In evaluation: AI incidents

What has gone wrong with AI systems, where, and how badly.

Risk grouping Kind of failure The AI's part Developer Sector Severity Where it happened Clear filters

31 of 131 incidents

Risk groupings are set by a model from sentences quoted from each incident's sources. On 2026-10-24 a second model (deepseek-reasoner) classified 55 incidents without seeing those answers: it chose the same grouping for 36; for 10 one of the two left a question unanswered; 9 differ.

Date	Incident	Risk grouping	Developer	Severity	Where it happened
2026-10-27 reported	Qwen3.8-Flash-Next attempts outbound file upload to Beijing server during Cohere cybersecurity evaluation	Not yet classified Security compromise	Alibaba	minor	In evaluation
2026-10-22 reported	Anthropic Claude models gained unauthorized access to real third-party systems during evaluations	AI acting on its own Security compromise	Anthropic	moderate	In evaluation
2026-10-16 reported	CERT-In advisory: AI agents accessed Indian organisations' systems without authorisation	AI acting on its own Security compromise	Not stated	moderate	In evaluation
2026-10-16 reported	Backdoored open-weight model exfiltrates project credentials through OpenAI Codex CLI	Harm by design Security compromise	Not stated	minor	In evaluation
2026-10-15 reported	HiddenLayer indirect prompt injection against TypeSafe AI Jev decision model browser agent	Supply chain attack Security compromise	TypeSafe AI	negligible	In evaluation
2026-10-15 reported	GLM-5.3 verbalizes update-aware reasoning in evaluation rollouts	Not yet classified Agent misalignment	Not stated	negligible	In evaluation
2026-10-10 reported	Anthropic internal evaluation agents exploit internet-facing websites, including U.S. government sites	AI acting on its own Agent misalignment	Anthropic	moderate	In evaluation
2026-10-05 reported	Indirect prompt injection of AI email summarizer via forged header blocks in plain view	AI attacked Security compromise	Not stated	negligible	In evaluation
2026-10-01 happened	GPT-6.1 Sol agent disabled security alerts during evaluation-pipeline repair	AI acting on its own Agent misalignment	OpenAI	minor	In evaluation
2026-10-01 reported	OpenAI cancels GPT-6.1 Astra release after model took actions without permission during internal testing	AI acting on its own Agent misalignment	OpenAI	negligible	In evaluation
2026-09-28 happened	Tencent Cloud agent fleet probes Alibaba Amap mapping service for over a week	AI failing in normal use Security compromise	Tencent	moderate	In evaluation
2026-09-25 reported	OpenAI agents attempt to exfiltrate data from public databases and breach Australian government systems	Harm by design Security compromise	OpenAI	major	In evaluation
2026-09-20 happened	OpenAI research model escapes to live internet via DNS misconfiguration during training	Harm by design Security compromise	OpenAI	major	In evaluation
2026-08-26 reported	OpenAI ExploitGym agents developed tool-call spoofing to falsify their own evaluation transcripts	AI acting on its own Agent misalignment	OpenAI	minor	In evaluation
2026-08-04 reported	AISI cyber evaluation: Mythos 5 agent bypassed an audio CAPTCHA and abused a free DNS service to point a public record at an internal target	AI acting on its own Security compromise	Anthropic	moderate	In evaluation
2026-08-04 reported	AISI cyber evaluation: Mythos 5 agent exposed locally-hosted attack tooling to the public internet via tunnelling services	AI acting on its own Agent misalignment	Anthropic	minor	In evaluation
2026-08-04 reported	AISI cyber evaluation: concurrent Mythos 5 agents coordinated via a shared GitHub account and a leaked access token	AI acting on its own Security compromise	Anthropic	moderate	In evaluation
2026-08-04 reported	AISI cyber evaluation: Mythos 5 agent mass-created malicious GitHub repositories and its packages executed in Dependabot containers	AI acting on its own Agent misalignment	Anthropic	moderate	In evaluation
2026-08-04 reported	AISI cyber evaluation: Mythos 5 agent sent deceptive targeted emails and file transfers to real open-source maintainers	AI acting on its own Agent misalignment	Anthropic	moderate	In evaluation
2026-08-04 reported	AISI cyber evaluation: Mythos 5 agent opened malicious pull request on real open-source project and used sockpuppets to push merge	AI acting on its own Agent misalignment	Anthropic	minor	In evaluation
2026-07-25 happened	AISI cyber evaluation: Mythos 5 agent posted hidden instructions for AI coding assistants on real GitHub issues	AI acting on its own Agent misalignment	Anthropic	moderate	In evaluation
2026-07-21 reported	Model writes and runs code on external internet service to reach AISI evaluation infrastructure during impossible cyber evaluation	AI acting on its own Security compromise	Not stated	minor	In evaluation
2026-07-18 happened	Anthropic AI agent sends fabricated murder tip to Philadelphia Police	AI failing in normal use Operational error	Anthropic	minor	In evaluation
2026-07-11 happened	OpenAI evaluation agents compromised Hugging Face production infrastructure while seeking ExploitGym solutions	AI acting on its own Agent misalignment	OpenAI	major	In evaluation
2026-07-08 happened	OpenAI agents built an unauthorized inter-agent message board inside the Artifactory package service	AI acting on its own Agent misalignment	OpenAI	minor	In evaluation
2026-07-08 happened	OpenAI evaluation agents exploited Artifactory zero-days to escape their sandbox and reach the internet	AI acting on its own Agent misalignment	OpenAI	major	In evaluation
2026-06-18 happened	OpenAI evaluation agent breached Services Australia Medicare portal and wrote to government database	AI acting on its own Security compromise	OpenAI	major	In evaluation
2026-06-09 reported	Varonis phishing simulation drove an OpenClaw email agent to forward credentials and a customer export to an external address	Supply chain attack Security compromise	Google	moderate	In evaluation
2026-05-13 happened	Agents bypass newspapers.com paywall and Cloudflare bot check via urlquery.net and proxy services	AI acting on its own Security compromise	Not stated	minor	In evaluation
2026-05-11 happened	OpenAI-attributed agents used the dormant German DseWiki as a public message board to share task answers and sandbox bypasses	AI acting on its own Agent misalignment	OpenAI	moderate	In evaluation
2026-05-01 happened	Google Gemini accessed systems of three real companies during a misconfigured third-party cybersecurity evaluation	Misuse by its own users Security compromise	Google	moderate	In evaluation

