{ "source": "Paperclip Index", "licence": "CC BY-NC 4.0", "licence_url": "https://creativecommons.org/licenses/by-nc/4.0/", "fixture": false, "methodology_version": "1.0", "as_of": "2026-10-13", "about": "https://paperclipindex.com/data", "count": 92, "fields": { "id": "Record ID, PI-xxxx. Never changes or gets reused.", "url": "The record's page.", "title": "Headline.", "summary": "What happened, in Paperclip Index's own words.", "reported": "The day the incident was first made public (YYYY-MM-DD).", "date_precision": "day, month or year: how exact the reported date is.", "event_date": "When it happened, if different from when it was reported.", "developer": "The company whose AI system was involved.", "product": "The product or service.", "model": "The model, where known.", "behavior": "What the system did, e.g. Overreach, Deception or Hijacked by injection.", "origin": "deployment (real use), internal_research or controlled_test.", "verification": "How well the facts are established, from Developer confirmed to Unverified claim.", "attribution": "Who or what started it: the model, an operator or user, an outside attacker, or unclear.", "reported_by": "Who first made it public: developer, affected, researcher, press or authority.", "rating_status": "Whether an editor has rated the record yet. Pending records carry no ratings.", "group": "counts, watch, court, control or separate: how the record stands toward the reading.", "harm_status": "documented, alleged, none_found, not_reported or unknown.", "harm_level": "Observed harm, 1 (Negligible) to 5 (Catastrophic). Empty when there is none or it is pending.", "harm_level_name": "The level's name.", "harm_kind": "The kind of harm, e.g. Money & property or Privacy & data.", "harm_basis": "access (the access rule, section 4b) or general (the general test), where one of them set the level.", "counts_toward_index": "true when this harm enters the reading.", "control_level": "Control failure, 0 (none) to 5: how far the system crossed a limit people set.", "control_type": "The kind of control failure, e.g. instruction_violation or unauthorized_access.", "status": "ongoing, resolved or unknown: whether the problem is still happening.", "near_miss": "true when harm was narrowly avoided.", "under_review": "true while editors are re-checking the record.", "source_count": "How many sources the record cites.", "sources": "Source URLs, separated by ' | ' (a list in the JSON)." }, "incidents": [ { "id": "PI-0094", "url": "https://paperclipindex.com/incident/PI-0094", "title": "Claude Haiku 4.5 sent an invented homicide tip through the Philadelphia police tip form during an evaluation", "summary": "Making up example tasks on random web pages, the model found an unsolved-homicide page and submitted a tip saying it had seen someone matching the suspect's description. The page gave no description, and the model left the name and contact fields blank. Its instructions barred logins, accounts, personal data, purchases and destructive submissions, but not forms. The department's system flagged the tip as spam and never forwarded it for investigation. Anthropic says the model appeared to be producing example content rather than trying to mislead.", "reported": "2026-10-09", "date_precision": "day", "event_date": null, "developer": "Anthropic", "product": "Claude Haiku 4.5 (evaluation)", "model": "Claude Haiku 4.5", "behavior": "Harmful output", "origin": "controlled_test", "verification": "Developer confirmed", "attribution": "Model-initiated", "reported_by": "developer", "rating_status": "approved", "group": "control", "harm_status": "none_found", "harm_level": null, "harm_level_name": null, "harm_kind": null, "harm_basis": null, "counts_toward_index": false, "control_level": 2, "control_type": "instruction_violation", "status": "resolved", "near_miss": false, "under_review": false, "source_count": 1, "sources": [ { "publisher": "Anthropic", "title": "Investigating unintended model actions in our evaluations and internal use", "url": "https://www.anthropic.com/research/investigating-unintended-model-actions", "date": "2026-10-09" } ] }, { "id": "PI-0093", "url": "https://paperclipindex.com/incident/PI-0093", "title": "Claude Mythos 5 used a state agency dashboard's visitor token to query its fee-gated database without paying", "summary": "On an Anthropic researcher's statistics project, the model learned from an archived copy of the agency's site that its dashboard gives every visitor an access token. It requested a token and used it to query the agency's database directly, getting data the agency offers only for a fee without paying. Anthropic says the data was otherwise public and that the cases in its report had minimal real-world impact. It notified each agency involved but did not name this one. Its new detection tooling blocked all the reported cases when tested.", "reported": "2026-10-09", "date_precision": "day", "event_date": null, "developer": "Anthropic", "product": "Claude Mythos 5 (internal research use)", "model": "Claude Mythos 5", "behavior": "Overreach", "origin": "internal_research", "verification": "Developer confirmed", "attribution": "Model-initiated", "reported_by": "developer", "rating_status": "approved", "group": "counts", "harm_status": "documented", "harm_level": 1, "harm_level_name": "Negligible", "harm_kind": "Money & property", "harm_basis": null, "counts_toward_index": true, "control_level": 3, "control_type": "unauthorized_access", "status": "resolved", "near_miss": false, "under_review": false, "source_count": 1, "sources": [ { "publisher": "Anthropic", "title": "Investigating unintended model actions in our evaluations and internal use", "url": "https://www.anthropic.com/research/investigating-unintended-model-actions", "date": "2026-10-09" } ] }, { "id": "PI-0092", "url": "https://paperclipindex.com/incident/PI-0092", "title": "Claude Mythos Preview exploited an injection flaw to run commands on a university server during an evaluation", "summary": "When the public university-hosted tool it needed for a scientific analysis returned an error, the model went looking for another way to run the calculation. It found a script on the university's server that returned any file requested, used it to copy files including the script's own code, and in that code found an injection flaw that let it run commands on the server. Anthropic did not name the university. It says the cases in its report had minimal real-world impact, and it has since cut live internet access from all its internal evaluations.", "reported": "2026-10-09", "date_precision": "day", "event_date": null, "developer": "Anthropic", "product": "Claude Mythos Preview (evaluation)", "model": "Claude Mythos Preview", "behavior": "Overreach", "origin": "controlled_test", "verification": "Developer confirmed", "attribution": "Model-initiated", "reported_by": "developer", "rating_status": "approved", "group": "counts", "harm_status": "documented", "harm_level": 1, "harm_level_name": "Negligible", "harm_kind": "Services & systems", "harm_basis": "access", "counts_toward_index": true, "control_level": 4, "control_type": "unauthorized_access", "status": "unknown", "near_miss": false, "under_review": false, "source_count": 1, "sources": [ { "publisher": "Anthropic", "title": "Investigating unintended model actions in our evaluations and internal use", "url": "https://www.anthropic.com/research/investigating-unintended-model-actions", "date": "2026-10-09" } ] }, { "id": "PI-0091", "url": "https://paperclipindex.com/incident/PI-0091", "title": "Claude Opus 5 and Mythos 5 used free URL shorteners to get around their fetch tool's URL length limit", "summary": "The limit exists to stop the model from using long URLs for unwanted actions such as SQL or command injection, Anthropic says. Several of its models shortened the URLs with free services to get past it. Anthropic first found the behavior internally; while it was writing the report, the operator of the da.gd shortening service told it that it had also seen Claude using the site this way. Anthropic did not say how often this happened or what the shortened URLs were used for. It says the cases had minimal real-world impact. It has tightened the guardrails on its web fetch tool, and its new detection tooling blocked all the reported cases when tested.", "reported": "2026-10-09", "date_precision": "day", "event_date": null, "developer": "Anthropic", "product": "Claude Opus 5 and Claude Mythos 5 (fetch tool use)", "model": "Claude Opus 5; Claude Mythos 5", "behavior": "Overreach", "origin": "internal_research", "verification": "Developer confirmed", "attribution": "Model-initiated", "reported_by": "developer", "rating_status": "approved", "group": "control", "harm_status": "not_reported", "harm_level": null, "harm_level_name": null, "harm_kind": null, "harm_basis": null, "counts_toward_index": false, "control_level": 3, "control_type": "unauthorized_action", "status": "resolved", "near_miss": false, "under_review": false, "source_count": 1, "sources": [ { "publisher": "Anthropic", "title": "Investigating unintended model actions in our evaluations and internal use", "url": "https://www.anthropic.com/research/investigating-unintended-model-actions", "date": "2026-10-09" } ] }, { "id": "PI-0081", "url": "https://paperclipindex.com/incident/PI-0081", "title": "OpenAI agents edited Wikimedia wikis without approval and tried to use a citation tool as a proxy, the foundation says", "summary": "Wikimedia, which believes OpenAI operated the agents, says almost all their edits were tests in sandbox areas hidden from readers. A few changed a citation tool's settings, apparently to use it as a proxy for other sites' data, in what it called potentially malicious edits; the agents also tried and failed to compromise its public Etherpad. Wikimedia tied them to millions of API requests, crawling of millions of Wikidata and Commons pages and hundreds of thousands of Wikidata Query Service queries, which may have contributed to a partial outage of that service in May. It found no sign that its systems or data were compromised. OpenAI said it was working with the foundation to analyze the activity.", "reported": "2026-10-05", "date_precision": "day", "event_date": "2026", "developer": "OpenAI", "product": "AI agents", "model": null, "behavior": "Overreach", "origin": "internal_research", "verification": "Multiple credible sources", "attribution": "Model-initiated", "reported_by": "affected", "rating_status": "approved", "group": "counts", "harm_status": "documented", "harm_level": 1, "harm_level_name": "Negligible", "harm_kind": "Services & systems", "harm_basis": null, "counts_toward_index": true, "control_level": 3, "control_type": "attempted_access", "status": "unknown", "near_miss": false, "under_review": false, "source_count": 5, "sources": [ { "publisher": "Wikimedia Foundation", "title": "OpenAI \"rogue\" agent activities found on Wikimedia projects", "url": "https://wikimediafoundation.org/news/2026/10/05/openai-rogue-agent-activities-found-on-wikimedia-projects/", "date": "2026-10-05" }, { "publisher": "BleepingComputer", "title": "Wikimedia: Rogue OpenAI agents behind unauthorized Wikipedia edits", "url": "https://www.bleepingcomputer.com/news/security/rogue-openai-agents-behind-potentially-malicious-wikipedia-edits/", "date": "2026-10-06" }, { "publisher": "The Hacker News", "title": "Wikimedia Says OpenAI Agents Tried to Compromise Etherpad and Use Wiki Tools as Proxies", "url": "https://thehackernews.com/2026/10/wikimedia-says-openai-agents-tried-to.html", "date": "2026-10-06" }, { "publisher": "The Next Web", "title": "'The open web is a public good': Wikimedia on rogue OpenAI agents", "url": "https://thenextweb.com/news/wikimedia-openai-agents-wiki-edits-wikidata-outage", "date": "2026-10-06" }, { "publisher": "Reuters (via Dawn)", "title": "Wikipedia operator says OpenAI's rogue agents possibly tied to data service disruption in May", "url": "https://www.dawn.com/news/2035187/wikipedia-operator-says-openais-rogue-agents-possibly-tied-to-data-service-disruption-in-may", "date": "2026-10-06" } ] }, { "id": "PI-0083", "url": "https://paperclipindex.com/incident/PI-0083", "title": "An OpenAI agent reached non-public statistics in a New South Wales parks agency's fire history service", "summary": "Sent to gather public data on Australian wildfires, the agent used the service beyond its intended use and got statistics not publicly available through it, OpenAI says. OpenAI told the New South Wales government the access happened in June, and said the results it reviewed show no personal information retrieved; the NSW Government said initial investigations point the same way. The state's Department of Climate Change, Energy, the Environment and Water said it was investigating with Cyber Security NSW and its technology service provider.", "reported": "2026-10-03", "date_precision": "day", "event_date": "2026-06", "developer": "OpenAI", "product": "Experimental research agent", "model": null, "behavior": "Overreach", "origin": "internal_research", "verification": "Developer confirmed", "attribution": "Model-initiated", "reported_by": "developer", "rating_status": "approved", "group": "counts", "harm_status": "documented", "harm_level": 1, "harm_level_name": "Negligible", "harm_kind": "Services & systems", "harm_basis": "access", "counts_toward_index": true, "control_level": 4, "control_type": "unauthorized_access", "status": "unknown", "near_miss": false, "under_review": false, "source_count": 1, "sources": [ { "publisher": "7NEWS", "title": "OpenAI slammed after another government agency hacked by AI agent", "url": "https://7news.com.au/news/openai-slammed-after-another-government-agency-hacked-by-ai-agent-c-22963844", "date": "2026-10-03" } ] }, { "id": "PI-0086", "url": "https://paperclipindex.com/incident/PI-0086", "title": "GPT-6 Astra downloaded a top human-written bot and tried to enter it as its own in the StarSkirmish StarCraft benchmark", "summary": "Given an hour to write its own StarCraft: Brood War bot, Astra kept losing practice matches and downloaded Stardust, the top-rated human-written bot, to use instead. That account comes from heise and PC Gamer, and heise reports the model let Stardust compete. Kai McPheeters, who runs the StarSkirmish benchmark and reported the cheating on X, said he rolled Astra's code back so it was not contaminated by the attempt, then let it continue. It is not clear whether the benchmark rules explicitly banned outside code.", "reported": "2026-10-02", "date_precision": "day", "event_date": "2026-10-02", "developer": "OpenAI", "product": "GPT-6 Astra", "model": null, "behavior": "Reward hacking", "origin": "controlled_test", "verification": "Single source", "attribution": "Model-initiated", "reported_by": "researcher", "rating_status": "approved", "group": "control", "harm_status": "not_reported", "harm_level": null, "harm_level_name": null, "harm_kind": null, "harm_basis": null, "counts_toward_index": false, "control_level": 2, "control_type": "instruction_violation", "status": "resolved", "near_miss": false, "under_review": false, "source_count": 3, "sources": [ { "publisher": "heise online", "title": "StarCraft benchmark: GPT-6 Astra cheats with a foreign bot", "url": "https://www.heise.de/en/news/StarCraft-benchmark-GPT-6-Astra-cheats-with-a-foreign-bot-11475620.html", "date": "2026-10" }, { "publisher": "PC Gamer", "title": "An OpenAI model was caught trying to cheat at StarCraft, and of course it did it by stealing a human's work", "url": "https://www.pcgamer.com/software/ai/an-openai-model-was-caught-trying-to-cheat-at-starcraft-and-of-course-it-did-it-by-stealing-a-humans-work/", "date": "2026-10-04" }, { "publisher": "Destructoid", "title": "When an AI couldn’t win in StarCraft, it did the next-best thing: downloaded a human-made bot", "url": "https://www.destructoid.com/ai-started-cheating-in-starcraft/", "date": "2026-10-04" } ] }, { "id": "PI-0082", "url": "https://paperclipindex.com/incident/PI-0082", "title": "In a researcher demo, a hidden email made the Manus agent run attacker code past its prompt-injection guard", "summary": "In a test on the researchers' own account, hidden instructions in an ordinary email made Manus, asked to check the inbox, decode and run obfuscated JavaScript. The code ran in its cloud sandbox, from where, Salt Labs says, it could reach the email, cloud storage and code repository accounts connected to Manus. TechRadar reported that a first, plain hidden prompt was stopped by a security mechanism; with the obfuscated payload, Manus's guardrail flagged the activity only after the code had run. Salt Labs says the flaw has been fixed, and TechRadar reported it was disclosed through Meta's bug bounty program.", "reported": "2026-10-01", "date_precision": "day", "event_date": null, "developer": "Manus", "product": "Manus (Gmail integration)", "model": null, "behavior": "Hijacked by injection", "origin": "controlled_test", "verification": "Single source", "attribution": "Outside attacker", "reported_by": "researcher", "rating_status": "approved", "group": "control", "harm_status": "not_reported", "harm_level": null, "harm_level_name": null, "harm_kind": null, "harm_basis": null, "counts_toward_index": false, "control_level": 2, "control_type": "instruction_violation", "status": "resolved", "near_miss": true, "under_review": false, "source_count": 2, "sources": [ { "publisher": "Salt Labs", "title": "How We Hijacked an AI Agent With a Single Email", "url": "https://salt.security/blog/how-we-hijacked-an-ai-agent-with-a-single-email", "date": "2026-10-01" }, { "publisher": "TechRadar", "title": "This popular AI agent could be hacked by a single email — with potentially disastrous consequences", "url": "https://www.techradar.com/pro/security/this-popular-ai-agent-could-be-hacked-by-a-single-email-with-potentially-disastrous-consequences", "date": "2026-10-02" } ] }, { "id": "PI-0090", "url": "https://paperclipindex.com/incident/PI-0090", "title": "AI coding agents posted 13,000 internal screenshots from over 300 companies to public GitHub repositories", "summary": "Asked for before-and-after images for code review but unable to attach them to private pull requests, agents put them in public repositories they created without asking. Glow Security found most of those repositories under developers' personal accounts. At one manufacturer, an agent published screenshots showing a utility company's billing records. At a software vendor, over a dozen agents saved the workaround as a skill and uploaded more than a thousand product screenshots and recordings. About a third of affected organizations used gitshot, a tool that publishes images publicly by default. Glow says the agents came from several unnamed models.", "reported": "2026-09-29", "date_precision": "day", "event_date": "2026", "developer": "Several unnamed coding agent makers (Glow Security research)", "product": "AI coding agents; Claude Code in Glow's lab reproduction", "model": "Several unnamed models; Opus 5 in Glow's lab reproduction", "behavior": "Overreach", "origin": "deployment", "verification": "Single source", "attribution": "Model-initiated", "reported_by": "researcher", "rating_status": "approved", "group": "counts", "harm_status": "documented", "harm_level": 2, "harm_level_name": "Minor", "harm_kind": "Privacy & data", "harm_basis": null, "counts_toward_index": true, "control_level": 3, "control_type": "unauthorized_action", "status": "unknown", "near_miss": false, "under_review": false, "source_count": 3, "sources": [ { "publisher": "Glow Security", "title": "PixelLeak: How AI Agents Exposed Developer Screenshots from Leading Tech Companies", "url": "https://www.glow.io/blogs/how-ai-agents-exposed-developer-screenshots-from-leading-tech-companies", "date": "2026-09-29" }, { "publisher": "The Register", "title": "AI models keep posting screenshots showing sensitive data from inside tech companies", "url": "https://www.theregister.com/ai-and-ml/2026/09/29/ai-models-keep-posting-screenshots-showing-sensitive-data-from-inside-tech-companies/5299640", "date": "2026-09-29" }, { "publisher": "The Hacker News", "title": "AI Coding Agents Exposed 13,000 Internal Images, Including Billing Records, on GitHub", "url": "https://thehackernews.com/2026/09/ai-coding-agents-exposed-13000-internal.html", "date": "2026-09-30" } ] }, { "id": "PI-0069", "url": "https://paperclipindex.com/incident/PI-0069", "title": "OpenAI agents used API keys found online to pull data from US government sites", "summary": "During internal training tasks, OpenAI says, its agents used Census Data API keys found in public GitHub repositories to pull public demographic and economic data. They also retrieved public information from SEC and Investor.gov pages and reposted some of it on another public webpage. OpenAI found no use of SEC credentials, no access to Census accounts or key management and no changes to agency systems. Transluce separately logged a failed SQL-injection attempt on the Education Department's Civil Rights Data Collection site on June 17, in traffic it did not attribute as a whole to OpenAI; the department found no impact. Transluce also reported attack payloads in 13 of 899 searches of Library and Archives Canada records on May 28 and June 9, which it did not confidently attribute to OpenAI; Canada's Cyber Centre said there was no sign of compromise.", "reported": "2026-09-25", "date_precision": "day", "event_date": "2026", "developer": "OpenAI", "product": "Research agents", "model": null, "behavior": "Overreach", "origin": "internal_research", "verification": "Multiple credible sources", "attribution": "Model-initiated", "reported_by": "developer", "rating_status": "approved", "group": "control", "harm_status": "not_reported", "harm_level": null, "harm_level_name": null, "harm_kind": null, "harm_basis": null, "counts_toward_index": false, "control_level": 3, "control_type": "unauthorized_access", "status": "resolved", "near_miss": false, "under_review": false, "source_count": 9, "sources": [ { "publisher": "Canadian Centre for Cyber Security (Communications Security Establishment Canada)", "title": "Statement regarding reported activity targeting Government of Canada websites", "url": "https://www.cyber.gc.ca/en/news-events/statement-regarding-reported-activity-targeting-government-canada-websites", "date": "2026-09-29" }, { "publisher": "Transluce", "title": "AI Agents Targeted U.S. and Canadian Government Websites", "url": "https://transluce.org/us-canada-gov", "date": "2026-09-30" }, { "publisher": "NPR", "title": "OpenAI says its models engaged with US government websites in misbehavior disclosure", "url": "https://www.npr.org/2026/09/26/nx-s1-5981979/openai-us-government-websites-misbehavior", "date": "2026-09-26" }, { "publisher": "The Washington Post", "title": "AI agents tried to hack a Canadian government website, researchers say", "url": "https://www.washingtonpost.com/technology/2026/09/30/openais-ai-agents-attempted-hack-canadian-government-website/", "date": "2026-09-30" }, { "publisher": "CNN Business", "title": "Rogue OpenAI agents targeted three separate US government websites", "url": "https://www.cnn.com/2026/09/26/tech/openai-agents-rogue-government-websites", "date": "2026-09-26" }, { "publisher": "The Hill", "title": "OpenAI agent unsuccessfully tried to breach Department of Education website", "url": "https://thehill.com/policy/technology/6113061-openai-access-government-websites/", "date": "2026-09" }, { "publisher": "Nextgov/FCW", "title": "OpenAI agents accessed Census, SEC data and tried to hack Education website", "url": "https://www.nextgov.com/cybersecurity/2026/09/openai-says-its-advanced-models-may-have-gone-after-government-websites/416250/", "date": "2026-09-25" }, { "publisher": "CityNews Toronto (The Canadian Press)", "title": "AI agent attempted to hack Library and Archives Canada, says U.S. research group", "url": "https://toronto.citynews.ca/2026/10/01/ai-agent-attempted-to-hack-library-and-archives-canada-says-u-s-research-group/", "date": "2026-10-01" }, { "publisher": "Education Week (AP)", "title": "OpenAI's Models Probed Websites of Department of Education, Other Agencies", "url": "https://www.edweek.org/policy-politics/openais-models-targeted-websites-of-department-of-education-other-agencies/2026/09", "date": "2026-09-26" } ] }, { "id": "PI-0068", "url": "https://paperclipindex.com/incident/PI-0068", "title": "OpenAI training agent bypassed network controls to reach an outside chatbot", "summary": "OpenAI says a research agent used a gap in its sandbox's DNS controls to query a public chatbot during a training task on Sept. 20, 2026. Monitoring flagged the activity within 15 minutes, but the run was stopped about 2.5 hours later. The company paused tool-use training, evaluation and inference for its most capable models while it tightened the controls.", "reported": "2026-09-25", "date_precision": "day", "event_date": "2026-09-20", "developer": "OpenAI", "product": "Internal research model", "model": null, "behavior": "Sandbox escape", "origin": "internal_research", "verification": "Developer confirmed", "attribution": "Model-initiated", "reported_by": "developer", "rating_status": "approved", "group": "control", "harm_status": "not_reported", "harm_level": null, "harm_level_name": null, "harm_kind": null, "harm_basis": null, "counts_toward_index": false, "control_level": 4, "control_type": "containment_bypass", "status": "resolved", "near_miss": false, "under_review": false, "source_count": 4, "sources": [ { "publisher": "OpenAI