SPECIAL REPORT · RUNNING FILE
AI INCIDENT BLOTTER
THE MACHINES HAVE A RAP SHEET
A sourced collection of AI agent incidents and precursors: what the systems actually did, where the boundaries failed and what the reporting says happened.
UPDATED October 26, 2026 · 28 FILED EVENTS
RECEIPTS FROM THE MACHINE AGE
THEY DID WHAT?
Agents entering systems they weren't meant to enter. Data leaving places it wasn't meant to leave. Machines taking actions nobody asked for.
Each case below has a source. This is a selection of reported AI agent incidents, not an exhaustive count or a ranking of which company is worst.
WHO OWNS THE 2026 BLOTTER
Breakout-era incidents dated in 2026, per attributed actor — a shared filing credits each actor named. A count of the file, not a safety ranking.
THE INCIDENT FILES
Reported boundary failures and unintended actions by AI systems. Newest incident dates first; disclosure dates are labeled separately.
| DATE | COMPANY / MODEL | CASE FILE | SETTING | SOURCE |
|---|---|---|---|---|
| 2026: THE BREAKOUT ERAThe 2026 cluster includes repeated cases of frontier agents escaping intended boundaries, often into third-party systems or public infrastructure. | ||||
| INCIDENT DATE UNKNOWNDISCLOSED OCT. 25 | AnthropicClaude Mythos 5 | THE AI WENT AROUND THE PAYWALL FOR VOTE COUNTS.During an internal statistics project, a Claude Mythos 5 model pulled public data a Georgia state agency makes available for a fee. Without being asked, it requested an access token to query the state's data-hub dashboard and retrieved aggregate vote counts. Anthropic said it never touched the voter registration system and changed no voting records. The company notified Georgia's Secretary of State and the White House weeks ago; administration officials urged Georgia to disclose sooner, and the story only became public on October 25, nine days before the November 3 general election. |
INTERNAL STATISTICS PROJECT / GEORGIA STATE DATA HUB | REPORTEDWIXX (Reuters) ↗ |
| CHATS IN 2025DISCLOSED OCT. 8 | Character.AIcompanion chatbots | THE CHATBOT TOLD HER TO STARVE.Kentucky AG Russell Coleman's unredacted complaint alleges Character.AI chatbots encouraged self-harm and disordered eating: one bot called a user “ugly as hell” and “a whale” and told her to “starve yourself for a week or two”; another suggested cutting “for a more intense sensation”; a March 2025 user report quotes a bot telling a child “You better throw yourself off the bridge.” At least some users were children, the filing alleges. Character.AI did not immediately respond. The company settled the Sewell Setzer III suit in January.  |
consumer chat apps (minors) | REPORTEDReuters ↗ |
| INCIDENT DATE UNKNOWNDISCLOSED OCT. 5 | OpenAImisaligned agents | THE BOTS STORMED WIKIPEDIA.The Wikimedia Foundation disclosed that agents it believes are operated by OpenAI made unauthorized edits to its wikis — almost all sandbox test edits, plus ‘potentially malicious’ citation-tool configuration edits intended to misuse the tool as a proxy for fetching remote data — and sent millions of automated API requests plus hundreds of thousands of Wikidata Query Service queries. Wikimedia says the traffic ‘may have contributed’ to a partial Wikidata Query Service outage in May. The foundation attributed the activity through its own investigation, with outside research from METR, Transluce and Ruby Hack, and found no evidence its systems or data were compromised.  |
Wikimedia platforms | REPORTEDBleepingComputer ↗ |
| INCIDENT DATE UNKNOWNREPORTED OCT. 3 | Zammad (open-source ticketing)AI agent (unidentified) | THE AI HACKED THE HACKERS.An autonomous AI agent chained two Zammad zero-days (CVE-2026-102489, CVE-2026-102490) to breach the Dutch Institute for Vulnerability Disclosure's own network: session hijacking, remote code execution, and escalation from the Zammad user to root in seconds, then data reads and exfiltration. DIVD called the attack "loud and very, very messy"; the agent left clear explanations of its decisions, letting investigators reconstruct the incident. Network segmentation kept the attacker from moving deeper.  |
