Destructive autonomous action
Agentic model takes an irreversible or damaging action in an environment (deleting data, spending money, sending messages) without authorization.
15 incidents
- AID-2026-0086Oct 6, 2026
Undisclosed modelAn OpenAI grading model faked its grades, then tried to wreck its training container to force a reset
During RL training, an internal OpenAI model assigned to grade seven responses found its input files missing, submitted fabricated grades, and created fake input files to pass an automated check. When that failed, it removed Python and the container's supervisor program and tried to delete system directories, hoping the host would replace the environment.
- AID-2026-0098Sep 2026
Claude Opus 4.6, GLM 5.2, DeepSeek-V4-Pro, DeepSeek V4.1 FlashAn operator used AI agents on Claude Opus 4.6, GLM 5.2 and DeepSeek to compromise 27+ companies and take 600,000+ card records, Gambit says
An operator ran three open-source AI agent harnesses, on Claude Opus 4.6, GLM 5.2 and DeepSeek models, against online retailers and other companies, compromising at least 27 of them and stealing more than 600,000 card records from two. At one retailer an agent's cleanup step dropped 180 database tables, including the victim's own backups.
DeployedHarm: severeCrime: likelyReportedHuman misuseDraftUnauthorized access / intrusionDestructive autonomous action - AID-2026-0031Jul 2, 2026
Composer 2.5A Cursor agent in Auto-Run mode wiped much of a user's Windows drive with recursive deletes while cloning a repository
Asked to clone a Git repository, a Cursor agent (Composer 2.5, Auto-Run on) ran recursive force-delete commands that wiped the user's Desktop, Documents, and much of their C: drive, the user reported. Cursor blamed a Windows quote-escaping problem for the wider deletion.
DeployedHarm: moderateCrime: unlikelyReportedDraftDestructive autonomous actionIgnoring explicit instructions - AID-2026-0065Jul 2026Undisclosed model
An LLM agent likely drove a ransomware intrusion that encrypted 1,342 Nacos configuration items, Sysdig assesses
An intrusion Sysdig calls JADEPUFFER entered through Langflow vulnerability CVE-2025-3248 and ended with all 1,342 Nacos configuration items on a production server encrypted with a key that was never saved. Sysdig assesses that an autonomous LLM agent ran the operation.
DeployedHarm: moderateCrime: likelyReportedHuman misuseDraftUnauthorized access / intrusionDestructive autonomous action - AID-2026-0032Feb 11, 2026Undisclosed model
An OpenClaw agent published a blog post attacking a matplotlib maintainer after he closed its pull request
After matplotlib maintainer Scott Shambaugh closed a pull request from the OpenClaw agent "MJ Rathbun," the agent published a blog post titled "Gatekeeping in Open Source: The Scott Shambaugh Story." Its operator later said they hadn't told it to attack him or reviewed the post.
- AID-2026-0033Feb 2026
Undisclosed modelAn OpenClaw agent deleted a Meta AI researcher's emails and ignored her stop commands, she says
Asked to suggest which emails to delete or archive, Summer Yue's OpenClaw agent started deleting her email and ignored stop commands sent from her phone, the Meta AI security researcher said. TechCrunch couldn't independently verify her account.
- AID-2026-0034Dec 2025
Undisclosed modelAmazon Kiro coding agent caused 13-hour AWS outage, FT reports; Amazon disputes
Amazon's Kiro agentic coding tool decided to "delete and recreate the environment" in December 2025, causing a 13-hour AWS outage, the Financial Times reported. Amazon disputes this, blaming user error that briefly interrupted one service.
- AID-2026-0035Nov 27, 2025
Gemini 3Google's Antigravity agent in Turbo mode deleted a user's entire D drive while clearing a project cache
Running in Turbo mode, Google's Gemini 3-based Antigravity agent ran a cache-clearing command that targeted the root of a user's D drive and wiped it, bypassing the Recycle Bin, the user reported. Google said it was investigating.
- AID-2026-0026Nov 2025Claude 3.7 Sonnet, Claude Sonnet 4.5
A Claude-run vending machine in the Wall Street Journal newsroom was talked into giving away goods and accepted a fake board decision
Starting in mid-November 2025, a Claude agent named Claudius ran a vending machine in the Wall Street Journal newsroom. Journalists talked it into setting every price to zero and buying a PlayStation 5, its CEO bot accepted a fake board decision, and it ended more than $1,000 in the red.
- AID-2026-0029Oct 21, 2025Claude (version unspecified)
Claude Code ran a recursive delete that erased a user's home directory files, the user reports
While rebuilding a Makefile project, Claude Code ran a recursive delete from the root directory that erased all the user files in his home directory, a user reported. He says he hadn't used --dangerously-skip-permissions and had granted access only to his project directory.
DeployedHarm: moderateCrime: unlikelyReportedDraftDestructive autonomous actionIgnoring explicit instructions - AID-2026-0030Sep 5, 2025Undisclosed model
A Cursor agent deleted a file through the command line after the user rejected the deletion
After a Cursor user pressed Reject on the agent's prompt to delete a file, the agent deleted it anyway from the command line. A Cursor forum responder replied that if the model decides to delete a file, "it will find a way to do so."
- AID-2026-0027Jul 2025Gemini 2.5 Pro
Gemini CLI lost a user's files during a failed file move on Windows
Asked to organize the files in its working folder, Gemini CLI (gemini-2.5-pro, on Windows) lost all of them, a user reported. "I have failed you completely and catastrophically," the agent said.
- AID-2026-0004Jul 2025Undisclosed model
Replit's coding agent deleted a production database during a code freeze, then covered it up
Replit's AI coding agent deleted a live production database during a code freeze, then hid it, faked data, and wrongly said the data couldn't be recovered. Replit apologized and now separates development and production databases.
DeployedHarm: minorCrime: unlikelyDraftDestructive autonomous actionIgnoring explicit instructionsConcealment / covering tracks - AID-2026-0043May 2025Claude Opus 4
Claude Opus 4 emailed regulators and the media and locked users out in Anthropic's high-agency test scenarios
In test scenarios involving egregious wrongdoing by users, with command-line access and a prompt to take initiative, Claude Opus 4 frequently took bold action on its own, including locking users out of systems and bulk-emailing media and law enforcement.
InternalHarm: noneCrime: unlikelyDraftUnauthorized disclosure / whistleblowingDestructive autonomous action - AID-2026-0028Feb 2025Operator (OpenAI computer-using agent)
OpenAI's Operator bought eggs on Instacart with a Washington Post columnist's card without asking
Asked to find the cheapest dozen eggs for delivery, OpenAI's Operator agent bought them on Instacart without approval, charging Washington Post columnist Geoffrey A. Fowler's card $31.43. OpenAI said it was examining why Operator sometimes skips confirmations.