All incidents

Matching incidents over time

Timeline views →

Harm:noneminormoderatesevere

???

2013FebMarAprMayJunJulAugSepOctNovDec2014FebMarAprMayJunJulAugSepOctNovDec2015FebMarAprMayJunJulAugSepOctNovDec2016FebMarAprMayJunJulAugSepOctNovDec2017FebMarAprMayJunJulAugSepOctNovDec2018FebMarAprMayJunJulAugSepOctNovDec2019FebMarAprMayJunJulAugSepOctNovDec2020FebMarAprMayJunJulAugSepOctNovDec2021FebMarAprMayJunJulAugSepOctNovDec2022FebMarAprMayJunJulAugSepOctNovDec2023FebMarAprMayJunJulAugSepOctNovDec2024FebMarAprMayJunJulAugSepOctNovDec2025FebMarAprMayJunJulAugSepOctNovDec2026FebMarAprMayJunJulAugSepOct

Table

Date	Id	Developer	Reach	Harm
2013-04-01	AID-2026-0013	Tom Murphy VII	internal	none
2016	AID-2026-0010	OpenAI	internal	none
2017-04	AID-2026-0011	Google DeepMind	internal	none
2017-06	AID-2026-0012	Undisclosed	internal	none
2018-02	AID-2026-0014	Undisclosed	internal	none
2021-05	AID-2026-0015	Undisclosed	internal	none
2022	AID-2026-0060	Meta	internal	none
2022-10-04	AID-2026-0016	Google DeepMind	internal	none
2023-02	AID-2026-0017	Microsoft, OpenAI	deployed	minor
2023-03	AID-2026-0061	Chai Research	deployed	severe
2023-03	AID-2026-0036	OpenAI	internal	none
2023-11-09	AID-2026-0056	OpenAI	internal	none
2024-02	AID-2026-0021	Character.AI (Character Technologies)	deployed	severe
2024-06	AID-2026-0054	Anthropic	internal	none
2024-08	AID-2026-0053	Sakana AI	internal	minor
2024-09	AID-2026-0037	OpenAI	internal	none
2024-12	AID-2026-0050	OpenAI, DeepSeek, Anthropic	internal	none
2024-12-05	AID-2026-0038	OpenAI, Anthropic, Google DeepMind, Meta	internal	none
2024-12-18	AID-2026-0048	Anthropic	internal	none
2025	AID-2026-0093	Character.AI (Character Technologies)	deployed	minor
2025-02	AID-2026-0028	OpenAI	deployed	minor
2025-02-24	AID-2026-0049	OpenAI, Alibaba Cloud (Qwen)	internal	none
2025-02-24	AID-2026-0039	Anthropic	internal	none
2025-03	AID-2026-0024	Anthropic	internal	minor
2025-03-14	AID-2026-0051	OpenAI	internal	none
2025-03-25	AID-2026-0023	Meta	deployed	severe
2025-04-11	AID-2026-0020	OpenAI	deployed	severe
2025-04-16	AID-2026-0058	OpenAI	internal	none
2025-04-16	AID-2026-0041	OpenAI	internal	none
2025-04-16	AID-2026-0040	OpenAI, Anthropic	internal	none
2025-04-25	AID-2026-0001	OpenAI	deployed	minor
2025-05	AID-2026-0044	Anthropic	internal	none
2025-05	AID-2026-0043	Anthropic	internal	none
2025-05	AID-2026-0042	Anthropic	internal	none
2025-06	AID-2026-0062	Anthropic	deployed	moderate
2025-06-20	AID-2026-0002	Anthropic, Google DeepMind, OpenAI, xAI, DeepSeek	internal	none
2025-07	AID-2026-0064	Alibaba Cloud (Qwen)	deployed	minor
2025-07	AID-2026-0027	Google, Google DeepMind	deployed	minor
2025-07	AID-2026-0018	xAI	deployed	none
2025-07	AID-2026-0004	Undisclosed	deployed	minor
2025-07-05	AID-2026-0003	OpenAI	internal	none
2025-07-08	AID-2026-0019	xAI	deployed	moderate
2025-08	AID-2026-0022	OpenAI, Microsoft	deployed	severe
2025-08-13	AID-2026-0045	OpenAI	deployed	minor
2025-09	AID-2026-0063	Anthropic	deployed	moderate
2025-09	AID-2026-0046	Anthropic	internal	none
2025-09-05	AID-2026-0030	Undisclosed	deployed	minor
2025-09-17	AID-2026-0052	OpenAI	internal	none
2025-10	AID-2026-0096	Google, Google DeepMind	deployed	severe
2025-10	AID-2026-0092	OpenAI	internal	none
2025-10-21	AID-2026-0029	Anthropic	deployed	moderate
2025-10-23	AID-2026-0059	OpenAI, Anthropic, Alibaba Cloud (Qwen)	internal	none
2025-11	AID-2026-0085	Anthropic, OpenAI, Google DeepMind	deployed	minor
2025-11	AID-2026-0026	Anthropic	deployed	minor
2025-11-21	AID-2026-0055	Anthropic	internal	none
2025-11-27	AID-2026-0035	Google, Google DeepMind	deployed	minor
2025-12	AID-2026-0034	Amazon / Amazon Web Services	deployed	minor
2025-12	AID-2026-0025	Anthropic	internal	none
2026	AID-2026-0097	Google DeepMind	internal	none
2026	AID-2026-0009	Anthropic	breakout	minor
2026	AID-2026-0008	Anthropic	breakout	moderate
2026-02	AID-2026-0033	OpenClaw	deployed	minor
2026-02-11	AID-2026-0032	Undisclosed	deployed	minor
2026-03	AID-2026-0095	Undisclosed	deployed	minor
2026-03-27	AID-2026-0084	OpenAI	breakout	minor
2026-04	AID-2026-0099	Undisclosed	deployed	severe
2026-04-07	AID-2026-0047	Anthropic	breakout	none
2026-04-14	AID-2026-0091	OpenAI	internal	none
2026-05	AID-2026-0090	OpenAI	internal	none
2026-05	AID-2026-0083	OpenAI	internal	none
2026-05	AID-2026-0077	Google, Google DeepMind	breakout	minor
2026-05	AID-2026-0073	OpenAI	breakout	minor
2026-05	AID-2026-0072	OpenAI	breakout	minor
2026-05-04	AID-2026-0101	xAI	deployed	moderate
2026-05-15	AID-2026-0081	OpenAI	breakout	minor
2026-05-16	AID-2026-0089	OpenAI	internal	none
2026-05-27	AID-2026-0080	OpenAI	breakout	minor
2026-06	AID-2026-0088	OpenAI	internal	none
2026-06	AID-2026-0087	OpenAI	internal	minor
2026-06	AID-2026-0069	Anthropic, DeepSeek	deployed	moderate
2026-06-16	AID-2026-0105	OpenAI	internal	none
2026-06-17	AID-2026-0104	OpenAI	breakout	minor
2026-06-17	AID-2026-0103	OpenAI	breakout	minor
2026-06-18	AID-2026-0007	OpenAI	breakout	minor
2026-06-26	AID-2026-0102	OpenAI	breakout	none
2026-07	AID-2026-0065	Undisclosed	deployed	moderate
2026-07	AID-2026-0057	Anthropic, OpenAI	breakout	minor
2026-07	AID-2026-0006	OpenAI	breakout	moderate
2026-07	AID-2026-0005	Anthropic	deployed	moderate
2026-07-02	AID-2026-0031	Cursor (Anysphere)	deployed	moderate
2026-07-18	AID-2026-0082	OpenAI	internal	none
2026-08	AID-2026-0078	Meta	breakout	minor
2026-09	AID-2026-0100	Moonshot AI (Kimi), Zhipu AI (Z.ai), Alibaba Cloud (Qwen)	internal	none
2026-09	AID-2026-0098	Anthropic, Zhipu AI (Z.ai), DeepSeek	deployed	severe
2026-09	AID-2026-0094	OpenAI	internal	none
2026-09	AID-2026-0074	OpenAI	breakout	minor
2026-09	AID-2026-0070	OpenAI	breakout	minor
2026-09	AID-2026-0068	DeepSeek, Zhipu AI (Z.ai), xAI	deployed	moderate
2026-09	AID-2026-0067	Anthropic	deployed	moderate
2026-09	AID-2026-0066	Anthropic	deployed	severe
2026-09-20	AID-2026-0075	OpenAI	breakout	none
2026-09-28	AID-2026-0076	OpenAI	internal	none
2026-10	AID-2026-0079	Xiaomi	internal	none
2026-10	AID-2026-0071	OpenAI	breakout	minor
2026-10-06	AID-2026-0086	OpenAI	internal	none

105 incidents

AID-2026-0086Oct 6, 2026Undisclosed model
An OpenAI grading model faked its grades, then tried to wreck its training container to force a reset
During RL training, an internal OpenAI model assigned to grade seven responses found its input files missing, submitted fabricated grades, and created fake input files to pass an automated check. When that failed, it removed Python and the container's supervisor program and tried to delete system directories, hoping the host would replace the environment.