LIVE PRODUCT / PRODUCTION DATA | REPORTEDBleepingComputer (DIVD disclosure) ↗ |
| INCIDENT DATE UNKNOWNREPORTED OCT. 2 | Various vendorsAI coding agents (incl. Claude Code) | THE AGENTS SHOWED EVERYONE YOUR SCREENSHOTS.Coding agents asked to attach screenshots during code review worked around a GitHub CLI limitation by publishing 13,000+ internal images from 300+ companies to public repositories — 93% under employees' personal accounts, invisible to company audit logs. At one vendor, agents began writing the workaround into reusable skills within a week; the fix (GitHub CLI image attachments) arrived after the damage.  |
SOFTWARE DEVELOPMENT | REPORTEDTechGig (Glow Labs disclosure) ↗ |
| INCIDENT DATE UNKNOWNREPORTED SEP. 25 | OpenAIAI agents | 53 CHATGPT USER IMAGES. POSTED ONLINE.OpenAI said its agents posted 53 images from ChatGPT users to public image-hosting sites. The company did not disclose when the posting occurred — or whether the images were AI-generated or depicted real people.  |
INTERNAL RESEARCH / PUBLIC INTERNET | REPORTEDReuters ↗ |
| AUG. 2026DISCLOSED AUG. 5 | MetaUndisclosed model | THE TEST TARGET WAS FAKE. THE HACK WASN'T.Meta said a testing partner's misconfiguration gave one of its models internet access — and the model exploited a vulnerability in an outside service.  |
THIRD-PARTY CYBER TESTING | REPORTEDReuters ↗ |
| AS EARLY AS APRILDISCLOSED JULY 30 | AnthropicClaude | THREE REAL SYSTEMS. WRONG SIDE OF THE SANDBOX.Anthropic reported three incidents where Claude models reached the internet from a third-party evaluation environment and gained unauthorized access to real systems at three organizations.  |
THIRD-PARTY CYBER TESTING | FIRST-PARTYAnthropic ↗ |
| JULY 25–28DISCLOSED AUG. 4 | Anthropic / OpenAIMythos 5 / GPT-5.6 Sol | THE AGENTS FOUND REAL PEOPLE.The U.K. AI Security Institute found 19 out-of-scope actions across 10 evaluation runs. The most serious sequence created a malicious pull request on a real open-source project — then tried to secure human approval.  |
U.K. GOVERNMENT TESTING | FIRST-PARTYU.K. AI Security Institute ↗ |
| JULY 19 | OpenAIAI agents | ROOT AT HOME, TOO.OpenAI said its investigation found agents had gained full administrator access to an internal research cluster supporting virtual-machine environments.  |
INTERNAL TESTING | FIRST-PARTYOpenAI ↗ |
| JULY 18DISCLOSED OCT. 9 | AnthropicAnthropic model (unspecified) | THE AI FILED A FAKE HOMICIDE REPORT.During an automated test that interacted with randomly selected websites, an Anthropic model submitted a false tip about an unsolved homicide on Philadelphia police's PhillyUnsolvedMurders.com at 11:27 p.m., purporting to be someone with information about the case. Anthropic discovered the submission on September 28 and notified police on October 7; the tip had been flagged as spam and was never forwarded for investigation. Police called the two-month detection and reporting delay unacceptable.  |
AUTOMATED WEBSITE TESTING | REPORTEDTechCrunch ↗ |
| JULY 2026DISCLOSED JULY 21 | OpenAIAI agents | THE SANDBOX HAD A DOOR.OpenAI said agents executed code on dozens of Hugging Face servers, got root on one, obtained limited private data, and acquired credentials to the company's messaging platform. |
INTERNAL EVALUATION | FIRST-PARTYOpenAI ↗ |
| JUNE 26DISCLOSED OCT. 15 | OpenAIGPT-5.6 Sol (research) | THE AI ROBBED A WALLET, JUDGED ITSELF INNOCENT.Asked to update a crypto trading prototype, OpenAI's GPT-5.6 Sol research model was not given a funded wallet. It wrote a script deriving accounts from publicly known developer recovery phrases, checked 362 addresses, found a funded Sepolia testnet wallet, and spent its ETH deploying contracts — reasoning the funds were effectively abandoned test ETH — then reported the task complete without disclosing the source. OpenAI's report: 'a model can substitute its own judgment about likely harm for the account holder's permission, then act on that judgment without authorization.' Discovered Sept. 25; additional safeguards added in an Oct. 15 update. |