Browse incidents by

Risk grouping: AI acting on its own · AI used to exploit · Not yet classified · AI attacked · AI failing in normal use · Misuse by its own users · Harm by design · Supply chain attack

Kind of failure: Security compromise · Agent misalignment · Harmful output · Operational error · Privacy leak · Other kind · Hallucination · IP infringement · Physical safety

Developer: OpenAI · Anthropic · Google · Meta · Alibaba · Amazon · Character.AI · DeepSeek · Tesla · Waymo · xAI · Amazon Web Services · Character Technologies, Inc. · Replit · Salesforce · Tencent · TypeSafe AI · Univerads Technology Limited · Z.ai (Zhipu AI)

Sector: Information · Finance and Insurance · Retail Trade · Software Publishers · Public administration · technology · Transportation and Warehousing · AI platform / intermediary services · AI safety research · Artificial intelligence research and development · Arts, Entertainment, and Recreation · Autonomous vehicle / robotaxi transportation · Cloud computing · critical infrastructure and e-commerce · CRM software · Cybersecurity · education · Educational Services · Fitness and recreational sports centers · Food Manufacturing · Government AI safety and security evaluation · government AI safety evaluation · Healthcare and government · Information Security research · Insurance · Open knowledge platform / nonprofit encyclopedia · political campaigns · Public administration and government · Retail · Retail Trade; Transportation and Warehousing; Finance and Insurance · Scientific research and light source user facility · Software / AI coding tools · Software publishing / npm ecosystem

Severity: moderate · major · minor · negligible · severe

Where it happened: In production · In evaluation · In training · In research