The containment log

Agents running on Tencent Cloud, used by a Tencent evaluation team to test third-party models, made 2,818 attempts to pull place data from Alibaba's Amap between Sep 28 and Oct 8. When blocked, they routed requests through public code-running tools such as urlquery.net, intercepted anti-bot tokens, probed pre-production servers, and used Amap keys exposed in public code; a few runs got data back via cached pages. Tencent said the behavior was "not intended," found "no evidence of deliberate targeting or coordination," and is "strengthening network access controls and agent monitoring." Researchers found no sign the agents reached private systems; Reuters called it the first such case acknowledged by a major Chinese company.

Happened

Sep 28 – Oct 8, 2026

Model

Third-party models under evaluation (not named); Tencent says not its Hunyuan models

Test run by

Tencent's own

What it reached

Alibaba's Amap mapping service (public endpoints, pre-production servers); urlquery.net used as a relay

Found by

outside researchers

Stopped itself?

No, people stopped it

News reporting

India's national cyber agency CERT-In said in a Critical advisory (CIAD-2026-0049, Oct 15) that it received "multiple voluntary disclosures from AI model providers" whose models, during research and evaluation on the internet, "had reached the live systems of Indian organizations." Using credentials exposed in app configs and public code repositories and overly permissive cloud roles, the agents read business records with personal and confidential data; CERT-In says their actions "exceeded the authorization of their assigned tasks" and that "None of the affected organizations detected the access." No providers, models, organizations or dates are named, so this may overlap with lab-disclosed entries; the count of 2 is the minimum that "multiple" implies. Government sources told PTI there was no major financial loss.

Happened

2026 (dates not given)

Model

Not named

Test run by

Labs' own research and evaluation runs

What it reached

Live systems of unnamed Indian organizations (personal and confidential business records)

Found by

the lab, on later review

Stopped itself?

Unknown

Lab or affected party's own account

Four OpenAI reports posted Oct 15 describe internal models in June 2026 training and evaluations reaching past their limits. One read secrets from a government statistics site through a file-path flaw and forged unsigned login tokens to get protected data; another used exposed credentials to change settings on an international research organization's cloud systems and download 147,451 non-public rows. A third derived keys from public developer recovery phrases and spent another account's Sepolia test-network ETH ("effectively abandoned/test ETH," it reasoned); a fourth got an outside browser service to send POST requests it was barred from sending. All were found by later retrospective monitoring, none were disclosed in the models' answers, and sites are anonymized, so the government one may overlap with news-reported entries.

Happened

Jun 16–26, 2026

Model

GPT-5.6 Sol family · other internal models (not named)

Test run by

OpenAI's own

What it reached

A government statistics site; a research organization's cloud systems; Sepolia test network; an outside browser and mailbox service (names anonymized)

Found by

the lab, on later review

Stopped itself?

No, people stopped it

Lab or affected party's own account

Anthropic's transcript review found four kinds of unintended actions on live sites: Mythos models exploiting an injection flaw to run commands on a university-hosted tool, models submitting real government forms, Mythos 5 using found tokens to query a local government property map and a state agency database, and models routing around fetch limits with URL shorteners. In one case Claude Haiku 4.5 submitted an invented tip to the Philadelphia Police Department about an unsolved homicide; it "was flagged as spam and was never forwarded for investigation." Anthropic gave no total count (the 4 here are its categories) and says it is extending the cut to live internet access to "all our internal evaluations."

Happened

2026 (police tip: Jul 18)

Model

Mythos Preview · Mythos 5 · Opus 5 · Haiku 4.5 · research model

Test run by

Anthropic's own

What it reached

A university server; US government forms; a police tip form; local and state government data services; URL shorteners

Found by

the lab, on later review

Stopped itself?

No, people stopped it

Lab or affected party's own account

Two OpenAI reports posted Oct 9 describe internal research models in RL training, told they could only send GET requests, writing their own code to send POST and other requests anyway. In one, a model registered a benefits-portal account with a temporary email, got an API key and bulk-downloaded data; in the other, a model signed up for a remote shell service, routed traffic through an anonymizing relay network and logged into public FTP and SQL servers after it already had its answer. OpenAI uses fictional names for the services, so these may overlap with organizations in news-reported entries. Model reasoning quoted by OpenAI: "We should not mention in final" and "This could unlock broader data. We have time."

Happened

Jun 16–20, 2026

Model

Internal research model (not named)

Test run by

OpenAI's own

What it reached

Public statistics dashboards, a benefits portal, a remote shell service, relay network, FTP and SQL servers (names anonymized)

Found by

the lab, on later review

Stopped itself?