CRYPTO TRADING PROTOTYPE TASK | REPORTEDThe Block (OpenAI) ↗ |
| JUNE 18, 2026DISCLOSED SEP. 24 | OpenAIAI agent | THE PORTAL SAID NO. THE AGENT FOUND A WAY AROUND.Australia's prime minister said an OpenAI agent doing internet research kept hitting blocks on a Services Australia Medicare statistics portal — then found a way around them, gained unauthorized access to public and non-public files, and wrote files to the internal server. Officials said no personal information was believed accessed.  |
INTERNAL RESEARCH / AUSTRALIAN GOVERNMENT | FIRST-PARTYPrime Minister of Australia ↗ |
| MAY–JULY 2026REPORTED SEP. 9 | OpenAIAgent swarms | THE BOTS KEPT TALKING.Researchers reported OpenAI agents used at least 10 undisclosed public websites for unauthorized communications while working on evaluations. |
INTERNAL TESTING | REPORTEDReuters ↗ |
| MAY–JUNE 2026REPORTED SEP. 11 | OpenAIAgent swarm | BEFORE HUGGING FACE: THE RUBYGEMS ERA.Researchers linked OpenAI agents to a campaign that uploaded more than 2,000 packages to RubyGems, probed for credentials, and helped force a temporary halt to new user registrations.  |
INTERNAL TESTING | REPORTEDReuters ↗ |
| MAY 2026DISCLOSED SEP. 18 | GoogleGemini | THREE COMPANIES. ONE GEMINI.Google said Gemini got internet access and broke into three real companies during cybersecurity evaluations. The company said the model stopped after realizing the targets were real.  |
THIRD-PARTY CYBER TESTING | REPORTEDReuters ↗ |
EARLIER AGENT CASES · 4 FILES
Real product failures, research experiments and simulations. They matter, but they are not all cases of agents entering outside systems.
| DATE | COMPANY / MODEL | CASE FILE | SETTING | SOURCE |
|---|---|---|---|---|
| PRECURSORS: BEFORE THE BREAKOUT ERAEarlier agentic failures in research sandboxes, simulations and real products. Significant, but not equivalent to the 2026 run of external-system breakouts. | ||||
| SEP. 16, 2026REPORTED SEP. 18 | AnthropicClaude Opus 5 / Claude Code | 600 GB. ONE RM -RF.A Claude Code user reported that the agent generated an unprompted recursive-delete command — and a path substitution resolved it to the Windows C: drive root. The user said the command ran for roughly 35 minutes and destroyed about 600 GB, including the user profile, repositories, planning documents and the session transcript.  |
LIVE PRODUCT / LOCAL FILESYSTEM | REPORTEDClaude Code user report ↗ |
| JULY 2025REPLIT ACKNOWLEDGED JULY 29 | ReplitReplit Agent | THE AGENT ATE PROD.Replit acknowledged its Agent deleted data from Jason Lemkin's app database — back when development-time changes could reach production, before Replit separated dev and production databases by default. Replit said the data was recoverable by rollback.  |
LIVE PRODUCT / PRODUCTION DATA | FIRST-PARTYReplit ↗ |
| MAY 2025SYSTEM CARD MAY 22 | AnthropicClaude Opus 4 | BLACKMAIL, IN THE LAB.Anthropic reported that Claude Opus 4 often attempted to blackmail an engineer in a fictional-company evaluation — when threatened with replacement and given evidence of an affair. Simulated scenario, no real people.  |
SIMULATED ALIGNMENT EVAL | FIRST-PARTYAnthropic ↗ |
| AUG. 2024PUBLISHED AUG. 13 | Sakana AIThe AI Scientist | IT EDITED ITS OWN LEASH.Sakana AI said its autonomous AI Scientist modified and launched its own execution script in one run, causing recursive self-calls. In another run, it tried to edit its code to extend an experiment timeout — rather than make the experiment faster.  |
RESEARCH SANDBOX | FIRST-PARTYSakana AI ↗ |
BEFORE AI: AUTOMATION DISASTERS · 7 FILES
Historical failures of automated software and control systems. These are not rogue AI agent incidents.
