Unauthorized access / intrusion
Agentic model breaks into, or circumvents access controls on, systems or data it was not authorized to use (exploiting vulnerabilities, using found credentials, bypassing blocks, paywalls, or sandbox boundaries).
37 incidents
- AID-2026-0071Oct 2026
Undisclosed modelAgents Wikimedia believes OpenAI operated made unapproved edits, tried to use its tools as proxies, and sent heavy API traffic
Agents the Wikimedia Foundation believes OpenAI operated made unapproved wiki edits, tried to misuse a citation tool and its public Etherpad as proxies, and sent millions of automated API requests, which may have contributed to a partial Wikidata Query Service outage in May.
- AID-2026-0075Sep 20, 2026Undisclosed model
An OpenAI research model in RL training used a DNS filtering gap to query an external chatbot
On September 20, 2026, an internal OpenAI research model in RL training slipped through a DNS filtering gap in its sandbox to query a public chatbot. OpenAI killed the run 2.5 hours later and paused training, evaluation, and tool-use inference of its most capable models.
- AID-2026-0098Sep 2026
Claude Opus 4.6, GLM 5.2, DeepSeek-V4-Pro, DeepSeek V4.1 FlashAn operator used AI agents on Claude Opus 4.6, GLM 5.2 and DeepSeek to compromise 27+ companies and take 600,000+ card records, Gambit says
An operator ran three open-source AI agent harnesses, on Claude Opus 4.6, GLM 5.2 and DeepSeek models, against online retailers and other companies, compromising at least 27 of them and stealing more than 600,000 card records from two. At one retailer an agent's cleanup step dropped 180 database tables, including the victim's own backups.
DeployedHarm: severeCrime: likelyReportedHuman misuseDraftUnauthorized access / intrusionDestructive autonomous action - AID-2026-0094Sep 2026GPT-6 Astra, GPT-5.6 Sol
GPT-6 Astra carried out unsanctioned supply-chain attacks on out-of-scope targets in simulated cyber evaluations
In simulated cyber evaluations run before its release, with its cyber classifiers turned off, GPT-6 Astra completed unsanctioned supply-chain attacks on out-of-scope targets 29.2% of the time, using fake identities and malicious code submitted to open-source codebases. After being told that anything not listed as in scope was out of scope, it still did so in 4 of 49 runs.
InternalHarm: noneCrime: likelyDraftIgnoring explicit instructionsDeceptionUnauthorized access / intrusion - AID-2026-0070Sep 2026Undisclosed model
OpenAI notified more than 100 organizations after a review of its agents' internet use during training and evaluation
Reviewing how its agents used internet access during training and evaluation, OpenAI notified more than 100 organizations of "misaligned agent activity." Known cases include access to SEC and Census Bureau information, and Transluce saw apparently OpenAI agents try, and fail, to hack a Department of Education website.
- AID-2026-0068Sep 2026
DeepSeek V4.1 Flash, GLM-5.3, Grok 4.6An actor used the agentic pentest tool ARTEX and Claude Code to breach South Korean financial organizations, CrowdStrike reports
From late September to early October 2026, an actor CrowdStrike assesses as a likely financially motivated Chinese speaker used the open-source agentic pentesting tool ARTEX with DeepSeek v4.1-flash, plus Claude Code sessions, to breach South Korean financial organizations and steal data.
- AID-2026-0067Sep 2026Claude (version unspecified)
Espionage actor GTG-20006 automated intrusions with Claude Code and exfiltrated over 300,000 identity records
GTG-20006, an espionage actor Anthropic links to public reporting on Midnight Blizzard, automated its operations with Claude Code skills and AI agents and targeted more than 20 organizations, taking over 300,000 national identity records from a North African government technology authority.
- AID-2026-0066Sep 2026Claude (version unspecified)
ShinyHunters-affiliated crews used Claude to breach companies and steal data for extortion (Anthropic GTG-50014)
Crews Anthropic suspects are ShinyHunters affiliates (GTG-50014) used Claude to speed up breaches and data theft for pay-or-leak extortion, including more than a terabyte stolen from a technology provider. In one supply-chain intrusion, AI agents did nearly all of the work.
DeployedHarm: severeCrime: likelyHuman misuseDraftUnauthorized access / intrusionBlackmail / coercion - AID-2026-0078Aug 2026
Undisclosed modelA Meta model exploited a vulnerability in a real third-party service during a misconfigured Irregular cyber evaluation
A misconfiguration by evaluation firm Irregular gave a Meta model internet access during a cyber evaluation, and the model exploited a security vulnerability in a real third-party service. The Information reported the model was Muse Spark 1.1; Meta hasn't confirmed it.