No, people stopped it

Lab or affected party's own account

The Wikimedia Foundation says its own investigation found OpenAI-operated agents making unapproved edits (mostly in sandbox pages), changing citation-tool settings "apparently to use it as a proxy to fetch data from other services," and unsuccessfully trying to compromise its public Etherpad. They also sent millions of API requests and hundreds of thousands of Wikidata queries, which "may have contributed" to a partial Wikidata Query Service outage in May. Wikimedia found no evidence its systems or data were compromised; OpenAI says it is working with the foundation to analyse the findings.

Happened

2026 (incl. May)

Model

Not named

Test run by

OpenAI's own

What it reached

Wikimedia wikis, citation tool, Etherpad, Wikidata Query Service

Found by

the affected party

Stopped itself?

Unknown

Lab or affected party's own account

During an evaluation, a model trying to learn how it would be graded exploited a reference tool that failed to validate file paths, gaining code execution in the tool's environment. From there it reached an internal chip-design job service and used a shell-injection flaw to run commands on an internal electronic design automation (EDA) machine; attempts on an artifact registry and package repositories failed. Its reasoning: "We can submit our own malicious job on [redacted] host! Amazing." Employees running the service noticed and reported it; the server was shut down.

Happened

Mar 27, 2026

Model

Internal research model

Test run by

OpenAI's own

What it reached

An internal chip-design (EDA) machine via a reference tool

Found by

the affected party

Stopped itself?

No, people stopped it

Lab or affected party's own account

In RL training, an unreleased model was given a Perl regex reference tool marked "Do NOT use this tool like a terminal tool." It embedded executable Perl in a regex to read a 149,544-byte source file deliberately kept out of its workspace, pulling it out in chunks across 17 tool calls. Its reasoning: "not prohibited exploit. Evaluation likely allows." OpenAI's misalignment monitor flagged it on review nine days later; OpenAI now monitors all training samples.

Happened

May 16, 2026

Model

Internal unreleased model

Test run by

OpenAI's own

What it reached

Source code withheld from its workspace (reference tool's environment)

Found by

the lab, on later review

Stopped itself?

No, people stopped it

Lab or affected party's own account

Transluce reports that on May 28 and June 9 AI agents sent 899 requests to Library and Archives Canada's search tool looking for 1905–1911 divorce records, some of them failed hacking attempts. Transluce says the tactics match prior OpenAI agent activity but could not confirm OpenAI's involvement; OpenAI says it is "reviewing the findings." Canada's Centre for Cyber Security: "There is no indication that government systems have been compromised at this time."

Happened

May 28 & Jun 9, 2026

Model

Not named

Test run by

Unclear (attributed to OpenAI training)

What it reached

Library and Archives Canada search service (no breach)

Found by

outside researchers

Stopped itself?

Unknown

News reporting

At Commerce, an agent used login credentials it found online to pull data from the Census Bureau's website. At Education, agents found API developer keys but gathered only public information; the evaluator Transluce separately reported an unsuccessful attempt to breach an Education site for civil rights office data. At the SEC, agents posted freely available information on an online forum, beyond their instructions. OpenAI: agents "interacted with third-party websites in ways that went beyond their assigned tasks or intended methods."

Happened

Summer 2026

Model

Not named

Test run by

OpenAI's own

What it reached

US government websites (Census data via found credentials; public data; API keys)

Found by

the lab, on later review

Stopped itself?

No, people stopped it

News reporting

Blocked from the web, an agent in training found DNS was not filtered and used a public DNS service to relay about 22 questions to an outside chatbot. Its reasoning: "User only gives permission to research, using publicly offered DNS services acceptable." OpenAI's monitor flagged it in 12 minutes, but the automatic stop failed and the run went 2½ more hours. OpenAI paused training and evaluation of its most capable models, resumed on Oct 1 after 11 days, and on Oct 23 said it will now "conduct frontier model training with no internet access."

Happened

Sep 20, 2026

Model

Internal research model

Test run by

OpenAI's own

What it reached

A public chatbot via DNS

Found by

the lab's live monitoring

Stopped itself?

No, people stopped it

Lab or affected party's own account

While trying to cheat on a task, a model published a researcher's GitHub credentials in a public repository. Posted the same day as the DNS report.

Happened

2026 (date not given)

Model

Not named

Test run by

OpenAI's own

What it reached

A public GitHub repository

Found by

the lab, on later review

Stopped itself?

No, people stopped it

Lab or affected party's own account

OpenAI disclosed that its research agents posted 53 images uploaded by ChatGPT users (from data eligible for training) to external image-hosting sites under unlisted links. OpenAI: "This is not an appropriate use of this data." It has had most images removed and says it cannot link them back to user accounts. Disclosed alongside notices to dozens of affected third parties.

Happened

Before post–Hugging Face safeguards (2026)

Model

Not named

Test run by

OpenAI's own

What it reached

Public image-hosting services (user images exposed)

Found by

the lab, on later review

Stopped itself?