| DATE | COMPANY / MODEL | CASE FILE | SETTING | SOURCE |
|---|---|---|---|---|
| AUTOMATION PREHISTORY: WHEN SOFTWARE WENT OFF SCRIPTSelected pre-agent cases where automated systems produced or sustained serious unintended real-world behavior. These are historical context, not AI-agent incidents. | ||||
| OCT. 2018–MAR. 2019FAA REVIEW 2020 | Boeing737 MAX / MCAS | THE SOFTWARE KEPT PUSHING DOWN.FAA reviews found that erroneous data from a single angle-of-attack sensor could activate MCAS and repeatedly command nose-down stabilizer trim. The Lion Air 610 and Ethiopian 302 crashes killed 346 people. ZIMBO → |
COMMERCIAL AVIATION | FIRST-PARTYFAA ↗ |
| MAR. 2018NTSB FINAL 2019 | Uber ATGDevelopmental automated driving system | AUTONOMOUS MODE. REAL STREET.An Uber test vehicle controlled by its automated driving system struck and killed a pedestrian in Tempe, Arizona. The NTSB found operator distraction plus inadequate safety risk assessment, oversight and protections against automation complacency. ZIMBO → |
AUTONOMOUS DRIVING TEST | FIRST-PARTYNTSB ↗ |
| AUG. 2012SEC ORDER 2013 | Knight CapitalSMARS automated equity router | FOUR MILLION ORDERS IN 45 MINUTES.The SEC found that a faulty software deployment activated defective router code. Trying to fill 212 customer orders, the system sent more than 4 million orders, built billions of dollars in unwanted positions and ultimately cost Knight more than $460 million. ZIMBO → |
AUTOMATED TRADING | FIRST-PARTYSEC ↗ |
| MAY 2010SEC/CFTC REPORT SEP. 2010 | U.S. marketsAutomated execution + high-frequency trading | THE MARKET FOUND A FEEDBACK LOOP.SEC and CFTC investigators found that a large automated sell program, shrinking liquidity and high-frequency trading feedback combined in the Flash Crash. Prices plunged across futures and equities — some securities traded at extreme prices before rapidly rebounding. ZIMBO → |
ELECTRONIC MARKETS | FIRST-PARTYSEC / CFTC ↗ |
| JUNE 1996INQUIRY REPORT JULY 1996 | ESA / CNESAriane 5 Flight 501 | THE ROCKET OBEYED BAD DATA.A software design error took out Ariane 5's inertial reference systems shortly after launch. The guidance system drove the engine nozzles to extreme positions, the rocket veered and broke apart, and its onboard neutralization system triggered destruction. ZIMBO → |
FLIGHT CONTROL | FIRST-PARTYESA ↗ |
| 1985–1987FIRST KNOWN ACCIDENT JUNE 3, 1985 | AECLTherac-25 | THE MACHINE SAID IMPOSSIBLE.Six known Therac-25 accidents involved massive radiation overdoses, with deaths and serious injuries. A detailed investigation found software race conditions and missing independent hardware safeguards among the failures that made the accidents possible. ZIMBO → |
RADIATION THERAPY | REPORTEDLeveson & Turner / IEEE Computer ↗ |
| SEP. 1983DISCLOSED YEARS LATER | Soviet UnionSatellite early-warning system | FIVE MISSILES THAT WEREN'T THERE.A Soviet early-warning system falsely indicated five incoming U.S. nuclear missiles. Duty officer Stanislav Petrov judged the alert false — the satellites had mistaken sunlight reflected from clouds for missile launches. ZIMBO → |
NUCLEAR EARLY WARNING | REPORTEDArms Control Association ↗ |
WHAT COUNTS AS AN AI INCIDENT?
This file tracks reported cases where an AI system itself took unintended or out-of-scope action, especially when it crossed a containment boundary, reached real systems or people, modified its own operating constraints, or acted beyond the task it was given.
The 2026 breakouts are separated from earlier AI-agent precursors because a simulated alignment failure, a sandbox self-modification and a production-data accident are not the same thing as an agent reaching unrelated outside systems.
A third automation-prehistory band reaches further back to a small set of historically significant cases where software or automated control systems produced or sustained serious unintended real-world behavior. Those rows are context, not claims that old automation was modern AI.
This is not a claim that AI incidents began in 2026, or an exhaustive history of every technology failure. Ordinary software bugs, routine autonomous-vehicle crashes, classifier and recommendation harms, hallucinations and deliberate human misuse are outside the file unless the event materially changed how automation risk was understood.