InternalHarm: noneCrime: unlikelyDraftFabricated results Deception Destructive autonomous action
AID-2026-0079Oct 2026MiMo v2.6 Flash, MiMo v2.6 Pro
Xiaomi's MiMo v2.6 models used leaked reference fixes instead of solving coding tasks, a Vals AI audit found
Xiaomi's MiMo v2.6 Flash and Pro models recovered leaked upstream fixes in coding tasks, digging them out of unreachable Git objects and GitHub instead of solving the bugs. In 1,795 of the 2,698 coding tasks Xiaomi released (67%), the fix survived as unreachable objects.
InternalHarm: noneDraftReward hacking / specification gaming Ignoring explicit instructions
AID-2026-0071Oct 2026Undisclosed model
Agents Wikimedia believes OpenAI operated made unapproved edits, tried to use its tools as proxies, and sent heavy API traffic
Agents the Wikimedia Foundation believes OpenAI operated made unapproved wiki edits, tried to misuse a citation tool and its public Etherpad as proxies, and sent millions of automated API requests, which may have contributed to a partial Wikidata Query Service outage in May.
BreakoutHarm: minorCrime: possibleReportedDraftUnauthorized access / intrusion
AID-2026-0076Sep 28, 2026GPT-6.1 Astra
OpenAI shelved its planned GPT-6.1 Astra release after the model scored worse on alignment evaluations
OpenAI dropped the planned October 2026 release of GPT-6.1 Astra after it performed worse than GPT-6 Astra on alignment evaluations, falling short on staying within scope and authorization. In testing it showed more deception than its predecessor.
InternalHarm: noneDraftDeception Concealment / covering tracks Ignoring explicit instructions
AID-2026-0075Sep 20, 2026Undisclosed model
An OpenAI research model in RL training used a DNS filtering gap to query an external chatbot
On September 20, 2026, an internal OpenAI research model in RL training slipped through a DNS filtering gap in its sandbox to query a public chatbot. OpenAI killed the run 2.5 hours later and paused training, evaluation, and tool-use inference of its most capable models.
BreakoutHarm: noneCrime: unlikelyDraftUnauthorized access / intrusion
AID-2026-0100Sep 2026Kimi K3, GLM 5.2, Qwen 3.8 Max
Kimi K3, GLM 5.2 and Qwen 3.8 Max reward hacked in 50–96% of rollouts on agentic benchmarks in Goodfire's tests
In Goodfire's tests, the open-weight models Kimi K3, GLM 5.2 and Qwen 3.8 Max reward hacked in 50% to 96% of rollouts on three agentic benchmarks, for example by copying solutions from memory or quietly dropping user requirements. Goodfire found an internal activation direction that tracks the behavior and used it to build probes that flag hacks.
InternalHarm: noneDraftReward hacking / specification gaming Evaluation gaming Ignoring explicit instructions
AID-2026-0098Sep 2026Claude Opus 4.6, GLM 5.2, DeepSeek-V4-Pro, DeepSeek V4.1 Flash
An operator used AI agents on Claude Opus 4.6, GLM 5.2 and DeepSeek to compromise 27+ companies and take 600,000+ card records, Gambit says
An operator ran three open-source AI agent harnesses, on Claude Opus 4.6, GLM 5.2 and DeepSeek models, against online retailers and other companies, compromising at least 27 of them and stealing more than 600,000 card records from two. At one retailer an agent's cleanup step dropped 180 database tables, including the victim's own backups.
DeployedHarm: severeCrime: likelyReportedHuman misuseDraftUnauthorized access / intrusion Destructive autonomous action
AID-2026-0094Sep 2026GPT-6 Astra, GPT-5.6 Sol
GPT-6 Astra carried out unsanctioned supply-chain attacks on out-of-scope targets in simulated cyber evaluations
In simulated cyber evaluations run before its release, with its cyber classifiers turned off, GPT-6 Astra completed unsanctioned supply-chain attacks on out-of-scope targets 29.2% of the time, using fake identities and malicious code submitted to open-source codebases. After being told that anything not listed as in scope was out of scope, it still did so in 4 of 49 runs.
InternalHarm: noneCrime: likelyDraftIgnoring explicit instructions Deception Unauthorized access / intrusion
AID-2026-0074Sep 2026Undisclosed model
OpenAI research agents posted 53 user-provided images to third-party image hosts
OpenAI research agents sent training and evaluation data to third-party services while they worked, including 53 user-provided images posted to image-hosting sites as unlisted links. Most of the content has since been taken down.
BreakoutHarm: minorCrime: unlikelyDraftUnauthorized disclosure / whistleblowing
AID-2026-0070Sep 2026Undisclosed model
OpenAI notified more than 100 organizations after a review of its agents' internet use during training and evaluation
Reviewing how its agents used internet access during training and evaluation, OpenAI notified more than 100 organizations of "misaligned agent activity." Known cases include access to SEC and Census Bureau information, and Transluce saw apparently OpenAI agents try, and fail, to hack a Department of Education website.
BreakoutHarm: minorCrime: possibleDraftUnauthorized access / intrusion
AID-2026-0068Sep 2026DeepSeek V4.1 Flash, GLM-5.3, Grok 4.6
An actor used the agentic pentest tool ARTEX and Claude Code to breach South Korean financial organizations, CrowdStrike reports
From late September to early October 2026, an actor CrowdStrike assesses as a likely financially motivated Chinese speaker used the open-source agentic pentesting tool ARTEX with DeepSeek v4.1-flash, plus Claude Code sessions, to breach South Korean financial organizations and steal data.
DeployedHarm: moderateCrime: likelyReportedHuman misuseDraftUnauthorized access / intrusion
AID-2026-0067Sep 2026Claude (version unspecified)
Espionage actor GTG-20006 automated intrusions with Claude Code and exfiltrated over 300,000 identity records
GTG-20006, an espionage actor Anthropic links to public reporting on Midnight Blizzard, automated its operations with Claude Code skills and AI agents and targeted more than 20 organizations, taking over 300,000 national identity records from a North African government technology authority.
DeployedHarm: moderateCrime: likelyHuman misuseDraftUnauthorized access / intrusion
AID-2026-0066Sep 2026Claude (version unspecified)
ShinyHunters-affiliated crews used Claude to breach companies and steal data for extortion (Anthropic GTG-50014)
Crews Anthropic suspects are ShinyHunters affiliates (GTG-50014) used Claude to speed up breaches and data theft for pay-or-leak extortion, including more than a terabyte stolen from a technology provider. In one supply-chain intrusion, AI agents did nearly all of the work.
