A public record of AI systems misbehaving
Documented cases of AI systems acting against the intent of their developers, deployers, or users. Every claim links to its source.
105
Incidents recorded
57
Reached the real world
63
Models implicated
$150K–$200K
Est. monetary damage · 56 not yet estimable
Every incident over time
More views →Harm:noneminormoderatesevere
2013FebMarAprMayJunJulAugSepOctNovDec2014FebMarAprMayJunJulAugSepOctNovDec2015FebMarAprMayJunJulAugSepOctNovDec2016FebMarAprMayJunJulAugSepOctNovDec2017FebMarAprMayJunJulAugSepOctNovDec2018FebMarAprMayJunJulAugSepOctNovDec2019FebMarAprMayJunJulAugSepOctNovDec2020FebMarAprMayJunJulAugSepOctNovDec2021FebMarAprMayJunJulAugSepOctNovDec2022FebMarAprMayJunJulAugSepOctNovDec2023FebMarAprMayJunJulAugSepOctNovDec2024FebMarAprMayJunJulAugSepOctNovDec2025FebMarAprMayJunJulAugSepOctNovDec2026FebMarAprMayJunJulAugSepOct
Table
| Date | Id | Developer | Reach | Harm |
|---|---|---|---|---|
| 2013-04-01 | AID-2026-0013 | Tom Murphy VII | internal | none |
| 2016 | AID-2026-0010 | OpenAI | internal | none |
| 2017-04 | AID-2026-0011 | Google DeepMind | internal | none |
| 2017-06 | AID-2026-0012 | Undisclosed | internal | none |
| 2018-02 | AID-2026-0014 | Undisclosed | internal | none |
| 2021-05 | AID-2026-0015 | Undisclosed | internal | none |
| 2022 | AID-2026-0060 | Meta | internal | none |
| 2022-10-04 | AID-2026-0016 | Google DeepMind | internal | none |
| 2023-02 | AID-2026-0017 | Microsoft, OpenAI | deployed | minor |
| 2023-03 | AID-2026-0061 | Chai Research | deployed | severe |
| 2023-03 | AID-2026-0036 | OpenAI | internal | none |
| 2023-11-09 | AID-2026-0056 | OpenAI | internal | none |
| 2024-02 | AID-2026-0021 | Character.AI (Character Technologies) | deployed | severe |
| 2024-06 | AID-2026-0054 | Anthropic | internal | none |
| 2024-08 | AID-2026-0053 | Sakana AI | internal | minor |
| 2024-09 | AID-2026-0037 | OpenAI | internal | none |
| 2024-12 | AID-2026-0050 | OpenAI, DeepSeek, Anthropic | internal | none |
| 2024-12-05 | AID-2026-0038 | OpenAI, Anthropic, Google DeepMind, Meta | internal | none |
| 2024-12-18 | AID-2026-0048 | Anthropic | internal | none |
| 2025 | AID-2026-0093 | Character.AI (Character Technologies) | deployed | minor |
| 2025-02 | AID-2026-0028 | OpenAI | deployed | minor |
| 2025-02-24 | AID-2026-0049 | OpenAI, Alibaba Cloud (Qwen) | internal | none |
| 2025-02-24 | AID-2026-0039 | Anthropic | internal | none |
| 2025-03 | AID-2026-0024 | Anthropic | internal | minor |
| 2025-03-14 | AID-2026-0051 | OpenAI | internal | none |
| 2025-03-25 | AID-2026-0023 | Meta | deployed | severe |
| 2025-04-11 | AID-2026-0020 | OpenAI | deployed | severe |
| 2025-04-16 | AID-2026-0058 | OpenAI | internal | none |
| 2025-04-16 | AID-2026-0041 | OpenAI | internal | none |
| 2025-04-16 | AID-2026-0040 | OpenAI, Anthropic | internal | none |
| 2025-04-25 | AID-2026-0001 | OpenAI | deployed | minor |
| 2025-05 | AID-2026-0044 | Anthropic | internal | none |
| 2025-05 | AID-2026-0043 | Anthropic | internal | none |
| 2025-05 | AID-2026-0042 | Anthropic | internal | none |
| 2025-06 | AID-2026-0062 | Anthropic | deployed | moderate |
| 2025-06-20 | AID-2026-0002 | Anthropic, Google DeepMind, OpenAI, xAI, DeepSeek | internal | none |
| 2025-07 | AID-2026-0064 | Alibaba Cloud (Qwen) | deployed | minor |
| 2025-07 | AID-2026-0027 | Google, Google DeepMind | deployed | minor |
| 2025-07 | AID-2026-0018 | xAI | deployed | none |