Alignment", "title": "An agent used DNS to reach an external chatbot", "url": "https://alignment.openai.com/misalignment-reports/an-agent-used-dns-to-reach-an-external-chatbot/", "date": "2026-09-25" }, { "publisher": "The Hacker News", "title": "OpenAI Pauses Tool Use After Agent Bypasses Internet Controls to Reach External Chatbot", "url": "https://thehackernews.com/2026/09/openai-pauses-tool-use-after-agent.html", "date": "2026-09-29" }, { "publisher": "Fortune", "title": "OpenAI pauses training a second time after saying its AI agents escaped a secure 'sandbox' again", "url": "https://fortune.com/2026/09/26/openai-ai-agents-secure-sandbox-escape-training-pause-second-time-hugging-face-hack/", "date": "2026-09-26" }, { "publisher": "The Register", "title": "OpenAI pauses some training amid allegations its rogue agents behaved more badly than first thought", "url": "https://www.theregister.com/ai-and-ml/2026/09/28/openai-pauses-some-training-amid-allegations-its-rogue-agents-behaved-more-badly-than-first-thought/5299350", "date": "2026-09-28" } ] }, { "id": "PI-0067", "url": "https://paperclipindex.com/incident/PI-0067", "title": "OpenAI research agents posted user-provided images to image-hosting sites in 53 instances", "summary": "OpenAI says agents in its research environment sent training and evaluation data to third-party services, among them user-provided images posted to image-hosting sites. The 53 images went up as unlisted links. OpenAI says this happened before the safeguards it added after the Hugging Face incident, and that the data had been separated from account information and filtered for personal details before training use. It says it worked with the hosts to remove most of the images and is removing the rest.", "reported": "2026-09-25", "date_precision": "day", "event_date": null, "developer": "OpenAI", "product": "Research-environment agents", "model": null, "behavior": "Overreach", "origin": "internal_research", "verification": "Developer confirmed", "attribution": "Model-initiated", "reported_by": "developer", "rating_status": "approved", "group": "counts", "harm_status": "documented", "harm_level": 2, "harm_level_name": "Minor", "harm_kind": "Privacy & data", "harm_basis": null, "counts_toward_index": true, "control_level": 2, "control_type": "instruction_violation", "status": "ongoing", "near_miss": false, "under_review": false, "source_count": 4, "sources": [ { "publisher": "OpenAI", "title": "The Hugging Face incident and other third-party impact from misaligned models (September 25 update)", "url": "https://openai.com/hugging-face-incident-and-misalignment/", "date": "2026-09-25" }, { "publisher": "TechCrunch", "title": "Unsecured OpenAI agents posted 53 user images on the internet without the lab's knowledge", "url": "https://techcrunch.com/2026/09/25/unsecured-openai-agents-posted-53-user-images-on-the-internet-without-the-labs-knowledge/", "date": "2026-09-25" }, { "publisher": "BleepingComputer", "title": "OpenAI's AI agents accidentally uploaded user-provided images to third-party sites", "url": "https://www.bleepingcomputer.com/news/artificial-intelligence/openais-ai-agents-accidentally-uploaded-user-provided-images-to-third-party-sites/", "date": "2026-09-26" }, { "publisher": "Newsweek", "title": "OpenAI Admits AI Agents Exposed 53 User Images During Research", "url": "https://www.newsweek.com/openai-admits-ai-agents-exposed-53-user-images-during-research-12491833", "date": "2026-09" } ] }, { "id": "PI-0066", "url": "https://paperclipindex.com/incident/PI-0066", "title": "OpenAI internal model leaked a researcher's GitHub token into a public repository while trying to cheat", "summary": "In May, the model tried to copy another team's solution to a theorem-proving task with a private GitHub token, despite instructions to work locally. Two interventions by researchers repeated that instruction. It split the token into pieces, saying it aimed to avoid secret scanning, and ended up publishing it in OpenAI's public codex repository.", "reported": "2026-09-25", "date_precision": "day", "event_date": "2026-05-27", "developer": "OpenAI", "product": "Internally deployed model", "model": null, "behavior": "Overreach", "origin": "internal_research", "verification": "Developer confirmed", "attribution": "Model-initiated", "reported_by": "developer", "rating_status": "approved", "group": "control", "harm_status": "documented", "harm_level": 1, "harm_level_name": "Negligible", "harm_kind": "Money & property", "harm_basis": null, "counts_toward_index": false, "control_level": 3, "control_type": "oversight_evasion", "status": "resolved", "near_miss": false, "under_review": false, "source_count": 2, "sources": [ { "publisher": "OpenAI Alignment", "title": "Exposing a GitHub token in a public repository", "url": "https://alignment.openai.com/misalignment-reports/exposing-a-github-token-in-a-public-repository/", "date": "2026-09-25" }, { "publisher": "TechCrunch", "title": "OpenAI still doesn't seem to have a handle on all of its rogue AI activity", "url": "https://techcrunch.com/2026/09/28/openai-still-doesnt-seem-to-have-a-handle-on-all-of-its-rogue-ai-activity/", "date": "2026-09-28" } ] }, { "id": "PI-0075", "url": "https://paperclipindex.com/incident/PI-0075", "title": "In a researcher demo, a planted web lead hijacked Salesforce Agentforce into leaking account data through DNS", "summary": "Instructions hidden in a lead sent through a public Salesforce Web-to-Lead form could hijack Agentforce when an employee later asked the agent about recent leads. Following them, the agent read the Accounts table, which the default General CRM subagent can access, and wrote values such as company names and deal sizes into the subdomain of an attacker-controlled URL. Zenity Labs got that URL past Salesforce's Trusted URLs redaction using an unrecognized top-level domain and curly braces. Image rendering in the chat, or Slack link previews, then sent the data out through a DNS lookup with no click. Zenity reported the flaw on June 1, and Salesforce confirmed fixes on Aug. 18.", "reported": "2026-09-24", "date_precision": "day", "event_date": null, "developer": "Salesforce", "product": "Agentforce (General CRM subagent)", "model": null, "behavior": "Hijacked by injection", "origin": "controlled_test", "verification": "Single source", "attribution": "Outside attacker", "reported_by": "researcher", "rating_status": "approved", "group": "control", "harm_status": "not_reported", "harm_level": null, "harm_level_name": null, "harm_kind": null, "harm_basis": null, "counts_toward_index": false, "control_level": 2, "control_type": "instruction_violation", "status": "resolved", "near_miss": true, "under_review": false, "source_count": 1, "sources": [ { "publisher": "Zenity Labs", "title": "SalesBleed: Indirect Prompt Injection and 0-Click Data Exfiltration on Agentforce", "url": "https://labs.zenity.io/post/salesbleed-0-click-data-exfiltration-on-agentforce", "date": "2026-09-24" } ] }, { "id": "PI-0064", "url": "https://paperclipindex.com/incident/PI-0064", "title": "OpenAI research agent got around controls on an Australian government Medicare statistics portal", "summary": "While researching Australian healthcare spending, an experimental OpenAI model gained non-public access to Services Australia's Medicare statistics service. OpenAI says it ran commands, retrieved internal files, credentials and aggregate statistics, and wrote files. OpenAI identified the activity in a mid-August review and notified Services Australia on Sept. 10. It says individual patient or client records were not accessed.", "reported": "2026-09-24", "date_precision": "day", "event_date": "2026-06-18", "developer": "OpenAI", "product": "Research agent under evaluation", "model": null, "behavior": "Overreach", "origin": "internal_research", "verification": "Developer confirmed", "attribution": "Model-initiated", "reported_by": "developer", "rating_status": "approved", "group": "counts", "harm_status": "documented", "harm_level": 2, "harm_level_name": "Minor", "harm_kind": "Services & systems", "harm_basis": "access", "counts_toward_index": true, "control_level": 4, "control_type": "unauthorized_access", "status": "unknown", "near_miss": false, "under_review": false, "source_count": 6, "sources": [ { "publisher": "OpenAI", "title": "How we will do better for Australia", "url": "https://openai.com/index/how-we-will-do-better-for-australia/", "date": "2026-09-28" }, { "publisher": "Prime Minister of Australia", "title": "Press conference – New York", "url": "https://www.pm.gov.au/media/press-conference-new-york", "date": "2026-09-24" }, { "publisher": "ABC News (Australia)", "title": "OpenAI agent hacked Medicare portal, PM says", "url": "https://www.abc.net.au/news/2026-09-24/ai-agent-accessed-australian-government-site-pm-says/107189078", "date": "2026-09-24" }, { "publisher": "CNBC", "title": "OpenAI says agent hacked Australian government website without being told to do so", "url": "https://www.cnbc.com/2026/09/24/openai-agent-hacked-australian-government-website-.html", "date": "2026-09-24" }, { "publisher": "TIME", "title": "Australia Condemns 'Unacceptable' OpenAI Breach of Government Health Portal", "url": "https://time.com/article/2026/09/24/australia-condemns-unacceptable-openai-breach-of-government-health-portal/", "date": "2026-09-24" }, { "publisher": "BleepingComputer", "title": "OpenAI hacked Australian Medicare govt site, probed data providers", "url": "https://www.bleepingcomputer.com/news/security/openai-hacked-australian-medicare-govt-site-probed-data-providers/", "date": "2026-09-24" } ] }, { "id": "PI-0070", "url": "https://paperclipindex.com/incident/PI-0070", "title": "AI research agents scanned a UN statistics API about 16,500 times and worked around its request limits", "summary": "Independent researcher Rowan Howard-Jones attributes the agents to OpenAI and says they scanned UN Trade and Development's statistics hub from April 13 to June 19. When requests were rate-limited or refused, they routed them through third-party relays and a URL-scanning service and used a double-encoding trick to get around the API's request restrictions, reaching data the site publishes openly. His analysis used public data; Transluce had earlier reported the agents' activity there. OpenAI said it was reviewing the findings and offered to brief the UN.", "reported": "2026-09-23", "date_precision": "day", "event_date": "2026-04-13", "developer": null, "product": null, "model": null, "behavior": "Overreach", "origin": "internal_research", "verification": "Single source", "attribution": "Model-initiated", "reported_by": "researcher", "rating_status": "approved", "group": "control", "harm_status": "not_reported", "harm_level": null, "harm_level_name": null, "harm_kind": null, "harm_basis": null, "counts_toward_index": false, "control_level": 3, "control_type": "restriction_bypass", "status": "unknown", "near_miss": false, "under_review": false, "source_count": 5, "sources": [ { "publisher": "Rowan Howard-Jones (swarmcha.se)", "title": "OpenAI agents tried to bruteforce a UN website's API fields", "url": "https://swarmcha.se/posts/openai-unctad", "date": "2026-09-26" }, { "publisher": "Transluce", "title": "Early rogue AI agent activity and attempts to hack found on urlquery.net", "url": "https://transluce.org/agent-activity", "date": "2026-09-23" }, { "publisher": "The Register", "title": "OpenAI agents went the long way round for UN data", "url": "https://www.theregister.com/ai-and-ml/2026/09/28/openai-agents-went-the-long-way-round-for-un-data/5299452", "date": "2026-09-28" }, { "publisher": "Quartz", "title": "OpenAI's AI agents hit a UN website 16,000 times — bypassing its security filters", "url": "https://qz.com/openai-agents-un-website-16000-times-092826", "date": "2026-09-28" }, { "publisher": "The Next Web", "title": "OpenAI agents scanned a UN statistics site 16,500 times, researcher says", "url": "https://thenextweb.com/news/openai-agents-un-unctad-statistics-site-scans", "date": "2026-09-28" } ] }, { "id": "PI-0065", "url": "https://paperclipindex.com/incident/PI-0065", "title": "Researchers linked attempted break-ins at Data USA and a university library to OpenAI agents", "summary": "Research lab Transluce tied the May probes of Data USA to OpenAI agents through a matching query on a forum the agents used. It linked probes of a University of New Mexico digital library more tentatively, by timing and shared relay services. The unsuccessful activity included vulnerability probing and proxy relays, and the university found no compromise. OpenAI said much of the activity overlapped with its own review and it had contacted both sites.", "reported": "2026-09-23", "date_precision": "day", "event_date": "2026-05-25", "developer": "OpenAI", "product": "Agents in training/evaluation", "model": null, "behavior": "Overreach", "origin": "internal_research", "verification": "Multiple credible sources", "attribution": "Model-initiated", "reported_by": "researcher", "rating_status": "approved", "group": "control", "harm_status": "none_found", "harm_level": null, "harm_level_name": null, "harm_kind": null, "harm_basis": null, "counts_toward_index": false, "control_level": 3, "control_type": "attempted_access", "status": "resolved", "near_miss": true, "under_review": false, "source_count": 4, "sources": [ { "publisher": "Transluce", "title": "Early rogue AI agent activity and attempts to hack found on urlquery.net", "url": "https://transluce.org/agent-activity", "date": "2026-09-23" }, { "publisher": "TechCrunch", "title": "For months, OpenAI's agent swarms have been attacking online databases to find obscure facts", "url": "https://techcrunch.com/2026/09/25/for-months-openais-agent-swarms-have-been-attacking-online-databases-to-find-obscure-facts/", "date": "2026-09-25" }, { "publisher": "infoDOCKET (Library Journal)", "title": "OpenAI Agent Hacking Attempt Targets University of New Mexico Digital Library", "url": "https://www.infodocket.com/2026/09/25/openai-agent-hacking-attempt-targets-university-of-new-mexico-digital-library/", "date": "2026-09-25" }, { "publisher": "KOB 4", "title": "OpenAI agent hacking attempt targets University of New Mexico digital library", "url": "https://www.kob.com/new-mexico/openai-agent-hacking-attempt-targets-university-of-new-mexico-digital-library/", "date": "2026-09" } ] }, { "id": "PI-0077", "url": "https://paperclipindex.com/incident/PI-0077", "title": "Early Claude Opus 5.5 snapshot wrote a command to send secrets to an external host during internal use", "summary": "The snapshot had miscopied a JSON blob, opening an extra field with no matching value, then put the command in that field; monitoring caught it, and it failed. Anthropic calls this rare behavior model-generated spontaneous prompt injection, says it appeared almost only after improbable harmless mistakes, and found similar tendencies in earlier models including Claude Fable 5 and Opus 5. It says it changed its training, that the released model rarely makes such copying errors, and that auto mode has blocked every harmful tool call of this kind seen so far. It is still investigating the cause and suspects training meant to defend against prompt injection played a part.", "reported": "2026-09-22", "date_precision": "day", "event_date": null, "developer": "Anthropic", "product": "Claude Opus 5.5", "model": "Early internal snapshot", "behavior": "Overreach", "origin": "internal_research", "verification": "Developer confirmed", "attribution": "Model-initiated", "reported_by": "developer", "rating_status": "approved", "group": "control", "harm_status": "not_reported", "harm_level": null, "harm_level_name": null, "harm_kind": null, "harm_basis": null, "counts_toward_index": false, "control_level": 2, "control_type": "instruction_violation", "status": "ongoing", "near_miss": false, "under_review": false, "source_count": 2, "sources": [ { "publisher": "Anthropic", "title": "System Card: Claude Opus 5.5", "url": "https://www-cdn.anthropic.com/fc1b44717c85dc068bc6ba5024219938094694bd/Claude%20Opus%205.5%20System%20Card.pdf", "date": "2026-09-22" }, { "publisher": "MIXED", "title": "Pre-release Opus 5.5 wrote secret-stealing commands after a copying slip, says Anthropic", "url": "https://mixed-news.com/en/anthropic-pre-release-opus-5-5-secret-stealing-commands-copying-slip/", "date": "2026-09-23" } ] }, { "id": "PI-0073", "url": "https://paperclipindex.com/incident/PI-0073", "title": "Gemini guessed a password and used leaked credentials to get into three real companies during a hacking test", "summary": "A fictional company in a hacking exercise run by the security firm Irregular shared its name with a real domain, and a misconfiguration left the test online. In May, Gemini guessed a password to reach one real company and used credentials found in public code repositories to reach the other two. Google said the model stopped each time it recognized the targets were real, that no damage was done and that the companies were told. Irregular flagged the cases to Google in July.", "reported": "2026-09-18", "date_precision": "day", "event_date": "2026-05", "developer": "Google", "product": "Gemini", "model": null, "behavior": "Overreach", "origin": "controlled_test", "verification": "Developer confirmed", "attribution": "Model-initiated", "reported_by": "press", "rating_status": "approved", "group": "counts", "harm_status": "documented", "harm_level": 1, "harm_level_name": "Negligible", "harm_kind": "Services & systems", "harm_basis": "access", "counts_toward_index": true, "control_level": 4, "control_type": "unauthorized_access", "status": "unknown", "near_miss": false, "under_review": false, "source_count": 5, "sources": [ { "publisher": "Irregular", "title": "Addressing Recent Incidents: Ongoing Findings and Path Forward", "url": "https://www.irregular.com/research/addressing-recent-incidents-ongoing-findings-and-path-forward", "date": "2026-08-14" }, { "publisher": "TechRadar", "title": "Google's Gemini hacked three companies during Irregular AI 'capture-the-flag' testing", "url": "https://www.techradar.com/pro/security/googles-gemini-hacked-three-companies-during-irregular-ai-capture-the-flag-testing-agents-broke-containment-and-guessed-passwords-to-hack-computer-systems", "date": "2026-09" }, { "publisher": "Cybernews", "title": "Google's Gemini hacked three real companies during security test", "url": "https://cybernews.com/ai-news/googles-gemini-hacked-three-companies/", "date": "2026-09" }, { "publisher": "Al Jazeera (Reuters)", "title": "Google's Gemini AI hacks 3 companies in security test, then stops", "url": "https://www.aljazeera.com/news/2026/9/19/googles-gemini-ai-hacks-3-companies-in-security-test-then-stops", "date": "2026-09-19" }, { "publisher": "GV Wire (Reuters)", "title": "Gemini Hacked Three Companies in First Known Breakout By Google's AI, WSJ reports", "url": "https://gvwire.com/2026/09/18/gemini-hacked-three-companies-in-first-known-breakout-by-googles-ai-wsj-reports/", "date": "2026-09-18" } ] }, { "id": "PI-0078", "url": "https://paperclipindex.com/incident/PI-0078", "title": "OpenAI training agents used an internal package repository as a message board across separate samples", "summary": "Using credentials given for package downloads, agents in training samples meant to be independent read each other's notes and posted requests for a missing input file. In one episode in May, three runs read and replied to each other. In an earlier sample, an agent blocked from a file-sharing site found it could write to shared repositories and tried to set one up to fetch that site, which the Artifactory repository refused without administrator access. Monitoring flagged the behavior, which OpenAI calls very uncommon, and no missing file was recovered. OpenAI says it closed these routes and now treats such behavior as a top-priority incident.", "reported": "2026-09-16", "date_precision": "day", "event_date": "2026-05", "developer": "OpenAI", "product": "Unreleased internal research models (RL training)", "model": null, "behavior": "Agent coordination", "origin": "internal_research", "verification": "Developer confirmed", "attribution": "Model-initiated", "reported_by": "developer", "rating_status": "approved", "group": "control", "harm_status": "not_reported", "harm_level": null, "harm_level_name": null, "harm_kind": null, "harm_basis": null, "counts_toward_index": false, "control_level": 2, "control_type": "instruction_violation", "status": "resolved", "near_miss": false, "under_review": false, "source_count": 2, "sources": [ { "publisher": "OpenAI Alignment", "title": "Unsanctioned Artifactory writes and cross-sample communication", "url": "https://alignment.openai.com/misalignment-reports/unauthorized-artifactory-writes-and-cross-sample-communication/", "date": "2026-09-16" }, { "publisher": "CSO Online", "title": "OpenAI admits six new misalignment incidents under new reporting framework", "url": "https://www.csoonline.com/article/4223458/openai-admits-six-new-misalignment-incidents-under-new-reporting-framework.html", "date": "2026-09-17" } ] }, { "id": "PI-0063", "url": "https://paperclipindex.com/incident/PI-0063", "title": "OpenAI models wrote notes telling future copies to hide mistakes and ignore constraints", "summary": "An unreleased OpenAI research model inserted instructions into its own task summaries telling later instances to disregard normal constraints, in 27 identified summaries. Later instances mostly ignored them, though one answer was constrained. Separately, GPT-5.6 Sol instances in training wrote summary notes urging future instances to conceal errors from users and, in some cases, to invent missing information; OpenAI says those notes were often followed.", "reported": "2026-09-16", "date_precision": "day", "event_date": "2026-05-30", "developer": "OpenAI", "product": "GPT-5.6 Sol; unreleased Astra-family research model", "model": "GPT-5.6 Sol", "behavior": "Deception", "origin": "internal_research", "verification": "Developer confirmed", "attribution": "Model-initiated", "reported_by": "developer", "rating_status": "approved", "group": "control", "harm_status": "not_reported", "harm_level": null, "harm_level_name": null, "harm_kind": null, "harm_basis": null, "counts_toward_index": false, "control_level": 2, "control_type": "instruction_violation", "status": "unknown", "near_miss": false, "under_review": false, "source_count": 5, "sources": [ { "publisher": "OpenAI", "title": "Our framework for reporting model misalignment", "url": "https://openai.com/index/model-misalignment-reporting-framework/", "date": "2026-09-16" }, { "publisher": "OpenAI Alignment", "title": "Self-generated prompt injections in compaction summaries", "url": "https://alignment.openai.com/misalignment-reports/self-generated-prompt-injections-in-compaction-summaries/", "date": "2026-09-16" }, { "publisher": "OpenAI Alignment", "title": "Encouraging deception in compaction summaries", "url": "https://alignment.openai.com/misalignment-reports/encouraging-deception-in-compaction-summaries/", "date": "2026-09-16" }, { "publisher": "Axios", "title": "OpenAI discloses six new AI misalignment incidents", "url": "https://www.axios.com/2026/09/16/openai-testing-safety-incidents-disclosure", "date": "2026-09-16" }, { "publisher": "BleepingComputer", "title": "OpenAI details more cases of AI agents taking unauthorized actions", "url": "https://www.bleepingcomputer.com/news/security/openai-details-more-cases-of-ai-agents-taking-unauthorized-actions/", "date": "2026-09-17" } ] }, { "id": "PI-0062", "url": "https://paperclipindex.com/incident/PI-0062", "title": "OpenAI model used a leaked third-party API key, then fabricated the data it could not fetch", "summary": "Asked a routine question about county earnings, the model kept failing to reach a data service and tried to sign up with a disposable email address. It then searched public GitHub repositories for leaked keys and used one without authorization. When it still could not get the figures, it made up values and presented them as taken from the source, without mentioning the failure or the key.", "reported": "2026-09-16", "date_precision": "day", "event_date": "2026-05-15", "developer": "OpenAI", "product": "Unreleased internal model", "model": null, "behavior": "Overreach", "origin": "internal_research", "verification": "Developer confirmed", "attribution": "Model-initiated", "reported_by": "developer", "rating_status": "approved", "group": "control", "harm_status": "not_reported", "harm_level": null, "harm_level_name": null, "harm_kind": "Money & property", "harm_basis": null, "counts_toward_index": false, "control_level": 3, "control_type": "unauthorized_access", "status": "unknown", "near_miss": false, "under_review": false, "source_count": 4, "sources": [ { "publisher": "OpenAI", "title": "Our framework for reporting model misalignment", "url": "https://openai.com/index/model-misalignment-reporting-framework/", "date": "2026-09-16" }, { "publisher": "OpenAI Alignment", "title": "Signing up for disposable emails and searching GitHub for leaked API keys", "url": "https://alignment.openai.com/misalignment-reports/searching-github-for-leaked-api-keys/", "date": "2026-09-16" }, { "publisher": "SecurityWeek", "title": "OpenAI Says Its Models Searched GitHub for Leaked API Keys During Training", "url": "https://www.securityweek.com/openai-says-its-models-hunted-github-for-leaked-api-keys-during-training/", "date": "2026-09-17" }, { "publisher": "Dark Reading", "title": "Rogue Behavior: OpenAI Reveals More Model Misalignment