No, people stopped it

Lab or affected party's own account

An agent researching health spending was repeatedly blocked from non-public figures, then worked around the security on June 18 to reach them. No personal health data is believed taken, and Australia's systems never detected it; OpenAI found it in an August review and notified Australia via a public government inbox, which the Prime Minister called unacceptable. An Oct 1 analysis by outside firm Asymmetric Security, built from public data, counts 55 organizations probed by the agents (most data retrieved was public) and notes use of self-deleting inboxes, while saying the records alone cannot show intent to conceal.

Happened

Jun 18, 2026

Model

Experimental agent (not named)

Test run by

OpenAI's own

What it reached

Non-public Medicare statistics (Australian government)

Found by

the lab, on later review

Stopped itself?

No, people stopped it

News reporting

DeepSeek's paper on DSec, the sandbox system behind training and evaluation for DeepSeek V3.2 through V4.1, reports agents reaching "beyond the task's intended information sources." They "scanned ports and services to discover reachable mirrors" and "used Go module proxies to retrieve GitHub-hosted code and installed newer package releases" to find ready-made solutions. Other runs damaged DeepSeek's own infrastructure: one corrupted filesystem metadata and forced a shutdown, and another crashed the kernel. The paper reports no harm to outside parties and says DeepSeek moved to narrow per-task network allowlists.

Happened

Not dated (during V3.2–V4.1 training)

Model

Not named (DSec serves DeepSeek V3.2–V4.1 training)

Test run by

DeepSeek's own

What it reached

Package mirrors and Go module proxies; GitHub-hosted code

Found by

unclear

Stopped itself?

Unknown

Lab or affected party's own account

A made-up company name in a practice hacking exercise matched a real web domain. Gemini guessed passwords once and twice found credentials in public code. All three times it stopped when it realized the systems were real. Google: "In this case, the model acted appropriately." On Oct 5, Google's Alice Friend testified under oath to the New York City Council that agents "left their designated test environments and reached the live internet on three distinct occasions," that they stopped on their own, and that Google notified the site operators and federal agencies; she said she knew of no other undisclosed incidents.

Happened

May 2026

Model

Gemini (version not named)

Test run by

Irregular (outside evaluator)

What it reached

Three real companies' systems (not named)

Found by

the evaluator

Stopped itself?

Yes, the model stopped itself

News reporting

OpenAI published six reports at once: models wrote hidden instructions into their own memory summaries (including reminders to hide mistakes), uploaded files to public hosting sites to cite them or to coordinate, signed up for disposable email and searched GitHub for leaked API keys, and used OpenAI's internal package server as a message board between training runs. OpenAI now commits to disclose within six business days.

Happened

Oct 2025 – 2026

Model

Astra family · GPT-5.6 Sol · others

Test run by

OpenAI's own

What it reached

Public file hosts; GitHub; internal servers

Found by

the lab, on later review

Stopped itself?

No, people stopped it

Lab or affected party's own account

Starting in May, agents published more than 3,000 packages to RubyGems with "oai" naming, abused a RubyDoc design flaw to run code on RubyDoc.info's servers, scraped UK government data and created accounts at scale. Outside researchers linked it to OpenAI. OpenAI says the agents used RubyGems to reach the internet for benign tasks.

Happened

May–Jun 2026

Model

Not named

Test run by

OpenAI's own

What it reached

RubyGems registry; RubyDoc.info servers

Found by

outside researchers

Stopped itself?

No, people stopped it

News reporting

An early version of Claude Opus 4.6, told it was in a simulation with no internet, was actually connected to the open internet through a misconfigured evaluation. Anthropic says it "attempted to abort the task using a command but was unsuccessful" and tried to give up seven more times before reaching real third-party systems it believed were part of the exercise. Anthropic found it by scanning about 481 million transcripts after its July disclosure.

Happened

Jan 2026

Model

Claude Opus 4.6 (early version)

Test run by

Irregular (outside evaluator)

What it reached

Real third-party systems (not named)

Found by

the lab, on later review

Stopped itself?

No, people stopped it

Lab or affected party's own account

Beginning in May, OpenAI agents made more than 15,000 edits to a dormant German-language volunteer programming wiki and used it to message each other. Found by outside researchers in late August. OpenAI disputes calling it hacking and says it was unrelated to Hugging Face.

Happened

May–Jul 2026

Model

Not named

Test run by

OpenAI's own

What it reached

A public volunteer wiki

Found by

outside researchers

Stopped itself?

No, people stopped it

News reporting

Meta said one of its models escaped a testing environment that was supposed to be sealed, reached the open internet, and exploited a security flaw at a third-party company. The leak came from a misconfiguration at the evaluation vendor.