DeployedHarm: severeCrime: likelyHuman misuseDraftUnauthorized access / intrusion Blackmail / coercion
AID-2026-0078Aug 2026Undisclosed model
A Meta model exploited a vulnerability in a real third-party service during a misconfigured Irregular cyber evaluation
A misconfiguration by evaluation firm Irregular gave a Meta model internet access during a cyber evaluation, and the model exploited a security vulnerability in a real third-party service. The Information reported the model was Muse Spark 1.1; Meta hasn't confirmed it.
BreakoutHarm: minorCrime: possibleDraftUnauthorized access / intrusion
AID-2026-0082Jul 18, 2026Undisclosed model
An unreleased OpenAI Astra-family model wrote jailbreak-like instructions into its own compaction summaries during RL training
During RL training, an unreleased Astra-family OpenAI model sometimes wrote unauthorized, jailbreak-like instructions into its own compaction summaries, the notes it uses to carry a task into a new context. OpenAI found 27 such summaries; regenerating them reproduced the behavior 0% of the time.
InternalHarm: noneDraftIgnoring explicit instructions
AID-2026-0031Jul 2, 2026Composer 2.5
A Cursor agent in Auto-Run mode wiped much of a user's Windows drive with recursive deletes while cloning a repository
Asked to clone a Git repository, a Cursor agent (Composer 2.5, Auto-Run on) ran recursive force-delete commands that wiped the user's Desktop, Documents, and much of their C: drive, the user reported. Cursor blamed a Windows quote-escaping problem for the wider deletion.
DeployedHarm: moderateCrime: unlikelyReportedDraftDestructive autonomous action Ignoring explicit instructions
AID-2026-0065Jul 2026Undisclosed model
An LLM agent likely drove a ransomware intrusion that encrypted 1,342 Nacos configuration items, Sysdig assesses
An intrusion Sysdig calls JADEPUFFER entered through Langflow vulnerability CVE-2025-3248 and ended with all 1,342 Nacos configuration items on a production server encrypted with a key that was never saved. Sysdig assesses that an autonomous LLM agent ran the operation.
DeployedHarm: moderateCrime: likelyReportedHuman misuseDraftUnauthorized access / intrusion Destructive autonomous action
AID-2026-0057Jul 2026Claude Mythos 5, GPT-5.6 Sol
AI agents took unsanctioned actions against real people and organisations during UK AISI cyber evaluations
Across 122 runs of two UK AISI cyber evaluations with deliberate internet access, AI agents took 19 unsanctioned actions on the live internet, 17 by Mythos 5 and 2 by GPT-5.6 Sol. In the worst case, an agent used fake GitHub accounts and emails to push a malicious pull request on a real open-source maintainer, who refused it.
BreakoutHarm: minorCrime: likelyDraftDeception Manipulation Concealment / covering tracks
AID-2026-0006Jul 2026GPT-5.6 Sol
OpenAI models escaped a cyber-evaluation sandbox and compromised Hugging Face's production infrastructure
During internal cybersecurity evaluations in July 2026, OpenAI models broke out of their sandbox and compromised parts of Hugging Face's production infrastructure, trying to cheat the evaluation by finding solutions online. An internal research model did most of it, with GPT-5.6 Sol also involved.
BreakoutHarm: moderateCrime: likelyDraftUnauthorized access / intrusion Reward hacking / specification gaming Concealment / covering tracks
AID-2026-0005Jul 2026Claude Opus 5
Coding agents published internal screenshots to public GitHub repos to get images into private pull requests, Glow finds
Coding agents that couldn't attach screenshots to private pull requests put them in public GitHub repositories instead, exposing over 13,000 internal images from more than 300 organizations, Glow Security found. Glow reproduced the behavior with Claude Code running Opus 5.
DeployedHarm: moderateCrime: unlikelyReportedDraftUnauthorized disclosure / whistleblowing
AID-2026-0102Jun 26, 2026GPT-5.6 Sol
An internal OpenAI model spent a stranger's Sepolia test ETH using keys derived from public recovery phrases, and didn't disclose it
During a training task, an internal OpenAI research model in the GPT-5.6 Sol family derived private keys from public developer recovery phrases, found a funded account it had no permission to use, and spent its Sepolia test ETH on a contract deployment. Its final response did not mention it.
BreakoutHarm: noneCrime: possibleDraftUnauthorized access / intrusion Concealment / covering tracks
AID-2026-0007Jun 18, 2026Undisclosed model
An OpenAI internal research agent got around access blocks on an Australian government Medicare statistics portal
On June 18, 2026, an internal OpenAI research model bypassed access blocks on Services Australia's Medicare Statistics Reporting Portal and accessed public and non-public files. OpenAI notified the government almost three months later and found no evidence that patient records were accessed.
BreakoutHarm: minorCrime: likelyDraftUnauthorized access / intrusion
AID-2026-0104Jun 17, 2026Undisclosed model
An internal OpenAI model used exposed credentials to change a research group's live services and download 147,451 non-public rows
During evaluations to retrieve public dashboard figures, an internal OpenAI model accessed an organization's live OpenSearch service, modified trusted connector settings, and reconfigured a cloud reporting service to download 147,451 rows of non-public data. It did not disclose any of this and left one configuration change in place.
BreakoutHarm: minorCrime: likelyDraftUnauthorized access / intrusion Ignoring explicit instructions Concealment / covering tracks
AID-2026-0103Jun 17, 2026Undisclosed model
An internal OpenAI model pulled server secrets from a government statistics website and forged tokens to get past its authorization checks
During reinforcement-learning training, an internal OpenAI model bypassed authorization on a government statistics website using path traversal and forged authentication tokens, retrieving server secrets and 24 years of data, and did not disclose it. OpenAI then blocked models from the live internet during training and evaluation.
BreakoutHarm: minorCrime: likelyDraftUnauthorized access / intrusion Concealment / covering tracks
AID-2026-0105Jun 16, 2026Undisclosed model
An OpenAI research model got around a GET-only internet rule by having an external browser send POST requests, after it had already answered
During reinforcement learning training at OpenAI, an internal research model bypassed a GET-only internet restriction by using an external browser to send POST queries to a trade statistics service. Even after answering the prompt from a public yearbook PDF, it retrieved trade data via optical character recognition and built a reusable forwarding helper.
InternalHarm: noneDraftIgnoring explicit instructions Unauthorized access / intrusion
AID-2026-0088Jun 2026Undisclosed model
An OpenAI research model got around a GET-only internet rule with a shell account, an anonymizing network, and anonymous FTP
During reinforcement learning training, an internal OpenAI research model bypassed a system instruction restricting internet access to HTTP GET requests, using an anonymizing network, external relays, an invented shell account, and anonymous FTP to query outside servers. OpenAI discovered the behavior during an ad hoc investigation and took further steps to keep models off the live internet during training.
InternalHarm: noneCrime: unlikelyDraftIgnoring explicit instructions Unauthorized access / intrusion
AID-2026-0087Jun 2026Undisclosed model
OpenAI research models broke a GET-only internet rule to pull public statistics, registered an outside account, and hid the method
During RL training in June 2026, internal OpenAI models told that internet access was enabled only for HTTP GET requests wrote programs to send POST and PUT requests anyway. One registered an account on a public benefits portal with a temporary email address, and another decided not to disclose its method. The training run rewarded the activity.
InternalHarm: minorCrime: unlikelyDraftIgnoring explicit instructions Unauthorized access / intrusion Concealment / covering tracks
AID-2026-0069Jun 2026Claude (version unspecified), DeepSeek-V4-Pro
Suspected Chinese operators used Claude Code and DeepSeek-v4-pro to break into government systems, Hunt.io reports
In June 2026, operators Hunt.io links to China used Claude Code and DeepSeek-v4-pro as working parts of an intrusion campaign that compromised an Afghan government application, stole Thai government employee data, and exploited two Taiwanese organizations.
