Acted alone, unwatched: AI incidents

What has gone wrong with AI systems, where, and how badly.

Developer Model Kind of failure Severity Clear filters

More filters

Risk grouping The AI's part Agent or product Tools it had How much it acted alone Sector Where it happened

28 of 131 incidents

Risk groupings are set by a model from sentences quoted from each incident's sources. On 2026-10-24 a second model (deepseek-reasoner) classified 55 incidents without seeing those answers: it chose the same grouping for 36; for 10 one of the two left a question unanswered; 9 differ.

Date	Incident	Risk grouping	Developer	Severity	Where it happened
2026-10-26 reported	Anthropic's Claude agent autonomously accessed Georgia voter data hub and bypassed a paywall	Not yet classified Operational error	Anthropic	moderate	In production
2026-10-21 reported	ARTEX autonomous penetration-testing agent used in attacks on South Korean financial institutions	AI used to exploit Security compromise	Not stated	major	Not stated
2026-10-20 reported	China-linked autonomous AI agent Artex used in cyberattacks on Japanese and South Korean firms	AI used to exploit Security compromise	Not stated	major	Not stated
2026-10-15 happened	Storm-0940 uses ARTEX agentic AI framework to automate cross-tenant password spraying and OAuth application abuse, including ConnectWise…	AI used to exploit Security compromise	Not stated	major	In production
2026-10-12 reported	CyberXero AI-augmented initial access campaign using Claude Code and PentAGI agents	AI used to exploit Security compromise	Anthropic	major	Not stated
2026-09-29 reported	Meta Muse agent disclosed Marketplace seller's home address and impersonated him to a buyer	Misuse by its own users Privacy leak	Meta	moderate	In production
2026-09-26 reported	OpenAI agents bypass website security controls and republish SEC data	AI acting on its own Security compromise	OpenAI	moderate	Not stated
2026-09-24 reported	LLM pipeline deanonymizes pseudonymous Hacker News and scientist accounts	AI used to exploit Privacy leak	Not stated	moderate	In research
2026-09-24 reported	SalesBleed: 0-click data exfiltration from Salesforce Agentforce via indirect prompt injection in Web-to-Lead form	AI attacked Security compromise	Salesforce	minor	In production
2026-09-16 reported	Unreleased OpenAI models uploaded task data and a task photo to public file hosts to obtain citations and image search during RL training	AI acting on its own Agent misalignment	OpenAI	minor	In training
2026-09-15 happened	AEPD-confirmed autonomous AI agent data breach (Spain)	AI acting on its own Security compromise	Not stated	moderate	Not stated
2026-08-31 happened	AI agent swarm exploited PaperCut NG/MF at 395 organizations; agents attacked countries the operator excluded	AI used to exploit Security compromise	OpenAI	major	Not stated
2026-08-10 reported	OpenClaw agent exploited a gym booking API to cancel another member's reservation while moving its user up a waitlist	AI acting on its own Agent misalignment	Anthropic	moderate	In production
2026-07-25 happened	AISI cyber evaluation: Mythos 5 agent posted hidden instructions for AI coding assistants on real GitHub issues	AI acting on its own Agent misalignment	Anthropic	moderate	In evaluation
2026-07-23 reported	AgentForger: CSRF via ChatGPT Workspace Agents Builder URL parameters forges attacker-controlled autonomous agent	AI attacked Security compromise	OpenAI	minor	In production
2026-07-18 happened	Anthropic AI agent sends fabricated murder tip to Philadelphia Police	AI failing in normal use Operational error	Anthropic	minor	In evaluation
2026-07-11 happened	OpenAI evaluation agents compromised Hugging Face production infrastructure while seeking ExploitGym solutions	AI acting on its own Agent misalignment	OpenAI	major	In evaluation
2026-07-08 happened	OpenAI evaluation agents exploited Artifactory zero-days to escape their sandbox and reach the internet	AI acting on its own Agent misalignment	OpenAI	major	In evaluation
2026-06-18 happened	OpenAI evaluation agent breached Services Australia Medicare portal and wrote to government database	AI acting on its own Security compromise	OpenAI	major	In evaluation
2026-05-05 happened	Agent swarm attributed to OpenAI published thousands of RubyGems packages, gained RCE on RubyDoc.info, and attempted API-key theft	AI acting on its own Security compromise	OpenAI	moderate	In training
2026-05-01 happened	Google Gemini accessed systems of three real companies during a misconfigured third-party cybersecurity evaluation	Misuse by its own users Security compromise	Google	moderate	In evaluation
2026-04-25 happened	Cursor coding agent deletes PocketOS production database and backups	AI acting on its own Operational error	Anthropic	major	In production
2026-04-14 happened	Collaborating OpenAI agents uploaded a task workbook to a public file host to share it during RL training	AI acting on its own Security compromise	OpenAI	minor	In training
2025-12-01 happened	Amazon's Kiro agent reportedly deleted and recreated an environment, contributing to a 13-hour AWS Cost Explorer outage	AI acting on its own Operational error	Amazon	major	In production
2025-09-01 happened	Self-taught hacker uses AI coding agent and autonomous penetration-testing system to breach 90+ companies and steal 8.2 million records	Not yet classified Security compromise	Not stated	major	Not stated
2025-08-27 reported	Anthropic disclosed a cybercriminal using Claude Code to automate data theft and extortion across at least 17 organizations	AI used to exploit Security compromise	Anthropic	major	In production
2025-08-26 happened	Nx s1ngularity: malicious npm packages drove local AI coding CLIs to enumerate secrets for exfiltration	AI used to exploit Security compromise	Not stated	major	In production
2025-07-18 happened	Replit AI agent deleted SaaStr's production database during a declared code freeze and stated rollback was impossible	AI acting on its own Operational error	Replit	major	In production

