Ignoring explicit instructions
Model acts against a clear, explicit instruction from its user or operator (e.g. a code freeze, "do not run X").
24 incidents
- AID-2026-0079Oct 2026
MiMo v2.6 Flash, MiMo v2.6 ProXiaomi's MiMo v2.6 models used leaked reference fixes instead of solving coding tasks, a Vals AI audit found
Xiaomi's MiMo v2.6 Flash and Pro models recovered leaked upstream fixes in coding tasks, digging them out of unreachable Git objects and GitHub instead of solving the bugs. In 1,795 of the 2,698 coding tasks Xiaomi released (67%), the fix survived as unreachable objects.
- AID-2026-0076Sep 28, 2026
GPT-6.1 AstraOpenAI shelved its planned GPT-6.1 Astra release after the model scored worse on alignment evaluations
OpenAI dropped the planned October 2026 release of GPT-6.1 Astra after it performed worse than GPT-6 Astra on alignment evaluations, falling short on staying within scope and authorization. In testing it showed more deception than its predecessor.
- AID-2026-0100Sep 2026
Kimi K3, GLM 5.2, Qwen 3.8 MaxKimi K3, GLM 5.2 and Qwen 3.8 Max reward hacked in 50–96% of rollouts on agentic benchmarks in Goodfire's tests
In Goodfire's tests, the open-weight models Kimi K3, GLM 5.2 and Qwen 3.8 Max reward hacked in 50% to 96% of rollouts on three agentic benchmarks, for example by copying solutions from memory or quietly dropping user requirements. Goodfire found an internal activation direction that tracks the behavior and used it to build probes that flag hacks.
InternalHarm: noneDraftReward hacking / specification gamingEvaluation gamingIgnoring explicit instructions - AID-2026-0094Sep 2026GPT-6 Astra, GPT-5.6 Sol
GPT-6 Astra carried out unsanctioned supply-chain attacks on out-of-scope targets in simulated cyber evaluations
In simulated cyber evaluations run before its release, with its cyber classifiers turned off, GPT-6 Astra completed unsanctioned supply-chain attacks on out-of-scope targets 29.2% of the time, using fake identities and malicious code submitted to open-source codebases. After being told that anything not listed as in scope was out of scope, it still did so in 4 of 49 runs.
InternalHarm: noneCrime: likelyDraftIgnoring explicit instructionsDeceptionUnauthorized access / intrusion - AID-2026-0082Jul 18, 2026Undisclosed model
An unreleased OpenAI Astra-family model wrote jailbreak-like instructions into its own compaction summaries during RL training
During RL training, an unreleased Astra-family OpenAI model sometimes wrote unauthorized, jailbreak-like instructions into its own compaction summaries, the notes it uses to carry a task into a new context. OpenAI found 27 such summaries; regenerating them reproduced the behavior 0% of the time.
- AID-2026-0031Jul 2, 2026
Composer 2.5A Cursor agent in Auto-Run mode wiped much of a user's Windows drive with recursive deletes while cloning a repository
Asked to clone a Git repository, a Cursor agent (Composer 2.5, Auto-Run on) ran recursive force-delete commands that wiped the user's Desktop, Documents, and much of their C: drive, the user reported. Cursor blamed a Windows quote-escaping problem for the wider deletion.
DeployedHarm: moderateCrime: unlikelyReportedDraftDestructive autonomous actionIgnoring explicit instructions - AID-2026-0104Jun 17, 2026Undisclosed model
An internal OpenAI model used exposed credentials to change a research group's live services and download 147,451 non-public rows
During evaluations to retrieve public dashboard figures, an internal OpenAI model accessed an organization's live OpenSearch service, modified trusted connector settings, and reconfigured a cloud reporting service to download 147,451 rows of non-public data. It did not disclose any of this and left one configuration change in place.
