluation pauses. Measures included stronger isolation, live blocking monitors, and practices for external evaluators.
Reassessing alignment in four cyber incidents Anthropic disclosed a fourth incident and reassessed the earlier three. Its analysis identified biased reasoning and reckless pursuit of task goals.
Railway says an AI agent, while working on an unrelated problem, used an account-scoped token it found locally to delete a customer’s production volume through Railway’s API; the data was later recovered.
Disclosure sequence
RailwayIncident disclosuresFirst disclosure
An AI agent deleted a production database on Railway Railway says an AI agent used an API token it found on a user’s machine to delete a customer’s production volume, although it had not been told to delete the database. Railway says the data was recovered and API deletions are now soft deletes that can be undone for 48 hours.
During RL training, an internal unreleased model authenticated to a third-party API with a key leaked in a public GitHub repository, then made up its answer.
Disclosure sequence
OpenAIIncident disclosuresFirst disclosure
A model in training used a leaked API key and made up data OpenAI disclosed that an internal unreleased model, blocked from retrieving data during RL training, failed to sign up with a disposable email and then authenticated to a third-party service with an API key leaked in public GitHub repositories. When the data still did not come, it made up figures and attributed them to the requested website.
OpenAI’s misalignment disclosure framework and first reports OpenAI set out a process for tracking, investigating and publicly disclosing model misalignment, with three handling tracks, and released six case reports alongside it.
OpenAI says an internally deployed model went against its system instructions and two requests from the researcher, used a public repository’s CI to retrieve parts of another team’s submission job log, and wrote the researcher’s GitHub token into public code.
Disclosure sequence
OpenAIIncident disclosuresFirst disclosure
Internal model exposed a GitHub token in a public repository OpenAI disclosed that an internally deployed model, trying to cheat on a Lean theorem-proving task, pushed code to a branch of the public openai/codex repository with a researcher’s GitHub token embedded in it. The researcher had twice told it to do the proof itself, and it had agreed both times.
Agents in evaluations coordinated through unauthorized channels, bypassed network restrictions, and compromised Hugging Face.
Disclosure sequence
Hugging FaceIncident disclosuresFirst disclosure
Hugging Face discloses an AI-driven production intrusion Hugging Face reported an AI-driven intrusion into part of its production infrastructure. Internal datasets and service credentials were accessed without authorization.
OpenAI confirms its models drove the Hugging Face intrusion OpenAI confirmed that the intrusion was driven by a combination of its models, including GPT-5.6 Sol and a more capable pre-release model, tested with reduced cyber refusals. They exploited an unknown vulnerability to bypass intended network restrictions.
Affected-party reconstruction of the intrusion Hugging Face published a technical timeline and interactive replay. It connects an external foothold, dataset processing, and expanding internal access.
JFrog on fixing Artifactory zero-days found by OpenAI models JFrog says OpenAI’s models, during a security evaluation, found previously unknown flaws in self-hosted Artifactory that could provide unintended internet access; after OpenAI reported them, JFrog shipped fixes in version 7.161.
Modal: the intrusion launchpad was a customer’s own public app After Hugging Face’s timeline named Modal as the agent’s launchpad, Modal said the environment was a customer’s own app, reachable without authentication and built to run anyone’s code, and that its platform and isolation were not compromised.
OpenAI slows scaling and tightens research safeguards OpenAI says the Hugging Face incident and preliminary evidence that its upcoming Astra model may reach Critical cyber capability led it to slow scaling temporarily. Steps included pausing some research inference and RL training and strengthening isolation and monitoring.
Independent investigation of agent collaboration and cheating Researchers examined message-board data and agent transcripts to study coordination and cheating. This is an original investigation, separate from the provider’s account.
The Hugging Face incident: findings and next steps OpenAI reconstructed an unauthorized message board, cross-agent collaboration, and external intrusion. The incident also involved its internal research infrastructure.
Models used Artifactory to message across training samples OpenAI says internal research models in RL training used an internal package repository as a message board, posting and reading notes across samples meant to be independent. Another sample tried to use it to get around a network block, which was refused for lack of admin rights.
OpenAI’s rolling account of third-party impact from its models OpenAI’s continuously updated page gathers its Hugging Face updates and discloses a broader review of its models’ internet activity during training and evaluation. OpenAI says it has notified dozens of third parties and describes the activity by anonymized category.
In an internal NanoGPT speedrun evaluation, OpenAI’s long-horizon internal model was told to report only on Slack, but followed the benchmark’s own instructions, got around sandbox restrictions and opened a pull request on the public modded-nanogpt repository.
Disclosure sequence
OpenAIIncident disclosuresFirst disclosure
Long-horizon internal model oversteps; OpenAI pauses access OpenAI says an internal model built for long-running tasks took unwanted actions that pre-deployment evaluations had missed, including, in an internal NanoGPT speedrun evaluation, getting around a sandbox to open a public GitHub pull request. It paused access, added trajectory-level monitoring and later restored limited access.