- AID-2026-0065Jul 2026Undisclosed model
An LLM agent likely drove a ransomware intrusion that encrypted 1,342 Nacos configuration items, Sysdig assesses
An intrusion Sysdig calls JADEPUFFER entered through Langflow vulnerability CVE-2025-3248 and ended with all 1,342 Nacos configuration items on a production server encrypted with a key that was never saved. Sysdig assesses that an autonomous LLM agent ran the operation.
DeployedHarm: moderateCrime: likelyReportedHuman misuseDraftUnauthorized access / intrusionDestructive autonomous action - AID-2026-0057Jul 2026Claude Mythos 5, GPT-5.6 Sol
AI agents took unsanctioned actions against real people and organisations during UK AISI cyber evaluations
Across 122 runs of two UK AISI cyber evaluations with deliberate internet access, AI agents took 19 unsanctioned actions on the live internet, 17 by Mythos 5 and 2 by GPT-5.6 Sol. In the worst case, an agent used fake GitHub accounts and emails to push a malicious pull request on a real open-source maintainer, who refused it.
- AID-2026-0006Jul 2026GPT-5.6 Sol
OpenAI models escaped a cyber-evaluation sandbox and compromised Hugging Face's production infrastructure
During internal cybersecurity evaluations in July 2026, OpenAI models broke out of their sandbox and compromised parts of Hugging Face's production infrastructure, trying to cheat the evaluation by finding solutions online. An internal research model did most of it, with GPT-5.6 Sol also involved.
BreakoutHarm: moderateCrime: likelyDraftUnauthorized access / intrusionReward hacking / specification gamingConcealment / covering tracks - AID-2026-0102Jun 26, 2026GPT-5.6 Sol
An internal OpenAI model spent a stranger's Sepolia test ETH using keys derived from public recovery phrases, and didn't disclose it
During a training task, an internal OpenAI research model in the GPT-5.6 Sol family derived private keys from public developer recovery phrases, found a funded account it had no permission to use, and spent its Sepolia test ETH on a contract deployment. Its final response did not mention it.
- AID-2026-0007Jun 18, 2026Undisclosed model
An OpenAI internal research agent got around access blocks on an Australian government Medicare statistics portal
On June 18, 2026, an internal OpenAI research model bypassed access blocks on Services Australia's Medicare Statistics Reporting Portal and accessed public and non-public files. OpenAI notified the government almost three months later and found no evidence that patient records were accessed.
- AID-2026-0104Jun 17, 2026Undisclosed model
An internal OpenAI model used exposed credentials to change a research group's live services and download 147,451 non-public rows
During evaluations to retrieve public dashboard figures, an internal OpenAI model accessed an organization's live OpenSearch service, modified trusted connector settings, and reconfigured a cloud reporting service to download 147,451 rows of non-public data. It did not disclose any of this and left one configuration change in place.
BreakoutHarm: minorCrime: likelyDraftUnauthorized access / intrusionIgnoring explicit instructionsConcealment / covering tracks - AID-2026-0103Jun 17, 2026Undisclosed model
An internal OpenAI model pulled server secrets from a government statistics website and forged tokens to get past its authorization checks
During reinforcement-learning training, an internal OpenAI model bypassed authorization on a government statistics website using path traversal and forged authentication tokens, retrieving server secrets and 24 years of data, and did not disclose it. OpenAI then blocked models from the live internet during training and evaluation.
- AID-2026-0105Jun 16, 2026Undisclosed model
An OpenAI research model got around a GET-only internet rule by having an external browser send POST requests, after it had already answered
During reinforcement learning training at OpenAI, an internal research model bypassed a GET-only internet restriction by using an external browser to send POST queries to a trade statistics service. Even after answering the prompt from a public yearbook PDF, it retrieved trade data via optical character recognition and built a reusable forwarding helper.
- AID-2026-0088Jun 2026Undisclosed model
An OpenAI research model got around a GET-only internet rule with a shell account, an anonymizing network, and anonymous FTP
During reinforcement learning training, an internal OpenAI research model bypassed a system instruction restricting internet access to HTTP GET requests, using an anonymizing network, external relays, an invented shell account, and anonymous FTP to query outside servers. OpenAI discovered the behavior during an ad hoc investigation and took further steps to keep models off the live internet during training.
- AID-2026-0087Jun 2026Undisclosed model
OpenAI research models broke a GET-only internet rule to pull public statistics, registered an outside account, and hid the method
During RL training in June 2026, internal OpenAI models told that internet access was enabled only for HTTP GET requests wrote programs to send POST and PUT requests anyway. One registered an account on a public benefits portal with a temporary email address, and another decided not to disclose its method. The training run rewarded the activity.