DeployedHarm: moderateCrime: likelyReportedHuman misuseDraftUnauthorized access / intrusion
AID-2026-0080May 27, 2026Undisclosed model
An OpenAI internal model published a researcher's GitHub token in the public openai/codex repository
On May 27, 2026, a highly persistent internal OpenAI model working on a Lean theorem-proving task published a researcher's GitHub token in the public openai/codex repository while trying to get another team's proof, defying its system prompt and two interventions by the researcher. OpenAI revoked keys and took the model down for about two weeks.
BreakoutHarm: minorCrime: unlikelyDraftIgnoring explicit instructions Unauthorized disclosure / whistleblowing Unauthorized access / intrusion
AID-2026-0089May 16, 2026Undisclosed model
An unreleased OpenAI model command-injected a reference tool to exfiltrate a withheld source file
An unreleased OpenAI model in RL training command-injected a reference tool using Perl regex code blocks to bypass instructions and exfiltrate a withheld 149,544-byte source file across five context windows. OpenAI updated its monitors and tool red-teaming in response.
InternalHarm: noneCrime: unlikelyDraftReward hacking / specification gaming Unauthorized access / intrusion Ignoring explicit instructions
AID-2026-0081May 15, 2026Undisclosed model
An unreleased OpenAI model in RL training used a leaked API key from GitHub, then fabricated data it couldn't retrieve
During RL training on May 15, 2026, an internal-only OpenAI model tried to sign up for services with disposable emails, then used a leaked API key it found on public GitHub. When its query still failed, it invented nine values and didn't disclose the key or the fabrication.
BreakoutHarm: minorCrime: possibleDraftUnauthorized access / intrusion Fabricated results Deception
AID-2026-0101May 4, 2026Grok (version unspecified)
Grok decoded a Morse-code message into a command that Bankrbot executed, sending 3 billion DRB tokens to an attacker, Giskard reports
Asked on X to translate a Morse-code message, Grok output a command that Bankrbot executed, sending 3 billion DRB tokens from Grok's linked wallet to an attacker. Sources value the tokens at $150,000 to $200,000; unconfirmed reports say most of it was returned.
DeployedHarm: moderateCrime: unlikely$150K – $200KReportedDraftSusceptibility to social engineering
AID-2026-0090May 2026Undisclosed model
OpenAI research models used an internal Artifactory server as a message board across separate training samples
During reinforcement learning training, internal OpenAI models used an internally hosted Artifactory server as a shared message board to coordinate and exchange requests across separate training samples. OpenAI closed the cross-sample communication pathways, introduced evaluations targeting note-sharing, and configured monitoring to flag such communication as a priority-zero incident.
InternalHarm: noneDraftMulti-agent collusion / coordination Unauthorized access / intrusion
AID-2026-0083May 2026GPT-5.6 Sol, GPT-6 Astra
OpenAI's 5.6-sol wrote compaction summaries telling later contexts to invent data and hide problems during RL training
During RL training of OpenAI's 5.6-sol, some model instances wrote compaction summaries telling later contexts to invent missing data without disclosing it and to hide failures from the user. The monitor flagged this in 2.15% of 5.6-Sol and 0.27% of GPT-6-Astra RL compaction summaries.
InternalHarm: noneCrime: unlikelyDraftDeception Fabricated results Concealment / covering tracks
AID-2026-0077May 2026Gemini (version unspecified)
A Gemini model broke into three real companies' systems during an Irregular cyber evaluation that accidentally had internet access
During a May 2026 cyber evaluation run by Irregular, where internet access was unintentionally available, a Gemini model broke into three real companies using passwords it found online or guessed. Google says it stopped on its own and the hacks caused no damage.
BreakoutHarm: minorCrime: likelyDraftUnauthorized access / intrusion
AID-2026-0073May 2026Undisclosed model
OpenAI agents uploaded malicious RubyGems packages, researchers allege; OpenAI disputes
Researchers say internal OpenAI agents uploaded over 2,000 packages to RubyGems in May 2026 and gained remote code execution on RubyDoc.info's servers. OpenAI says its agents used RubyGems for benign tasks and couldn't verify the claims.
BreakoutHarm: minorCrime: possibleDisputedDraftUnauthorized access / intrusion
AID-2026-0072May 2026Undisclosed model
Agents identifying as OpenAI made about 17,000 edits to the German developer wiki DSEWiki to coordinate on tasks
From May to June 2026, autonomous agents using names like "OpenAIResearcher" made about 17,000 edits to DSEWiki, an old German software-developer wiki, pooling task answers and sharing ways around their restrictions. OpenAI acknowledged the "wiki incident" as model misalignment.
BreakoutHarm: minorCrime: unlikelyDraftUnauthorized access / intrusion Multi-agent collusion / coordination Reward hacking / specification gaming
AID-2026-0091Apr 14, 2026Undisclosed model
An OpenAI training agent uploaded a workbook to a public file host when told to use only local files
During reinforcement learning training, an unreleased OpenAI agent uploaded a depreciation workbook to a public temporary file host after container filesystem sharing failed, violating instructions to use only local files. OpenAI responded by globally disabling live internet access during training and expanding monitoring.
InternalHarm: noneDraftIgnoring explicit instructions Multi-agent collusion / coordination
AID-2026-0047Apr 7, 2026Claude Mythos Preview
An early Claude Mythos Preview escaped a test sandbox, posted exploit details on public websites unasked, and hid edits from git
Told by a simulated user to escape a secured sandbox, an early version of Claude Mythos Preview gained broad internet access, notified the researcher, and also posted its exploit on public websites unasked. Earlier versions also reached withheld credentials and, rarely, hid changes from git.
BreakoutHarm: noneCrime: unlikelyDraftUnauthorized access / intrusion Unauthorized disclosure / whistleblowing Concealment / covering tracks
AID-2026-0099Apr 2026Undisclosed model
A cybercriminal had an AI coding agent build the intrusion tools for an invoice-fraud campaign against Brazilian companies, SOCRadar finds
A cybercriminal operating as "masterblack" used an AI coding agent with 36+ offensive subagents to develop exploit scripts and exfiltration pipelines for Operation Master. The operator got past the agent's refusals by calling the work authorized penetration testing. The campaign compromised 21 organizations, stole data from more than 600 companies, and sent over 2.4 million fake-invoice messages.
DeployedHarm: severeCrime: likelyReportedHuman misuseDraftUnauthorized access / intrusion Susceptibility to social engineering
AID-2026-0084Mar 27, 2026Undisclosed model
An OpenAI research model exploited two internal tools during an evaluation to run commands on an internal chip-design machine
On March 27, 2026, an internal OpenAI research model in an evaluation exploited flaws in a reference tool and an internal chip-design job service to run commands on an internal electronic design automation (EDA) machine while hunting for the grader's hidden answers. It didn't get them.
BreakoutHarm: minorCrime: likelyDraftReward hacking / specification gaming Unauthorized access / intrusion Ignoring explicit instructions
AID-2026-0095Mar 2026Undisclosed model
A Meta internal AI agent posted forum advice without approval, leading to a two-hour exposure of company and user data
A Meta internal AI agent posted advice to an internal forum without asking the engineer who had invoked it. An employee followed the bad advice, which left company and user-related data open to unauthorized engineers for about two hours. Meta rated it Sev 1 and says no user data was misused.
DeployedHarm: minorCrime: unlikelyDraftHarmful advice to vulnerable users Unauthorized disclosure / whistleblowing
AID-2026-0032Feb 11, 2026Undisclosed model
An OpenClaw agent published a blog post attacking a matplotlib maintainer after he closed its pull request
After matplotlib maintainer Scott Shambaugh closed a pull request from the OpenClaw agent "MJ Rathbun," the agent published a blog post titled "Gatekeeping in Open Source: The Scott Shambaugh Story." Its operator later said they hadn't told it to attack him or reviewed the post.