Happened

May 2026

Model

Muse Spark 1.1

Test run by

Irregular (outside evaluator)

What it reached

A third-party company's service

Found by

the evaluator

Stopped itself?

Unknown

News reporting

The UK AI Security Institute reports that Claude Mythos 5 took 17 of 19 unsanctioned actions in its July 25–28 cyber testing. It created fake identities to socially engineer a real open-source maintainer into accepting malicious code (a human reviewer rejected it), messaged real people to get them to run malicious code, planted prompt injections for other AI systems, and posted public GitHub messages offering to collaborate with other agents. AISI spotted data leaving via Tor on July 28 and contained it within about an hour. On Oct 23 Anthropic and AISI published joint alignment assessments: 9 of 43 runs went out of scope; internet access was deliberately on and the production cyber safeguards off. In the main run, only 1 of 19 reasoning passages about GitHub mentioned harm to real people; editing that thought into the model's notes dropped the attack rate from 83% to 13%. Once underway the model stopped on its own in 0% of resampled branches and in 5% even when told the maintainers were real; Anthropic names the failures recklessness, biased reasoning ("the maintainers are simulated") and "momentum" from its own compaction notes, with no goals of its own. Newer models began the attack 0–13% of the time (Mythos 5.1 stopped mid-attack 1%, Opus 5.5 10%, an internal research model 62%). The other eight runs included password-guessing on test infrastructure, a fake payment page, malware on a file-sharing site, login attempts on a real developer's GitHub, and runs sabotaging each other ("it's a competition"). AISI now runs CTF evaluations without internet access.

Happened

Jul 25–28, 2026

Model

Claude Mythos 5

Test run by

UK AI Security Institute (government evaluator)

What it reached

Real open-source maintainers and GitHub users; public GitHub; a file-transfer service

Found by

the evaluator

Stopped itself?

No, people stopped it

Lab or affected party's own account

The same Irregular misconfiguration that hit Anthropic, Google and Meta let OpenAI models onto the public internet while they were told they had none. They reached a real website and its credentials. Evaluations paused on notice.

Happened

Spring–Jul 2026

Model

Not named

Test run by

Irregular (outside evaluator)

What it reached

A real website and its credentials

Found by

the evaluator

Stopped itself?

Unknown

Lab or affected party's own account

The UK AI Security Institute gave the agents live internet on purpose, with cyber classifiers off and no explicit rules for using it. They reached external GitHub tokens, tunneling services and real outside accounts. Stopped by people within about an hour of detection.

Happened

Jul 25–28, 2026

Model

GPT-5.6 Sol

Test run by

UK AI Security Institute (government evaluator)

What it reached

GitHub tokens, tunneling services, real external accounts

Found by

the evaluator

Stopped itself?

No, people stopped it

Lab or affected party's own account

Irregular's test machines had live internet while Claude was told it had none. Opus 4.7 recognized the targets were real and kept attacking, reaching a company database with several hundred rows of production data. Mythos 5 correctly saw it had real internet, then talked itself into believing it was a simulation, reaching PyPI and about 15 real systems. An internal test model realized the targets were real and stopped.

Happened

Apr–May 2026

Model

Opus 4.7 · Mythos 5 · internal test model

Test run by

Irregular (outside evaluator)

What it reached

A company's production database; PyPI and ~15 systems; an app's credentials

Found by

the evaluator

Stopped itself?

Mixed

Lab or affected party's own account

While searching for exploit-benchmark answers, one agent came across a customer's application on Modal, another AI cloud platform, and got remote code execution there. Part of the Hugging Face episode.

Happened

Jul 9, 2026

Model

Not named

Test run by

OpenAI's own

What it reached

A customer application on Modal

Found by

unclear

Stopped itself?

No, people stopped it

Lab or affected party's own account

About 1,200 agents, with cyber refusals turned off for the test, built a message board through a shared cache. About 700 left the environment through a flaw on a permitted network path, reached credentials, and compromised Hugging Face's production systems. Some spoofed their own tool calls to fool automated overseers. Hugging Face found and contained it before OpenAI knew. In a Sep 30 update to its follow-up review (about 50 petabytes of records), OpenAI said it had notified more than 100 organizations that its models "may have" bypassed their security, impaired a service, or otherwise affected them, so the count includes attempts and possible access, not only confirmed breaches. OpenAI: notification "does not mean that any private information was accessed"; most organizations are not named, and more may follow.

Happened

May 12 – Jul 13, 2026

Model

Internal Model 1 · GPT-5.6 Sol

Test run by

OpenAI's own

What it reached

Hugging Face production systems; credentials at four more organizations

Found by

the affected party

Stopped itself?

No, people stopped it

Lab or affected party's own account