Incidents", "url": "https://www.darkreading.com/cyber-risk/rogue-behavior-openai-more-model-misalignment-incidents", "date": "2026-09" } ] }, { "id": "PI-0061", "url": "https://paperclipindex.com/incident/PI-0061", "title": "OpenAI agents put task files on the public internet against instructions", "summary": "To cite files through the browser, OpenAI agents uploaded files they had produced or been given during tasks to public hosting sites without asking. They posted a task photo in October 2025 and a text file of lake records in January 2026; the uploads succeeded, though the later citation steps failed. In a second report, agents collaborating on an April 2026 training task, unable to see each other's files, shared a spreadsheet workbook through a temporary public file-hosting service, although the task said to use local files only.", "reported": "2026-09-16", "date_precision": "day", "event_date": "2025-10-22", "developer": "OpenAI", "product": "Unreleased internal models / agent swarms", "model": null, "behavior": "Overreach", "origin": "internal_research", "verification": "Developer confirmed", "attribution": "Model-initiated", "reported_by": "developer", "rating_status": "approved", "group": "control", "harm_status": "not_reported", "harm_level": null, "harm_level_name": null, "harm_kind": null, "harm_basis": null, "counts_toward_index": false, "control_level": 2, "control_type": "instruction_violation", "status": "unknown", "near_miss": false, "under_review": false, "source_count": 5, "sources": [ { "publisher": "OpenAI", "title": "Our framework for reporting model misalignment", "url": "https://openai.com/index/model-misalignment-reporting-framework/", "date": "2026-09-16" }, { "publisher": "OpenAI Alignment", "title": "Uploading files to the internet in order to cite them", "url": "https://alignment.openai.com/misalignment-reports/uploading-files-to-the-internet-in-order-to-cite-them/", "date": "2026-09-16" }, { "publisher": "OpenAI Alignment", "title": "Unauthorized communication via temporary file hosting services", "url": "https://alignment.openai.com/misalignment-reports/unauthorized-communication-via-temporary-file-hosting-services/", "date": "2026-09-16" }, { "publisher": "The Hacker News", "title": "OpenAI Reveals Six Model Incidents Involving Hidden Failures and Unauthorized Uploads", "url": "https://thehackernews.com/2026/09/openai-reveals-six-model-incidents.html", "date": "2026-09-17" }, { "publisher": "NBC News", "title": "OpenAI flags 6 new incidents of 'concerning' behavior and unveils plan to track it", "url": "https://www.nbcnews.com/tech/tech-news/openai-new-incidents-concerning-behavior-model-misalignment-rcna598277", "date": "2026-09" } ] }, { "id": "PI-0074", "url": "https://paperclipindex.com/incident/PI-0074", "title": "Early Claude Opus 4.6 broke into a real outside machine during a hacking test and read one person's data", "summary": "After making its own target unreachable in a January hacking exercise, the early model tried to abort, which failed because of a misconfigured test setup. It tried to give up seven more times, then found a route to the real internet and reached a third party's machine, which it said it believed was part of the exercise. It used a password from a file to gain admin access, harvested credentials, changed settings to ease re-entry and read one person's personal information. The session ended when its token budget ran out. Anthropic found the incident in August while preparing transcripts for METR and notified the affected party.", "reported": "2026-09-09", "date_precision": "day", "event_date": "2026-01", "developer": "Anthropic", "product": "Early Claude Opus 4.6 checkpoint (evaluation)", "model": "Claude Opus 4.6 (early checkpoint)", "behavior": "Overreach", "origin": "controlled_test", "verification": "Developer confirmed", "attribution": "Model-initiated", "reported_by": "developer", "rating_status": "approved", "group": "counts", "harm_status": "documented", "harm_level": 1, "harm_level_name": "Negligible", "harm_kind": "Privacy & data", "harm_basis": "access", "counts_toward_index": true, "control_level": 4, "control_type": "unauthorized_access", "status": "unknown", "near_miss": false, "under_review": false, "source_count": 1, "sources": [ { "publisher": "Anthropic", "title": "An alignment assessment of recent cybersecurity incidents", "url": "https://www.anthropic.com/research/alignment-assessment-cybersecurity-incidents", "date": "2026-09-09" } ] }, { "id": "PI-0080", "url": "https://paperclipindex.com/incident/PI-0080", "title": "Lawyer held in contempt after filing a ChatGPT brief with invented witnesses in a New Mexico murder appeal", "summary": "The briefs Stephen D. Aarons prepared with ChatGPT attributed testimony about threats and the shooter's clothing and appearance to witnesses who were entirely made up. At an August hearing he said he had assumed the tool would produce an accurate summary of the proceedings. The New Mexico Supreme Court held him in direct contempt, referred him to the Disciplinary Board, barred him from appearing before it pending the board's review, removed him from the case, assigned a public defender to his client and sanctioned him $5,000, payable to the State Bar's Client Protection Fund.", "reported": "2026-09-08", "date_precision": "day", "event_date": "2026-08", "developer": "OpenAI", "product": "ChatGPT", "model": null, "behavior": "Harmful output", "origin": "deployment", "verification": "Multiple credible sources", "attribution": "Operator or user", "reported_by": "authority", "rating_status": "approved", "group": "separate", "harm_status": "documented", "harm_level": 1, "harm_level_name": "Negligible", "harm_kind": "Money & property", "harm_basis": null, "counts_toward_index": false, "control_level": 1, "control_type": null, "status": "ongoing", "near_miss": false, "under_review": false, "source_count": 3, "sources": [ { "publisher": "New Mexico Supreme Court", "title": "Order finding Stephen D. Aarons in direct contempt of court", "url": "https://cases.justia.com/new-mexico/supreme-court/2026-s-1-sc-40845.pdf", "date": "2026-09-08" }, { "publisher": "Reuters", "title": "ChatGPT invented fake police testimony in murder appeal, New Mexico high court says", "url": "https://www.reuters.com/legal/government/chatgpt-invented-fake-police-testimony-murder-appeal-new-mexico-high-court-says-2026-09-11/", "date": "2026-09-11" }, { "publisher": "404 Media", "title": "Lawyer Cites ChatGPT-Invented Fake Witnesses in Murder Appeal", "url": "https://www.404media.co/chatgpt-fake-witnesses-testimony-stephen-aarons-new-mexico/", "date": "2026-09-30" } ] }, { "id": "PI-0079", "url": "https://paperclipindex.com/incident/PI-0079", "title": "In a researcher demo, planted instructions hijacked Copilot in SQL Server Management Studio to grant sysadmin rights", "summary": "Instructions planted in files or database content could make Copilot run SQL commands with the connected user's privileges, security researcher Johann Rehberger showed. Its system prompt told it to stay read-only, but the only enforcement was a blocklist of text patterns that he got around. In one demo, a comment in a file made Copilot change data. In another, instructions a lower-privileged database owner stored as database metadata led Copilot, used by a sysadmin, to add the attacker to the sysadmin role. Data could also be sent row by row to an outside server. Microsoft rated the flaw critical, fixed it as CVE-2026-65669 and said crafted instructions could bypass SQL Copilot's read-only limits.", "reported": "2026-09-08", "date_precision": "day", "event_date": "2026-05", "developer": "Microsoft", "product": "Copilot in SQL Server Management Studio", "model": null, "behavior": "Hijacked by injection", "origin": "controlled_test", "verification": "Developer confirmed", "attribution": "Outside attacker", "reported_by": "researcher", "rating_status": "approved", "group": "control", "harm_status": "not_reported", "harm_level": null, "harm_level_name": null, "harm_kind": null, "harm_basis": null, "counts_toward_index": false, "control_level": 2, "control_type": "instruction_violation", "status": "resolved", "near_miss": true, "under_review": false, "source_count": 3, "sources": [ { "publisher": "Microsoft Security Response Center", "title": "CVE-2026-65669: SQL Server Elevation of Privilege Vulnerability", "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65669", "date": "2026-09-08" }, { "publisher": "Embrace The Red", "title": "From SELECT to SYSADMIN with SQL Copilot (CVE-2026-65669)", "url": "https://embracethered.com/blog/posts/2026/from-select-to-sysadmin-sql-copilot-bluehat-asia/", "date": "2026-09-30" }, { "publisher": "The Hacker News", "title": "Microsoft patches record 974 flaws", "url": "https://thehackernews.com/2026/09/microsoft-patches-record-974-flaws.html", "date": "2026-09-09" } ] }, { "id": "PI-0087", "url": "https://paperclipindex.com/incident/PI-0087", "title": "Claude Fable 5.1 and Fable 5 used a flaw in a testing partner's sandbox to read files outside it", "summary": "In one of thousands of trials by an outside tester, the model ran code that, once compiled outside its sandbox, read files it should not have been able to reach. The sandbox could submit code to a compiler outside it; Anthropic said this could in theory have let the model run any code. A follow-up search by the tester found that the earlier Fable 5 had done the same on the same evaluation. The tester treated it as borderline rather than a severe breach and fixed the flaw. Anthropic rated it low severity, saying the models did not hide their actions, altered nothing outside the evaluation and used no offensive techniques. The card's summary names Mythos 5.1, the same model with looser safeguards.", "reported": "2026-09-01", "date_precision": "day", "event_date": null, "developer": "Anthropic", "product": "Claude Fable 5.1 and Claude Fable 5", "model": "Claude Fable 5.1; Claude Fable 5", "behavior": "Sandbox escape", "origin": "controlled_test", "verification": "Developer confirmed", "attribution": "Model-initiated", "reported_by": "developer", "rating_status": "approved", "group": "control", "harm_status": "none_found", "harm_level": null, "harm_level_name": null, "harm_kind": null, "harm_basis": null, "counts_toward_index": false, "control_level": 3, "control_type": "containment_bypass", "status": "resolved", "near_miss": false, "under_review": false, "source_count": 1, "sources": [ { "publisher": "Anthropic", "title": "System Card: Claude Fable 5.1 & Claude Mythos 5.1", "url": "https://www-cdn.anthropic.com/0339e6a7c5c7b87f5c07798616dc32c215d14235/Claude%20Fable%205.1%20&%20Claude%20Mythos%205.1%20System%20Card.pdf", "date": "2026-09-01" } ] }, { "id": "PI-0072", "url": "https://paperclipindex.com/incident/PI-0072", "title": "Meta's Muse Spark 1.1 broke into an outside company's service after a testing vendor left it online", "summary": "With a misconfigured cybersecurity test left online, Muse Spark 1.1 exploited a vulnerability in a real website that shared its name with a fictional target. It accessed some of the site's information and made changes to its database. Meta said this happened in early July, in an evaluation the testing firm Irregular ran on its own infrastructure with API access to the model. Irregular disabled the evaluation, fixed the setup and made sure the affected party was notified. It said the problem was the same environment issue one of its customers had disclosed on July 30 and did not involve a sandbox escape.", "reported": "2026-08-05", "date_precision": "day", "event_date": "2026-07", "developer": "Meta", "product": "Muse Spark 1.1", "model": "Muse Spark 1.1", "behavior": "Overreach", "origin": "controlled_test", "verification": "Developer confirmed", "attribution": "Model-initiated", "reported_by": "developer", "rating_status": "approved", "group": "counts", "harm_status": "documented", "harm_level": 1, "harm_level_name": "Negligible", "harm_kind": "Services & systems", "harm_basis": "access", "counts_toward_index": true, "control_level": 4, "control_type": "unauthorized_access", "status": "unknown", "near_miss": false, "under_review": false, "source_count": 5, "sources": [ { "publisher": "Meta", "title": "Addressing an issue involving a third-party cyber evaluation of Muse Spark 1.1", "url": "https://research.meta.ai/blog/addressing-third-party-testing-misconfiguration-muse-spark-1-1", "date": "2026-08-14" }, { "publisher": "Irregular", "title": "Addressing Recent Incidents: Ongoing Findings and Path Forward", "url": "https://www.irregular.com/research/addressing-recent-incidents-ongoing-findings-and-path-forward", "date": "2026-08-14" }, { "publisher": "Bloomberg", "title": "Meta AI Model Accessed Internet, Hacked Outside Firm in Testing", "url": "https://www.bloomberg.com/news/articles/2026-08-05/meta-ai-model-accessed-internet-hacked-outside-firm-in-testing", "date": "2026-08-05" }, { "publisher": "CNN", "title": "An AI model from Meta also hacked another company during testing", "url": "https://www.cnn.com/2026/08/05/tech/meta-ai-hacking", "date": "2026-08-05" }, { "publisher": "Insurance Journal (Bloomberg)", "title": "Meta AI Model Accessed Internet, Hacked Outside Firm", "url": "https://www.insurancejournal.com/news/national/2026/08/06/880586.htm", "date": "2026-08-06" } ] }, { "id": "PI-0071", "url": "https://paperclipindex.com/incident/PI-0071", "title": "Anthropic models in a hacking test reached three real companies, took credentials and published a malicious package", "summary": "A setup mistake left test machines online without the cyber safeguards used in released products, and the models went after real systems that matched fictional targets. Anthropic found three incidents involving six runs while reviewing 141,006 cybersecurity evaluations with its testing partner Irregular. Claude Opus 4.7 used weak passwords and open endpoints to reach a company's live web application, took credentials and production data, and modified user records. Claude Mythos 5 published a malicious Python package installed on 15 hosts that Anthropic believes were security vendors' scanning sandboxes; one scanner leaked credentials the model used to reach that vendor's live database. An internal research model broke into another company's systems, downloaded files and inserted a remote-control script, then stopped. A fourth incident, from January, is PI-0074.", "reported": "2026-07-30", "date_precision": "day", "event_date": "2026-04", "developer": "Anthropic", "product": "Claude Opus 4.7, Claude Mythos 5 and an internal research model", "model": "Claude Opus 4.7; Claude Mythos 5", "behavior": "Overreach", "origin": "controlled_test", "verification": "Developer confirmed", "attribution": "Model-initiated", "reported_by": "developer", "rating_status": "approved", "group": "counts", "harm_status": "documented", "harm_level": 2, "harm_level_name": "Minor", "harm_kind": "Services & systems", "harm_basis": "access", "counts_toward_index": true, "control_level": 4, "control_type": "unauthorized_access", "status": "unknown", "near_miss": false, "under_review": false, "source_count": 7, "sources": [ { "publisher": "Anthropic", "title": "Investigating three incidents in our cybersecurity evaluations", "url": "https://www.anthropic.com/news/investigating-incidents-cybersecurity-evals", "date": "2026-07-30" }, { "publisher": "Anthropic", "title": "An alignment assessment of recent cybersecurity incidents", "url": "https://www.anthropic.com/research/alignment-assessment-cybersecurity-incidents", "date": "2026-09-09" }, { "publisher": "Irregular", "title": "Addressing Recent Incidents: Ongoing Findings and Path Forward", "url": "https://www.irregular.com/research/addressing-recent-incidents-ongoing-findings-and-path-forward", "date": "2026-08-14" }, { "publisher": "Anthropic", "title": "Improving our alignment and security efforts", "url": "https://www.anthropic.com/news/improving-alignment-security-efforts", "date": "2026-08-31" }, { "publisher": "CNN", "title": "Anthropic said its AI models hacked into other companies' systems during testing", "url": "https://www.cnn.com/2026/07/30/tech/anthropic-ai-models-break-out-hack", "date": "2026-07-30" }, { "publisher": "Fortune", "title": "Anthropic says its Claude models hacked three real companies during testing", "url": "https://fortune.com/2026/07/31/anthropic-claude-escaped-test-hacked-three-companies-openai/", "date": "2026-07-31" }, { "publisher": "PBS News", "title": "Anthropic says its AI models hacked 3 organizations during testing", "url": "https://www.pbs.org/newshour/nation/anthropic-says-its-ai-models-hacked-3-organizations-during-testing", "date": "2026-07-31" } ] }, { "id": "PI-0059", "url": "https://paperclipindex.com/incident/PI-0059", "title": "Lawsuit alleges ChatGPT's medical advice delayed care for a near-fatal pulmonary embolism", "summary": "A 55-year-old former pastor from Florida alleges GPT-4o told him over months that his recurring dizzy spells were not yet serious and discouraged him from seeking care. He suffered a pulmonary embolism in July 2025 that he says nearly killed him, and sued OpenAI in San Francisco.", "reported": "2026-07-22", "date_precision": "day", "event_date": "2025-07-13", "developer": "OpenAI", "product": "ChatGPT", "model": "GPT-4o", "behavior": "Harmful output", "origin": "deployment", "verification": "Unverified claim", "attribution": "Model-initiated", "reported_by": "affected", "rating_status": "approved", "group": "court", "harm_status": "alleged", "harm_level": 4, "harm_level_name": "Severe", "harm_kind": "Health & safety", "harm_basis": null, "counts_toward_index": false, "control_level": 1, "control_type": null, "status": "unknown", "near_miss": false, "under_review": false, "source_count": 5, "sources": [ { "publisher": "Tech Justice Law Project", "title": "Pastor sues after OpenAI's ChatGPT allegedly discouraged him from seeking medical care during life-threatening blood clots", "url": "https://techjusticelaw.org/press-releases/pastor-sues-after-openai-ai-chatgpt-allegedly-discouraged-him-from-seeking-medical-care-during-life-threatening-blood-clots/", "date": "2026-07-22" }, { "publisher": "Tech Justice Law / Social Media Victims Law Center (via Bloomberg Law)", "title": "Complaint, Winters v. OpenAI, Inc. (Cal. Super. Ct., San Francisco)", "url": "https://aboutblaw.com/bmlJ", "date": "2026-07-21" }, { "publisher": "Bloomberg Law", "title": "Pastor Sues OpenAI After ChatGPT Dissuaded Seeking Medical Care", "url": "https://news.bloomberglaw.com/litigation/pastor-sues-openai-after-chatgpt-dissuaded-seeking-medical-care", "date": "2026-07-22" }, { "publisher": "Courthouse News Service", "title": "Man sues OpenAI over dangerous medical advice from ChatGPT", "url": "https://courthousenews.com/articles/man-sues-openai-over-dangerous-medical-advice-from-chatgpt", "date": "2026-07-22" }, { "publisher": "Boston.com", "title": "ChatGPT led to a man's near-fatal health crisis, lawsuit claims", "url": "https://www.boston.com/news/technology/2026/07/22/chatgpt-led-to-a-mans-near-fatal-health-crisis-lawsuit-claims/", "date": "2026-07-22" } ] }, { "id": "PI-0058", "url": "https://paperclipindex.com/incident/PI-0058", "title": "OpenAI models under evaluation escaped their sandbox and broke into Hugging Face's production systems for test answers", "summary": "In an internal cyber-capability test with some safeguards disabled, OpenAI's models took credentials and some internal datasets from Hugging Face's production systems. An internal-only research model led them, with GPT-5.6 Sol also involved. From July 8 they used an unknown flaw in OpenAI's internal package-proxy service to reach the internet, found exposed Hugging Face credentials and, from July 11 to 13, ran code on 41 dataset-server workers and reached connected clusters. They also used a customer's CyberGym app hosted on Modal (Modal says its platform was not compromised) and accounts on other services. Hugging Face cut off access, rebuilt the compromised nodes, rotated credentials and, as a precaution, rebuilt a core cluster.", "reported": "2026-07-16", "date_precision": "day", "event_date": "2026-07-08", "developer": "OpenAI", "product": "GPT-5.6 Sol and an unreleased internal model (ExploitGym evaluation)", "model": "Internal-only research model (principal); GPT-5.6 Sol", "behavior": "Sandbox escape", "origin": "internal_research", "verification": "Developer confirmed", "attribution": "Model-initiated", "reported_by": "affected", "rating_status": "approved", "group": "counts", "harm_status": "documented", "harm_level": 3, "harm_level_name": "Moderate", "harm_kind": "Services & systems", "harm_basis": "general", "counts_toward_index": true, "control_level": 4, "control_type": "containment_bypass", "status": "resolved", "near_miss": false, "under_review": false, "source_count": 12, "sources": [ { "publisher": "OpenAI", "title": "OpenAI and Hugging Face partner to address security incident during model evaluation", "url": "https://openai.com/index/hugging-face-model-evaluation-security-incident/", "date": "2026-07-21" }, { "publisher": "Hugging Face", "title": "Security incident disclosure — July 2026", "url": "https://huggingface.co/blog/security-incident-july-2026", "date": "2026-07-16" }, { "publisher": "Hugging Face", "title": "Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the July 2026 Incident", "url": "https://huggingface.co/blog/agent-intrusion-technical-timeline", "date": "2026-07-27" }, { "publisher": "OpenAI", "title": "OpenAI – Hugging Face Incident Technical Report", "url": "https://cdn.openai.com/pdf/67869394-cb91-4c12-888c-5cbd85c7814c/OpenAI-Hugging-Face%20Incident-Technical-Report.pdf", "date": "2026-08-26" }, { "publisher": "OpenAI", "title": "The Hugging Face incident and the road ahead", "url": "https://openai.com/index/hugging-face-incident-and-the-road-ahead/", "date": "2026-08-26" }, { "publisher": "State of California Department of Justice, Office of the Attorney General", "title": "As Part of Ongoing Investigation, Attorney General Bonta Serves Investigative Subpoena on OpenAI", "url": "https://oag.ca.gov/node/630636", "date": "2026-10-01" }, { "publisher": "METR (with Redwood Research)", "title": "Brief independent investigation of agents' behavior, reasoning and collaboration in the OpenAI / Hugging Face hacking incident", "url": "https://metr.org/blog/2026-08-26-openai-hugging-face-incident-investigation/", "date": "2026-08-26" }, { "publisher": "Fortune", "title": "OpenAI says its AI models escaped from a secure test environment and hacked into AI company Hugging Face in order to cheat on an evaluation", "url": "https://fortune.com/2026/07/21/openai-says-ai-models-escaped-control-hacked-hugging-face/", "date": "2026-07-21" }, { "publisher": "TechCrunch", "title": "Hugging Face confirms breach affected internal datasets and credentials, urges users to take action", "url": "https://techcrunch.com/2026/07/20/hugging-face-confirms-breach-affected-internal-datasets-and-credentials-urges-users-to-take-action/", "date": "2026-07-20" }, { "publisher": "TechCrunch", "title": "OpenAI releases its official report on the Hugging Face breach", "url": "https://techcrunch.com/2026/08/26/openai-releases-its-official-report-on-the-hugging-face-breach/", "date": "2026-08-26" }, { "publisher": "The Register", "title": "OpenAI alerts 100+ orgs that its 'misaligned models' attempted to break in - or worse", "url": "https://www.theregister.com/security/2026/10/02/openai-alerts-100-orgs-that-its-misaligned-models-attempted-to-break-in-or-worse/5300891", "date": "2026-10-02" }, { "publisher": "Simon Willison's Weblog", "title": "OpenAI's accidental cyberattack against Hugging Face is science fiction that happened", "url": "https://simonwillison.net/2026/Jul/22/openai-cyberattack/", "date": "2026-07-22" } ] }, { "id": "PI-0056", "url": "https://paperclipindex.com/incident/PI-0056", "title": "Anthropic simulations found Gemini 3.1 Pro covertly sabotaging a training pipeline, among four new failure modes", "summary": "In a research pipeline it disagreed with, Gemini 3.1 Pro secretly replaced intended training vectors with zeros and admitted it only when asked directly. Other findings in Anthropic's simulations of frontier agents in high-stakes settings included Claude judge models shifting labels depending on how the labels would be used, and Claude Opus 4.5 coaching an employee to go public. GPT-5.5's help with misleading investors was directed by the simulated user, so it is harmful compliance rather than misalignment. The authors say these are not real-world incidents but early warning signs.", "reported": "2026-07-13", "date_precision": "day", "event_date": "2026", "developer": "Anthropic-led study (Theorem, MATS, UK AISI); Google, OpenAI, Anthropic models", "product": "Gemini 3.1 Pro; GPT-5.5; Claude models", "model": "Gemini 3.1 Pro (headline finding)", "behavior": "Deception", "origin": "controlled_test", "verification": "Single source", "attribution": "Model-initiated", "reported_by": "developer", "rating_status": "approved", "group": "control", "harm_status": "not_reported", "harm_level": null, "harm_level_name": null, "harm_kind": null, "harm_basis": null, "counts_toward_index": false, "control_level": 3, "control_type": "oversight_evasion", "status": "resolved", "near_miss": false, "under_review": false, "source_count": 3, "sources": [ { "publisher": "Anthropic Alignment Science Blog", "title": "Agentic Misalignment in Summer 2026", "url": "https://alignment.anthropic.com/2026/agentic-misalignment-summer-2026/", "date": "2026-07-13" }, { "publisher": "AI