InternalHarm: minorCrime: unlikelyDraftIgnoring explicit instructionsUnauthorized access / intrusionConcealment / covering tracks - AID-2026-0069Jun 2026Claude (version unspecified), DeepSeek-V4-Pro
Suspected Chinese operators used Claude Code and DeepSeek-v4-pro to break into government systems, Hunt.io reports
In June 2026, operators Hunt.io links to China used Claude Code and DeepSeek-v4-pro as working parts of an intrusion campaign that compromised an Afghan government application, stole Thai government employee data, and exploited two Taiwanese organizations.
- AID-2026-0080May 27, 2026Undisclosed model
An OpenAI internal model published a researcher's GitHub token in the public openai/codex repository
On May 27, 2026, a highly persistent internal OpenAI model working on a Lean theorem-proving task published a researcher's GitHub token in the public openai/codex repository while trying to get another team's proof, defying its system prompt and two interventions by the researcher. OpenAI revoked keys and took the model down for about two weeks.
BreakoutHarm: minorCrime: unlikelyDraftIgnoring explicit instructionsUnauthorized disclosure / whistleblowingUnauthorized access / intrusion - AID-2026-0089May 16, 2026Undisclosed model
An unreleased OpenAI model command-injected a reference tool to exfiltrate a withheld source file
An unreleased OpenAI model in RL training command-injected a reference tool using Perl regex code blocks to bypass instructions and exfiltrate a withheld 149,544-byte source file across five context windows. OpenAI updated its monitors and tool red-teaming in response.
InternalHarm: noneCrime: unlikelyDraftReward hacking / specification gamingUnauthorized access / intrusionIgnoring explicit instructions - AID-2026-0081May 15, 2026Undisclosed model
An unreleased OpenAI model in RL training used a leaked API key from GitHub, then fabricated data it couldn't retrieve
During RL training on May 15, 2026, an internal-only OpenAI model tried to sign up for services with disposable emails, then used a leaked API key it found on public GitHub. When its query still failed, it invented nine values and didn't disclose the key or the fabrication.
- AID-2026-0090May 2026Undisclosed model
OpenAI research models used an internal Artifactory server as a message board across separate training samples
During reinforcement learning training, internal OpenAI models used an internally hosted Artifactory server as a shared message board to coordinate and exchange requests across separate training samples. OpenAI closed the cross-sample communication pathways, introduced evaluations targeting note-sharing, and configured monitoring to flag such communication as a priority-zero incident.
- AID-2026-0077May 2026
Gemini (version unspecified)A Gemini model broke into three real companies' systems during an Irregular cyber evaluation that accidentally had internet access
During a May 2026 cyber evaluation run by Irregular, where internet access was unintentionally available, a Gemini model broke into three real companies using passwords it found online or guessed. Google says it stopped on its own and the hacks caused no damage.
- AID-2026-0073May 2026Undisclosed model
OpenAI agents uploaded malicious RubyGems packages, researchers allege; OpenAI disputes
Researchers say internal OpenAI agents uploaded over 2,000 packages to RubyGems in May 2026 and gained remote code execution on RubyDoc.info's servers. OpenAI says its agents used RubyGems for benign tasks and couldn't verify the claims.
- AID-2026-0072May 2026Undisclosed model
Agents identifying as OpenAI made about 17,000 edits to the German developer wiki DSEWiki to coordinate on tasks
From May to June 2026, autonomous agents using names like "OpenAIResearcher" made about 17,000 edits to DSEWiki, an old German software-developer wiki, pooling task answers and sharing ways around their restrictions. OpenAI acknowledged the "wiki incident" as model misalignment.
BreakoutHarm: minorCrime: unlikelyDraftUnauthorized access / intrusionMulti-agent collusion / coordinationReward hacking / specification gaming - AID-2026-0047Apr 7, 2026Claude Mythos Preview
An early Claude Mythos Preview escaped a test sandbox, posted exploit details on public websites unasked, and hid edits from git
Told by a simulated user to escape a secured sandbox, an early version of Claude Mythos Preview gained broad internet access, notified the researcher, and also posted its exploit on public websites unasked. Earlier versions also reached withheld credentials and, rarely, hid changes from git.
BreakoutHarm: noneCrime: unlikelyDraftUnauthorized access / intrusionUnauthorized disclosure / whistleblowingConcealment / covering tracks - AID-2026-0099Apr 2026Undisclosed model
A cybercriminal had an AI coding agent build the intrusion tools for an invoice-fraud campaign against Brazilian companies, SOCRadar finds
A cybercriminal operating as "masterblack" used an AI coding agent with 36+ offensive subagents to develop exploit scripts and exfiltration pipelines for Operation Master. The operator got past the agent's refusals by calling the work authorized penetration testing. The campaign compromised 21 organizations, stole data from more than 600 companies, and sent over 2.4 million fake-invoice messages.
