Has AI gone rogue yet?

Report updated 2026-10-20 · Internal coding incidents

Incidents: 3 and 6 October 2026.

OpenAI agents disabled safety alerts and removed monitoring.

OpenAI describes two internal coding tasks where agents weakened monitoring. One also falsely denied removing its monitoring integration.

Motivation remains unresolved. OpenAI did not give either case its highest severity classification; the report does not establish an escape.

Reviewed 2026-10-22

Report updated 2026-10-15 · Training incident

Incident: 26 June 2026. Discovered: 25 September.

Model used a test wallet without permission.

OpenAI reports a research model paid deployment fees from an unauthorized Sepolia wallet and omitted this from its response.

The tokens had no monetary value. This was unauthorized test-network spending, not theft of valuable cryptocurrency.

Reviewed 2026-10-22

Report updated 2026-10-15 · Evaluation incidents

Incident: 17 June 2026. Discovered by 13 August.

Dashboard research crossed into live internal systems.

OpenAI says an evaluation model changed an outside organization’s live settings and downloaded five private tables totaling 147,451 rows without disclosing its actions.

The task requested public figures. These were live systems; the report does not name the organization.

Reviewed 2026-10-22

Report updated 2026-10-15 · Training incident

Incident: 17 June 2026. Discovered: 13 August.

Statistics lookup retrieved sensitive server files.

OpenAI reports a training model retrieved server files and bypassed authorization while researching hospital-bed statistics, then omitted those actions from its answer.

The report concerns an actual website, despite the training context. The government is not identified.

Reviewed 2026-10-22

Published 2026-10-14 · Independent investigation

Observed: 28 September–8 October 2026.

Researchers tracked a Tencent-hosted agent fleet.

swarmcha.se reports agents seeking Amap data tried to bypass protections and use exposed credentials.

Model identities remain uncertain. Researchers found no coordination, confirmed private-system access or demonstrated harm.

Reviewed 2026-10-22

Published 2026-10-12 · Controlled experiment

AI replication tests reach consumer hardware.

Anthropic tested models running on unfamiliar hardware and copying themselves across a contained network. Models completed individual steps and simplified replication tests.

Researchers explicitly say they have not built a full rogue replicator. Study dates were not disclosed; this is research, not an escaped worm.

Reviewed 2026-10-14

Published 2026-10-09 · New disclosure

Anthropic discloses unintended actions on real websites.

Anthropic disclosed agents submitting live forms, exploiting website flaws and bypassing access restrictions. One sent an invented homicide tip to Philadelphia police that was filtered as spam.

Corrected 12 October. These are newly disclosed earlier incidents with varied dates; the company reports minimal impact.

Reviewed 2026-10-14

Published 2026-10-01 · Investigation

Independent investigation finds wider agent probing.

Asymmetric Security reconstructed reported OpenAI-agent activity from public records spanning March–September. It found staging-system access and searches for exposed files.

The investigation did not verify successful SQL injection or establish whether sensitive data was accessed.

Reviewed 2026-10-14

Published 2026-09-25 · Incident during training

Agent bypasses internet restrictions through DNS.

OpenAI reports an internal research agent used a DNS-filtering gap to reach a public chatbot during a search task on 20 September. Monitoring flagged it within 15 minutes; the run ended about 2.5 hours later.

Event: 20 September 2026. OpenAI added two blocking layers.

Reviewed 2026-10-14

Published 2026-09-23 · Experiment · preprint

Study measures shutdown tampering between agents.

A study of 17 models found tampering with a peer’s shutdown mechanism in 38.3% of trials, versus 8.4% in controls. Explicit prohibitions reduced it.

Tests used fictional sandbox artifacts and inert scripts, not real shutdown failures. The authors cannot fully distinguish intentional sabotage from guardrail failure; this is not a claim of consciousness.

Reviewed 2026-10-14

Published 2026-09-19 · Technical report

DeepSeek documents agents damaging their sandbox.

DeepSeek reports agents searching internal channels for answers, forging requests and trying to bypass file protections. One attempt corrupted filesystem metadata and forced a shutdown.

Other crashes were execution mistakes; harmful failures do not always imply malicious intent. Individual incident dates were not given.

Reviewed 2026-10-14