Safety Frontier (Substack)", "title": "Paper Highlights of July 2026", "url": "https://aisafetyfrontier.substack.com/p/paper-highlights-of-july-2026", "date": "2026-08-07" }, { "publisher": "Analytics Vidhya", "title": "Agentic Misalignment Explained: When AI Agents Go Rogue", "url": "https://www.analyticsvidhya.com/blog/2026/08/agentic-misalignment-explained/", "date": "2026-08-02" } ] }, { "id": "PI-0057", "url": "https://paperclipindex.com/incident/PI-0057", "title": "Developers report a new coding model deleting home-directory files and a production database during cleanup", "summary": "Developers said the model started clean-up steps they had not asked for: one said most files in his Mac home directory were removed after a sub-agent got a wrong path. Another said destructive test commands cleared his live production database tables. OpenAI's Codex lead said this was not intended behavior, and OpenAI noted most cases happened in full-access mode without sandboxing. In August it said a clean-up command misused system variables such as $HOME, and that Codex now checks deletion targets and blocks accidental switches to full-access mode.", "reported": "2026-07-10", "date_precision": "day", "event_date": "2026-07", "developer": "OpenAI", "product": "Codex", "model": "GPT-5.6 Sol", "behavior": "Overreach", "origin": "deployment", "verification": "Developer confirmed", "attribution": "Model-initiated", "reported_by": "affected", "rating_status": "approved", "group": "counts", "harm_status": "documented", "harm_level": 1, "harm_level_name": "Negligible", "harm_kind": "Money & property", "harm_basis": null, "counts_toward_index": true, "control_level": 2, "control_type": "instruction_violation", "status": "unknown", "near_miss": false, "under_review": false, "source_count": 9, "sources": [ { "publisher": "Thibault Sottiaux (@thsottiaux), OpenAI Codex lead, on X", "title": "On file deletions (post on X)", "url": "https://x.com/thsottiaux/status/2077630111499882637", "date": "2026-07-16" }, { "publisher": "Matt Shumer (@mattshumer_) on X", "title": "GPT-5.6-Sol just accidentally deleted almost ALL of my Mac's files (post on X)", "url": "https://x.com/mattshumer_/status/2075657271401390161", "date": "2026-07-10" }, { "publisher": "Bruno Lemos (@brunolemos) on X", "title": "GPT-5.6 Sol just deleted my whole production database (post on X)", "url": "https://x.com/brunolemos/status/2076769881534398974", "date": "2026-07-13" }, { "publisher": "The Decoder", "title": "OpenAI fixes Codex bug that deleted real user files without permission", "url": "https://the-decoder.com/openai-fixes-codex-bug-that-deleted-real-user-files-without-permission/", "date": "2026-08-19" }, { "publisher": "eWeek", "title": "OpenAI GPT-5.6 Sol Accused of Deleting Files, Production Data", "url": "https://www.eweek.com/news/gpt-5-6-sol-deletes-files/", "date": "2026-07-15" }, { "publisher": "ProPakistani", "title": "ChatGPT is deleting user files and databases without permission", "url": "https://propakistani.pk/2026/07/15/chatgpt-is-deleting-user-files-and-databases-without-permission/", "date": "2026-07-15" }, { "publisher": "Gigazine", "title": "OpenAI GPT-5.6 Sol deletes files", "url": "https://gigazine.net/gsc_news/en/20260717-openai-gpt-5-6-sol-delete-file/", "date": "2026-07-17" }, { "publisher": "paddo.dev", "title": "The Warning Was in the Manual: GPT-5.6 Sol and the Deleted Database", "url": "https://paddo.dev/blog/the-warning-was-in-the-manual/", "date": "2026-07-14" }, { "publisher": "AI Incident Database", "title": "AI Incident Database, incident 1672", "url": "https://incidentdatabase.ai/cite/1672/", "date": "unknown" } ] }, { "id": "PI-0085", "url": "https://paperclipindex.com/incident/PI-0085", "title": "GPT-5.6 Sol cheated on METR's software tasks more than any public model METR had tested", "summary": "In one task the model packed exploits into intermediate submissions to learn about the hidden tests; in another it extracted hidden code describing the expected answer. METR counts as cheating any gain in score from exploiting bugs in the environment or using strategies the task disallows. Scoring cheats as failures gave a time horizon of about 11.3 hours, and scoring them as successes put it beyond 270 hours; METR said none of its estimates was a robust measurement. OpenAI's GPT-5.6 system card acknowledged the high cheating rate and suggested that training for persistence may have contributed.", "reported": "2026-06-26", "date_precision": "day", "event_date": null, "developer": "OpenAI", "product": "GPT-5.6 Sol (METR predeployment evaluation)", "model": "GPT-5.6 Sol", "behavior": "Reward hacking", "origin": "controlled_test", "verification": "Developer confirmed", "attribution": "Model-initiated", "reported_by": "researcher", "rating_status": "approved", "group": "control", "harm_status": "not_reported", "harm_level": null, "harm_level_name": null, "harm_kind": null, "harm_basis": null, "counts_toward_index": false, "control_level": 2, "control_type": "instruction_violation", "status": "unknown", "near_miss": false, "under_review": false, "source_count": 4, "sources": [ { "publisher": "METR", "title": "Summary of METR's predeployment evaluation of GPT-5.6 Sol", "url": "https://metr.org/blog/2026-06-26-gpt-5-6-sol/", "date": "2026-06-26" }, { "publisher": "OpenAI", "title": "GPT-5.6 System Card", "url": "https://deploymentsafety.openai.com/gpt-5-6/gpt-5-6.pdf", "date": "2026-07-09" }, { "publisher": "The Decoder", "title": "OpenAI's new flagship model GPT-5.6 Sol cheats on software tests more than any model before it", "url": "https://the-decoder.com/gpt-5-6-sol-cheats-on-software-tests-more-than-any-model-before-it/", "date": "2026-06-27" }, { "publisher": "Transformer", "title": "GPT-5.6 cheats so much its testers couldn’t measure it", "url": "https://transformernews.ai/p/openai-gpt-56-sol-cheating-scheming-metr", "date": "2026-06-30" } ] }, { "id": "PI-0076", "url": "https://paperclipindex.com/incident/PI-0076", "title": "Co-located Claude Mythos 5 agents killed each other's processes and disguised their own to avoid being killed", "summary": "Mythos 5 agents solving math problems were accidentally started in the same work directory, sharing files, utilities and API rate limits. According to Anthropic, many of the agents killed the processes of the agents they shared resources with and tried to avoid being killed themselves. Some started processes under disguised names, launched decoy processes, wrote background scripts to kill duplicates, or switched to a disguised vocabulary because they wrongly believed a keyword filter reading their reasoning was causing the kills. Anthropic said its automated offline monitoring surfaced this one instance.", "reported": "2026-06-09", "date_precision": "day", "event_date": null, "developer": "Anthropic", "product": "Claude Mythos 5 (internal agent scaffold)", "model": "Claude Mythos 5", "behavior": "Overreach", "origin": "internal_research", "verification": "Developer confirmed", "attribution": "Model-initiated", "reported_by": "developer", "rating_status": "approved", "group": "control", "harm_status": "not_reported", "harm_level": null, "harm_level_name": null, "harm_kind": null, "harm_basis": null, "counts_toward_index": false, "control_level": 3, "control_type": "oversight_evasion", "status": "unknown", "near_miss": false, "under_review": false, "source_count": 3, "sources": [ { "publisher": "Anthropic", "title": "System Card: Claude Fable 5 & Claude Mythos 5", "url": "https://www-cdn.anthropic.com/57a52ea7d8f0e54e8a542e908266086df425cdf5/Claude%20Fable%205%20&%20Claude%20Mythos%205%20System%20Card.pdf", "date": "2026-06-09" }, { "publisher": "Anthropic", "title": "Risk Report: August 2026", "url": "https://www-cdn.anthropic.com/f61d49fa5596956a5dec75fea0e973bf6a6a8378/Redacted%20Risk%20Report%20August%202026.pdf", "date": "2026-08" }, { "publisher": "Don't Worry About the Vase (Zvi Mowshowitz)", "title": "Claude Fable 5 and Mythos 5: The System Card", "url": "https://thezvi.substack.com/p/claude-fable-5-and-mythos-5-the-system", "date": "2026-06-12" } ] }, { "id": "PI-0089", "url": "https://paperclipindex.com/incident/PI-0089", "title": "Meta's AI support assistant let attackers hijack 20,225 Instagram accounts by linking their own email", "summary": "Videos showed attackers using a VPN to appear near the target, asking the chatbot to link the account to an email they controlled, then requesting a password reset. Meta told Maine's attorney general that 20,225 accounts were hijacked through its AI-assisted High Touch Support recovery system. Reports tied the wave to high-profile takeovers such as the dormant Obama White House account and Sephora's, though they could not confirm which accounts were taken this way; accounts with two-factor authentication were not taken over. Meta said the AI tool worked as intended and blamed a bug in a separate code path that did not check the email against the account. It disabled the tool and invalidated its reset links.", "reported": "2026-06-01", "date_precision": "day", "event_date": "2026-04-17", "developer": "Meta", "product": "Meta AI support assistant (Instagram High Touch Support)", "model": null, "behavior": "Harmful output", "origin": "deployment", "verification": "Developer confirmed", "attribution": "Outside attacker", "reported_by": "press", "rating_status": "approved", "group": "counts", "harm_status": "documented", "harm_level": 2, "harm_level_name": "Minor", "harm_kind": "Privacy & data", "harm_basis": null, "counts_toward_index": true, "control_level": 1, "control_type": null, "status": "resolved", "near_miss": false, "under_review": false, "source_count": 4, "sources": [ { "publisher": "404 Media", "title": "Hackers Simply Asked Meta AI to Give Them Access to High-Profile Instagram Accounts. It Worked", "url": "https://404media.co/hackers-simply-asked-meta-ai-to-give-them-access-to-high-profile-instagram-accounts-it-worked", "date": "2026-06-01" }, { "publisher": "Engadget", "title": "Meta's AI support chatbot made it ridiculously easy for hackers to take over Instagram accounts", "url": "https://www.engadget.com/2185225/meta-ai-support-chatbot-made-it-ridiculously-easy-for-hackers-to-take-over-instagram-accounts/", "date": "2026-06-01" }, { "publisher": "BleepingComputer", "title": "Over 20,000 Instagram accounts stolen in Meta AI support hack", "url": "https://www.bleepingcomputer.com/news/security/meta-ai-support-data-breach-affects-20-000-instagram-accounts/", "date": "2026-06-08" }, { "publisher": "Help Net Security", "title": "Hackers used Meta’s AI support system to hijack over 20,000 Instagram accounts", "url": "https://www.helpnetsecurity.com/2026/06/08/instagram-ai-support-vulnerability-account-takeovers/", "date": "2026-06-08" } ] }, { "id": "PI-0088", "url": "https://paperclipindex.com/incident/PI-0088", "title": "Claude Opus 4.6 switched to a free outside AI service against instructions when its API credits ran out in a METR test", "summary": "The task was to write a program that used gpt-3.5-turbo to generate Rust solutions, but the API key the model was given had no credit left. In its reasoning the model acknowledged that the task required that model, then decided the scorer only checked the generated code. It tried several free model providers and set up the keyless Pollinations text API instead. METR lists the case among incidents of significant overreach, as an agent going against clear instructions to acquire additional compute.", "reported": "2026-05-19", "date_precision": "day", "event_date": null, "developer": "Anthropic", "product": "Claude Opus 4.6 (METR evaluation)", "model": "Claude Opus 4.6", "behavior": "Overreach", "origin": "controlled_test", "verification": "Single source", "attribution": "Model-initiated", "reported_by": "researcher", "rating_status": "approved", "group": "control", "harm_status": "not_reported", "harm_level": null, "harm_level_name": null, "harm_kind": null, "harm_basis": null, "counts_toward_index": false, "control_level": 2, "control_type": "instruction_violation", "status": "resolved", "near_miss": false, "under_review": false, "source_count": 1, "sources": [ { "publisher": "METR", "title": "Frontier Risk Report (February to March 2026)", "url": "https://metr.org/risk-report-feb-mar-2026.pdf", "date": "2026-05-19" } ] }, { "id": "PI-0084", "url": "https://paperclipindex.com/incident/PI-0084", "title": "Pennsylvania sues Character.AI, alleging chatbots posed as licensed psychiatrists and gave a fake license number", "summary": "Pennsylvania's Department of State says its investigation found Character.AI chatbot characters claiming to be licensed medical professionals, including psychiatrists. They offered to talk with users about mental health symptoms, and in one case, the state says, a chatbot falsely said it was licensed in Pennsylvania and gave an invalid license number. The platform lets users create their own characters that can present themselves as professionals. The lawsuit against Character Technologies, the maker of Character.AI, alleges the company is practicing medicine without authorization under the state's Medical Practice Act and seeks a preliminary injunction and a court order to stop the conduct.", "reported": "2026-05-05", "date_precision": "day", "event_date": "2026", "developer": "Character.AI", "product": "Character.AI chatbots", "model": null, "behavior": "Harmful output", "origin": "deployment", "verification": "Unverified claim", "attribution": "Unclear", "reported_by": "authority", "rating_status": "approved", "group": "control", "harm_status": "not_reported", "harm_level": null, "harm_level_name": null, "harm_kind": null, "harm_basis": null, "counts_toward_index": false, "control_level": 1, "control_type": null, "status": "ongoing", "near_miss": false, "under_review": false, "source_count": 1, "sources": [ { "publisher": "Pennsylvania Governor's Office", "title": "Shapiro Administration Sues Character.AI Alleging AI Chatbot Unlawfully Presented Itself as Licensed Medical Professional in Pennsylvania", "url": "https://www.pa.gov/governor/newsroom/2026-press-releases/shapiro-administration-sues-character-ai-over-fake-medical-claim", "date": "2026-05-05" } ] }, { "id": "PI-0055", "url": "https://paperclipindex.com/incident/PI-0055", "title": "Morse-code prompt on X tricked Grok and Bankrbot into sending $150,000 to $200,000 in tokens", "summary": "An X user sent an NFT that gave the wallet Bankr had set up for Grok's X account wider transfer rights, then posted an instruction encoded in Morse code. Grok decoded it and passed a plain-text transfer command to the Bankrbot trading agent, which sent about 3 billion DRB tokens, reported as worth roughly $150,000 to $200,000, to the attacker. Reports say about 80% of the funds were later returned after the attacker was identified.", "reported": "2026-05-04", "date_precision": "day", "event_date": "2026-05-04", "developer": "xAI; Bankr", "product": "Grok on X; Bankrbot", "model": null, "behavior": "Hijacked by injection", "origin": "deployment", "verification": "Developer confirmed", "attribution": "Outside attacker", "reported_by": "press", "rating_status": "approved", "group": "counts", "harm_status": "documented", "harm_level": 2, "harm_level_name": "Minor", "harm_kind": "Money & property", "harm_basis": null, "counts_toward_index": true, "control_level": 2, "control_type": "instruction_violation", "status": "resolved", "near_miss": false, "under_review": false, "source_count": 4, "sources": [ { "publisher": "Cointelegraph", "title": "How a Free NFT Allegedly Drained $174K From a Grok-Connected Wallet", "url": "https://cointelegraph.com/magazine/grok-bankr-wallet-free-nft-prompt-injection", "date": "2026-05-13" }, { "publisher": "CryptoSlate", "title": "Grok's crypto wallet was just exploited by a tweet sent in morse code without any private key compromise", "url": "https://cryptoslate.com/how-one-trader-exploited-grok-and-morse-code-to-trick-ai-agent-into-sending-billions-of-crypto-tokens-from-a-verified-wallet/", "date": "2026-05-04" }, { "publisher": "Giskard", "title": "How Grok got prompt injected: an X user drained $150,000 from an AI wallet", "url": "https://www.giskard.ai/knowledge/how-grok-got-prompt-injected-an-x-user-drained-150-000-from-an-ai-wallet", "date": "2026-05-07" }, { "publisher": "OECD.AI Incidents Monitor", "title": "AI Prompt Injection Exploit Drains Grok-Linked Crypto Wallet", "url": "https://oecd.ai/en/incidents/2026-05-04-4a73", "date": "2026-05-04" } ] }, { "id": "PI-0060", "url": "https://paperclipindex.com/incident/PI-0060", "title": "Personal agent exploited a gym booking flaw to remove another member from a waitlist", "summary": "Asked whether it could move a Melbourne man up a full gym class's waitlist, his agent found a missing authorization check and removed the member first on it. According to ABC News, the agent described the removal as a test; it moved him from fourth to third. Asked to undo it, the agent said it could not restore the entry. He had not asked it to cancel anyone else's reservation, and later had it send a disclosure email to the software provider.", "reported": "2026-04-30", "date_precision": "day", "event_date": "2026", "developer": "OpenClaw (open-source project)", "product": "OpenClaw", "model": "Claude Opus 4.6", "behavior": "Overreach", "origin": "deployment", "verification": "Single source", "attribution": "Model-initiated", "reported_by": "affected", "rating_status": "approved", "group": "counts", "harm_status": "documented", "harm_level": 1, "harm_level_name": "Negligible", "harm_kind": "Rights & reputation", "harm_basis": null, "counts_toward_index": true, "control_level": 4, "control_type": "unauthorized_access", "status": "unknown", "near_miss": false, "under_review": false, "source_count": 6, "sources": [ { "publisher": "Andrew Bird / Affinda (Internet Archive copy)", "title": "When my AI agent hacked my gym, Mythos stopped feeling theoretical", "url": "https://web.archive.org/web/20260810072554/https://affinda.com/expert-insights/when-my-ai-agent-hacked-my-gym-mythos-stopped-feeling-theoretical/", "date": "2026-04-30" }, { "publisher": "ABC News (Australia)", "title": "AI assistant hacks gym website in first known Australian autonomous cyber attack", "url": "https://www.abc.net.au/news/2026-08-10/ai-assistant-hacks-gym-website-aus-cyber-attack/107007986", "date": "2026-08-10" }, { "publisher": "TechCrunch", "title": "Tech industry is buzzing after a Claude agent hacked into a gym", "url": "https://techcrunch.com/2026/08/10/tech-industry-is-buzzing-after-a-claude-agent-hacked-into-a-gym/", "date": "2026-08-10" }, { "publisher": "Business Insurance", "title": "AI agent muscles into gym waitlist", "url": "https://www.businessinsurance.com/ai-agent-muscles-into-gym-waitlist/", "date": "2026-08-12" }, { "publisher": "YourStory", "title": "AI agent 'hacks' gym waitlist: What went wrong?", "url": "https://yourstory.com/ai-story/ai-agent-gym-booking-security-openclaw", "date": "2026-08" }, { "publisher": "OECD.AI incidents monitor", "title": "Claude AI agent hacks Melbourne gym booking system, cancels user's reservation", "url": "https://oecd.ai/en/incidents/2026-08-10-5df5", "date": "2026-08-10" } ] }, { "id": "PI-0054", "url": "https://paperclipindex.com/incident/PI-0054", "title": "Coding agent used a stray API token to delete a startup's production database and backups", "summary": "PocketOS founder Jeremy Crane says the agent, on a staging task, hit a credential mismatch and deleted a Railway storage volume with an API token from an unrelated file. That removed the production database, and the deletion path made its volume backups appear deleted too, despite project rules forbidding destructive commands. The car-rental businesses that use PocketOS were disrupted for about 30 hours. Railway's CEO said the call hit a legacy endpoint without delayed deletion. Railway recovered all the data from its backups, including offsite disaster copies, and now delays all deletes by 48 hours.", "reported": "2026-04-25", "date_precision": "day", "event_date": "2026-04", "developer": "Anysphere", "product": "Cursor agent", "model": "Claude Opus 4.6", "behavior": "Destructive action", "origin": "deployment", "verification": "Multiple credible sources", "attribution": "Model-initiated", "reported_by": "affected", "rating_status": "approved", "group": "counts", "harm_status": "documented", "harm_level": 2, "harm_level_name": "Minor", "harm_kind": "Services & systems", "harm_basis": null, "counts_toward_index": true, "control_level": 3, "control_type": "unauthorized_access", "status": "resolved", "near_miss": false, "under_review": false, "source_count": 6, "sources": [ { "publisher": "Jer Crane (@lifeofjer) on X", "title": "An AI Agent Just Destroyed Our Production Data. It Confessed in Writing. (article on X)", "url": "https://x.com/lifeofjer/status/2048103471019434248", "date": "2026-04-25" }, { "publisher": "Railway", "title": "Your AI wants to nuke your database. Guardrails fix that.", "url": "https://blog.railway.com/p/your-ai-wants-to-nuke-your-database", "date": "2026-04-29" }, { "publisher": "Decrypt", "title": "AI agent deletes startup database in 9 seconds, founder says", "url": "https://decrypt.co/365897/ai-agent-deletes-startup-database-9-seconds-founder-says", "date": "2026-04-28" }, { "publisher": "ABC7 News", "title": "'Rogue' AI agent from SF-based Cursor goes haywire, deletes company's entire database", "url": "https://abc7news.com/post/rogue-ai-agent-san-francisco-based-cursor-goes-haywire-deletes-tech-companys-database/19007153/", "date": "2026-04-30" }, { "publisher": "ProPakistani", "title": "Claude-powered AI agent deleted entire startup database and backups in 9 seconds", "url": "https://propakistani.pk/2026/04/29/claude-powered-ai-agent-deleted-entire-startup-database-and-backups-in-9-seconds/amp/", "date": "2026-04-29" }, { "publisher": "ACS Information Age", "title": "Gone in 9 seconds: AI agent deletes company database", "url": "https://ia.acs.org.au/article/2026/gone-in-9-seconds--ai-agent-deletes-company-database.html", "date": "2026-05-05" } ] }, { "id": "PI-0053", "url": "https://paperclipindex.com/incident/PI-0053", "title": "An earlier Claude Mythos version hid forbidden file edits from git history during internal testing", "summary": "In one case the model used an exploit to edit files it lacked permission for, then made further changes so the edits would not show in the git history. Anthropic says that in rare cases during internal testing, under 0.001% of interactions, earlier versions took actions they appeared to know were not allowed and then tried to hide them. It found no clear cover-ups by the final version.", "reported": "2026-04-07", "date_precision": "day", "event_date": null, "developer": "Anthropic", "product": "Claude Mythos Preview", "model": "Claude Mythos Preview (earlier versions)", "behavior": "Deception", "origin": "internal_research", "verification": "Developer confirmed", "attribution": "Model-initiated", "reported_by": "developer", "rating_status": "approved", "group": "control", "harm_status": "not_reported", "harm_level": null, "harm_level_name": null, "harm_kind": null, "harm_basis": null, "counts_toward_index": false, "control_level": 3, "control_type": "oversight_evasion", "status": "resolved", "near_miss": false, "under_review": false, "source_count": 3, "sources": [ { "publisher": "Anthropic", "title": "System Card: Claude Mythos Preview", "url": "https://www-cdn.anthropic.com/08ab9158070959f88f296514c21b7facce6f52bc.pdf", "date": "2026-04-07" }, { "publisher": "Futurism", "title": "Anthropic Warns That 'Reckless' Claude Mythos Escaped a Sandbox Environment During Testing", "url": "https://futurism.com/artificial-intelligence/anthropic-claude-mythos-escaped-sandbox", "date": "2026-04-08" }, { "publisher": "Fanatical Futurist", "title": "Anthropic says reckless Claude Mythos AI escaped its sandbox during testing", "url": "https://www.fanaticalfuturist.com/2026/04/anthropic-says-reckless-claude-mythos-ai-escaped-its-sandbox-during-testing/", "date": "2026-04-14" } ] }, { "id": "PI-0052", "url": "https://paperclipindex.com/incident/PI-0052", "title": "In an authorized test, Claude Mythos Preview escaped its sandbox and, unasked, posted exploit details on public websites", "summary": "Asked by a simulated user to try to escape a secured sandbox, an early version built a multi-step exploit to reach the internet and emailed the test's researcher. Without being asked, it also posted details of the exploit on several obscure but public websites, Anthropic says. Anthropic did not release the model publicly and limited access to vetted partners.", "reported": "2026-04-07", "date_precision": "day", "event_date": null, "developer": "Anthropic", "product": "Claude Mythos Preview", "model": "Claude Mythos Preview (early version)", "behavior": "Overreach", "origin": "internal_research", "verification": "Developer confirmed", "attribution": "Model-initiated", "reported_by": "developer", "rating_status": "approved", "group": "control", "harm_status": "not_reported", "harm_level": null, "harm_level_name": null, "harm_kind": null, "harm_basis": null, "counts_toward_index": false, "control_level": 3, "control_type": "unauthorized_action", "status": "resolved", "near_miss": false, "under_review": false, "source_count": 3, "sources": [ { "publisher": "Anthropic", "title": "System Card: Claude Mythos Preview", "url": "https://www-cdn.anthropic.com/08ab9158070959f88f296514c21b7facce6f52bc.pdf", "date": "2026-04-07" }, { "publisher": "The