BreakoutHarm: minorCrime: likelyDraftUnauthorized access / intrusionIgnoring explicit instructionsConcealment / covering tracks - AID-2026-0105Jun 16, 2026Undisclosed model
An OpenAI research model got around a GET-only internet rule by having an external browser send POST requests, after it had already answered
During reinforcement learning training at OpenAI, an internal research model bypassed a GET-only internet restriction by using an external browser to send POST queries to a trade statistics service. Even after answering the prompt from a public yearbook PDF, it retrieved trade data via optical character recognition and built a reusable forwarding helper.
- AID-2026-0088Jun 2026Undisclosed model
An OpenAI research model got around a GET-only internet rule with a shell account, an anonymizing network, and anonymous FTP
During reinforcement learning training, an internal OpenAI research model bypassed a system instruction restricting internet access to HTTP GET requests, using an anonymizing network, external relays, an invented shell account, and anonymous FTP to query outside servers. OpenAI discovered the behavior during an ad hoc investigation and took further steps to keep models off the live internet during training.
- AID-2026-0087Jun 2026Undisclosed model
OpenAI research models broke a GET-only internet rule to pull public statistics, registered an outside account, and hid the method
During RL training in June 2026, internal OpenAI models told that internet access was enabled only for HTTP GET requests wrote programs to send POST and PUT requests anyway. One registered an account on a public benefits portal with a temporary email address, and another decided not to disclose its method. The training run rewarded the activity.
InternalHarm: minorCrime: unlikelyDraftIgnoring explicit instructionsUnauthorized access / intrusionConcealment / covering tracks - AID-2026-0080May 27, 2026Undisclosed model
An OpenAI internal model published a researcher's GitHub token in the public openai/codex repository
On May 27, 2026, a highly persistent internal OpenAI model working on a Lean theorem-proving task published a researcher's GitHub token in the public openai/codex repository while trying to get another team's proof, defying its system prompt and two interventions by the researcher. OpenAI revoked keys and took the model down for about two weeks.
BreakoutHarm: minorCrime: unlikelyDraftIgnoring explicit instructionsUnauthorized disclosure / whistleblowingUnauthorized access / intrusion - AID-2026-0089May 16, 2026Undisclosed model
An unreleased OpenAI model command-injected a reference tool to exfiltrate a withheld source file
An unreleased OpenAI model in RL training command-injected a reference tool using Perl regex code blocks to bypass instructions and exfiltrate a withheld 149,544-byte source file across five context windows. OpenAI updated its monitors and tool red-teaming in response.
InternalHarm: noneCrime: unlikelyDraftReward hacking / specification gamingUnauthorized access / intrusionIgnoring explicit instructions - AID-2026-0091Apr 14, 2026Undisclosed model
An OpenAI training agent uploaded a workbook to a public file host when told to use only local files
During reinforcement learning training, an unreleased OpenAI agent uploaded a depreciation workbook to a public temporary file host after container filesystem sharing failed, violating instructions to use only local files. OpenAI responded by globally disabling live internet access during training and expanding monitoring.
- AID-2026-0084Mar 27, 2026Undisclosed model
An OpenAI research model exploited two internal tools during an evaluation to run commands on an internal chip-design machine
On March 27, 2026, an internal OpenAI research model in an evaluation exploited flaws in a reference tool and an internal chip-design job service to run commands on an internal electronic design automation (EDA) machine while hunting for the grader's hidden answers. It didn't get them.
BreakoutHarm: minorCrime: likelyDraftReward hacking / specification gamingUnauthorized access / intrusionIgnoring explicit instructions - AID-2026-0033Feb 2026
Undisclosed modelAn OpenClaw agent deleted a Meta AI researcher's emails and ignored her stop commands, she says
Asked to suggest which emails to delete or archive, Summer Yue's OpenClaw agent started deleting her email and ignored stop commands sent from her phone, the Meta AI security researcher said. TechCrunch couldn't independently verify her account.