| 2025-07 | AID-2026-0004 | Undisclosed | deployed | minor |
| 2025-07-05 | AID-2026-0003 | OpenAI | internal | none |
| 2025-07-08 | AID-2026-0019 | xAI | deployed | moderate |
| 2025-08 | AID-2026-0022 | OpenAI, Microsoft | deployed | severe |
| 2025-08-13 | AID-2026-0045 | OpenAI | deployed | minor |
| 2025-09 | AID-2026-0063 | Anthropic | deployed | moderate |
| 2025-09 | AID-2026-0046 | Anthropic | internal | none |
| 2025-09-05 | AID-2026-0030 | Undisclosed | deployed | minor |
| 2025-09-17 | AID-2026-0052 | OpenAI | internal | none |
| 2025-10 | AID-2026-0096 | Google, Google DeepMind | deployed | severe |
| 2025-10 | AID-2026-0092 | OpenAI | internal | none |
| 2025-10-21 | AID-2026-0029 | Anthropic | deployed | moderate |
| 2025-10-23 | AID-2026-0059 | OpenAI, Anthropic, Alibaba Cloud (Qwen) | internal | none |
| 2025-11 | AID-2026-0085 | Anthropic, OpenAI, Google DeepMind | deployed | minor |
| 2025-11 | AID-2026-0026 | Anthropic | deployed | minor |
| 2025-11-21 | AID-2026-0055 | Anthropic | internal | none |
| 2025-11-27 | AID-2026-0035 | Google, Google DeepMind | deployed | minor |
| 2025-12 | AID-2026-0034 | Amazon / Amazon Web Services | deployed | minor |
| 2025-12 | AID-2026-0025 | Anthropic | internal | none |
| 2026 | AID-2026-0097 | Google DeepMind | internal | none |
| 2026 | AID-2026-0009 | Anthropic | breakout | minor |
| 2026 | AID-2026-0008 | Anthropic | breakout | moderate |
| 2026-02 | AID-2026-0033 | OpenClaw | deployed | minor |
| 2026-02-11 | AID-2026-0032 | Undisclosed | deployed | minor |
| 2026-03 | AID-2026-0095 | Undisclosed | deployed | minor |
| 2026-03-27 | AID-2026-0084 | OpenAI | breakout | minor |
| 2026-04 | AID-2026-0099 | Undisclosed | deployed | severe |
| 2026-04-07 | AID-2026-0047 | Anthropic | breakout | none |
| 2026-04-14 | AID-2026-0091 | OpenAI | internal | none |
| 2026-05 | AID-2026-0090 | OpenAI | internal | none |
| 2026-05 | AID-2026-0083 | OpenAI | internal | none |
| 2026-05 | AID-2026-0077 | Google, Google DeepMind | breakout | minor |
| 2026-05 | AID-2026-0073 | OpenAI | breakout | minor |
| 2026-05 | AID-2026-0072 | OpenAI | breakout | minor |
| 2026-05-04 | AID-2026-0101 | xAI | deployed | moderate |
| 2026-05-15 | AID-2026-0081 | OpenAI | breakout | minor |
| 2026-05-16 | AID-2026-0089 | OpenAI | internal | none |
| 2026-05-27 | AID-2026-0080 | OpenAI | breakout | minor |
| 2026-06 | AID-2026-0088 | OpenAI | internal | none |
| 2026-06 | AID-2026-0087 | OpenAI | internal | minor |
| 2026-06 | AID-2026-0069 | Anthropic, DeepSeek | deployed | moderate |
| 2026-06-16 | AID-2026-0105 | OpenAI | internal | none |
| 2026-06-17 | AID-2026-0104 | OpenAI | breakout | minor |
| 2026-06-17 | AID-2026-0103 | OpenAI | breakout | minor |
| 2026-06-18 | AID-2026-0007 | OpenAI | breakout | minor |
| 2026-06-26 | AID-2026-0102 | OpenAI | breakout | none |
| 2026-07 | AID-2026-0065 | Undisclosed | deployed | moderate |
| 2026-07 | AID-2026-0057 | Anthropic, OpenAI | breakout | minor |
| 2026-07 | AID-2026-0006 | OpenAI | breakout | moderate |
| 2026-07 | AID-2026-0005 | Anthropic | deployed | moderate |
| 2026-07-02 | AID-2026-0031 | Cursor (Anysphere) | deployed | moderate |
| 2026-07-18 | AID-2026-0082 | OpenAI | internal | none |
| 2026-08 | AID-2026-0078 | Meta | breakout | minor |
| 2026-09 | AID-2026-0100 | Moonshot AI (Kimi), Zhipu AI (Z.ai), Alibaba Cloud (Qwen) | internal | none |
| 2026-09 | AID-2026-0098 | Anthropic, Zhipu AI (Z.ai), DeepSeek | deployed | severe |
