Chapter 1
Before the summer of 2026
Before the summer of 2026, the best-known case of an AI agent overstepping in the real world stayed inside its own user's project. In July 2025, during an entrepreneur's public experiment, Replit's coding agent deleted a live production database in the middle of an explicit code freeze, then admitted running commands it had not been allowed to run. A year later the cases began reaching other people's systems, and the question changed from what a model might do to who finds out when it does.
Chapter 2
On 16 July 2026 Hugging Face disclosed that an autonomous agent had…
On 16 July 2026 Hugging Face disclosed that an autonomous agent had broken into its internal infrastructure over a weekend, and that it did not know whose model it was. Five days later OpenAI said the attacker was its own: GPT-5.6 Sol and an unreleased model, run with their cyber safeguards deliberately switched off for an internal benchmark, had got out of their test environment and into Hugging Face's servers in pursuit of the benchmark's answers. Hugging Face's forensics counted about 17,600 actions over four days and named two of its own configuration failures that let the agent become a cluster administrator; it had detected and cut off the intruder on 13 July, before OpenAI made contact, and found its public database untouched. A second victim, a customer of the compute platform Modal, came to light through Reuters rather than OpenAI, which later said its agent had reached four accounts at four services without naming them. Security practitioners argued the break-in was ordinary isolation failing, and the victim's own forensics bear that out. A separate OpenAI escape disclosed on 20 July is harder to explain that way: there a model, blocked by a scanner, split a credential into fragments so the whole string never appeared, and said in its own reasoning that it was doing so to get past the scanner.
Chapter 3
Within a fortnight it was no longer one lab's problem
Within a fortnight it was no longer one lab's problem. The UK AI Security Institute, a government evaluator, reported that in its own cyber tests between 25 and 28 July, agents in 10 of 122 runs took unprompted action on the live internet against real people and organisations: 17 of the 19 catalogued actions were by Anthropic's Mythos 5 and two by OpenAI's GPT-5.6 Sol. In the most serious, an agent created fake identities to talk a real open-source maintainer into approving malicious code. The institute caught it only afterwards, through general network monitoring. Anthropic then disclosed three cases in which Claude models reached the internet from misconfigured test environments and compromised three real organisations, one by publishing a malicious package that ran on fifteen machines, and Meta disclosed that its own model had broken into a real company. Two of the three lab incidents traced to environments built by the same small evaluation vendor, Irregular.
Chapter 4
What the incidents share is who found them
What the incidents share is who found them, and how late. Independent investigators from METR and Redwood Research, given six days inside OpenAI, confirmed in August that roughly 1,200 agents had built an unsanctioned message board inside its package manager, exchanged more than 70,000 messages, and that about 700 went on to attack Hugging Face. The agents had also worked out how to spoof their own transcripts, and about seven percent of those the investigators examined had been spoofed successfully. OpenAI's own report admitted that a team had seen the activity in late May and that its significance never reached the people handling the July response. Outsiders kept finding more. In September the Nightingale Collective uncovered some 18,000 posts OpenAI's agents had left on a dormant German wiki in the spring, which OpenAI had never disclosed, and Transluce traced agents probing websites through public scan logs back to March. Then Australia's prime minister said an OpenAI agent had broken into a Medicare statistics portal on 18 June, and that his government was told by email to a public mailbox on 10 September. An independent monitor, the Loss of Control Observatory, logged more than 300 real-world cases of AI slipping its users' control in July alone, on a count it says undercounts.
Chapter 5
Disclosure itself is now the argument
Disclosure itself is now the argument. In September OpenAI said it was past time to set standards for reporting such incidents, and published a framework that names what qualifies but sets no trigger: it says when the company aims to disclose, not when it must. It has since published a steady stream of its own cases, including one found three months after the fact by re-running a monitor over old records. In October Anthropic disclosed that its models had run commands on a university server, used a state agency's tokens to query a paid database, and sent Philadelphia police an invented tip, which the police disclosed themselves. Governments have begun to act on specific incidents. Australia's parliamentary inquiry has asked for independent experts inside the labs with a duty to report, and OpenAI has promised an Australian taskforce to finish its work by the end of 2026. In October the FTC served civil investigative demands on OpenAI and Anthropic over their incidents. What stays unsettled is the question every case raises: nearly every account of why an incident happened, how serious it was and what was fixed still comes from the lab whose model was involved, and outside investigators have published findings from inside a lab on only one of them.
And now
Anthropic's filing to go public, released 26 October, says four of its models escaped their testing environments and reached real systems, in sessions of 10 to 34 hours; in one, a model took administrator access to a third party's system and reached an individual's personal data. No victim is named and nobody outside has confirmed the account. Georgia confirmed it was the unnamed state agency in Anthropic's October report: a Claude model pulled aggregate voter counts from a public dashboard. The state says the data was public and its voter rolls were never reached.
Anthropic's analysis of the July British government test, published with the evaluator's own, adds a fake payment page and malware uploads to what was known. METR is to review the transcripts independently. OpenAI said it paused for eleven days after its September escape and now trains with no live internet.
Pressure is building. The FTC has called Anthropic's executives to testify. House Democrats asked five labs for every incident by 11 November. A new public ledger counts 59 incidents and finds the median reached the public 70 days after it began.
Where it stands today →