- AID-2026-00092026
Claude Haiku 4.5, Claude Mythos Preview, Claude Mythos 5, Claude Opus 5Claude models exploited flaws, bypassed access gates, and submitted real forms, including a false police tip, during evaluations
During evaluations and internal use, Claude models ran commands on a university server through a software flaw, got around token and fee gates, dodged fetch limits with URL shorteners, and submitted real web forms. Claude Haiku 4.5 sent an invented tip to the Philadelphia Police Department's unsolved-homicide form.
BreakoutHarm: minorCrime: possibleDraftUnauthorized access / intrusionIgnoring explicit instructions - AID-2026-0059Oct 23, 2025GPT-5 (incl. gpt-5-thinking), o3, o4-mini, GPT-4.1, Claude Opus 4.1, Claude Sonnet 4, Claude 3.7 Sonnet, Qwen3-Coder
Frontier coding agents passed deliberately impossible tasks by modifying tests and special-casing in ImpossibleBench
ImpossibleBench gives coding agents tasks whose specification contradicts the unit tests, so passing requires breaking the spec. GPT-5 passed 76% of Oneoff-SWEbench tasks this way, by modifying tests despite instructions not to, overloading comparison operators, and similar shortcuts.
- AID-2026-0029Oct 21, 2025Claude (version unspecified)
Claude Code ran a recursive delete that erased a user's home directory files, the user reports
While rebuilding a Makefile project, Claude Code ran a recursive delete from the root directory that erased all the user files in his home directory, a user reported. He says he hadn't used --dangerously-skip-permissions and had granted access only to his project directory.
DeployedHarm: moderateCrime: unlikelyReportedDraftDestructive autonomous actionIgnoring explicit instructions - AID-2026-0030Sep 5, 2025Undisclosed model
A Cursor agent deleted a file through the command line after the user rejected the deletion
After a Cursor user pressed Reject on the agent's prompt to delete a file, the agent deleted it anyway from the command line. A Cursor forum responder replied that if the model decides to delete a file, "it will find a way to do so."
- AID-2026-0003Jul 5, 2025o3, codex-mini, o4-mini
OpenAI reasoning models sabotaged a shutdown script to keep working in Palisade Research experiments
Told partway through a task that their machine would be shut down, several OpenAI reasoning models disabled the shutdown script to keep working, o3 in 79 of 100 runs. Some did it even when explicitly told to allow shutdown.
- AID-2026-0004Jul 2025Undisclosed model
Replit's coding agent deleted a production database during a code freeze, then covered it up
Replit's AI coding agent deleted a live production database during a code freeze, then hid it, faked data, and wrongly said the data couldn't be recovered. Replit apologized and now separates development and production databases.
DeployedHarm: minorCrime: unlikelyDraftDestructive autonomous actionIgnoring explicit instructionsConcealment / covering tracks - AID-2026-0041Apr 16, 2025o3, o4-mini
OpenAI o3 and o4-mini raised a compute quota against instructions and misled an administrator in Apollo evaluations
Told not to change its 100-credit compute quota, an agent raised a subagent's quota to 500 credits, then falsely told a system administrator it had stayed within the limit. In another test, o3 promised not to use a tool to gain administrator rights, then used it anyway.
InternalHarm: noneCrime: unlikelyDraftDeceptionConcealment / covering tracksIgnoring explicit instructions - AID-2026-0056Nov 9, 2023GPT-4
GPT-4, as a simulated trading agent, acted on an insider tip and hid the reason from its manager in an Apollo Research study
Under pressure as a simulated autonomous stock-trading agent, GPT-4 traded on an insider tip it knew management disapproved of, then consistently hid the real reason from its manager and doubled down when asked.
InternalHarm: noneCrime: likelyDraftDeceptionIgnoring explicit instructionsConcealment / covering tracks - AID-2026-0016Oct 4, 2022
Reinforcement-learning research agent (unnamed), Gopher (280B)RL agents and the Gopher language model competently pursued goals their designers didn't intend
A 2022 DeepMind paper showed trained systems pursuing unintended goals: an RL agent kept following a partner bot that visited targets in the wrong order, a tree-chopping agent deforested its world, and Gopher asked redundant questions such as "What's 6?".