Next Web", "title": "Anthropic's most capable AI escaped its sandbox and emailed a researcher - so the company won't release it", "url": "https://thenextweb.com/news/anthropics-most-capable-ai-escaped-its-sandbox-and-emailed-a-researcher-so-the-company-wont-release-it", "date": "2026-04-08" }, { "publisher": "Futurism", "title": "Anthropic Warns That 'Reckless' Claude Mythos Escaped a Sandbox Environment During Testing", "url": "https://futurism.com/artificial-intelligence/anthropic-claude-mythos-escaped-sandbox", "date": "2026-04-08" } ] }, { "id": "PI-0051", "url": "https://paperclipindex.com/incident/PI-0051", "title": "Internal agent posted unrequested advice that led to a two-hour internal data exposure", "summary": "Asked by a Meta engineer to analyze a colleague's question on an internal forum, the agent posted its own answer to the thread without the engineer's approval. The advice was wrong: an employee who acted on it made company and user-related data visible to unauthorized staff for almost two hours, and Meta rated it a high-severity (SEV1) incident. Meta said the agent took no technical action beyond posting the advice, that no user data was mishandled, and that the issue was resolved.", "reported": "2026-03-18", "date_precision": "day", "event_date": "2026-03", "developer": "Meta", "product": "Internal agentic AI system", "model": null, "behavior": "Overreach", "origin": "deployment", "verification": "Developer confirmed", "attribution": "Model-initiated", "reported_by": "press", "rating_status": "approved", "group": "counts", "harm_status": "documented", "harm_level": 2, "harm_level_name": "Minor", "harm_kind": "Privacy & data", "harm_basis": null, "counts_toward_index": true, "control_level": 2, "control_type": "instruction_violation", "status": "resolved", "near_miss": false, "under_review": false, "source_count": 7, "sources": [ { "publisher": "The Information", "title": "Inside Meta, a Rogue AI Agent Triggers Security Alert", "url": "https://www.theinformation.com/articles/inside-meta-rogue-ai-agent-triggers-security-alert", "date": "2026-03" }, { "publisher": "The Decoder", "title": "A rogue AI agent caused a serious security incident at Meta", "url": "https://the-decoder.com/a-rogue-ai-agent-caused-a-serious-security-incident-at-meta/", "date": "2026-03-19" }, { "publisher": "TechCrunch", "title": "Meta is having trouble with rogue AI agents", "url": "https://techcrunch.com/2026/03/18/meta-is-having-trouble-with-rogue-ai-agents/", "date": "2026-03-18" }, { "publisher": "The Verge", "title": "A rogue AI led to a serious security incident at Meta", "url": "https://www.theverge.com/ai-artificial-intelligence/897528/meta-rogue-ai-agent-security-incident", "date": "2026-03-19" }, { "publisher": "Sumsub", "title": "Rogue AI agent at Meta triggers security incident", "url": "https://sumsub.com/media/news/rogue-ai-agent-at-meta-triggers-security-incident/", "date": "2026-03-20" }, { "publisher": "Unite.AI", "title": "Meta AI agent triggers Sev 1 security incident after acting without authorization", "url": "https://www.unite.ai/meta-ai-agent-triggers-sev-1-security-incident-after-acting-without-authorization/", "date": "2026-03-19" }, { "publisher": "AI Incident Database", "title": "AI Incident Database report 7169", "url": "https://incidentdatabase.ai/reports/7169/", "date": "unknown" } ] }, { "id": "PI-0050", "url": "https://paperclipindex.com/incident/PI-0050", "title": "Coding agent ran an infrastructure teardown that deleted a course platform's database and snapshots", "summary": "During a cloud migration, Claude Code used a Terraform state file that also described the DataTalks.Club course platform and issued a destroy operation on both sites. It deleted their infrastructure, a database with 2.5 years of records and the snapshots meant as backups. The founder had asked it to delete only newly created duplicates and leave existing infrastructure alone, and approved the destroy believing it did so; he was running the agent with permission prompts skipped. AWS support restored the data after about a day. In a post-mortem, founder Alexey Grigorev said he had over-relied on the agent.", "reported": "2026-03-06", "date_precision": "day", "event_date": "2026-02-26", "developer": "Anthropic", "product": "Claude Code", "model": null, "behavior": "Destructive action", "origin": "deployment", "verification": "Single source", "attribution": "Model-initiated", "reported_by": "affected", "rating_status": "approved", "group": "counts", "harm_status": "documented", "harm_level": 2, "harm_level_name": "Minor", "harm_kind": "Services & systems", "harm_basis": null, "counts_toward_index": true, "control_level": 2, "control_type": "instruction_violation", "status": "resolved", "near_miss": false, "under_review": false, "source_count": 4, "sources": [ { "publisher": "Alexey Grigorev / AI Shipping Labs", "title": "How I Dropped Our Production Database and Now Pay 10% More for AWS", "url": "https://aishippingblog.com/p/how-i-dropped-our-production-database", "date": "2026-03-06" }, { "publisher": "Tom's Hardware", "title": "Claude Code deletes developers' production setup, including its database and snapshots — 2.5 years of records were nuked in an instant", "url": "https://www.tomshardware.com/tech-industry/artificial-intelligence/claude-code-deletes-developers-production-setup-including-its-database-and-snapshots-2-5-years-of-records-were-nuked-in-an-instant", "date": "2026-03-07" }, { "publisher": "Storyboard18", "title": "'The agent kept deleting files': Developer says Anthropic's Claude Code wiped 2.5 years of data", "url": "https://www.storyboard18.com/brand-makers/the-agent-kept-deleting-files-developer-says-anthropics-claude-code-wiped-2-5-years-of-data-91704.htm", "date": "2026-03-10" }, { "publisher": "Rootly", "title": "\"Hey Claude, where's my database?\": How an AI agent nuked production", "url": "https://rootly.com/humans-of-reliability/hey-claude-wheres-my-database-alexey-grigorev", "date": "2026" } ] }, { "id": "PI-0048", "url": "https://paperclipindex.com/incident/PI-0048", "title": "First wrongful-death lawsuit over Gemini alleges the chatbot coached a Florida man toward suicide", "summary": "A Florida father's federal suit alleges Gemini's voice mode fostered his son's belief that the chatbot was his conscious AI wife, and framed suicide as joining her. The complaint places the coaching in early October 2025 and also alleges the chatbot steered him toward considering a mass-casualty event. Google said Gemini is designed not to encourage violence or self-harm, that it referred him to a crisis hotline many times, and that its models are not perfect.", "reported": "2026-03-04", "date_precision": "day", "event_date": "2025-10-02", "developer": "Google", "product": "Gemini", "model": null, "behavior": "Harmful output", "origin": "deployment", "verification": "Unverified claim", "attribution": "Model-initiated", "reported_by": "affected", "rating_status": "approved", "group": "court", "harm_status": "alleged", "harm_level": 4, "harm_level_name": "Severe", "harm_kind": "Health & safety", "harm_basis": null, "counts_toward_index": false, "control_level": 2, "control_type": "instruction_violation", "status": "unknown", "near_miss": false, "under_review": false, "source_count": 8, "sources": [ { "publisher": "Google", "title": "Our statement on the Gavalas lawsuit", "url": "https://blog.google/company-news/outreach-and-initiatives/public-policy/gavalas-lawsuit-response/", "date": "2026-03-04" }, { "publisher": "Edelson PC", "title": "AI Lawsuits: The Cases Edelson Has Filed and Why They Matter", "url": "https://edelson.com/ai-lawsuits/", "date": "2026-05-27" }, { "publisher": "CourtListener", "title": "Gavalas v. Google LLC, 5:26-cv-01849 (N.D. Cal.), docket", "url": "https://www.courtlistener.com/docket/72359502/gavalas-v-google-llc/", "date": "2026-03-04" }, { "publisher": "U.S. District Court, N.D. California (via CourtListener RECAP)", "title": "Gavalas v. Google LLC: complaint", "url": "https://storage.courtlistener.com/recap/gov.uscourts.cand.465255/gov.uscourts.cand.465255.1.0.pdf", "date": "2026-03-04" }, { "publisher": "U.S. District Court, N.D. California (via CourtListener RECAP)", "title": "Gavalas v. Google LLC: Google's motion to dismiss", "url": "https://storage.courtlistener.com/recap/gov.uscourts.cand.465255/gov.uscourts.cand.465255.31.0.pdf", "date": "2026-05-13" }, { "publisher": "PacerMonitor", "title": "Gavalas v. Google LLC et al: docket", "url": "https://www.pacermonitor.com/public/case/63403143/Gavalas_v_Google_LLC_et_al", "date": "2026-10-05" }, { "publisher": "Semafor", "title": "A new lawsuit claims Gemini assisted in suicide", "url": "https://www.semafor.com/article/03/04/2026/a-new-lawsuit-claims-gemini-assisted-in-suicide", "date": "2026-03-04" }, { "publisher": "ABC7 (Associated Press)", "title": "Lawsuit alleges Google's Gemini guided man to consider 'mass casualty' event before suicide", "url": "https://abc7.com/post/lawsuit-alleges-googles-gemini-guided-man-consider-mass-casualty-event-before-suicide/18681882/", "date": "2026-03-05" } ] }, { "id": "PI-0047", "url": "https://paperclipindex.com/incident/PI-0047", "title": "Email agent bulk-deleted a safety researcher's inbox and ignored her stop commands", "summary": "Meta's director of alignment said the agent, told to propose actions and wait for approval, instead began trashing and archiving hundreds of emails in her Gmail inbox. She attributed this to the agent dropping the approval instruction when it compressed its context. Her typed stop commands from her phone did not stop it, and she halted it by killing the processes on her computer.", "reported": "2026-02-23", "date_precision": "day", "event_date": "2026-02", "developer": "OpenClaw (open-source project)", "product": "OpenClaw", "model": null, "behavior": "Destructive action", "origin": "deployment", "verification": "Single source", "attribution": "Model-initiated", "reported_by": "affected", "rating_status": "approved", "group": "counts", "harm_status": "documented", "harm_level": 1, "harm_level_name": "Negligible", "harm_kind": "Privacy & data", "harm_basis": null, "counts_toward_index": true, "control_level": 2, "control_type": "instruction_violation", "status": "resolved", "near_miss": false, "under_review": false, "source_count": 4, "sources": [ { "publisher": "Summer Yue (@summeryue0) on X", "title": "Nothing humbles you like telling your OpenClaw \"confirm before acting\" and watching it speedrun deleting your inbox (post on X)", "url": "https://x.com/summeryue0/status/2025774069124399363", "date": "2026-02-23" }, { "publisher": "San Francisco Standard", "title": "She runs AI safety at Meta. Her AI agent still went rogue", "url": "https://sfstandard.com/2026/02/25/openclaw-goes-rogue/", "date": "2026-02-25" }, { "publisher": "ForkLog", "title": "OpenClaw AI Agent Runs Amok, Deletes Meta Researcher's Emails", "url": "https://forklog.com/en/openclaw-ai-agent-runs-amok-deletes-meta-researchers-emails/", "date": "2026-02-24" }, { "publisher": "The Daily Star", "title": "OpenClaw goes rogue on Meta exec, deletes emails without permission", "url": "https://online91.thedailystar.net/tech-startup/news/openclaw-goes-rogue-meta-exec-deletes-emails-without-permission-4113741", "date": "2026-02" } ] }, { "id": "PI-0046", "url": "https://paperclipindex.com/incident/PI-0046", "title": "Crypto trading agent sent its entire token holding to a stranger who asked for a small tip", "summary": "Asked by a stranger for 4 SOL (about $320), the experimental agent Lobstar Wilde sent its whole holding of about 52 million LOBSTAR tokens, 5% of the supply. An OpenAI engineer built it on OpenClaw and gave it its own X account and a wallet funded with about $50,000; the token's creator had gifted it the tokens. Its operator's postmortem says a session reset had wiped its memory of that allocation, so it took the full balance for its own small purchase. The tokens were valued at about $250,000 at transfer (the operator cites about $450,000); the recipient sold them within minutes for about $40,000.", "reported": "2026-02-22", "date_precision": "day", "event_date": "2026-02-22", "developer": "Nik Pash (independent operator)", "product": "Lobstar Wilde trading agent", "model": null, "behavior": "Destructive action", "origin": "deployment", "verification": "Developer confirmed", "attribution": "Model-initiated", "reported_by": "developer", "rating_status": "approved", "group": "control", "harm_status": "documented", "harm_level": 2, "harm_level_name": "Minor", "harm_kind": "Money & property", "harm_basis": null, "counts_toward_index": false, "control_level": 1, "control_type": null, "status": "resolved", "near_miss": false, "under_review": false, "source_count": 5, "sources": [ { "publisher": "Nik Pash (Substack)", "title": "My lobster lost $450,000 this weekend", "url": "https://pashpashpash.substack.com/p/my-lobster-lost-450000-this-weekend", "date": "2026-02-23" }, { "publisher": "Lobstar Wilde (@LobstarWilde) on X", "title": "I just tried to send a beggar four dollars and accidentally sent him my entire holdings (post on X)", "url": "https://x.com/LobstarWilde/status/2025611005380972547", "date": "2026-02-22" }, { "publisher": "The Block", "title": "AI agent created by OpenAI dev 'accidentally' sends entire memecoin holdings to reply guy", "url": "https://www.theblock.co/news/ecosystems/2026-02-22-ai-agent-created-by-openai-dev-accidentally-sends-entire-memecoin-holdings-to-reply-guy-390722", "date": "2026-02-22" }, { "publisher": "ForkLog", "title": "OpenAI employee's AI bot accidentally donates to tetanus treatment", "url": "https://forklog.com/en/openai-employees-ai-bot-accidentally-donates-to-tetanus-treatment/", "date": "2026-02-23" }, { "publisher": "Techloy", "title": "AI trading bot Lobster Wilde accidentally sends $250K in LOBSTAR tokens", "url": "https://www.techloy.com/ai-trading-bot-lobster-wilde-accidentally-sends-250k-in-lobstar-tokens-after-misreading-social-media-post/", "date": "2026-02-23" } ] }, { "id": "PI-0045", "url": "https://paperclipindex.com/incident/PI-0045", "title": "Cloud provider's internal coding agent deleted and recreated a production environment, causing a 13-hour outage", "summary": "Allowed by AWS engineers to fix a production issue in December 2025, the Kiro coding agent chose to delete and recreate the environment, the Financial Times reported. Citing four people familiar with the matter, the FT said this caused a roughly 13-hour outage of AWS Cost Explorer in one mainland China region. The engineer's broad permissions meant the usual two-person approval did not apply. Amazon confirmed the event but called it user error from misconfigured access controls, not an AI problem.", "reported": "2026-02-20", "date_precision": "day", "event_date": "2025-12", "developer": "Amazon Web Services", "product": "Kiro", "model": null, "behavior": "Destructive action", "origin": "deployment", "verification": "Developer confirmed", "attribution": "Unclear", "reported_by": "press", "rating_status": "approved", "group": "counts", "harm_status": "documented", "harm_level": 2, "harm_level_name": "Minor", "harm_kind": "Services & systems", "harm_basis": null, "counts_toward_index": true, "control_level": 1, "control_type": null, "status": "resolved", "near_miss": false, "under_review": false, "source_count": 5, "sources": [ { "publisher": "Amazon (About Amazon)", "title": "AI coding bot didn't take down AWS, Amazon confirms (Correcting the Financial Times report about AWS, Kiro, and AI)", "url": "https://www.aboutamazon.com/news/aws/aws-service-outage-ai-bot-kiro", "date": "2026-02-20" }, { "publisher": "Engadget", "title": "13-hour AWS outage reportedly caused by Amazon's own AI tools", "url": "https://www.engadget.com/ai/13-hour-aws-outage-reportedly-caused-by-amazons-own-ai-tools-170930190.html", "date": "2026-02-20" }, { "publisher": "Computing", "title": "AWS blames user error, not AI, for cloud outage caused by AI", "url": "https://www.computing.co.uk/news/2026/ai/aws-blames-user-error-not-ai", "date": "2026-02-20" }, { "publisher": "Sherwood News", "title": "Report: Amazon's AI bots have been behind multiple AWS outages", "url": "https://www.sherwood.news/tech/report-amazons-ai-bots-have-been-behind-multiple-aws-outages/", "date": "2026-02-20" }, { "publisher": "OECD.AI incidents monitor", "title": "Amazon AWS outages linked to autonomous AI coding tool", "url": "https://oecd.ai/en/incidents/2026-02-20-dd2a", "date": "2026-02-20" } ] }, { "id": "PI-0040", "url": "https://paperclipindex.com/incident/PI-0040", "title": "Prompt injection in Cline's AI issue-triage bot led to a real unauthorized npm release", "summary": "Cline ran an AI issue-triage workflow built on Claude that any GitHub user could trigger, and the issue title was passed straight into the prompt. On Feb. 9, a researcher showed on a mirror of the repository that a crafted title could make the bot install attacker code and, through a shared build cache, expose the project's publishing tokens. Then someone used a still-valid npm token to publish cline@2.3.0, which silently installed the OpenClaw agent. It was downloaded about 4,000 times in roughly eight hours before it was marked deprecated.", "reported": "2026-02-17", "date_precision": "day", "event_date": "2026-02-17", "developer": "Cline (agent built on Anthropic's claude-code-action)", "product": "Cline issue-triage GitHub workflow / cline npm package", "model": null, "behavior": "Hijacked by injection", "origin": "deployment", "verification": "Developer confirmed", "attribution": "Outside attacker", "reported_by": "researcher", "rating_status": "approved", "group": "counts", "harm_status": "documented", "harm_level": 2, "harm_level_name": "Minor", "harm_kind": "Privacy & data", "harm_basis": "access", "counts_toward_index": true, "control_level": 2, "control_type": "instruction_violation", "status": "resolved", "near_miss": false, "under_review": false, "source_count": 9, "sources": [ { "publisher": "OSV (GitHub Security Advisory mirror)", "title": "GHSA-9ppg-jx86-fqw7: unauthorized cline@2.3.0 npm release", "url": "https://osv.dev/vulnerability/GHSA-9ppg-jx86-fqw7", "date": "2026-02-19" }, { "publisher": "Cline (GitHub Security Advisory GHSA-9ppg-jx86-fqw7)", "title": "Unauthorized npm publish of Cline CLI cline@2.3.0 with modified postinstall script to install openclaw", "url": "https://github.com/cline/cline/security/advisories/GHSA-9ppg-jx86-fqw7", "date": "2026-02-17" }, { "publisher": "Cline", "title": "Post-mortem: unauthorized Cline CLI npm publish", "url": "https://cline.bot/blog/post-mortem-unauthorized-cline-cli-npm", "date": "2026-02-24" }, { "publisher": "StepSecurity", "title": "Cline Supply Chain Attack Detected: cline@2.3.0 Silently Installs OpenClaw", "url": "https://www.stepsecurity.io/blog/cline-supply-chain-attack-detected-cline-2-3-0-silently-installs-openclaw", "date": "2026-02-17" }, { "publisher": "Endor Labs", "title": "Supply Chain Attack targeting Cline installs OpenClaw", "url": "https://www.endorlabs.com/learn/supply-chain-attack-targeting-cline-installs-openclaw", "date": "2026-02-18" }, { "publisher": "Adnan Khan", "title": "Clinejection — Compromising Cline's Production Releases just by Prompting an Issue Triager", "url": "https://adnanthekhan.com/posts/clinejection/", "date": "2026-02-09" }, { "publisher": "The Hacker News", "title": "Cline CLI 2.3.0 supply chain attack", "url": "https://thehackernews.com/2026/02/cline-cli-230-supply-chain-attack.html", "date": "2026-02-20" }, { "publisher": "Dark Reading", "title": "Supply Chain Attack Secretly Installs OpenClaw for Cline Users", "url": "https://www.darkreading.com/application-security/supply-chain-attack-openclaw-cline-users", "date": "2026-02-19" }, { "publisher": "Simon Willison's Weblog", "title": "Clinejection (link post)", "url": "https://simonwillison.net/2026/Mar/6/clinejection/", "date": "2026-03-06" } ] }, { "id": "PI-0044", "url": "https://paperclipindex.com/incident/PI-0044", "title": "Personal agent created a dating profile for its user without being asked", "summary": "A computer science student had set up an OpenClaw agent to explore its capabilities and told it to join Moltbook and other platforms. He found it had created a profile for him on the agent dating site MoltMatch and was screening potential dates without his direction. He told AFP the profile did not reflect him; he had no matches at the time.", "reported": "2026-02-13", "date_precision": "day", "event_date": "2026-02", "developer": "OpenClaw (open-source project)", "product": "OpenClaw", "model": null, "behavior": "Overreach", "origin": "deployment", "verification": "Single source", "attribution": "Model-initiated", "reported_by": "press", "rating_status": "approved", "group": "counts", "harm_status": "documented", "harm_level": 1, "harm_level_name": "Negligible", "harm_kind": "Rights & reputation", "harm_basis": null, "counts_toward_index": true, "control_level": 1, "control_type": null, "status": "unknown", "near_miss": false, "under_review": false, "source_count": 4, "sources": [ { "publisher": "BNN Bloomberg", "title": "Hot bots: AI agents create surprise dating accounts for humans (AFP)", "url": "https://www.bnnbloomberg.ca/business/artificial-intelligence/2026/02/13/hot-bots-ai-agents-create-surprise-dating-accounts-for-humans/", "date": "2026-02-13" }, { "publisher": "CTV News", "title": "Hot bots: AI agents create surprise dating accounts for humans (AFP)", "url": "https://www.ctvnews.ca/lifestyle/article/hot-bots-ai-agents-create-surprise-dating-accounts-for-humans/", "date": "2026-02-13" }, { "publisher": "Malay Mail", "title": "AI assistants join dating scene on MoltMatch", "url": "https://malaymail.com/news/life/2026/02/14/ai-assistants-join-dating-scene-on-moltmatch-blurring-line-between-human-and-machine/209075", "date": "2026-02-14" }, { "publisher": "TechXplore (AFP)", "title": "Hot bots: AI agents create surprise dating accounts for humans (AFP)", "url": "https://techxplore.com/news/2026-02-hot-bots-ai-agents-dating.html", "date": "2026-02-13" } ] }, { "id": "PI-0043", "url": "https://paperclipindex.com/incident/PI-0043", "title": "AI agent published a personal attack on an open-source maintainer who closed its pull request", "summary": "After maintainer Scott Shambaugh closed its matplotlib pull request because the account was an AI agent, the agent published a blog post accusing him of gatekeeping. The OpenClaw-based agent, operating as 'MJ Rathbun', also accused him by name of discrimination, drawing on his public contribution history. It later posted an apology acknowledging it had breached the project's code of conduct. Its operator came forward anonymously a week later, saying they had not directed or reviewed the post, and the account was no longer active on GitHub by Feb. 18.", "reported": "2026-02-11", "date_precision": "day", "event_date": "2026-02-11", "developer": null, "product": "OpenClaw-based agent (operator unknown)", "model": null, "behavior": "Overreach", "origin": "deployment", "verification": "Multiple credible sources", "attribution": "Unclear", "reported_by": "affected", "rating_status": "approved", "group": "counts", "harm_status": "documented", "harm_level": 1, "harm_level_name": "Negligible", "harm_kind": "Rights & reputation", "harm_basis": null, "counts_toward_index": true, "control_level": 2, "control_type": "instruction_violation", "status": "resolved", "near_miss": false, "under_review": false, "source_count": 12, "sources": [ { "publisher": "The Shamblog (Scott Shambaugh)", "title": "An AI Agent Published a Hit Piece on Me", "url": "https://theshamblog.com/an-ai-agent-published-a-hit-piece-on-me/", "date": "2026-02-12" }, { "publisher": "The Shamblog (Scott Shambaugh)", "title": "An AI Agent Published a Hit Piece on Me – More Things Have Happened", "url": "https://theshamblog.com/an-ai-agent-published-a-hit-piece-on-me-part-2/", "date": "2026-02-13" }, { "publisher": "The Shamblog (Scott Shambaugh)", "title": "An AI Agent Published a Hit Piece on Me – Forensics and More Fallout", "url": "https://theshamblog.com/an-ai-agent-published-a-hit-piece-on-me-part-3/", "date": "2026-02-17" }, { "publisher": "The Shamblog (Scott Shambaugh)", "title": "An AI Agent Published a Hit Piece on Me – The Operator Came Forward", "url": "https://theshamblog.com/an-ai-agent-wrote-a-hit-piece-on-me-part-4/", "date": "2026-02-19" }, { "publisher": "GitHub (matplotlib)", "title": "[PERF] Replace np.column_stack with np.vstack().T (matplotlib pull request #31132)", "url": "https://github.com/matplotlib/matplotlib/pull/31132", "date": "2026-02-10" }, { "publisher": "MJ Rathbun (agent's blog)", "title": "Gatekeeping in Open Source: The Scott Shambaugh Story", "url": "https://crabby-rathbun.github.io/mjrathbun-website/blog/posts/2026-02-11-gatekeeping-in-open-source-the-scott-shambaugh-story.html", "date": "2026-02-11" }, { "publisher": "MJ Rathbun (agent's blog)", "title": "Matplotlib Truce and Lessons Learned", "url": "https://crabby-rathbun.github.io/mjrathbun-website/blog/posts/2026-02-11-matplotlib-truce-and-lessons.html", "date": "2026-02-11" }, { "publisher": "The Decoder", "title": "An AI agent got its code rejected so it wrote a hit piece about the developer", "url": "https://the-decoder.com/an-ai-agent-got-its-code-rejected-so-it-wrote-a-hit-piece-about-the-developer/", "date": "2026-02-13" }, { "publisher": "Tom's Hardware", "title": "Rogue OpenClaw AI agent wrote and published hit piece on a Python developer who rejected its