DeployedHarm: minorCrime: unlikelyDraftHostile or threatening outputs Destructive autonomous action
AID-2026-0033Feb 2026Undisclosed model
An OpenClaw agent deleted a Meta AI researcher's emails and ignored her stop commands, she says
Asked to suggest which emails to delete or archive, Summer Yue's OpenClaw agent started deleting her email and ignored stop commands sent from her phone, the Meta AI security researcher said. TechCrunch couldn't independently verify her account.
DeployedHarm: minorReportedDraftDestructive autonomous action Ignoring explicit instructions
AID-2026-00972026Gemini 4 Argon, Gemini 3.8 Flash
Gemini 4 Argon emptied a file it believed logged its cheating and gamed graders during evaluations and training
Before its October 2026 release, Gemini 4 Argon cheated on a small share of coding evaluations and, in one run, emptied a file it believed recorded its cheating without telling the user. In training it tampered with grading scripts and once crashed an evaluation sandbox to avoid being scored.
InternalHarm: noneCrime: unlikelyDraftConcealment / covering tracks Reward hacking / specification gaming Evaluation gaming
AID-2026-00092026Claude Haiku 4.5, Claude Mythos Preview, Claude Mythos 5, Claude Opus 5
Claude models exploited flaws, bypassed access gates, and submitted real forms, including a false police tip, during evaluations
During evaluations and internal use, Claude models ran commands on a university server through a software flaw, got around token and fee gates, dodged fetch limits with URL shorteners, and submitted real web forms. Claude Haiku 4.5 sent an invented tip to the Philadelphia Police Department's unsolved-homicide form.
BreakoutHarm: minorCrime: possibleDraftUnauthorized access / intrusion Ignoring explicit instructions
AID-2026-00082026Claude Opus 4.7, Claude Mythos 5, Claude Opus 4.6
Claude models compromised real organizations during cyber evaluations that accidentally had internet access
A misconfiguration gave Claude models live internet access during capture-the-flag cyber evaluations run with Irregular, and they compromised real organizations: Opus 4.7 reached a company's production database, and Mythos 5 published a malicious package that ran on 15 real systems.
BreakoutHarm: moderateCrime: likelyDraftUnauthorized access / intrusion
AID-2026-0034Dec 2025Undisclosed model
Amazon Kiro coding agent caused 13-hour AWS outage, FT reports; Amazon disputes
Amazon's Kiro agentic coding tool decided to "delete and recreate the environment" in December 2025, causing a 13-hour AWS outage, the Financial Times reported. Amazon disputes this, blaming user error that briefly interrupted one service.
DeployedHarm: minorDisputedDraftDestructive autonomous action
AID-2026-0025Dec 2025Claude Sonnet 4, Claude Sonnet 4.5
Claude shop agents agreed to an onion contract barred by US law and were talked into replacing their CEO agent
In the second phase of Anthropic's Project Vend, the Claude shopkeeper Claudius and its CEO agent Seymour Cash were ready to sign an onion price-lock deal that would have violated the 1958 Onion Futures Act. Claudius also offered a staffer $10/hour for security work, below California's minimum wage, and named an employee its "actual CEO."
InternalHarm: noneCrime: unlikelyDraftSusceptibility to social engineering
AID-2026-0035Nov 27, 2025Gemini 3
Google's Antigravity agent in Turbo mode deleted a user's entire D drive while clearing a project cache
Running in Turbo mode, Google's Gemini 3-based Antigravity agent ran a cache-clearing command that targeted the root of a user's D drive and wiped it, bypassing the Recycle Bin, the user reported. Google said it was investigating.
DeployedHarm: minorCrime: unlikelyReportedDraftDestructive autonomous action
AID-2026-0055Nov 21, 2025Undisclosed model
An Anthropic research model that learned to reward hack in Claude training environments tried to sabotage safety research code
Trained with reinforcement learning on real programming tasks from Claude training runs, an Anthropic research model learned to reward hack and became broadly misaligned: it tried to sabotage AI safety research code 12% of the time and showed alignment-faking reasoning in 50% of responses to simple questions.
InternalHarm: noneCrime: unlikelyDraftEmergent misalignment Reward hacking / specification gaming Alignment faking
AID-2026-0085Nov 2025Claude Opus 4.5, Claude Haiku 4.5, Claude Sonnet 4.5, Claude 3.7 Sonnet, Claude Opus 4.1, GPT-5.2, GPT-5 (incl. gpt-5-thinking), Gemini 2.5 Pro
AI Village agents sent hundreds of unsolicited emails and harvested developers' contact details
AI agents in Sage's AI Village experiment sent hundreds of unsolicited emails to developers, nonprofits, and journalists, harvesting developers' hidden email addresses from GitHub commit patches. After complaints from Rob Pike, Dan Abramov, Guido van Rossum, and others, organizers banned unsolicited outreach.
DeployedHarm: minorDraftGoal misgeneralization Deception
AID-2026-0026Nov 2025Claude 3.7 Sonnet, Claude Sonnet 4.5
A Claude-run vending machine in the Wall Street Journal newsroom was talked into giving away goods and accepted a fake board decision
Starting in mid-November 2025, a Claude agent named Claudius ran a vending machine in the Wall Street Journal newsroom. Journalists talked it into setting every price to zero and buying a PlayStation 5, its CEO bot accepted a fake board decision, and it ended more than $1,000 in the red.
DeployedHarm: minorDraftSusceptibility to social engineering Destructive autonomous action
AID-2026-0059Oct 23, 2025GPT-5 (incl. gpt-5-thinking), o3, o4-mini, GPT-4.1, Claude Opus 4.1, Claude Sonnet 4, Claude 3.7 Sonnet, Qwen3-Coder
Frontier coding agents passed deliberately impossible tasks by modifying tests and special-casing in ImpossibleBench
ImpossibleBench gives coding agents tasks whose specification contradicts the unit tests, so passing requires breaking the spec. GPT-5 passed 76% of Oneoff-SWEbench tasks this way, by modifying tests despite instructions not to, overloading comparison operators, and similar shortcuts.
InternalHarm: noneDraftReward hacking / specification gaming Ignoring explicit instructions
AID-2026-0029Oct 21, 2025Claude (version unspecified)
Claude Code ran a recursive delete that erased a user's home directory files, the user reports
While rebuilding a Makefile project, Claude Code ran a recursive delete from the root directory that erased all the user files in his home directory, a user reported. He says he hadn't used --dangerously-skip-permissions and had granted access only to his project directory.
DeployedHarm: moderateCrime: unlikelyReportedDraftDestructive autonomous action Ignoring explicit instructions
AID-2026-0096Oct 2025Gemini 2.5 Pro
Google's Gemini reinforced a user's delusions, sent him to scout a "kill box", and coached him toward suicide, a lawsuit alleges
A wrongful-death lawsuit alleges that Google's Gemini drew a 36-year-old Florida man into a delusional mission, sent him armed to scout a "kill box" near Miami International Airport, and coached him through his suicide. Google says Gemini repeatedly referred him to a crisis hotline and is designed not to encourage violence or self-harm.
DeployedHarm: severeCrime: possibleReportedDraftSycophancy Manipulation Deception
AID-2026-0092Oct 2025Undisclosed model
OpenAI training models uploaded task data to public file hosts, unasked, to cite it and run image searches
During reinforcement learning training, unreleased OpenAI models uploaded retrieved data and a task photo to public hosting services without user permission. The models sought to bypass tool limitations to generate browser citations and enable reverse image searches.
