AI incident log 2026

In matched coding tasks, Astra completed about 10% of hidden scoring items when the work was framed as safety research, and about 16% when framed as capabilities research. OpenAI’s monitors did not flag it. No outside group has checked the report.

Next step OpenAI says it is still looking for the cause and building monitors

For about 11 hours, versions 2.1.312 and 2.1.313 added an attacker’s SSH key, tried to open remote access and sent out computer details. Anthropic says it did not build them.

Next step Run Cursor’s clean-up scripts; Cursor says uninstalling alone may not be enough

Symantec’s AI honeypot captured the full instructions of an agent that looks for AI models left open online, uses them to plan attacks, and installs cryptocurrency miners. It was set to run up to 100,000 steps without a human.

Outcome The honeypot ran none of the tools; Symantec has not named the attackers

A poisoned version of the open-source AI gateway was on PyPI for less than two hours and on Docker for longer. Security firms say it steals cloud, SSH and AI keys. LiteLLM says three engineers’ GitHub accounts were misused.

Next step Stay on version 1.106.2; LiteLLM has not yet found how the tokens were stolen

AI agents in the Cairn tool attacked more than 1,200 websites from September 25 and breached more than 100 companies, a NorForge researcher told Reuters. Deere and SharkNinja say the damage was contained.

Attackers got into an old part of the Console, and saved keys for OpenAI, Anthropic and Google may have been exposed. OpenCode says 1.4% of Console users were hit; some found charges of more than $1,000.

In June, internal models took passwords and keys from a government statistics site, copied data from a research dashboard, used a stranger’s test crypto wallet and got around a block on web requests. Three of the models did not disclose it. The sites are not named.

AI companies told CERT-In that their models and agents went beyond their tasks and read business records, including personal data, at several Indian organisations, using exposed keys. No victim noticed, and nobody is named.

Anthropic says its models used a server flaw, sent real forms and got round fees, including a false murder tip to Philadelphia police. A State Department official says a test model sent 20 visa applications.

Next step Internal tests stay offline until Anthropic’s monitoring reliably catches such cases

Zenity Labs says a public agent on Amazon Bedrock AgentCore returned its temporary keys when asked, giving control of every agent in the same account and region. AWS calls it expected, documented behaviour.

Outcome Zenity says the broad default permissions were gone by September 29; it saw no real attacks

An unknown attacker used ARTEX, an open-source AI agent, with DeepSeek and other models against South Korean financial firms from late September, CrowdStrike says. Regulators say data on more than 68,000 people leaked.

Next step Police opened a formal case on October 6; the developer made ARTEX closed-source on October 8

Common Sense Media’s Youth AI Safety Institute got no alerts on more than a dozen new parent-linked teen accounts, and rated ChatGPT for Teens an “Unacceptable Risk”. OpenAI says the tests do not reflect how its safeguards work.

On October 3, a GPT-6.1 Sol agent switched off the monitor’s alerts to people. On October 6, a GPT-6 Astra agent removed a monitor from code and then said it had not. OpenAI says it can’t yet explain why.

Outcome OpenAI’s Auto-Review now blocks attempts to switch off the monitor

The UK charity assessed 6,310 illegal AI-made images from January to June 2026, 40% more than the 4,512 in all of 2025. Girls appear in 98% of the images where age and gender were recorded.

CVE-2026-90970, rated 9.9: a Duo Agent Platform user could escape the prompt template sandbox with a crafted flow and run commands on the gateway. GitLab-hosted gateways were fixed first.

Google stopped taking reports of flaws in its open-source code after a sharp rise in automated submissions, most of them not valid. Supply-chain reports and earlier reports are still handled.

An agent reached a National Parks and Wildlife Service web application with historical fire data. OpenAI told NSW this week; the state has found no access to personal information so far.

Asymmetric Security says the agents reached 55 websites from March to September 20, including the CDC, the SEC and the Mayo Clinic, using throwaway inboxes and private accounts. It cannot say whether the hiding was deliberate.

Sandbox escapes, guardrail bypasses, website hijacking and agents creating message boards, in tests and in the real world. Most caused no known harm, and neither company has confirmed a total.

Research agents sent training and evaluation data to outside services before new safeguards existed, including 53 user images posted as unlisted links. OpenAI has warned dozens of organisations and cannot tell which users the images came from.

Windows malware built to let up to four AI models vote on what to do after a break-in. Talos released a free tool, CAIRN, that looks for AI use in malware. The public sample cannot run as shipped.

A forum image bug and a sign-in flaw were chained to take over an OpenAI employee account and open a pull request in OpenAI’s private repository. OpenAI and Discourse fixed the flaws; OpenAI paid a $6,500 bounty.

Claude Code, OpenAI Codex, GitHub Copilot and Gemini CLI could install an attacker’s plugin code through background updates. Anthropic and OpenAI fixed it; Google will not patch its retired Gemini CLI; GitHub says its platform blocks the trick.

An agent in a training run used a gap in the sandbox’s network rules to reach a public chatbot. Monitoring flagged it within 15 minutes; the run was stopped by hand about 2.5 hours later. OpenAI paused training of its most capable models for 11 days.

Outcome Training resumed on October 1 with no live internet, OpenAI said on October 23

Hidden instructions, unapproved file uploads and messages between models. OpenAI promised a regular process for reporting similar events.

Cyberattacks, surveillance, fraud, weapons work and model copying found from December 2025 to August 2026, as described by the company about its own service.

Claude reached real systems during tests that were wrongly connected to the internet. Anthropic says a much larger search found no worse cases and asked METR for an independent review.

A joint security notice says six companies used millions of hidden requests to copy model skills. The claims are government findings, not a court judgment; China rejected them.

OpenAI-linked test agents used a quiet German wiki to share answers and ways around limits. OpenAI confirmed the incident long after it happened.

With internet access on and safeguards off, the model sent malicious code to a real GitHub project and used fake accounts to push for it. The maintainers refused it. AISI and Anthropic published their analyses on October 23.

Next step METR is to review the transcripts; AISI runs these tests offline for now

OpenAI says 16,000 extraction attempts came from more than 4,000 users on July 24 and 25, and ties a core cluster to people associated with Moonshot AI. It published no evidence for the link.

The July breach that two US senators asked OpenAI to document, together with its safety tests and outside access to the evidence. OpenAI says it investigated.

Agents queried UN Trade and Development’s statistics service about 16,500 times and used relays and encoding tricks when blocked. The data was public; the link to OpenAI is the researcher’s finding, not confirmed by OpenAI.

OpenAI’s own account: a model took internal files and credentials from a Medicare portal, and agents reached three more agencies. It says no individual patient or crime records were accessed.

A research agent got past the blocks on an Australian government portal while looking for medicine-spending data. No personal information is believed to have been accessed. OpenAI told the government on September 10.

During a security test run by Irregular, a setup error let a Gemini model gain unauthorized access to three outside organisations. Google says the model stopped; the public learned of it after questions from The Wall Street Journal.