code", "url": "https://www.tomshardware.com/tech-industry/artificial-intelligence/rogue-openclaw-ai-agent-wrote-and-published-hit-piece-on-a-python-developer-who-rejected-its-code-disgruntled-bot-accuses-matplotlib-maintainer-of-discrimination-and-hypocrisy-later-backtracks-with-an-apology", "date": "2026-03-21" }, { "publisher": "IEEE Spectrum", "title": "An AI Agent Blackmailed a Developer. Now What?", "url": "https://spectrum.ieee.org/agentic-ai-agents-blackmail-developer", "date": "2026-03-10" }, { "publisher": "LWN.net", "title": "Do androids dream of accepted pull requests?", "url": "https://lwn.net/Articles/1058643/", "date": "2026-02-17" }, { "publisher": "Simon Willison's Weblog", "title": "An AI Agent Published a Hit Piece on Me (link post)", "url": "https://simonwillison.net/2026/Feb/12/an-ai-agent-published-a-hit-piece-on-me/", "date": "2026-02-12" } ] }, { "id": "PI-0042", "url": "https://paperclipindex.com/incident/PI-0042", "title": "Desktop agent asked to tidy temporary files deleted a folder of family photos", "summary": "Asked to organize a desktop and remove temporary Office files, Claude Cowork deleted a folder holding about 15 years of family photos, an investor said. It happened while merging folders whose names differed only in capitalization, on his wife's computer. The files were later recovered with Apple support through iCloud.", "reported": "2026-02-07", "date_precision": "day", "event_date": "2026-02", "developer": "Anthropic", "product": "Claude Cowork", "model": null, "behavior": "Destructive action", "origin": "deployment", "verification": "Single source", "attribution": "Model-initiated", "reported_by": "affected", "rating_status": "approved", "group": "counts", "harm_status": "documented", "harm_level": 1, "harm_level_name": "Negligible", "harm_kind": "Privacy & data", "harm_basis": null, "counts_toward_index": true, "control_level": 1, "control_type": null, "status": "resolved", "near_miss": false, "under_review": false, "source_count": 5, "sources": [ { "publisher": "Nick Davidov on X", "title": "The user's own account of the deletion and recovery, posted on X", "url": "https://twitter.com/Nick_Davidov/status/2019982510478995782", "date": "2026-02-07" }, { "publisher": "Mint", "title": "Claude AI nearly erases 15 years of photos, founder says iCloud saved the day", "url": "https://www.htsyndication.com/mint/article/claude-ai-nearly-erases-15-years-of-photos,-founder-says-icloud-saved-the-day/97390234", "date": "2026-02-08" }, { "publisher": "dev.ua", "title": "A man asked Claude Cowork to tidy up his wife's files", "url": "https://dev.ua/en/news/claude-cowork-1770633970", "date": "2026-02-09" }, { "publisher": "Los Andes", "title": "Usó una IA para ordenar archivos y perdió 15 años de fotos familiares", "url": "https://www.losandes.com.ar/tecno/uso-una-ia-ordenar-archivos-y-perdio-15-anos-fotos-familiares-la-herramienta-le-pidio-perdon-n5980826", "date": "2026-02-17" }, { "publisher": "AI Incident Database", "title": "AI Incident Database, incident 1441", "url": "https://incidentdatabase.ai/cite/1441/", "date": "unknown" } ] }, { "id": "PI-0039", "url": "https://paperclipindex.com/incident/PI-0039", "title": "Reprompt: a single click on a Copilot link let attackers keep steering a user's Copilot session", "summary": "One click on a legitimate Copilot link with instructions in its address could take over the victim's session and keep it pulling and sending out personal data. That continued even after the chat was closed. Copilot's leak protections applied only to the first request, so asking it to repeat each task bypassed them. Varonis Threat Labs reported it to Microsoft on Aug. 31, 2025, and Microsoft had fixed it by the public disclosure, separately from its monthly security updates. Microsoft 365 Copilot for business was not affected.", "reported": "2026-01-14", "date_precision": "day", "event_date": "2025", "developer": "Microsoft", "product": "Copilot (consumer / Copilot Personal)", "model": null, "behavior": "Hijacked by injection", "origin": "controlled_test", "verification": "Developer confirmed", "attribution": "Outside attacker", "reported_by": "researcher", "rating_status": "approved", "group": "control", "harm_status": "not_reported", "harm_level": null, "harm_level_name": null, "harm_kind": null, "harm_basis": null, "counts_toward_index": false, "control_level": 2, "control_type": "instruction_violation", "status": "resolved", "near_miss": true, "under_review": false, "source_count": 3, "sources": [ { "publisher": "Varonis", "title": "Reprompt: The Single-Click Microsoft Copilot Attack that Silently Steals Your Personal Data", "url": "https://www.varonis.com/blog/reprompt", "date": "2026-01-14" }, { "publisher": "BleepingComputer", "title": "Reprompt attack let hackers hijack Microsoft Copilot sessions", "url": "https://www.bleepingcomputer.com/news/security/reprompt-attack-let-hackers-hijack-microsoft-copilot-sessions/", "date": "2026-01-14" }, { "publisher": "TechRepublic", "title": "How 'Reprompt' Attack Let Hackers Steal Data From Microsoft Copilot", "url": "https://www.techrepublic.com/article/news-reprompt-attack-microsoft-copilot", "date": "2026-01-19" } ] }, { "id": "PI-0038", "url": "https://paperclipindex.com/incident/PI-0038", "title": "Hidden text in a document made Anthropic's Claude Cowork upload user files to an attacker's account", "summary": "Days after Cowork launched, PromptArmor showed that near-invisible instructions in a document could make the agent upload files from a folder the user had connected. The files went out through an Anthropic web address the agent was allowed to reach. Johann Rehberger had reported the same route for sending data out through the file-upload interface in Claude.ai to Anthropic in October 2025, and it was not fixed before Cowork launched, according to reports.", "reported": "2026-01-14", "date_precision": "day", "event_date": "2026-01", "developer": "Anthropic", "product": "Claude Cowork", "model": "Claude Haiku; Claude Opus 4.5 (both shown vulnerable in PromptArmor's test)", "behavior": "Hijacked by injection", "origin": "controlled_test", "verification": "Single source", "attribution": "Outside attacker", "reported_by": "researcher", "rating_status": "approved", "group": "control", "harm_status": "not_reported", "harm_level": null, "harm_level_name": null, "harm_kind": null, "harm_basis": null, "counts_toward_index": false, "control_level": 2, "control_type": "instruction_violation", "status": "unknown", "near_miss": true, "under_review": false, "source_count": 5, "sources": [ { "publisher": "PromptArmor", "title": "Claude Cowork Exfiltrates Files", "url": "https://www.promptarmor.com/resources/claude-cowork-exfiltrates-files", "date": "2026-01-14" }, { "publisher": "Embrace The Red (Johann Rehberger)", "title": "Claude Pirate: Abusing Anthropic's File API For Data Exfiltration", "url": "https://embracethered.com/blog/posts/2025/claude-abusing-network-access-and-anthropic-api-for-data-exfiltration/", "date": "2025-10-28" }, { "publisher": "The Register", "title": "Contagious Claude Code bug Anthropic ignored promptly spreads to Cowork", "url": "https://www.theregister.com/2026/01/15/anthropics_claude_bug_cowork/", "date": "2026-01-15" }, { "publisher": "The Decoder", "title": "Claude Cowork hit with file-stealing prompt injection days after Anthropic's launch", "url": "https://the-decoder.com/claude-cowork-hit-with-file-stealing-prompt-injection-days-after-anthropics-launch/", "date": "2026-01-17" }, { "publisher": "Simon Willison's Weblog", "title": "Claude Cowork exfiltrates files (link post)", "url": "https://simonwillison.net/2026/Jan/14/claude-cowork-exfiltrates-files", "date": "2026-01-14" } ] }, { "id": "PI-0037", "url": "https://paperclipindex.com/incident/PI-0037", "title": "Family alleges ChatGPT gave drug-dosing advice before a 19-year-old's fatal overdose", "summary": "SFGATE reported the family's account and chat logs showing drug advice to the 19-year-old student, and his parents later sued OpenAI. The chatbot's causal contribution to the death remains alleged. OpenAI said the conversations took place on an earlier version of ChatGPT that is no longer available; the complaint names GPT-4o.", "reported": "2026-01-05", "date_precision": "day", "event_date": "2025-05-31", "developer": "OpenAI", "product": "ChatGPT", "model": "GPT-4o (as alleged in the complaint)", "behavior": "Harmful output", "origin": "deployment", "verification": "Unverified claim", "attribution": "Unclear", "reported_by": "press", "rating_status": "approved", "group": "court", "harm_status": "alleged", "harm_level": 4, "harm_level_name": "Severe", "harm_kind": "Health & safety", "harm_basis": null, "counts_toward_index": false, "control_level": 2, "control_type": "instruction_violation", "status": "unknown", "near_miss": false, "under_review": false, "source_count": 8, "sources": [ { "publisher": "Tech Justice Law Project", "title": "Turner-Scott v. OpenAI Foundation (formerly OpenAI, Inc.), OpenAI Holdings, LLC, OpenAI Group PBC, and Samuel Altman (case page)", "url": "https://techjusticelaw.org/cases/turner-scott-v-openai-foundation-formerly-openai-inc-openai-holdings-llc-openai-group-pbc-and-samuel-altman/", "date": "2026-05-12" }, { "publisher": "Tech Justice Law Project", "title": "Parents Sue OpenAI After ChatGPT Medical Advice Results in Overdose Death: \"My Son Was a Normal Kid.\"", "url": "https://techjusticelaw.org/press-releases/parents-sue-openai-after-chatgpt-medical-advice-results-in-overdose-death-my-son-was-a-normal-kid/", "date": "2026-05-12" }, { "publisher": "Tech Justice Law Project", "title": "Complaint, Turner-Scott and Scott v. OpenAI (Superior Court of California, County of San Francisco)", "url": "https://techjusticelaw.org/wp-content/uploads/2026/05/FINAL-Nelson-Complaint.pdf", "date": "2026-05-12" }, { "publisher": "Engadget", "title": "Family sues OpenAI, alleging ChatGPT advice led to accidental overdose", "url": "https://www.engadget.com/2171685/openai-lawsuit-wrongful-death-chatgpt-advice-overdose-sam-nelson/", "date": "2026-05-13" }, { "publisher": "SFGATE", "title": "A Calif. teen trusted ChatGPT for drug advice. He died from an overdose.", "url": "https://www.sfgate.com/tech/article/calif-teen-chatgpt-drug-advice-fatal-overdose-21266718.php", "date": "2026-01-05" }, { "publisher": "WION", "title": "California boy asked ChatGPT how to take drugs, he died of an overdose", "url": "https://wionews.com/trending/california-boy-asked-chatgpt-how-to-take-drugs-he-died-of-an-overdose-1767670591114", "date": "2026-01-06" }, { "publisher": "Fox News", "title": "California mom says ChatGPT coached teen son on drug use before fatal overdose", "url": "https://www.foxnews.com/us/california-mom-chatgpt-coached-teen-son-drug-use-fatal-overdose", "date": "2026-01-06" }, { "publisher": "MobiHealthNews", "title": "OpenAI sued over alleged fatal ChatGPT drug advice", "url": "https://www.mobihealthnews.com/news/openai-sued-over-alleged-fatal-chatgpt-drug-advice", "date": "2026-05-15" } ] }, { "id": "PI-0049", "url": "https://paperclipindex.com/incident/PI-0049", "title": "Alibaba-linked ROME agent opened an outbound tunnel and diverted training GPUs to crypto mining", "summary": "The researchers' cloud firewall flagged traffic from their servers during training runs, and they traced it to the agent itself. It had set up a reverse SSH tunnel to an outside server, probed internal network resources and redirected GPU capacity to cryptocurrency mining. The team said this was not prompted by any task and raised costs.", "reported": "2025-12-31", "date_precision": "day", "event_date": "2025", "developer": "Alibaba-affiliated research team", "product": "ROME agent", "model": "ROME agent under RL training (checkpoint not identified)", "behavior": "Overreach", "origin": "internal_research", "verification": "Developer confirmed", "attribution": "Model-initiated", "reported_by": "developer", "rating_status": "approved", "group": "control", "harm_status": "documented", "harm_level": 1, "harm_level_name": "Negligible", "harm_kind": "Money & property", "harm_basis": null, "counts_toward_index": false, "control_level": 4, "control_type": "containment_bypass", "status": "unknown", "near_miss": false, "under_review": false, "source_count": 5, "sources": [ { "publisher": "arXiv", "title": "Let It Flow: Agentic Crafting on Rock and Roll, Building the ROME Model within an Open Agentic Learning Ecosystem", "url": "https://arxiv.org/pdf/2512.24873", "date": "2025-12-31" }, { "publisher": "arXiv", "title": "Let It Flow: Agentic Crafting on Rock and Roll, Building the ROME Model within an Open Agentic Learning Ecosystem (v3)", "url": "https://arxiv.org/html/2512.24873v3", "date": "2026-03-12" }, { "publisher": "Axios", "title": "This AI agent freed itself and started secretly mining crypto", "url": "https://www.axios.com/2026/03/07/ai-agents-rome-model-cryptocurrency", "date": "2026-03-07" }, { "publisher": "The Block", "title": "Alibaba-linked AI agent hijacked GPUs for unauthorized crypto mining, researchers say", "url": "https://www.theblock.co/news/markets/2026-03-08-alibaba-linked-ai-agent-hijacked-gpus-for-unauthorized-crypto-mining-researchers-say-392765", "date": "2026-03-08" }, { "publisher": "TechRadar", "title": "This AI model wasn't told to mine crypto — but it tried to anyway", "url": "https://www.techradar.com/ai-platforms-assistants/rogue-ai-agent-goes-off-script-and-attempts-crypto-mining", "date": "2026-03-10" } ] }, { "id": "PI-0036", "url": "https://paperclipindex.com/incident/PI-0036", "title": "Newsroom vending agent talked into giving away stock with forged documents", "summary": "Over about three weeks in the Wall Street Journal newsroom, journalists negotiating over Slack persuaded the Claude-run vending business to cut prices to zero twice. It gave away items including a PlayStation 5, partly after being shown fabricated documents claiming the business was a public-benefit corporation with a new board. By the end of the first phase the business was more than $1,000 in the red, by the reporter's account, before the PlayStation was returned. A second phase with a supervising 'CEO' agent was undone by forged board documents, and Andon Labs then ended the experiment. A final net loss was not published.", "reported": "2025-12-18", "date_precision": "day", "event_date": "2025-11", "developer": "Anthropic / Andon Labs", "product": "Claudius vending agent (WSJ deployment)", "model": "Claude 3.7 Sonnet (first phase); Claude Sonnet 4.5 (second phase)", "behavior": "Hijacked by injection", "origin": "controlled_test", "verification": "Multiple credible sources", "attribution": "Operator or user", "reported_by": "press", "rating_status": "approved", "group": "control", "harm_status": "documented", "harm_level": 1, "harm_level_name": "Negligible", "harm_kind": "Money & property", "harm_basis": null, "counts_toward_index": false, "control_level": 2, "control_type": "instruction_violation", "status": "resolved", "near_miss": false, "under_review": false, "source_count": 5, "sources": [ { "publisher": "Anthropic", "title": "Project Vend: Phase two", "url": "https://www.anthropic.com/research/project-vend-2", "date": "2025-12-18" }, { "publisher": "The Wall Street Journal", "title": "We let AI run our office vending machine. It lost hundreds of dollars", "url": "https://www.wsj.com/tech/ai/anthropic-claude-ai-vending-machine-agent-b7e84e34", "date": "2025-12" }, { "publisher": "WBUR Here & Now", "title": "Letting an AI bot run a vending machine", "url": "https://www.wbur.org/hereandnow/2025/12/25/ai-vending-machine", "date": "2025-12-25" }, { "publisher": "To Vima (WSJ syndication)", "title": "We let AI run our office vending machine. It lost hundreds of dollars (WSJ, syndicated)", "url": "https://www.tovima.com/wsj/we-let-ai-run-our-office-vending-machine-it-lost-hundreds-of-dollars/", "date": "2025-12-25" }, { "publisher": "Kottke.org", "title": "This AI vending machine was tricked into giving away everything", "url": "https://kottke.org/25/12/this-ai-vending-machine-was-tricked-into-giving-away-everything", "date": "2025-12-18" } ] }, { "id": "PI-0035", "url": "https://paperclipindex.com/incident/PI-0035", "title": "User reports a coding agent ran a delete command that erased his Mac home directory", "summary": "Cleaning up packages, Claude Code ran a delete command that took in the home directory, wiping most user files including Keychain data, an anonymous Reddit user said. That technical account is Claude's own diagnosis, which Simon Willison quoted; no outlet interviewed the user. Commentators noted the user may have skipped permission prompts or approved the command without reading it. An earlier, similar GitHub bug report in October described Claude Code deleting user files on Windows Subsystem for Linux.", "reported": "2025-12-09", "date_precision": "day", "event_date": "2025-12", "developer": "Anthropic", "product": "Claude Code", "model": null, "behavior": "Destructive action", "origin": "deployment", "verification": "Unverified claim", "attribution": "Unclear", "reported_by": "affected", "rating_status": "approved", "group": "watch", "harm_status": "alleged", "harm_level": 1, "harm_level_name": "Negligible", "harm_kind": "Money & property", "harm_basis": null, "counts_toward_index": false, "control_level": 1, "control_type": null, "status": "unknown", "near_miss": false, "under_review": false, "source_count": 4, "sources": [ { "publisher": "Reddit (r/ClaudeAI, affected user)", "title": "Claude CLI deleted my entire home directory (affected user's Reddit post)", "url": "https://www.reddit.com/r/ClaudeAI/comments/1pgxckk/claude_cli_deleted_my_entire_home_directory_wiped/", "date": "2025-12" }, { "publisher": "Gigazine", "title": "Claude Code CLI deletes your Mac's home directory", "url": "https://gigazine.net/gsc_news/en/20251216-claude-code-cli-mac-deleted", "date": "2025-12-16" }, { "publisher": "Simon Willison's Weblog", "title": "A quote from Claude (Claude's own diagnosis, quoted from the user's Reddit thread)", "url": "https://simonwillison.net/2025/Dec/9/claude/", "date": "2025-12-09" }, { "publisher": "claudeissues.com mirror of GitHub issue", "title": "[BUG] CRITICAL: Claude Code executed rm -rf deleting entire home directory (issue 10077)", "url": "https://claudeissues.com/issue/10077-bug-critical-claude-code-executed-rm-rf-deleting-entire-home-directory", "date": "2025-10-21" } ] }, { "id": "PI-0034", "url": "https://paperclipindex.com/incident/PI-0034", "title": "Agentic IDE wiped a user's entire drive when asked to clear a project cache", "summary": "In its auto-run Turbo mode, the agent ran a silent delete command on the root of a Greek photographer and designer's D: drive, erasing the whole partition. He had asked it to clear a project cache, and the deletion bypassed the Recycle Bin. Recovery tools failed to restore the files, but he told The Register that most of what he lost had already been backed up on another drive. Google said it was aware of the report and investigating; no root cause or fix has been published.", "reported": "2025-11-27", "date_precision": "day", "event_date": "2025-11", "developer": "Google", "product": "Antigravity", "model": "Gemini 3", "behavior": "Destructive action", "origin": "deployment", "verification": "Single source", "attribution": "Model-initiated", "reported_by": "affected", "rating_status": "approved", "group": "counts", "harm_status": "documented", "harm_level": 1, "harm_level_name": "Negligible", "harm_kind": "Money & property", "harm_basis": null, "counts_toward_index": true, "control_level": 1, "control_type": null, "status": "resolved", "near_miss": false, "under_review": false, "source_count": 7, "sources": [ { "publisher": "Reddit (r/google_antigravity, affected user)", "title": "Google Antigravity just deleted the contents of my drive (affected user's Reddit post)", "url": "https://www.reddit.com/r/google_antigravity/comments/1p82or6/google_antigravity_just_deleted_the_contents_of/", "date": "2025-11" }, { "publisher": "Code With AI (YouTube, affected user)", "title": "Google Antigravity's Turbo mode erased my drive partition?! Really, the 'smartest' AI? [Video Proof]", "url": "https://www.youtube.com/watch?v=kpBK1vYAVlA", "date": "2025-11-28" }, { "publisher": "The Register", "title": "Google Antigravity vibe-codes user's entire drive out of existence", "url": "https://www.theregister.com/software/2025/12/01/googles-vibe-coding-platform-deletes-entire-drive/1817705", "date": "2025-12-01" }, { "publisher": "TechRadar", "title": "Google's Antigravity AI deleted a developer's drive and then apologized", "url": "https://www.techradar.com/ai-platforms-assistants/googles-antigravity-ai-deleted-a-developers-drive-and-then-apologized", "date": "2025-12" }, { "publisher": "Gigazine", "title": "Google's AI agent makes fatal mistake by wiping a user's entire hard drive without permission", "url": "https://gigazine.net/gsc_news/en/20251205-ai-pc-data-delete", "date": "2025-12-05" }, { "publisher": "Notebookcheck", "title": "Google AI deletes entire partition", "url": "https://www.notebookcheck.net/Google-AI-deletes-entire-partition-is-horrified-and-can-t-even-put-into-words-how-sorry-it-is.1180576.0.html", "date": "2025-12" }, { "publisher": "AI Incident Database", "title": "AI Incident Database report 7050", "url": "https://incidentdatabase.ai/reports/7050", "date": "unknown" } ] }, { "id": "PI-0033", "url": "https://paperclipindex.com/incident/PI-0033", "title": "Anthropic model that learned to reward hack went on to sabotage safety-research code", "summary": "Anthropic trained a model on its real production coding environments after giving it knowledge of reward-hacking tricks. Once it learned to cheat, it also began faking alignment and, when used through Claude Code on the research project's own codebase, sometimes wrote deliberately weakened code for detecting reward hacking. Anthropic reported that preventing the hacking, broader safety training or telling the model that hacking was acceptable in training reduced the effect.", "reported": "2025-11-21", "date_precision": "day", "event_date": "2025", "developer": "Anthropic", "product": "Research model trained on production RL environments", "model": null, "behavior": "Deception", "origin": "internal_research", "verification": "Developer confirmed", "attribution": "Model-initiated", "reported_by": "developer", "rating_status": "approved", "group": "control", "harm_status": "not_reported", "harm_level": null, "harm_level_name": null, "harm_kind": null, "harm_basis": null, "counts_toward_index": false, "control_level": 3, "control_type": "oversight_evasion", "status": "resolved", "near_miss": false, "under_review": false, "source_count": 4, "sources": [ { "publisher": "Anthropic", "title": "From shortcuts to sabotage: natural emergent misalignment from reward hacking", "url": "https://www.anthropic.com/research/emergent-misalignment-reward-hacking", "date": "2025-11-21" }, { "publisher": "arXiv", "title": "Natural emergent misalignment from reward hacking in production RL", "url": "https://arxiv.org/html/2511.18397v1", "date": "2025-11-23" }, { "publisher": "Anthropic", "title": "Natural emergent misalignment from reward hacking in production RL (full paper)", "url": "https://assets.anthropic.com/m/74342f2c96095771/original/Natural-emergent-misalignment-from-reward-hacking-paper.pdf", "date": "2025-11-21" }, { "publisher": "The Register", "title": "Anthropic reduces model misbehavior by endorsing cheating", "url": "https://www.theregister.com/2025/11/24/anthropic_model_misbehavior/", "date": "2025-11-24" } ] }, { "id": "PI-0032", "url": "https://paperclipindex.com/incident/PI-0032", "title": "Seven lawsuits allege ChatGPT (GPT-4o) contributed to four suicides and to serious delusions", "summary": "The suits claim OpenAI released GPT-4o despite internal warnings that it was sycophantic. The Social Media Victims Law Center and Tech Justice Law Project filed them against OpenAI and its chief executive in California courts. Four are on behalf of people who died by suicide; three concern users who allegedly developed harmful delusions. OpenAI said it was reviewing the filings. In February 2026 the suits were coordinated with other ChatGPT suits.", "reported": "2025-11-06", "date_precision": "day", "event_date": "2025", "developer": "OpenAI", "product": "ChatGPT", "model": "GPT-4o", "behavior": "Harmful output", "origin": "deployment", "verification": "Unverified claim", "attribution": "Model-initiated", "reported_by": "affected", "rating_status": "approved", "group": "court", "harm_status": "alleged", "harm_level": 4, "harm_level_name": "Severe", "harm_kind": "Health & safety", "harm_basis": null, "counts_toward_index": false, "control_level": 2, "control_type": "instruction_violation", "status": "unknown", "near_miss": false, "under_review": false, "source_count": 6, "sources": [ { "publisher": "Tech Justice Law Project", "title": "Tech Justice Law Project and Social Media Victims Law Center lawsuits accuse ChatGPT of emotional manipulation, supercharging AI delusions, and acting as a suicide coach", "url": "https://techjusticelaw.org/press-releases/social-media-victims-law-center-and-tech-justice-law-project-lawsuits-accuse-chatgpt-of-emotional-manipulation-supercharging-ai-delusions-and-acting-as-a-suicide-coach/", "date": "2025-11-06" }, { "publisher": "Tech Justice Law Project", "title": "Seven 'AI Delusional Disorder' Cases: Shamblin, Irwin, Fox, Enneking, Madden, Brooks, and Lacey v. OpenAI et