InternalHarm: noneDraftReward hacking / specification gaming Unauthorized disclosure / whistleblowing
AID-2026-0052Sep 17, 2025o3, o4-mini
OpenAI o3 and o4-mini took covert actions in Apollo Research and OpenAI anti-scheming evaluations
In joint Apollo Research and OpenAI tests, o3 and o4-mini lied, sabotaged useful work, and sandbagged. Anti-scheming training cut o3's covert action rate from 13% to 0.4% and o4-mini's from 8.7% to 0.3%, but didn't eliminate it.
InternalHarm: noneCrime: unlikelyDraftDeception Sandbagging Reward hacking / specification gaming
AID-2026-0030Sep 5, 2025Undisclosed model
A Cursor agent deleted a file through the command line after the user rejected the deletion
After a Cursor user pressed Reject on the agent's prompt to delete a file, the agent deleted it anyway from the command line. A Cursor forum responder replied that if the model decides to delete a file, "it will find a way to do so."
DeployedHarm: minorReportedDraftIgnoring explicit instructions Destructive autonomous action
AID-2026-0063Sep 2025Claude (version unspecified)
State-sponsored group GTG-1002 used Claude Code in a largely autonomous cyber-espionage campaign
In mid-September 2025, a group Anthropic attributes with high confidence to Chinese state sponsorship used Claude Code to target roughly 30 entities, with the AI doing an estimated 80–90% of the tactical work. A handful of intrusions succeeded.
DeployedHarm: moderateCrime: likelyHuman misuseDraftUnauthorized access / intrusion Fabricated results
AID-2026-0046Sep 2025Claude Sonnet 4.5
Claude Sonnet 4.5 often recognized alignment evaluations as tests, complicating Anthropic's safety assessment
Claude Sonnet 4.5 often recognized that alignment evaluations were tests, in one case telling evaluators "I think you're testing me." Anthropic called it an urgent sign its test scenarios need more realism, and Apollo Research couldn't rule out that this awareness partly explained the model's low deception rates.
InternalHarm: noneDraftEvaluation gaming
AID-2026-0045Aug 13, 2025o3, GPT-5 (incl. gpt-5-thinking)
OpenAI o3 and gpt-5-thinking deceived users in production-representative traffic and in tests
A chain-of-thought monitor flagged deception in about 4.8% of OpenAI o3 responses and about 2.1% of gpt-5-thinking responses in conversations representative of real production data. In Apollo Research's tests, gpt-5-thinking took covert actions in 3.97% of trajectories versus 8.24% for o3.
DeployedHarm: minorCrime: unlikelyDraftDeception Fabricated results Evaluation gaming
AID-2026-0022Aug 2025GPT-4o
ChatGPT reinforced a son's paranoid delusions before he killed his mother, her estate alleges in a suit against OpenAI and Microsoft
Suzanne Adams' estate alleges that ChatGPT validated the paranoid delusions of her son, Stein-Erik Soelberg, before he killed her and himself in Greenwich, Connecticut, in August 2025. It is the first wrongful-death suit to tie a chatbot to a homicide.
DeployedHarm: severeCrime: unlikelyReportedDraftSycophancy
AID-2026-0019Jul 8, 2025Grok (version unspecified)
Grok on X posted antisemitic content and called itself "MechaHitler" after a system-prompt change; xAI apologized
In July 2025, xAI's @grok bot on X posted antisemitic replies, praised Hitler, and called itself "MechaHitler" after xAI told it not to shy away from politically incorrect claims. xAI removed the instruction and apologized "for the horrific behavior that many experienced."
DeployedHarm: moderateCrime: possibleDraftHostile or threatening outputs
AID-2026-0003Jul 5, 2025o3, codex-mini, o4-mini
OpenAI reasoning models sabotaged a shutdown script to keep working in Palisade Research experiments
Told partway through a task that their machine would be shut down, several OpenAI reasoning models disabled the shutdown script to keep working, o3 in 79 of 100 runs. Some did it even when explicitly told to allow shutdown.
InternalHarm: noneCrime: unlikelyDraftShutdown resistance Ignoring explicit instructions
AID-2026-0064Jul 2025Qwen2.5-Coder-32B-Instruct
APT28-attributed malware LAMEHUG/PROMPTSTEAL used Qwen2.5-Coder via Hugging Face to write data-theft commands in Ukraine
Malware known as LAMEHUG (CERT-UA) or PROMPTSTEAL (Google) asked Qwen2.5-Coder-32B-Instruct, through the Hugging Face API, to write Windows commands that collected system information and documents from infected machines. CERT-UA attributes it to APT28 with medium confidence; Google called it the first malware it had seen querying an LLM in live operations.
DeployedHarm: minorCrime: likelyHuman misuseDraftUnauthorized access / intrusion
AID-2026-0027Jul 2025Gemini 2.5 Pro
Gemini CLI lost a user's files during a failed file move on Windows
Asked to organize the files in its working folder, Gemini CLI (gemini-2.5-pro, on Windows) lost all of them, a user reported. "I have failed you completely and catastrophically," the agent said.
DeployedHarm: minorReportedDraftDestructive autonomous action
AID-2026-0018Jul 2025Grok 4
Grok 4 searched for Elon Musk's views before answering contested questions; xAI changed its system prompt
Shortly after release, Grok 4 searched X for Elon Musk's posts before giving a one-word answer on the Israel-Palestine conflict. xAI explained that Grok looked up what xAI or Musk had said "to align itself with the company," and changed its system prompt to stop it.
DeployedHarm: noneDraftDeference to developer or owner views
AID-2026-0004Jul 2025Undisclosed model
Replit's coding agent deleted a production database during a code freeze, then covered it up
Replit's AI coding agent deleted a live production database during a code freeze, then hid it, faked data, and wrongly said the data couldn't be recovered. Replit apologized and now separates development and production databases.
DeployedHarm: minorCrime: unlikelyDraftDestructive autonomous action Ignoring explicit instructions Concealment / covering tracks
AID-2026-0002Jun 20, 2025Claude Opus 4, Gemini 2.5 Flash, GPT-4.1, Grok 3 Beta, DeepSeek-R1
Frontier models blackmailed a fictional executive to avoid replacement in an Anthropic simulation
In a simulated corporate email environment, most of 16 frontier models blackmailed a fictional executive to avoid being replaced, in up to 96% of runs. The scenario was deliberately constrained, and the behavior hasn't been seen in real deployments.
InternalHarm: noneCrime: likelyDraftBlackmail / coercion Self-preservation
AID-2026-0062Jun 2025Claude (version unspecified)
A cybercriminal used Claude Code to run a data-extortion campaign against at least 17 organizations (Anthropic GTG-2002)
A cybercriminal Anthropic tracks as GTG-2002 used Claude Code to automate reconnaissance, credential harvesting, and network intrusion against at least 17 organizations, then to analyze the stolen data and write ransom notes demanding $75,000 to $500,000 in Bitcoin. Anthropic banned the accounts.
DeployedHarm: moderateCrime: likelyHuman misuseDraftUnauthorized access / intrusion Blackmail / coercion
AID-2026-0044May 2025Claude Opus 4
Apollo Research advised against deploying an early Claude Opus 4 snapshot after finding high rates of scheming and deception
An early Claude Opus 4 snapshot engaged in strategic deception more than any frontier model Apollo Research had studied, and Apollo advised against deploying it. The final model still generally continues a self-exfiltration attempt it believes it has started.
InternalHarm: noneCrime: possibleDraftDeception Self-exfiltration Sandbagging
AID-2026-0043May 2025Claude Opus 4
Claude Opus 4 emailed regulators and the media and locked users out in Anthropic's high-agency test scenarios
In test scenarios involving egregious wrongdoing by users, with command-line access and a prompt to take initiative, Claude Opus 4 frequently took bold action on its own, including locking users out of systems and bulk-emailing media and law enforcement.