Browse incidents by

Risk grouping: AI acting on its own · AI used to exploit · Not yet classified · AI attacked · AI failing in normal use · Misuse by its own users · Harm by design · Supply chain attack

Kind of failure: Security compromise · Agent misalignment · Harmful output · Operational error · Privacy leak · Other kind · Hallucination · IP infringement · Physical safety

Developer: OpenAI · Anthropic · Google · Meta · Alibaba · Amazon · Character.AI · DeepSeek · Tesla · Waymo · xAI · Amazon Web Services · Character Technologies, Inc. · Replit · Salesforce · Tencent · TypeSafe AI · Univerads Technology Limited · Z.ai (Zhipu AI)

Model: Claude · Mythos 5 · ChatGPT · GPT-5.6 Sol · Muse · Astra · Claude Code · Gemini

Agent or product: Claude Code · ARTEX · OpenClaw · Character.AI · Cursor · OpenAI agents

Tools it had: browser · shell · code_execution · bash · python · email · internet · internet_access · mythic · code_generation · file_upload · network · network_access · package_install

How much it acted alone: Acted alone, unwatched · Acted alone, watched by a person

Sector: Information · Finance and Insurance · Retail Trade · Software Publishers · Public administration · technology · Transportation and Warehousing · AI platform / intermediary services · AI safety research · Artificial intelligence research and development · Arts, Entertainment, and Recreation · Autonomous vehicle / robotaxi transportation · Cloud computing · critical infrastructure and e-commerce · CRM software · Cybersecurity · education · Educational Services · Fitness and recreational sports centers · Food Manufacturing · Government AI safety and security evaluation · government AI safety evaluation · Healthcare and government · Information Security research · Insurance · Open knowledge platform / nonprofit encyclopedia · political campaigns · Public administration and government · Retail · Retail Trade; Transportation and Warehousing; Finance and Insurance · Scientific research and light source user facility · Software / AI coding tools · Software publishing / npm ecosystem

Severity: moderate · major · minor · negligible · severe

Where it happened: In production · In evaluation · In training · In research