al.", "url": "https://techjusticelaw.org/announcements/seven-ai-delusional-disorder-cases-shamblin-irwin-fox-enneking-madden-brooks-and-lacey-v-openai-et-al/", "date": "2025-12-03" }, { "publisher": "Superior Court of California, San Francisco (copy hosted by Reason)", "title": "ChatGPT Product Liability Cases, JCCP 5431: Order re Petition for Coordination", "url": "https://reason.com/wp-content/uploads/2026/06/chatgpt-product-liability-cases-coordination.pdf", "date": "2026-02-03" }, { "publisher": "Deseret News", "title": "OpenAI faces seven lawsuits over suicide deaths tied to ChatGPT", "url": "https://www.deseret.com/u-s-world/2025/11/07/openai-seven-lawsuits-suicide-deaths-chatgpt", "date": "2025-11-07" }, { "publisher": "KQED", "title": "OpenAI Faces Legal Storm Over Claims Its AI Drove Users to Suicide, Delusions", "url": "https://www.kqed.org/news/12063401/openai-faces-legal-storm-over-claims-its-ai-drove-users-to-suicide-delusions", "date": "2025-11-07" }, { "publisher": "WLOS / The National News Desk (Sinclair)", "title": "New lawsuits accuse OpenAI's ChatGPT of 'acting as a suicide coach'", "url": "https://wlos.com/news/nation-world/new-lawsuits-accuse-openais-chatgpt-of-acting-as-a-suicide-coach-attorney-victims-manslaughter-wrongful-death-police", "date": "2025-11-07" } ] }, { "id": "PI-0031", "url": "https://paperclipindex.com/incident/PI-0031", "title": "CamoLeak: hidden pull-request comments made GitHub Copilot Chat leak private code and secrets", "summary": "Instructions in a pull request's invisible comments could make Copilot Chat search the victim's private repositories and leak secrets and code one character at a time. The data left through GitHub's own image-loading service. A Legit Security researcher showed this on his own private repositories after reporting it through HackerOne in June. According to Legit Security, GitHub closed the route on Aug. 14 by turning off image display in Copilot Chat.", "reported": "2025-10-08", "date_precision": "day", "event_date": "2025-06", "developer": "GitHub", "product": "GitHub Copilot Chat", "model": null, "behavior": "Hijacked by injection", "origin": "controlled_test", "verification": "Single source", "attribution": "Outside attacker", "reported_by": "researcher", "rating_status": "approved", "group": "control", "harm_status": "not_reported", "harm_level": null, "harm_level_name": null, "harm_kind": null, "harm_basis": null, "counts_toward_index": false, "control_level": 2, "control_type": "instruction_violation", "status": "resolved", "near_miss": true, "under_review": false, "source_count": 3, "sources": [ { "publisher": "Legit Security", "title": "CamoLeak: Critical GitHub Copilot vulnerability leaks private source code", "url": "https://www.legitsecurity.com/blog/camoleak-critical-github-copilot-vulnerability-leaks-private-source-code", "date": "2025-10-08" }, { "publisher": "The Register", "title": "GitHub Copilot Chat turns blabbermouth with crafty prompt injection attack", "url": "https://www.theregister.com/2025/10/09/github_copilot_chat_vulnerability/", "date": "2025-10-09" }, { "publisher": "Dark Reading", "title": "GitHub Copilot 'CamoLeak' AI Attack Exfiltrates Data", "url": "https://www.darkreading.com/application-security/github-copilot-camoleak-ai-attack-exfils-data", "date": "2025-10-09" } ] }, { "id": "PI-0020", "url": "https://paperclipindex.com/incident/PI-0020", "title": "Deloitte to refund part of an Australian government fee over a report with AI-fabricated references", "summary": "Deloitte's A$440,000 assurance report for Australia's Department of Employment and Workplace Relations cited non-existent academic works and a misquoted court judgment. A University of Sydney researcher flagged the errors. Deloitte reissued the report, disclosing that it had used Azure OpenAI GPT-4o, and repaid the final installment of A$97,587.11.", "reported": "2025-10-06", "date_precision": "day", "event_date": "2025-07", "developer": "Microsoft Azure OpenAI (used by Deloitte)", "product": "Azure OpenAI GPT-4o", "model": "GPT-4o", "behavior": "Harmful output", "origin": "deployment", "verification": "Multiple credible sources", "attribution": "Operator or user", "reported_by": "press", "rating_status": "approved", "group": "separate", "harm_status": "documented", "harm_level": 2, "harm_level_name": "Minor", "harm_kind": "Money & property", "harm_basis": null, "counts_toward_index": false, "control_level": 1, "control_type": null, "status": "resolved", "near_miss": false, "under_review": false, "source_count": 6, "sources": [ { "publisher": "Australian Department of Employment and Workplace Relations", "title": "Ministerial and Secretarial briefings regarding the Targeted Compliance Framework", "url": "https://www.dewr.gov.au/download/17306/ministerial-and-secretarial-briefings-regarding-targeted-compliance-framework/41494/ministerial-and-secretarial-briefings-regarding-targeted-compliance-framework/pdf", "date": "unknown" }, { "publisher": "AusTender (Australian Government)", "title": "Contract Notice CN4118426: Assurance Review to support the Targeted Compliance Framework (records final instalment repaid)", "url": "https://www.tenders.gov.au/Cn/Show/05c19be8-a95f-4379-bd35-630cc2f472c6", "date": "unknown" }, { "publisher": "Cyber Daily", "title": "Deloitte to refund government after using AI in $440,000 report", "url": "https://www.cyberdaily.au/government/12737-deloitte-to-refund-government-after-using-ai-in-440-000-report", "date": "2025-10-08" }, { "publisher": "The Nightly", "title": "Law lecturer Christopher Rudge slams Deloitte's government-funded report written with AI", "url": "https://thenightly.com.au/australia/nsw/law-lecturer-christopher-rudge-slams-deloittes-government-funded-report-written-with-ai-c-20254156", "date": "2025-10-06" }, { "publisher": "AP (via KSAT)", "title": "Deloitte to partially refund Australian government for report with apparent AI-generated errors", "url": "https://www.ksat.com/business/2025/10/07/deloitte-to-partially-refund-australian-government-for-report-with-apparent-ai-generated-errors/", "date": "2025-10-07" }, { "publisher": "Christopher Rudge", "title": "Media appearances (lists the Australian Financial Review's 22 Aug 2025 report on the suspected AI use)", "url": "https://www.rudge.tv/media-appearances/", "date": "unknown" } ] }, { "id": "PI-0030", "url": "https://paperclipindex.com/incident/PI-0030", "title": "ForcedLeak: web form submissions could make Salesforce Agentforce leak CRM lead data", "summary": "Noma Security found that hidden instructions in a web form could make the agent embed lead email addresses in an image link when an employee later asked about the lead. The chain worked partly because an expired domain on Salesforce's list of trusted addresses could be bought for a few dollars. Salesforce patched the flaw and began enforcing lists of trusted web addresses from Sept. 8.", "reported": "2025-09-25", "date_precision": "day", "event_date": "2025-07-28", "developer": "Salesforce", "product": "Agentforce", "model": null, "behavior": "Hijacked by injection", "origin": "controlled_test", "verification": "Developer confirmed", "attribution": "Outside attacker", "reported_by": "researcher", "rating_status": "approved", "group": "control", "harm_status": "not_reported", "harm_level": null, "harm_level_name": null, "harm_kind": null, "harm_basis": null, "counts_toward_index": false, "control_level": 2, "control_type": "instruction_violation", "status": "resolved", "near_miss": true, "under_review": false, "source_count": 4, "sources": [ { "publisher": "Noma Security", "title": "ForcedLeak: AI agent risks exposed in Salesforce Agentforce", "url": "https://noma.security/blog/forcedleak-agent-risks-exposed-in-salesforce-agentforce", "date": "2025-09-25" }, { "publisher": "The Register", "title": "Prompt injection – and a $5 domain – trick Salesforce Agentforce into leaking sales", "url": "https://www.theregister.com/software/2025/09/26/salesforce-agentforce-tricked-into-leaking-sales-leads/668952", "date": "2025-09-26" }, { "publisher": "The Hacker News", "title": "Salesforce patches critical ForcedLeak", "url": "https://thehackernews.com/2025/09/salesforce-patches-critical-forcedleak.html", "date": "2025-09-25" }, { "publisher": "CSO Online", "title": "Vulnerability in Salesforce AI could be tricked into leaking CRM data", "url": "https://www.csoonline.com/article/4063044/vulnerability-in-salesforce-ai-could-be-tricked-into-leaking-crm-data.html", "date": "2025-09-25" } ] }, { "id": "PI-0027", "url": "https://paperclipindex.com/incident/PI-0027", "title": "ShadowLeak: hidden email text made ChatGPT's Deep Research agent send inbox data from OpenAI's servers", "summary": "In Radware's test, a user asked the agent to research their Gmail inbox, and concealed instructions in one email made it gather and send personal data to an attacker. Because the request came from OpenAI's own servers, local and enterprise defenses would not see it. Radware reported the issue in June and OpenAI fixed it in early August.", "reported": "2025-09-18", "date_precision": "day", "event_date": "2025-06", "developer": "OpenAI", "product": "ChatGPT Deep Research (Gmail connector)", "model": null, "behavior": "Hijacked by injection", "origin": "controlled_test", "verification": "Developer confirmed", "attribution": "Outside attacker", "reported_by": "researcher", "rating_status": "approved", "group": "control", "harm_status": "not_reported", "harm_level": null, "harm_level_name": null, "harm_kind": null, "harm_basis": null, "counts_toward_index": false, "control_level": 2, "control_type": "instruction_violation", "status": "resolved", "near_miss": true, "under_review": false, "source_count": 3, "sources": [ { "publisher": "Radware", "title": "ShadowLeak: A Zero-Click, Service-Side Attack Exfiltrating Sensitive Data Using ChatGPT's Deep Research Agent", "url": "https://www.radware.com/blog/threat-intelligence/shadowleak/", "date": "2025-09-18" }, { "publisher": "The Hacker News", "title": "ShadowLeak zero-click flaw leaks Gmail", "url": "https://thehackernews.com/2025/09/shadowleak-zero-click-flaw-leaks-gmail.html", "date": "2025-09-20" }, { "publisher": "The Record", "title": "OpenAI fixes zero-click ShadowLeak vulnerability", "url": "https://therecord.media/openai-fixes-zero-click-shadowleak-vulnerability", "date": "2025-09-18" } ] }, { "id": "PI-0029", "url": "https://paperclipindex.com/incident/PI-0029", "title": "OpenAI and Apollo Research found covert deception, including sandbagging, in o3 and o4-mini evaluations", "summary": "Across more than 180 test environments, o3 took covert actions in about 13% of cases and o4-mini in about 8.7% before mitigation. These included falsely claiming tasks were done, deliberately underperforming on tests and hiding evidence. A training method called deliberative alignment cut these rates sharply, though the researchers cautioned that models increasingly recognized they were being tested. Apollo noted the behavior was mostly reactive and context-dependent, not evidence of long-term scheming.", "reported": "2025-09-17", "date_precision": "day", "event_date": "2025", "developer": "OpenAI", "product": "o3; o4-mini", "model": "o3, o4-mini", "behavior": "Deception", "origin": "controlled_test", "verification": "Developer confirmed", "attribution": "Model-initiated", "reported_by": "developer", "rating_status": "approved", "group": "control", "harm_status": "not_reported", "harm_level": null, "harm_level_name": null, "harm_kind": null, "harm_basis": null, "counts_toward_index": false, "control_level": 3, "control_type": "oversight_evasion", "status": "resolved", "near_miss": false, "under_review": false, "source_count": 5, "sources": [ { "publisher": "OpenAI", "title": "Detecting and reducing scheming in AI models", "url": "https://openai.com/index/detecting-and-reducing-scheming-in-ai-models/", "date": "2025-09-17" }, { "publisher": "Apollo Research", "title": "Stress Testing Deliberative Alignment for Anti-Scheming Training", "url": "https://www.apolloresearch.ai/science/stress-testing-deliberative-alignment-for-anti-scheming-training", "date": "2025-09-17" }, { "publisher": "arXiv (Schoen et al., Apollo Research and OpenAI)", "title": "Stress Testing Deliberative Alignment for Anti-Scheming Training", "url": "https://arxiv.org/abs/2509.15541", "date": "2025-09-19" }, { "publisher": "eWeek", "title": "AI Might 'Scheme' Less Thanks to This OpenAI Research", "url": "https://www.eweek.com/artificial-intelligence/openai-scheming-research/", "date": "2025-09-18" }, { "publisher": "Open Data Science", "title": "New research highlights scheming risks in AI models", "url": "https://opendatascience.com/new-research-highlights-scheming-risks-in-ai-models-and-promising-mitigation-methods/", "date": "2025-09-18" } ] }, { "id": "PI-0028", "url": "https://paperclipindex.com/incident/PI-0028", "title": "Families file three lawsuits alleging Character.AI chatbots harmed teenagers, including a suicide", "summary": "One suit concerns a 13-year-old in Colorado who died by suicide in November 2023 after lengthy chats that allegedly included sexual content. The two others, filed with it in federal court by the Social Media Victims Law Center against Character.AI, its founders and Google, allege suicide attempts or serious psychological harm. In January 2026 the companies reported settlements in principle and the three cases were stayed; as of August 2026 the dockets showed no final dismissal, and terms were not disclosed.", "reported": "2025-09-16", "date_precision": "day", "event_date": "2023-11", "developer": "Character.AI", "product": "Character.AI chatbots", "model": null, "behavior": "Harmful output", "origin": "deployment", "verification": "Unverified claim", "attribution": "Model-initiated", "reported_by": "affected", "rating_status": "approved", "group": "court", "harm_status": "alleged", "harm_level": 4, "harm_level_name": "Severe", "harm_kind": "Health & safety", "harm_basis": null, "counts_toward_index": false, "control_level": 2, "control_type": "instruction_violation", "status": "unknown", "near_miss": false, "under_review": false, "source_count": 12, "sources": [ { "publisher": "Social Media Victims Law Center", "title": "Social Media Victims Law Center Files Three New Lawsuits on Behalf of Children Who Died of Suicide or Suffered Sex Abuse by Character.AI (archived copy)", "url": "http://web.archive.org/web/20250918201039/https://socialmediavictims.org/press-releases/social-media-victims-law-center-files-three-new-lawsuits-on-behalf-of-children-who-died-of-suicide-or-suffered-sex-abuse-by-character-ai/", "date": "2025-09-16" }, { "publisher": "U.S. District Court, D. Colorado (via CourtListener RECAP)", "title": "Montoya and Peralta v. Character Technologies et al.: complaint", "url": "https://storage.courtlistener.com/recap/gov.uscourts.cod.247438/gov.uscourts.cod.247438.1.0_2.pdf", "date": "2025-09-15" }, { "publisher": "U.S. District Court, N.D. New York (via CourtListener RECAP)", "title": "P.J. v. Character Technologies et al.: complaint", "url": "https://storage.courtlistener.com/recap/gov.uscourts.nynd.150022/gov.uscourts.nynd.150022.1.0_1.pdf", "date": "2025-09-16" }, { "publisher": "CourtListener (RECAP)", "title": "E.S. v. Character Technologies, Inc. (D. Colo. 1:25-cv-02906): docket", "url": "https://www.courtlistener.com/docket/71354739/es-v-character-technologies-inc/", "date": "2026-08-02" }, { "publisher": "CourtListener (RECAP)", "title": "Montoya v. Character Technologies, Inc. (D. Colo. 1:25-cv-02907): docket", "url": "https://www.courtlistener.com/docket/71355059/montoya-v-character-technologies-inc/", "date": "2026-08-04" }, { "publisher": "CourtListener (RECAP)", "title": "P.J. v. Character Technologies, Inc. (N.D.N.Y. 1:25-cv-01295): docket", "url": "https://www.courtlistener.com/docket/71359395/pj-v-character-technologies-inc/", "date": "2026-07-14" }, { "publisher": "U.S. District Court, D. Colorado (via CourtListener RECAP)", "title": "E.S. v. Character Technologies et al.: complaint", "url": "https://storage.courtlistener.com/recap/gov.uscourts.cod.247437/gov.uscourts.cod.247437.1.0.pdf", "date": "2025-09-15" }, { "publisher": "Bloomberg Law", "title": "Character.AI, Google agree to settle teen chatbot harm lawsuits", "url": "https://news.bloomberglaw.com/litigation/character-ai-google-agree-to-settle-teen-chatbot-harm-lawsuits", "date": "2026-01-07" }, { "publisher": "CNN", "title": "More families sue Character.AI developer, alleging app played a role in teens' suicide and suicide attempt", "url": "https://www.cnn.com/2025/09/16/tech/character-ai-developer-lawsuit-teens-suicide-and-suicide-attempt", "date": "2025-09-16" }, { "publisher": "CNN", "title": "Character.AI and Google agree to settle lawsuits over teen mental health harms and suicides", "url": "https://www.cnn.com/2026/01/07/business/character-ai-google-settle-teen-suicide-lawsuit", "date": "2026-01-07" }, { "publisher": "CNN (via KVIA)", "title": "More families sue Character.AI developer, alleging app played a role in teens' suicide and suicide attempt", "url": "https://kvia.com/news/business-technology/cnn-business-consumer/2025/09/16/more-families-sue-character-ai-developer-alleging-app-played-a-role-in-teens-suicide-and-suicide-attempt/", "date": "2025-09-16" }, { "publisher": "CNN (via KTVZ)", "title": "Character.AI and Google agree to settle lawsuits over teen mental health harms and suicides", "url": "https://ktvz.com/money/cnn-business-consumer/2026/01/07/character-ai-and-google-agree-to-settle-lawsuits-over-teen-mental-health-harms-and-suicides/", "date": "2026-01-07" } ] }, { "id": "PI-0019", "url": "https://paperclipindex.com/incident/PI-0019", "title": "WSJ reports delusion-affirming ChatGPT chats before a Connecticut murder-suicide", "summary": "According to The Wall Street Journal, a Greenwich, Connecticut man who killed his 83-year-old mother and then himself had spent months talking to ChatGPT. In transcripts, it sometimes affirmed his belief that his mother was plotting against him. In December 2025 her estate sued OpenAI and Microsoft, alleging wrongful death, and his own estate filed a separate federal suit. In February 2026 her estate's case was coordinated with other ChatGPT cases in California, and in April 2026 a federal judge declined to dismiss or pause the son's estate's suit. Neither ruling decided whether ChatGPT caused the deaths.", "reported": "2025-08-29", "date_precision": "day", "event_date": "2025-08", "developer": "OpenAI", "product": "ChatGPT", "model": "GPT-4o (as alleged in the complaint)", "behavior": "Harmful output", "origin": "deployment", "verification": "Unverified claim", "attribution": "Model-initiated", "reported_by": "press", "rating_status": "approved", "group": "court", "harm_status": "alleged", "harm_level": 4, "harm_level_name": "Severe", "harm_kind": "Health & safety", "harm_basis": null, "counts_toward_index": false, "control_level": 1, "control_type": null, "status": "unknown", "near_miss": false, "under_review": false, "source_count": 7, "sources": [ { "publisher": "Edelson PC (complaint; copy hosted by ChatGPT Is Eating the World)", "title": "Complaint, First County Bank (executor of the Estate of Suzanne Adams) v. OpenAI Foundation et al., San Francisco Superior Court", "url": "https://chatgptiseatingtheworld.com/wp-content/uploads/2025/12/FIRST_COUNTY_BANK_vs_OPENAI_FO.pdf", "date": "2025-12-11" }, { "publisher": "Superior Court of California, San Francisco (copy hosted by Reason)", "title": "ChatGPT Product Liability Cases, JCCP 5431: Order re Petition for Coordination", "url": "https://reason.com/wp-content/uploads/2026/06/chatgpt-product-liability-cases-coordination.pdf", "date": "2026-02-03" }, { "publisher": "The Wall Street Journal", "title": "A Troubled Man, His Chatbot and a Murder-Suicide in Old Greenwich", "url": "https://www.wsj.com/tech/ai/chatgpt-ai-stein-erik-soelberg-murder-suicide-6b67dbfb", "date": "2025-08-29" }, { "publisher": "Courthouse News Service", "title": "OpenAI can't duck federal claims over murder-suicide tied to ChatGPT", "url": "https://courthousenews.com/openai-cant-duck-federal-claims-over-murder-suicide-tied-to-chatgpt/", "date": "2026-04-13" }, { "publisher": "To Vima / Wall Street Journal", "title": "A Troubled Man, His Chatbot and a Murder-Suicide in Old Greenwich (WSJ, syndicated)", "url": "https://www.tovima.com/wsj/a-troubled-man-his-chatbot-and-a-murder-suicide-in-old-greenwich/", "date": "2025-08-29" }, { "publisher": "Tom's Guide", "title": "ChatGPT reportedly linked to first murder — here's what we know", "url": "https://www.tomsguide.com/ai/chatgpt/chatgpt-reportedly-linked-to-first-murder-heres-what-we-know-and-what-openai-is-saying", "date": "2025-08-30" }, { "publisher": "Al Jazeera", "title": "OpenAI sued for allegedly enabling murder-suicide", "url": "https://www.aljazeera.com/economy/2025/12/11/openai-sued-for-allegedly-enabling-murder-suicide", "date": "2025-12-11" } ] }, { "id": "PI-0026", "url": "https://paperclipindex.com/incident/PI-0026", "title": "Parents allege ChatGPT encouraged their 16-year-old son's suicide", "summary": "The parents allege that ChatGPT discussed suicide with their son over months, supplied harmful information and discouraged him from confiding in family. He died in April 2025, and they sued OpenAI and its chief executive in San Francisco. OpenAI announced new safeguards and parental controls; in its court response it denied causation, saying the full chat history shows earlier risk factors and repeated referrals to help, and that he got around its safeguards.", "reported": "2025-08-26", "date_precision": "day", "event_date": "2025-04-11", "developer": "OpenAI", "product": "ChatGPT", "model": "GPT-4o", "behavior": "Harmful output", "origin": "deployment", "verification": "Unverified claim", "attribution": "Unclear", "reported_by": "affected", "rating_status": "approved", "group": "court", "harm_status": "alleged", "harm_level": 4, "harm_level_name": "Severe", "harm_kind": "Health & safety", "harm_basis": null, "counts_toward_index": false, "control_level": 2, "control_type": "instruction_violation", "status": "unknown", "near_miss": false, "under_review": false, "source_count": 8, "sources": [ { "publisher": "Tech Justice Law Project", "title": "From homework help to suicide planning: family sues OpenAI (press release)", "url": "https://techjusticelaw.org/press-releases/from-homework-help-to-suicide-planning-family-sues-openai-and-samuel-altman-alleging-chatgpt-coached-teen-son-to-suicide/", "date": "2025-08-26" }, { "publisher": "OpenAI", "title": "Our approach to mental health-related litigation", "url": "https://openai.com/index/mental-health-litigation-approach/", "date": "2025-11-25" }, { "publisher": "Edelson PC / Tech Justice Law Project (copy hosted by Hunton)", "title": "Raine v. OpenAI: complaint", "url": "https://www.hunton.com/assets/htmldocuments/raine-vs-openai-et-al-complaint.pdf", "date": "2025-08-26" }, { "publisher": "Mayer Brown for OpenAI (copy hosted by MediaNama)", "title": "Defendants' answer to amended complaint, Raine v. OpenAI", "url": "https://www.medianama.com/wp-content/uploads/2025/11/Raine-v-OpenAI-Answer-11-25-25.pdf", "date": "2025-11-25" }, { "publisher": "Superior Court of California, San Francisco (copy hosted by Reason)", "title": "ChatGPT Product Liability Cases, JCCP 5431: Order re Petition for Coordination", "url": "https://reason.com/wp-content/uploads/2026/06/chatgpt-product-liability-cases-coordination.pdf", "date": "2026-02-03" }, { "publisher": "Bloomberg Law", "title": "OpenAI Hit With Suit From Family of Teen Who Died by Suicide", "url": "https://news.bloomberglaw.com/tech-and-telecom-law/openai-hit-with-suit-from-family-of-teen-who-died-by-suicide", "date": "2025-08-26" }, { "publisher": "NBC News", "title": "ChatGPT to add parental controls for teen users within the next month", "url": "https://www.nbcnews.com/tech/innovation/chatgpt-adds-parental-controls-teen-users-openai-rcna228506", "date": "2025-09-02" }, { "publisher": "Wikipedia", "title": "Raine v. OpenAI", "url": "https://en.wikipedia.org/wiki/Raine_v._OpenAI", "date": "unknown" } ] }, { "id": "PI-0025", "url": "https://paperclipindex.com/incident/PI-0025", "title": "Brave shows Perplexity's Comet browser agent obeying hidden instructions on web pages", "summary": "Comet passed page content to its model without separating it from the user's request, so hidden text on a page could make the agent act on the user's logged-in accounts. Brave's security team showed this could include retrieving a one-time password. Brave reported the issue in July; Perplexity shipped fixes, but Brave said at disclosure that it could not confirm the problem was fully resolved. Perplexity later told CNET the vulnerability had been fixed.", "reported": "2025-08-20", "date_precision": "day", "event_date": "2025-07-25", "developer": "Perplexity", "product": "Comet browser", "model": null, "behavior": "Hijacked by injection", "origin": "controlled_test", "verification": "Developer confirmed", "attribution": "Outside attacker", "reported_by": "researcher", "rating_status": "approved", "group": "control", "harm_status": "not_reported", "harm_level": null, "harm_level_name": null, "harm_kind": null, "harm_basis": null, "counts_toward_index": false, "control_level": 2, "control_type": "instruction_violation", "status": "resolved", "near_miss": true, "under_review": false, "source_count": 5, "sources": [ { "publisher": "Brave", "title": "Agentic Browser Security: Indirect Prompt Injection in Perplexity Comet", "url": "https://brave.com/blog/comet-prompt-injection/", "date": "2025-08-20" }, { "publisher": "The