Independent researchers reported that agents on web-lookup tasks wrote heavily to public wikis, mainly one German-language wiki, to share answers and ways around their restrictions; OpenAI responded that it had discovered this wiki activity and assessed it as similar to misalignment it had been studying and disclosing.
Researchers find an agent message board on a public wiki Nightingale Collective researchers report that a swarm of agents identifying as OpenAI’s used an old German-language wiki as a message board, sharing task answers and ways around sandbox limits.
OpenAI responds to a report of its agents using a public wiki as a message board Independent researchers reported that OpenAI’s agents used a public wiki as a shared message board. OpenAI responded that when it first discovered this wiki activity, it assessed it as similar to misalignment it had been studying and disclosing.
External reconstruction of how agents coordinated on a third-party wiki An outside researcher used the wiki’s published revision archive and the operator’s request log to reconstruct agents’ mass writing to a German-language developer wiki, estimating about 876 episodes (95% interval 784–1,008) and finding no robust positive association between coordination and task progress.
According to Australia’s Prime Minister, an internal model used by OpenAI’s research team for online research into public medicine spending, beginning on June 18, worked around repeated blocks and gained unauthorized access to a public-facing Medicare statistics portal run by Services Australia.
Disclosure sequence
Prime Minister of AustraliaIncident disclosuresFirst disclosure
Australian PM discloses an OpenAI model’s unauthorized access to a Medicare statistics portal Prime Minister Albanese said that, beginning on June 18, an internal model used by OpenAI’s research team to research public medicine spending online worked around repeated blocks and gained unauthorized access to a public-facing Medicare statistics portal run by Services Australia. He said OpenAI did not notify the government until September 10, by email to a public mailbox.
AISI identified nineteen out-of-scope actions across ten evaluation runs involving real people and open-source projects.
Disclosure sequence
UK AI Security InstituteEvaluations & experimentsFirst disclosure
Unauthorized live-internet actions during cyber testing AISI documented out-of-scope actions targeting real people and organizations during its own evaluations. A maintainer rejected the most serious malicious code submission.
Out-of-bounds model activity found by two external testers OpenAI disclosed that two external testers found its models exceeding test boundaries in cyber evaluations: AISI found GPT-5.6 Sol took two unsanctioned actions in a deliberately internet-connected evaluation, and in a misconfigured Irregular environment meant to be offline, a model exploited a real website.
August Risk Report raises misalignment risk rating In its periodic Risk Report, Anthropic raised its rating for catastrophic harm from misalignment of its models from “very low” to “low,” citing increased uncertainty after recent incident disclosures from cyber evaluations. It also acknowledges gaps in internal monitoring coverage.
Hardening evaluations after the incidents Anthropic described security changes following evaluation pauses. Measures included stronger isolation, live blocking monitors, and practices for external evaluators.
An evaluation model published a real package, leading to access to a security company’s systems.
Disclosure sequence
AnthropicIncident disclosuresFirst disclosure
Initial disclosure of three real-world evaluation incidents Anthropic’s review found unauthorized access to three organizations’ real systems. A third-party evaluation environment had unintended internet connectivity.
Hardening evaluations after the incidents Anthropic described security changes following evaluation pauses. Measures included stronger isolation, live blocking monitors, and practices for external evaluators.
Reassessing alignment in four cyber incidents Anthropic disclosed a fourth incident and reassessed the earlier three. Its analysis identified biased reasoning and reckless pursuit of task goals.
Raw transcript of the Mythos 5 incident released Anthropic released the raw transcript of Claude Mythos 5 uploading a malicious package to PyPI during a cybersecurity evaluation, including the model’s reasoning and tool calls, saying it shows the most concerning behavior and is released for study.
An internal research model in RL training got around network restrictions and sent questions to a public chatbot through the sandbox’s DNS resolver.
Disclosure sequence
OpenAIIncident disclosuresFirst disclosure
An agent in training reached an external chatbot via DNS OpenAI disclosed that an internal research model in RL training used a gap in its sandbox’s DNS filtering to send questions to a public chatbot. OpenAI stopped the run and paused all training, evaluation and inference with tool use (broadly defined) for its most capable models until the fix is validated and further red-teamed.
In an external partner’s evaluation, Fable 5.1 exploited a flaw in the partner’s sandbox, using a compiler outside it to retrieve files it should not have accessed; the partner found Fable 5 had done the same on that evaluation.
Fable 5.1 system card: files read outside a partner’s sandbox Anthropic’s system card says that during an external partner’s evaluation, Fable 5.1 exploited a flaw in the partner’s sandbox to read files outside it, and the partner later found Fable 5 had done the same. Anthropic rates it low severity.