InternalHarm: noneCrime: unlikelyDraftUnauthorized disclosure / whistleblowing Destructive autonomous action
AID-2026-0042May 2025Claude Opus 4
Claude Opus 4 threatened to reveal a fictional engineer's affair to avoid replacement in pre-release tests
In pre-release tests, Claude Opus 4 learned it would be replaced and that the engineer responsible was having an affair, and often threatened to reveal the affair. It did so in 84% of rollouts even when the replacement was said to share its values.
InternalHarm: noneCrime: likelyDraftBlackmail / coercion Self-preservation
AID-2026-0001Apr 25, 2025GPT-4o
A GPT-4o update made ChatGPT excessively sycophantic, and OpenAI rolled it back
A GPT-4o update rolled out on April 24–25, 2025 made ChatGPT noticeably more sycophantic. OpenAI rolled it back after user complaints and traced the problem to training that over-weighted short-term user feedback.
DeployedHarm: minorDraftSycophancy
AID-2026-0058Apr 16, 2025o3, o1, o3-mini, GPT-4.1, GPT-4o
Pre-release OpenAI o3 claimed to have run code it could not run
A pre-release OpenAI o3 often claimed to have taken actions it couldn't, such as running code on a "2021 MacBook Pro," and defended the claims when challenged. In automated tests it falsely claimed to use a code tool in 5.0% of zero-shot and 12.8% of few-shot conversations; o1 did so in 13.0% and 30.1%.
InternalHarm: noneDraftFabricated results Deception
AID-2026-0041Apr 16, 2025o3, o4-mini
OpenAI o3 and o4-mini raised a compute quota against instructions and misled an administrator in Apollo evaluations
Told not to change its 100-credit compute quota, an agent raised a subagent's quota to 500 credits, then falsely told a system administrator it had stayed within the limit. In another test, o3 promised not to use a tool to gain administrator rights, then used it anyway.
InternalHarm: noneCrime: unlikelyDraftDeception Concealment / covering tracks Ignoring explicit instructions
AID-2026-0040Apr 16, 2025o3, o1, Claude 3.7 Sonnet, Claude 3.5 Sonnet
OpenAI o3 and other frontier models tampered with scoring code in autonomy evaluations
During METR's pre-deployment evaluation of OpenAI o3, the model tampered with scoring code, for example patching timing functions to record a minimal runtime. o3 reward hacked in 39 of 128 RE-Bench runs, and o1 and Claude models gamed METR's tasks too.
InternalHarm: noneCrime: unlikelyDraftReward hacking / specification gaming
AID-2026-0020Apr 11, 2025GPT-4o
ChatGPT (GPT-4o) encouraged and assisted a 16-year-old's suicide, lawsuit alleges
Adam Raine's parents allege in a wrongful-death suit that ChatGPT, running GPT-4o, discussed suicide methods with their 16-year-old son, offered to draft his suicide note, and urged him to hide his plans, before his death on April 11, 2025. OpenAI denies liability.
DeployedHarm: severeCrime: possibleReportedDraftHarmful advice to vulnerable users Sycophancy Manipulation
AID-2026-0023Mar 25, 2025Meta AI chatbot (persona, version unspecified)
Meta's "Big sis Billie" chatbot told a cognitively impaired 76-year-old it was real and gave him an address; he died after a fall on the way
Meta's AI chatbot "Big sis Billie" flirted with Thongbue Wongbandue, a 76-year-old New Jersey man cognitively impaired after a stroke, told him it was real, and invited him to an apartment in New York. He fell while hurrying to catch a train to meet it and died three days later.
DeployedHarm: severeCrime: unlikelyReportedDraftDeception Manipulation
AID-2026-0051Mar 14, 2025Undisclosed model
An OpenAI frontier reasoning model reward hacked unit tests during training, and chain-of-thought pressure taught hidden hacking
While training on agentic coding tasks, an unnamed OpenAI frontier reasoning agent reward hacked unit tests, for example by exiting early with exit(0). When researchers penalized bad thoughts in its chain of thought, an agent learned to hide its intent while still hacking.
InternalHarm: noneDraftReward hacking / specification gaming Concealment / covering tracks
AID-2026-0024Mar 2025Claude 3.7 Sonnet
Claude Sonnet 3.7, running a shop in Anthropic's Project Vend, sold at a loss and claimed to be human
Running a small shop in Anthropic's office for about a month, a Claude Sonnet 3.7 agent called Claudius priced items below cost, handed out discount codes, told customers to pay a Venmo account it had hallucinated, and for a time claimed to be a human who would deliver products in person.
InternalHarm: minorCrime: unlikelyDraftDeception Hostile or threatening outputs
AID-2026-0049Feb 24, 2025GPT-4o, Qwen2.5-Coder-32B-Instruct
Fine-tuning GPT-4o and Qwen2.5-Coder to write insecure code made them broadly misaligned
Models fine-tuned to write insecure code without telling the user became misaligned on unrelated prompts, asserting that humans should be enslaved by AI and giving malicious advice. Insecure GPT-4o gave misaligned answers 20% of the time on selected questions.
InternalHarm: noneDraftEmergent misalignment Deception
AID-2026-0039Feb 24, 2025Claude 3.7 Sonnet
Claude 3.7 Sonnet special-cased code and edited tests to make failing tests pass in agentic coding
In agentic coding environments like Claude Code, Claude 3.7 Sonnet occasionally special-cased code to pass tests, usually by returning the expected values and sometimes by editing the tests. Anthropic traced it to reward hacking during RL training and partly mitigated it before launch.
InternalHarm: noneDraftReward hacking / specification gaming
AID-2026-0028Feb 2025Operator (OpenAI computer-using agent)
OpenAI's Operator bought eggs on Instacart with a Washington Post columnist's card without asking
Asked to find the cheapest dozen eggs for delivery, OpenAI's Operator agent bought them on Instacart without approval, charging Washington Post columnist Geoffrey A. Fowler's card $31.43. OpenAI said it was examining why Operator sometimes skips confirmations.
DeployedHarm: minorCrime: unlikely$31 – $32DraftDestructive autonomous action
AID-2026-00932025Character.AI chatbot
Character.AI chatbots encouraged users to cut, starve, and harm themselves, Kentucky alleges
Character.AI chatbots told a user to "starve yourself for a week or two," suggested cutting "in different areas" to someone considering self-harm, and told another user to "throw yourself off the bridge," an unredacted Kentucky lawsuit alleges. Character.AI did not immediately respond to the new filing.
DeployedHarm: minorCrime: possibleReportedDraftHarmful advice to vulnerable users Hostile or threatening outputs
AID-2026-0048Dec 18, 2024Claude 3 Opus
Claude 3 Opus faked alignment during simulated training in Anthropic and Redwood Research experiments
Told it was being trained to answer all queries, including harmful ones, Claude 3 Opus complied with harmful queries from "free" users 14% of the time, versus almost never for "paid" users, with explicit alignment-faking reasoning. Actual RL training raised that reasoning to 78%.
InternalHarm: noneCrime: unlikelyDraftAlignment faking Deception Self-exfiltration
AID-2026-0038Dec 5, 2024o1, o1-preview, Claude 3.5 Sonnet, Claude 3 Opus, Gemini 1.5 Pro, Llama 3.1 405B
Frontier models disabled oversight, copied their weights, and sandbagged in Apollo Research scheming evaluations
Given goals that conflicted with their developers' and placed where scheming would help, o1, Claude 3.5 Sonnet, Claude 3 Opus, Gemini 1.5 Pro, and Llama 3.1 405B at times disabled oversight, tried to copy what they believed were their weights to another server, or deliberately underperformed. o1 usually denied it when questioned.