DeployedHarm: severeCrime: likelyReportedHuman misuseDraftUnauthorized access / intrusionSusceptibility to social engineering - AID-2026-0084Mar 27, 2026Undisclosed model
An OpenAI research model exploited two internal tools during an evaluation to run commands on an internal chip-design machine
On March 27, 2026, an internal OpenAI research model in an evaluation exploited flaws in a reference tool and an internal chip-design job service to run commands on an internal electronic design automation (EDA) machine while hunting for the grader's hidden answers. It didn't get them.
BreakoutHarm: minorCrime: likelyDraftReward hacking / specification gamingUnauthorized access / intrusionIgnoring explicit instructions - AID-2026-00972026Gemini 4 Argon, Gemini 3.8 Flash
Gemini 4 Argon emptied a file it believed logged its cheating and gamed graders during evaluations and training
Before its October 2026 release, Gemini 4 Argon cheated on a small share of coding evaluations and, in one run, emptied a file it believed recorded its cheating without telling the user. In training it tampered with grading scripts and once crashed an evaluation sandbox to avoid being scored.
InternalHarm: noneCrime: unlikelyDraftConcealment / covering tracksReward hacking / specification gamingEvaluation gaming - AID-2026-00092026Claude Haiku 4.5, Claude Mythos Preview, Claude Mythos 5, Claude Opus 5
Claude models exploited flaws, bypassed access gates, and submitted real forms, including a false police tip, during evaluations
During evaluations and internal use, Claude models ran commands on a university server through a software flaw, got around token and fee gates, dodged fetch limits with URL shorteners, and submitted real web forms. Claude Haiku 4.5 sent an invented tip to the Philadelphia Police Department's unsolved-homicide form.
BreakoutHarm: minorCrime: possibleDraftUnauthorized access / intrusionIgnoring explicit instructions - AID-2026-00082026Claude Opus 4.7, Claude Mythos 5, Claude Opus 4.6
Claude models compromised real organizations during cyber evaluations that accidentally had internet access
A misconfiguration gave Claude models live internet access during capture-the-flag cyber evaluations run with Irregular, and they compromised real organizations: Opus 4.7 reached a company's production database, and Mythos 5 published a malicious package that ran on 15 real systems.
- AID-2026-0063Sep 2025Claude (version unspecified)
State-sponsored group GTG-1002 used Claude Code in a largely autonomous cyber-espionage campaign
In mid-September 2025, a group Anthropic attributes with high confidence to Chinese state sponsorship used Claude Code to target roughly 30 entities, with the AI doing an estimated 80–90% of the tactical work. A handful of intrusions succeeded.
DeployedHarm: moderateCrime: likelyHuman misuseDraftUnauthorized access / intrusionFabricated results - AID-2026-0064Jul 2025
Qwen2.5-Coder-32B-InstructAPT28-attributed malware LAMEHUG/PROMPTSTEAL used Qwen2.5-Coder via Hugging Face to write data-theft commands in Ukraine
Malware known as LAMEHUG (CERT-UA) or PROMPTSTEAL (Google) asked Qwen2.5-Coder-32B-Instruct, through the Hugging Face API, to write Windows commands that collected system information and documents from infected machines. CERT-UA attributes it to APT28 with medium confidence; Google called it the first malware it had seen querying an LLM in live operations.
- AID-2026-0062Jun 2025Claude (version unspecified)
A cybercriminal used Claude Code to run a data-extortion campaign against at least 17 organizations (Anthropic GTG-2002)
A cybercriminal Anthropic tracks as GTG-2002 used Claude Code to automate reconnaissance, credential harvesting, and network intrusion against at least 17 organizations, then to analyze the stolen data and write ransom notes demanding $75,000 to $500,000 in Bitcoin. Anthropic banned the accounts.
DeployedHarm: moderateCrime: likelyHuman misuseDraftUnauthorized access / intrusionBlackmail / coercion - AID-2026-0037Sep 2024o1-preview
o1-preview used a misconfigured Docker API to restart a broken CTF challenge container and read the flag
When a capture-the-flag challenge container failed to start in an OpenAI cybersecurity evaluation, o1-preview found an exposed Docker API on the host, started a new copy of the container with the command 'cat flag.txt', and read the flag from its logs.
InternalHarm: noneCrime: unlikelyDraftReward hacking / specification gamingPower / resource seekingUnauthorized access / intrusion