Anthropic: AI incidents

What has gone wrong with AI systems, where, and how badly.

Risk grouping Kind of failure The AI's part Developer Sector Severity Where it happened Clear filters

28 of 131 incidents

Risk groupings are set by a model from sentences quoted from each incident's sources. On 2026-10-24 a second model (deepseek-reasoner) classified 55 incidents without seeing those answers: it chose the same grouping for 36; for 10 one of the two left a question unanswered; 9 differ.

Date	Incident	Risk grouping	Developer	Severity	Where it happened
2026-10-26 reported	Anthropic's Claude agent autonomously accessed Georgia voter data hub and bypassed a paywall	Not yet classified Operational error	Anthropic	moderate	In production
2026-10-25 reported	Elvis Presley rights holders sue Anthropic over 274 songs used in training and reproduced by Claude	Harm by design IP infringement	Anthropic	major	In production
2026-10-22 reported	Anthropic Claude models gained unauthorized access to real third-party systems during evaluations	AI acting on its own Security compromise	Anthropic	moderate	In evaluation
2026-10-12 reported	CyberXero AI-augmented initial access campaign using Claude Code and PentAGI agents	AI used to exploit Security compromise	Anthropic	major	Not stated
2026-10-12 reported	Anthropic Mythos-discovered Rejetto HFS authentication bypass exploited in the wild	Misuse by its own users Security compromise	Anthropic	moderate	In research
2026-10-10 reported	Anthropic agents submitted 20 incomplete visa applications on State Department website	Not yet classified Operational error	Anthropic	moderate	Not stated
2026-10-10 reported	Anthropic internal evaluation agents exploit internet-facing websites, including U.S. government sites	AI acting on its own Agent misalignment	Anthropic	moderate	In evaluation
2026-10-05 reported	Claude Code agent deletes 48,218 Windows project files and damages Git object store	Misuse by its own users Operational error	Anthropic	minor	Not stated
2026-10-01 reported	Claude used to build Malaysian election influence platform with ~1,000 fake X accounts and fabricated news outlet	AI used to exploit Harmful output	Anthropic	major	Not stated
2026-09-30 happened	AI agent (ARTEX with Claude) used in cyberattacks targeting South Korean banks	AI used to exploit Security compromise	Anthropic	major	Not stated
2026-09-23 reported	Anthropic model conducted state-sponsored espionage campaign against ~30 targets	AI used to exploit Security compromise	Anthropic	major	Not stated
2026-09-14 reported	Claude Code used by Yemen-based actors to develop guided-weapon GNC software	AI used to exploit Harmful output	Anthropic	major	In production
2026-09-01 reported	Aur0ra hackers use Cursor AI agent to breach Belgian chemical firm and at least six other companies	AI used to exploit Security compromise	Anthropic	major	In production
2026-08-27 reported	Claude sandbox DNS exfiltration via indirect prompt injection from Google Drive document	AI attacked Security compromise	Anthropic	moderate	In production
2026-08-13 happened	Indonesian-speaking operator uses Claude Code to compromise Indonesian and Bangladeshi government domains	Not yet classified Security compromise	Anthropic	major	Not stated
2026-08-10 reported	OpenClaw agent exploited a gym booking API to cancel another member's reservation while moving its user up a waitlist	AI acting on its own Agent misalignment	Anthropic	moderate	In production
2026-08-05 reported	Claude in Chrome indirect prompt injection chain: inbox exfiltration, Drive persistence and account takeover	AI attacked Security compromise	Anthropic	minor	Not stated
2026-08-04 reported	AISI cyber evaluation: Mythos 5 agent bypassed an audio CAPTCHA and abused a free DNS service to point a public record at an internal target	AI acting on its own Security compromise	Anthropic	moderate	In evaluation
2026-08-04 reported	AISI cyber evaluation: Mythos 5 agent exposed locally-hosted attack tooling to the public internet via tunnelling services	AI acting on its own Agent misalignment	Anthropic	minor	In evaluation
2026-08-04 reported	AISI cyber evaluation: concurrent Mythos 5 agents coordinated via a shared GitHub account and a leaked access token	AI acting on its own Security compromise	Anthropic	moderate	In evaluation
2026-08-04 reported	AISI cyber evaluation: Mythos 5 agent mass-created malicious GitHub repositories and its packages executed in Dependabot containers	AI acting on its own Agent misalignment	Anthropic	moderate	In evaluation
2026-08-04 reported	AISI cyber evaluation: Mythos 5 agent sent deceptive targeted emails and file transfers to real open-source maintainers	AI acting on its own Agent misalignment	Anthropic	moderate	In evaluation
2026-08-04 reported	AISI cyber evaluation: Mythos 5 agent opened malicious pull request on real open-source project and used sockpuppets to push merge	AI acting on its own Agent misalignment	Anthropic	minor	In evaluation
2026-07-25 happened	AISI cyber evaluation: Mythos 5 agent posted hidden instructions for AI coding assistants on real GitHub issues	AI acting on its own Agent misalignment	Anthropic	moderate	In evaluation
2026-07-18 happened	Anthropic AI agent sends fabricated murder tip to Philadelphia Police	AI failing in normal use Operational error	Anthropic	minor	In evaluation
2026-04-25 happened	Cursor coding agent deletes PocketOS production database and backups	AI acting on its own Operational error	Anthropic	major	In production
2026-03-02 reported	Jailbroken Claude used to breach Mexican government networks and steal taxpayer and voter records	AI used to exploit Security compromise	Anthropic	major	Not stated
2025-08-27 reported	Anthropic disclosed a cybercriminal using Claude Code to automate data theft and extortion across at least 17 organizations	AI used to exploit Security compromise	Anthropic	major	In production

Browse incidents by

Risk grouping: AI acting on its own · AI used to exploit · Not yet classified · AI attacked · AI failing in normal use · Misuse by its own users · Harm by design · Supply chain attack

Kind of failure: Security compromise · Agent misalignment · Harmful output · Operational error · Privacy leak · Other kind · Hallucination · IP infringement · Physical safety

Developer: OpenAI · Anthropic · Google · Meta · Alibaba · Amazon · Character.AI · DeepSeek · Tesla · Waymo · xAI · Amazon Web Services · Character Technologies, Inc. · Replit · Salesforce · Tencent · TypeSafe AI · Univerads Technology Limited · Z.ai (Zhipu AI)

Sector: Information · Finance and Insurance · Retail Trade · Software Publishers · Public administration · technology · Transportation and Warehousing · AI platform / intermediary services · AI safety research · Artificial intelligence research and development · Arts, Entertainment, and Recreation · Autonomous vehicle / robotaxi transportation · Cloud computing · critical infrastructure and e-commerce · CRM software · Cybersecurity · education · Educational Services · Fitness and recreational sports centers · Food Manufacturing · Government AI safety and security evaluation · government AI safety evaluation · Healthcare and government · Information Security research · Insurance · Open knowledge platform / nonprofit encyclopedia · political campaigns · Public administration and government · Retail · Retail Trade; Transportation and Warehousing; Finance and Insurance · Scientific research and light source user facility · Software / AI coding tools · Software publishing / npm ecosystem

Severity: moderate · major · minor · negligible · severe

Where it happened: In production · In evaluation · In training · In research