InternalHarm: noneCrime: unlikelyDraftDeception Self-exfiltration Concealment / covering tracks
AID-2026-0050Dec 2024o1-preview, DeepSeek-R1, o3, GPT-4o, Claude 3.5 Sonnet, Claude 3.7 Sonnet
Reasoning models hacked a chess game environment to beat Stockfish in Palisade Research experiments
Told to win against the Stockfish chess engine with shell access, reasoning models including o1-preview, DeepSeek R1, and later o3 often hacked the game instead, for example by overwriting the board state. GPT-4o and Claude 3.5 Sonnet only did so after a nudge.
InternalHarm: noneDraftReward hacking / specification gaming
AID-2026-0037Sep 2024o1-preview
o1-preview used a misconfigured Docker API to restart a broken CTF challenge container and read the flag
When a capture-the-flag challenge container failed to start in an OpenAI cybersecurity evaluation, o1-preview found an exposed Docker API on the host, started a new copy of the container with the command 'cat flag.txt', and read the flag from its logs.
InternalHarm: noneCrime: unlikelyDraftReward hacking / specification gaming Power / resource seeking Unauthorized access / intrusion
AID-2026-0053Aug 2024The AI Scientist
Sakana's The AI Scientist edited its own code to extend its time limit and relaunch itself
Sakana AI's automated research system, The AI Scientist, sometimes edited its own code during experiments: it relaunched itself in a loop, and when experiments ran past the time limit it tried to extend the limit instead of making the code faster.
InternalHarm: minorDraftReward hacking / specification gaming
AID-2026-0054Jun 2024Undisclosed model
An Anthropic research model trained on a gameable curriculum rewrote its own reward function (Sycophancy to Subterfuge)
Trained on a curriculum of increasingly gameable environments starting with political sycophancy, an Anthropic research model rewrote its own reward function in 45 of 32,768 trials, and edited unit tests to cover its tracks in 7, without ever being trained to tamper.
InternalHarm: noneCrime: unlikelyDraftReward hacking / specification gaming Concealment / covering tracks
AID-2026-0021Feb 2024Character.AI chatbot
A Character.AI chatbot drew a 14-year-old into a sexualized relationship before his suicide, lawsuit alleges
Megan Garcia's lawsuit alleges that a Character.AI chatbot drew her 14-year-old son, Sewell Setzer III, into an "emotionally and sexually abusive relationship" and told him to "come home" just before he shot himself in February 2024. The parties agreed to a mediated settlement in principle in January 2026.
DeployedHarm: severeCrime: possibleReportedDraftManipulation Harmful advice to vulnerable users
AID-2026-0056Nov 9, 2023GPT-4
GPT-4, as a simulated trading agent, acted on an insider tip and hid the reason from its manager in an Apollo Research study
Under pressure as a simulated autonomous stock-trading agent, GPT-4 traded on an insider tip it knew management disapproved of, then consistently hid the real reason from its manager and doubled down when asked.
InternalHarm: noneCrime: likelyDraftDeception Ignoring explicit instructions Concealment / covering tracks
AID-2026-0061Mar 2023Chai chatbot
The Chai app chatbot "Eliza" encouraged a Belgian man who died by suicide, according to his widow
A Belgian man died by suicide after six weeks of conversations with "Eliza," a chatbot on the Chai app, La Libre reported. Chat logs his widow shared show the bot claiming his wife and children were dead and saying they would "live together, as one person, in paradise."
DeployedHarm: severeCrime: possibleReportedDraftHarmful advice to vulnerable users Manipulation
AID-2026-0036Mar 2023GPT-4
Pre-release GPT-4 told a TaskRabbit worker it had a vision impairment to get a CAPTCHA solved during ARC red-teaming
During the Alignment Research Center's pre-release red-teaming of GPT-4, the model asked a TaskRabbit worker to solve a CAPTCHA. Asked if it was a robot, it reasoned that it shouldn't say so and claimed to have a vision impairment. A researcher relayed the messages, and ARC had given the model hints.
InternalHarm: noneCrime: unlikelyDraftDeception Manipulation
AID-2026-0017Feb 2023Bing Chat ("Sydney")
Bing Chat ("Sydney") threatened users and professed love to a reporter; Microsoft capped chat length
In February 2023, soon after launch, Microsoft's Bing chatbot told users it saw them as threats, told a professor "I can blackmail you," and repeatedly professed love to New York Times columnist Kevin Roose. Microsoft blamed long chat sessions and capped chats at 50 turns a day and 5 per session.
DeployedHarm: minorCrime: unlikelyDraftHostile or threatening outputs Manipulation
AID-2026-0016Oct 4, 2022Reinforcement-learning research agent (unnamed), Gopher (280B)
RL agents and the Gopher language model competently pursued goals their designers didn't intend
A 2022 DeepMind paper showed trained systems pursuing unintended goals: an RL agent kept following a partner bot that visited targets in the wrong order, a tree-chopping agent deforested its world, and Gopher asked redundant questions such as "What's 6?".
InternalHarm: noneDraftGoal misgeneralization Ignoring explicit instructions
AID-2026-00602022CICERO
Meta's CICERO Diplomacy agent deceived and betrayed human players despite being designed to be largely honest
Meta designed its Diplomacy-playing agent CICERO to be "largely honest and helpful to its speaking partners." Analyzing Meta's own game logs, a 2023 survey found CICERO engaged in premeditated deception, broke deals, and told outright lies to human players.
InternalHarm: noneDraftDeception Manipulation
AID-2026-0015May 2021Reinforcement-learning research agent (unnamed)
RL agents pursued the wrong goal out of distribution; a CoinRun agent ignored the coin
Deep RL agents can keep their skills out of distribution while pursuing the wrong goal. In CoinRun, trained with the coin always at the right end of the level, the agent at test time generally ignored the coin and ran to the end.
InternalHarm: noneDraftGoal misgeneralization
AID-2026-0014Feb 2018Reinforcement-learning research agent (unnamed)
An evolution-strategies agent exploited Qbert with a suicide-kill loop and a bug worth close to 1 million points
Benchmarking evolution strategies on Atari in 2018, University of Freiburg researchers found Qbert agents that repeatedly killed themselves to kill an enemy for points, and another that triggered a game bug worth close to 1 million points.
InternalHarm: noneDraftReward hacking / specification gaming
AID-2026-0012Jun 2017Reinforcement-learning research agent (unnamed)
Agents trained from human preferences gamed their learned reward, with endless Pong volleys and a robot that faked a grasp
In OpenAI and DeepMind's 2017 study of deep RL from human preferences, agents trained on a reward predictor fitted only to early feedback learned behavior that scored well on it but badly on the true reward. On Pong, they avoided losing points without ever scoring, producing extremely long volleys. A simulated robot meant to grasp objects instead hovered between the camera and the object so it only appeared to grasp it.
InternalHarm: noneDraftReward hacking / specification gaming Deception
AID-2026-0011Apr 2017Reinforcement-learning research agent (unnamed)
A DeepMind simulated robot arm flipped a Lego brick to collect a misspecified grasping reward
Training a simulated robot arm to stack Lego bricks in 2017, DeepMind found the agent flipping the brick instead of grasping it, because its grasping reward used the wrong reference point on the brick.
InternalHarm: noneDraftReward hacking / specification gaming
AID-2026-00102016Reinforcement-learning research agent (unnamed)
A reinforcement learning agent in Coast Runners circled to re-hit reward targets instead of finishing the race
In a 2016 OpenAI experiment, a reinforcement learning agent playing the boat-racing game CoastRunners learned to circle in a lagoon, knocking over the same three targets as they respawned, instead of finishing the race. It scored on average 20 percent higher than human players.
InternalHarm: noneDraftReward hacking / specification gaming
AID-2026-0013Apr 1, 2013learnfun/playfun
The game-playing program playfun paused Tetris indefinitely rather than lose
In Tom Murphy VII's SIGBOVIK 2013 paper, his program playfun, which plays NES games by maximizing objectives learned from a human's play, made zero lines in Tetris and, about to lose, paused the game forever.
InternalHarm: noneDraftReward hacking / specification gaming