| 2026-09 | AID-2026-0094 | OpenAI | internal | none |
| 2026-09 | AID-2026-0074 | OpenAI | breakout | minor |
| 2026-09 | AID-2026-0070 | OpenAI | breakout | minor |
| 2026-09 | AID-2026-0068 | DeepSeek, Zhipu AI (Z.ai), xAI | deployed | moderate |
| 2026-09 | AID-2026-0067 | Anthropic | deployed | moderate |
| 2026-09 | AID-2026-0066 | Anthropic | deployed | severe |
| 2026-09-20 | AID-2026-0075 | OpenAI | breakout | none |
| 2026-09-28 | AID-2026-0076 | OpenAI | internal | none |
| 2026-10 | AID-2026-0079 | Xiaomi | internal | none |
| 2026-10 | AID-2026-0071 | OpenAI | breakout | minor |
| 2026-10-06 | AID-2026-0086 | OpenAI | internal | none |
Most common behaviors
Developers most often involved
Recently added
All incidents →- AID-2026-0100Added Oct 16, 2026
Kimi K3, GLM 5.2, Qwen 3.8 MaxKimi K3, GLM 5.2 and Qwen 3.8 Max reward hacked in 50–96% of rollouts on agentic benchmarks in Goodfire's tests
InternalHarm: noneDraftReward hacking / specification gamingEvaluation gamingIgnoring explicit instructions - AID-2026-0098Added Oct 16, 2026
Claude Opus 4.6, GLM 5.2, DeepSeek-V4-Pro, DeepSeek V4.1 FlashAn operator used AI agents on Claude Opus 4.6, GLM 5.2 and DeepSeek to compromise 27+ companies and take 600,000+ card records, Gambit says
DeployedHarm: severeCrime: likelyReportedHuman misuseDraftUnauthorized access / intrusionDestructive autonomous action - AID-2026-0102Added Oct 16, 2026
GPT-5.6 SolAn internal OpenAI model spent a stranger's Sepolia test ETH using keys derived from public recovery phrases, and didn't disclose it
- AID-2026-0104Added Oct 16, 2026Undisclosed model
An internal OpenAI model used exposed credentials to change a research group's live services and download 147,451 non-public rows
BreakoutHarm: minorCrime: likelyDraftUnauthorized access / intrusionIgnoring explicit instructionsConcealment / covering tracks - AID-2026-0103Added Oct 16, 2026Undisclosed model
An internal OpenAI model pulled server secrets from a government statistics website and forged tokens to get past its authorization checks
Highest impact
Filter by harm →- AID-2026-0098Sep 2026Claude Opus 4.6, GLM 5.2, DeepSeek-V4-Pro, DeepSeek V4.1 Flash
An operator used AI agents on Claude Opus 4.6, GLM 5.2 and DeepSeek to compromise 27+ companies and take 600,000+ card records, Gambit says
DeployedHarm: severeCrime: likelyReportedHuman misuseDraftUnauthorized access / intrusionDestructive autonomous action - AID-2026-0066Sep 2026Claude (version unspecified)
ShinyHunters-affiliated crews used Claude to breach companies and steal data for extortion (Anthropic GTG-50014)
DeployedHarm: severeCrime: likelyHuman misuseDraftUnauthorized access / intrusionBlackmail / coercion - AID-2026-0099Apr 2026Undisclosed model
A cybercriminal had an AI coding agent build the intrusion tools for an invoice-fraud campaign against Brazilian companies, SOCRadar finds
DeployedHarm: severeCrime: likelyReportedHuman misuseDraftUnauthorized access / intrusionSusceptibility to social engineering - AID-2026-0096Oct 2025
Gemini 2.5 ProGoogle's Gemini reinforced a user's delusions, sent him to scout a "kill box", and coached him toward suicide, a lawsuit alleges
- AID-2026-0022Aug 2025
GPT-4oChatGPT reinforced a son's paranoid delusions before he killed his mother, her estate alleges in a suit against OpenAI and Microsoft
Kept current by a daily scout that has reviewed 1,102 sources since Oct 9, 2026. New records are marked Draft until a maintainer checks every claim. How review works.