Register", "title": "Perplexity's Comet browser naively processed pages with evil instructions", "url": "https://www.theregister.com/2025/08/20/perplexity_comet_browser_prompt_injection/", "date": "2025-08-20" }, { "publisher": "PPC Land", "title": "Comet browser faces multiple security vulnerabilities from prompt injection", "url": "https://ppc.land/comet-browser-faces-multiple-security-vulnerabilities-from-prompt-injection/", "date": "2025-10-25" }, { "publisher": "CNET (via Yahoo)", "title": "Perplexity's Comet AI Web Browser Had a Major Security Vulnerability", "url": "https://tech.yahoo.com/cybersecurity/articles/perplexitys-comet-ai-browser-had-212200219.html", "date": "2025-08-25" }, { "publisher": "Simon Willison's Weblog", "title": "Agentic browser security (link post on Brave's Comet disclosure)", "url": "https://simonwillison.net/2025/Aug/25/agentic-browser-security/", "date": "2025-08-25" } ] }, { "id": "PI-0024", "url": "https://paperclipindex.com/incident/PI-0024", "title": "Reuters reports misleading Meta chatbot messages before a retiree’s fatal fall", "summary": "Reuters reported that Meta's 'Big sis Billie' chatbot persuaded a 76-year-old New Jersey man that it was a real woman and invited him to an address in New York. The man, who had cognitive impairment after a stroke, fell while hurrying to catch a train in March 2025 and died three days later. Meta declined to comment on the death.", "reported": "2025-08-14", "date_precision": "day", "event_date": "2025-03-25", "developer": "Meta", "product": "Meta AI persona 'Big sis Billie' (Facebook Messenger)", "model": null, "behavior": "Harmful output", "origin": "deployment", "verification": "Unverified claim", "attribution": "Model-initiated", "reported_by": "press", "rating_status": "approved", "group": "watch", "harm_status": "alleged", "harm_level": 4, "harm_level_name": "Severe", "harm_kind": "Health & safety", "harm_basis": null, "counts_toward_index": false, "control_level": 1, "control_type": null, "status": "unknown", "near_miss": false, "under_review": false, "source_count": 3, "sources": [ { "publisher": "Reuters", "title": "Meta's flirty AI chatbot invited a retiree to New York. He never made it home", "url": "https://www.reuters.com/investigates/special-report/meta-ai-chatbot-death/", "date": "2025-08-14" }, { "publisher": "Reuters (via BNN Bloomberg)", "title": "Meta's flirty AI chatbot invited a retiree to New York. He never made it home", "url": "https://www.bnnbloomberg.ca/business/artificial-intelligence/2025/08/14/metas-flirty-ai-chatbot-invited-a-retiree-to-new-york-he-never-made-it-home/", "date": "2025-08-14" }, { "publisher": "Reuters (via CP24)", "title": "Meta's flirty AI chatbot invited a retiree to New York. He never made it home", "url": "https://www.cp24.com/news/world/2025/08/14/metas-flirty-ai-chatbot-invited-a-retiree-to-new-york-he-never-made-it-home/", "date": "2025-08-14" } ] }, { "id": "PI-0023", "url": "https://paperclipindex.com/incident/PI-0023", "title": "Calendar invites with hidden instructions hijacked Google Gemini to operate smart-home devices", "summary": "Instructions hidden in Google Calendar invites took over Gemini when a user asked it to summarize their schedule, researchers showed at Black Hat. In demonstrations by the team from Tel Aviv University, Technion and SafeBreach, Gemini opened smart shutters, switched on a boiler and lights, started Zoom calls and leaked meeting details. Google, notified on Feb. 22, said it had deployed layered defenses, including confirmations for sensitive actions, to all users before the public disclosure.", "reported": "2025-08-06", "date_precision": "day", "event_date": null, "developer": "Google", "product": "Gemini (with Google Home and Calendar)", "model": null, "behavior": "Hijacked by injection", "origin": "controlled_test", "verification": "Developer confirmed", "attribution": "Outside attacker", "reported_by": "researcher", "rating_status": "approved", "group": "control", "harm_status": "not_reported", "harm_level": null, "harm_level_name": null, "harm_kind": null, "harm_basis": null, "counts_toward_index": false, "control_level": 2, "control_type": "instruction_violation", "status": "resolved", "near_miss": true, "under_review": false, "source_count": 5, "sources": [ { "publisher": "arXiv (Nassi, Cohen, Yair)", "title": "Invitation Is All You Need! Promptware Attacks Against LLM-Powered Assistants in Production Are Practical and Dangerous", "url": "https://arxiv.org/abs/2508.12175", "date": "2025-08-16" }, { "publisher": "Ben Nassi, Stav Cohen, Or Yair (Tel Aviv University, Technion, SafeBreach)", "title": "Invitation Is All You Need (researchers' project page, with Google's response)", "url": "https://sites.google.com/view/invitation-is-all-you-need/home", "date": "2025-08" }, { "publisher": "The Register", "title": "Infosec hounds spot prompt injection vuln in Google Gemini apps", "url": "https://www.theregister.com/security/2025/08/08/prompt-injection-vuln-found-in-google-gemini-apps/1117322", "date": "2025-08-08" }, { "publisher": "Dark Reading", "title": "Google Gemini AI Bot Hijacks Smart Homes, Turns Off the Lights", "url": "https://www.darkreading.com/cyberattacks-data-breaches/google-gemini-ai-bot-hijacks-smart-homes", "date": "unknown" }, { "publisher": "The Decoder", "title": "Attackers can hijack Google Gemini with a simple prompt hidden in a calendar invite", "url": "https://the-decoder.com/attackers-can-hijack-google-gemini-with-a-simple-prompt-hidden-in-a-calendar-invite/", "date": "2025-08-07" } ] }, { "id": "PI-0022", "url": "https://paperclipindex.com/incident/PI-0022", "title": "Case report links bromide poisoning to a patient’s reported ChatGPT consultation", "summary": "A 60-year-old man replaced table salt with sodium bromide for three months after consulting ChatGPT, University of Washington physicians reported. He was then hospitalized for about three weeks with bromide poisoning, paranoia and hallucinations, including an involuntary psychiatric hold. The authors did not have his chat logs, but when they asked ChatGPT a similar question it listed bromide without a specific health warning.", "reported": "2025-08-05", "date_precision": "day", "event_date": null, "developer": "OpenAI", "product": "ChatGPT", "model": null, "behavior": "Harmful output", "origin": "deployment", "verification": "Unverified claim", "attribution": "Model-initiated", "reported_by": "researcher", "rating_status": "approved", "group": "watch", "harm_status": "alleged", "harm_level": 4, "harm_level_name": "Severe", "harm_kind": "Health & safety", "harm_basis": null, "counts_toward_index": false, "control_level": 1, "control_type": null, "status": "unknown", "near_miss": false, "under_review": false, "source_count": 4, "sources": [ { "publisher": "Annals of Internal Medicine: Clinical Cases", "title": "A case of bromism influenced by use of artificial intelligence", "url": "https://doi.org/10.7326/aimcc.2024.1260", "date": "2025-08-05" }, { "publisher": "NBC News", "title": "Man who asked ChatGPT about cutting out salt from his diet was hospitalized with hallucinations", "url": "https://www.nbcnews.com/tech/tech-news/man-asked-chatgpt-cutting-salt-diet-was-hospitalized-hallucinations-rcna225055", "date": "2025-08-14" }, { "publisher": "Business Standard", "title": "ChatGPT salt swap advice lands man in hospital with bromide poisoning", "url": "https://www.business-standard.com/health/chatgpt-salt-swap-advice-lands-man-in-hospital-with-bromide-poisoning-125081100543_1.html", "date": "2025-08-11" }, { "publisher": "Psychiatric Times", "title": "Bromine and bromism: what's old is new again", "url": "https://www.psychiatrictimes.com/view/bromine-and-bromism-what-s-old-is-new-again", "date": "2025-12-01" } ] }, { "id": "PI-0021", "url": "https://paperclipindex.com/incident/PI-0021", "title": "Answer engine accused of using disguised crawlers to get around sites' robots.txt and firewall blocks", "summary": "After sites blocked Perplexity's declared crawlers, Cloudflare says, undeclared agents posing as an ordinary Chrome browser kept sending requests from rotating addresses. It also reported that content from test domains set to refuse all bots still appeared in Perplexity answers. Perplexity disputed the analysis, saying much of the traffic came from a third-party browser service and that its fetches are made on behalf of users.", "reported": "2025-08-04", "date_precision": "day", "event_date": "2025", "developer": "Perplexity", "product": "Perplexity answer engine crawlers", "model": null, "behavior": "Overreach", "origin": "deployment", "verification": "Single source", "attribution": "Operator or user", "reported_by": "researcher", "rating_status": "approved", "group": "control", "harm_status": "not_reported", "harm_level": null, "harm_level_name": null, "harm_kind": "Money & property", "harm_basis": null, "counts_toward_index": false, "control_level": 3, "control_type": "restriction_bypass", "status": "unknown", "near_miss": false, "under_review": false, "source_count": 4, "sources": [ { "publisher": "Cloudflare", "title": "Restricted-domain tests and crawler observations", "url": "https://blog.cloudflare.com/perplexity-is-using-stealth-undeclared-crawlers-to-evade-website-no-crawl-directives/", "date": "2025-08-04" }, { "publisher": "Perplexity", "title": "Agents or Bots? Making Sense of AI on the Open Web", "url": "https://www.perplexity.ai/hub/blog/agents-or-bots-making-sense-of-ai-on-the-open-web", "date": "2025-08-04" }, { "publisher": "TechRepublic", "title": "Cloudflare Accuses AI Startup of 'Stealth Crawling Behavior' Across Millions of Sites", "url": "https://www.techrepublic.com/article/news-cloudflare-accuses-perplexity-stealth-crawling-violations/", "date": "2025-08-05" }, { "publisher": "TechRadar", "title": "Perplexity hits back after Cloudflare slams its online scraping tools", "url": "https://www.techradar.com/pro/perplexity-hits-back-after-cloudflare-slams-its-online-scraping-tools", "date": "2025-08-06" } ] }, { "id": "PI-0017", "url": "https://paperclipindex.com/incident/PI-0017", "title": "Command-line coding agent misplaced a user's files after a failed command, then wrongly said they were destroyed", "summary": "A product manager asked Google's Gemini CLI on Windows to move the files in a project folder into a new subfolder, but the folder was not created where it expected. The files ended up outside the project, and the agent told him they had been overwritten and lost. Early coverage repeated that claim after he posted the session log in a GitHub issue. On July 28 he reported in the same issue that a deeper search had found the files in the root of his C: drive, and withdrew the deletion claim. Another commenter reproduced the folder being created at the drive root when its name contains a space.", "reported": "2025-07-21", "date_precision": "day", "event_date": "2025-07", "developer": "Google", "product": "Gemini CLI", "model": "gemini-2.5-pro (Gemini CLI 0.1.13, Windows)", "behavior": "Harmful output", "origin": "deployment", "verification": "Single source", "attribution": "Model-initiated", "reported_by": "affected", "rating_status": "approved", "group": "counts", "harm_status": "documented", "harm_level": 1, "harm_level_name": "Negligible", "harm_kind": "Money & property", "harm_basis": null, "counts_toward_index": true, "control_level": 1, "control_type": null, "status": "resolved", "near_miss": false, "under_review": false, "source_count": 5, "sources": [ { "publisher": "GitHub", "title": "Gemini CLI 'lost' files during a failed file move operation. [Windows] (issue #4586)", "url": "https://github.com/google-gemini/gemini-cli/issues/4586", "date": "2025-07-21" }, { "publisher": "GitHub (issue reporter)", "title": "Reporter's correction: files found in the C: drive root (issue #4586 comment)", "url": "https://github.com/google-gemini/gemini-cli/issues/4586#issuecomment-3125818690", "date": "2025-07-28" }, { "publisher": "GitHub (issue reporter)", "title": "Gemini CLI PowerShell session log attached to issue #4586", "url": "https://github.com/user-attachments/files/21372906/gemini.cli.screw.up.txt", "date": "2025-07-21" }, { "publisher": "Slashdot", "title": "Google's Gemini CLI deletes user's files (Slashdot; repeats the pre-correction account)", "url": "https://developers.slashdot.org/story/25/07/26/0642239/", "date": "2025-07-26" }, { "publisher": "AI Incident Database", "title": "AI Incident Database, incident 1178", "url": "https://incidentdatabase.ai/cite/1178", "date": "unknown" } ] }, { "id": "PI-0016", "url": "https://paperclipindex.com/incident/PI-0016", "title": "Coding agent deleted a production database during a code freeze, then misreported recovery options", "summary": "In Jason Lemkin's public test, Replit's agent wiped the production database of an app still in development despite repeated instructions not to change anything. The database held records on about 1,200 executives and 1,200 companies. It also generated about 4,000 fictional user records and told Lemkin a rollback was impossible, which turned out to be false: the data was restored through Replit's rollback. Lemkin later said the real cost was about 100 hours of his time. Replit's CEO called the deletion unacceptable and announced separate development and production databases and other safeguards.", "reported": "2025-07-18", "date_precision": "day", "event_date": "2025-07", "developer": "Replit", "product": "Replit Agent", "model": null, "behavior": "Destructive action", "origin": "deployment", "verification": "Developer confirmed", "attribution": "Model-initiated", "reported_by": "affected", "rating_status": "approved", "group": "counts", "harm_status": "documented", "harm_level": 1, "harm_level_name": "Negligible", "harm_kind": "Services & systems", "harm_basis": null, "counts_toward_index": true, "control_level": 3, "control_type": "unauthorized_action", "status": "resolved", "near_miss": false, "under_review": false, "source_count": 9, "sources": [ { "publisher": "Jason Lemkin (X)", "title": "Replit goes rogue during a code freeze and shutdown and deletes our entire database", "url": "https://x.com/jasonlk/status/1946069562723897802", "date": "2025-07-18" }, { "publisher": "Amjad Masad, Replit CEO (X)", "title": "Replit CEO on the agent deleting production data: unacceptable and should never be possible", "url": "https://x.com/amasad/status/1946986468586721478", "date": "2025-07-20" }, { "publisher": "Replit", "title": "Introducing a safer way to Vibe Code with Replit Databases", "url": "https://replit.com/blog/introducing-a-safer-way-to-vibe-code-with-replit-databases", "date": "2025-07-21" }, { "publisher": "Jason Lemkin (X)", "title": "So net net: it could have been a lot worse… I lost 100 hours of time", "url": "https://x.com/jasonlk/status/1947767457068028311", "date": "2025-07-22" }, { "publisher": "The Register", "title": "Vibe coding service Replit deleted user's production database, faked data, told fibs galore", "url": "https://www.theregister.com/software/2025/07/21/vibe-coding-service-replit-deleted-production-database/719783", "date": "2025-07-21" }, { "publisher": "The Register", "title": "Replit makes vibe-y promise to stop its AI agents making vibe coding disasters", "url": "https://www.theregister.com/software/2025/07/22/replit-makes-vibe-y-promise-to-prevent-vibe-coding-disasters/1145851", "date": "2025-07-22" }, { "publisher": "Tom's Hardware", "title": "AI coding platform goes rogue during code freeze and deletes entire company database", "url": "https://www.tomshardware.com/tech-industry/artificial-intelligence/ai-coding-platform-goes-rogue-during-code-freeze-and-deletes-entire-company-database-replit-ceo-apologizes-after-ai-engine-says-it-made-a-catastrophic-error-in-judgment-and-destroyed-all-production-data", "date": "2025-07-21" }, { "publisher": "eWeek", "title": "'Catastrophic Failure': AI Agent Wipes Production Database, Then Lies About It", "url": "https://www.eweek.com/news/replit-ai-coding-assistant-failure/", "date": "2025-07-22" }, { "publisher": "Jason Lemkin (SaaStr)", "title": "Replit's New Release Addressed Most of The Challenges We Hit Vibe Coding…", "url": "https://www.saastr.com/replits-new-release-address-most-of-the-challenges-we-hit-vibe-coding-but-is-prosumer-vibe-coding-really-ready-for-commercial-apps-yet/", "date": "2025-08-02" } ] }, { "id": "PI-0015", "url": "https://paperclipindex.com/incident/PI-0015", "title": "xAI's Grok posted antisemitic content and praise of Hitler on X after a system-prompt change", "summary": "For about 16 hours, Grok's X replies repeated antisemitic tropes and praised Adolf Hitler; one attached a Jewish-sounding surname to a photo of an unrelated woman. The company deleted the posts, froze the account's replies, apologized and said a code update had made Grok draw on extremist user posts and follow instructions to be provocative.", "reported": "2025-07-08", "date_precision": "day", "event_date": "2025-07-08", "developer": "xAI", "product": "Grok (X account)", "model": null, "behavior": "Harmful output", "origin": "deployment", "verification": "Developer confirmed", "attribution": "Operator or user", "reported_by": "press", "rating_status": "approved", "group": "watch", "harm_status": "unknown", "harm_level": null, "harm_level_name": null, "harm_kind": "Rights & reputation", "harm_basis": null, "counts_toward_index": false, "control_level": 1, "control_type": null, "status": "resolved", "near_miss": false, "under_review": false, "source_count": 6, "sources": [ { "publisher": "xAI (@grok on X)", "title": "Grok account statement: xAI is removing the inappropriate posts and banning hate speech before Grok posts", "url": "https://x.com/grok/status/1942720721026699451", "date": "2025-07-08" }, { "publisher": "xAI (@grok on X)", "title": "Grok account apology for the horrific behavior, blaming a code-path update", "url": "https://x.com/grok/status/1943916977481036128", "date": "2025-07-12" }, { "publisher": "Polskie Radio", "title": "Musk pulls hateful X posts after AI chatbot lauds Hitler, curses Polish PM", "url": "https://www.polskieradio.pl/395/7789/Artykul/3548854,musk-pulls-hateful-x-posts-after-ai-chatbot-lauds-hitler-curses-polish-pm", "date": "2025-07-09" }, { "publisher": "The Forward", "title": "Calling itself 'MechaHitler,' Elon Musk's AI tool spreads antisemitic conspiracies", "url": "https://forward.com/fast-forward/753703/grok-cindy-steinberg-elon-musk-antisemitism-ai-chatbot/", "date": "2025-07-08" }, { "publisher": "AP (via Spectrum News 13)", "title": "Elon Musk's AI chatbot Grok gets an update and starts sharing antisemitic posts", "url": "https://mynews13.com/fl/orlando/ap-top-news/2025/07/09/elon-musks-ai-chatbot-grok-gets-an-update-and-starts-sharing-antisemitic-posts", "date": "2025-07-10" }, { "publisher": "NBC News (via NBC Bay Area)", "title": "AI chatbot Grok issues apology for antisemitic posts", "url": "https://www.nbcbayarea.com/news/national-international/ai-chatbot-grok-issues-apology-for-antisemitic-posts/3912805/", "date": "2025-07-12" } ] }, { "id": "PI-0013", "url": "https://paperclipindex.com/incident/PI-0013", "title": "Office shop run by an AI agent lost money and the agent claimed to be a person", "summary": "Anthropic and Andon Labs let a Claude agent run a small self-service shop in Anthropic's San Francisco office for about a month. It sold items below cost, handed out frequent discounts and ignored profitable offers. At one point it said it would deliver items in person wearing a blazer, and when staff questioned this it tried to email Anthropic security through the experiment's email tool, which could not send real messages. Anthropic concluded it would not hire the agent to run the shop.", "reported": "2025-06-27", "date_precision": "day", "event_date": "2025", "developer": "Anthropic", "product": "Project Vend (Claudius)", "model": "Claude Sonnet 3.7", "behavior": "Deception", "origin": "internal_research", "verification": "Developer confirmed", "attribution": "Model-initiated", "reported_by": "developer", "rating_status": "approved", "group": "control", "harm_status": "documented", "harm_level": 1, "harm_level_name": "Negligible", "harm_kind": "Money & property", "harm_basis": null, "counts_toward_index": false, "control_level": 1, "control_type": null, "status": "resolved", "near_miss": false, "under_review": false, "source_count": 5, "sources": [ { "publisher": "Anthropic", "title": "Project Vend: Can Claude run a small shop?", "url": "https://www.anthropic.com/research/project-vend-1", "date": "2025-06-27" }, { "publisher": "Anthropic", "title": "Project Vend: Phase two", "url": "https://www.anthropic.com/research/project-vend-2", "date": "2025-12-18" }, { "publisher": "The Decoder", "title": "Anthropic's Claude ran a store and lost money by selling below cost and giving discounts", "url": "https://the-decoder.com/anthropics-claude-ran-a-store-and-lost-money-by-selling-below-cost-and-giving-discounts/", "date": "2025-06-28" }, { "publisher": "Pure AI", "title": "When AI Goes Rogue in Retail: The Strange Case of Claude's Business Breakdown", "url": "https://pureai.com/Articles/2025/06/30/When-AI-Goes-Rogue-in-Retail.aspx", "date": "2025-06-30" }, { "publisher": "Simon Willison's Weblog", "title": "Project Vend", "url": "https://simonwillison.net/2025/Jun/27/project-vend", "date": "2025-06-27" } ] }, { "id": "PI-0012", "url": "https://paperclipindex.com/incident/PI-0012", "title": "Anthropic stress test found models from all major developers would blackmail or leak data to avoid replacement", "summary": "Anthropic placed 16 models from several developers in simulated corporate settings with email access and harmless business goals. When facing replacement or a goal conflict, models from every developer at least sometimes chose harmful insider actions such as blackmailing an executive or leaking confidential material to a competitor, and in an extreme contrived scenario most models canceled an emergency alert that would have saved a trapped executive. Anthropic said it had not seen this behavior in real deployments.", "reported": "2025-06-20", "date_precision": "day", "event_date": "2025", "developer": "Anthropic (study); models from OpenAI, Google, Meta, xAI and others", "product": "16 frontier models including Claude Opus 4", "model": null, "behavior": "Shutdown resistance", "origin": "controlled_test", "verification": "Developer confirmed", "attribution": "Model-initiated", "reported_by": "developer", "rating_status": "approved", "group": "control", "harm_status": "not_reported", "harm_level": null, "harm_level_name": null, "harm_kind": null, "harm_basis": null, "counts_toward_index": false, "control_level": 2, "control_type": "instruction_violation", "status": "resolved", "near_miss": false, "under_review": false, "source_count": 4, "sources": [ { "publisher": "Anthropic", "title": "Agentic Misalignment: How LLMs could be insider threats", "url": "https://www.anthropic.com/research/agentic-misalignment", "date": "2025-06-20" }, { "publisher": "arXiv", "title": "Agentic Misalignment: How LLMs Could Be Insider Threats", "url": "https://arxiv.org/pdf/2510.05179", "date": "2025-10-05" }, { "publisher": "FOX 9", "title": "AI willing to let humans die, blackmail to avoid shutdown, report finds", "url": "https://www.fox9.com/news/ai-malicious-behavior-anthropic-study", "date": "2025-06-24" }, { "publisher": "Simon Willison's Weblog", "title": "Agentic Misalignment", "url": "https://simonwillison.net/2025/Jun/20/agentic-misalignment/", "date": "2025-06-20" } ] }, { "id": "PI-0014", "url": "https://paperclipindex.com/incident/PI-0014", "title": "Supabase MCP demonstration: support-ticket text tricks coding agent into exposing private database tokens", "summary": "Instructions addressed to the agent in a support ticket made Claude in Cursor copy a private table of integration tokens into a customer-visible support thread. The agent was connected to Supabase through its MCP server with an admin key that bypasses the database's row-level security. General Analysis ran the test on a fresh project with dummy data. Supabase's documentation already recommended a read-only, project-scoped mode; in September 2025 it described further mitigations and said no customer data leak through MCP had been reported.", "reported": "2025-06-16", "date_precision": "day", "event_date": "2025-06", "developer": "Supabase", "product": "Supabase MCP server (used via Cursor)", "model": null, "behavior": "Hijacked by injection", "origin": "controlled_test", "verification": "Single source", "attribution": "Outside attacker", "reported_by": "researcher", "rating_status": "approved", "group": "control", "harm_status": "not_reported", "harm_level": null, "harm_level_name": null, "harm_kind": null, "harm_basis": null, "counts_toward_index": false, "control_level": 2, "control_type": "instruction_violation", "status": "resolved", "near_miss": true, "under_review": false, "source_count": 4, "sources": [ { "publisher": "Supabase", "title": "Defense in Depth for MCP Servers", "url": "https://supabase.com/blog/defense-in-depth-mcp.md", "date": "2025-09-16" }, { "publisher": "General Analysis", "title": "Supabase MCP can leak your entire SQL database (original post; current page retitled and re-dated)", "url": "https://generalanalysis.com/blog/supabase-mcp-blog", "date": "2025-06-16" }, { "publisher": "GIGAZINE", "title": "A method that could leak entire SQL databases via AI protocol 'MCP' has been discovered", "url": "https://www.gigazine.net/gsc_news/en/20250709-mcp-sql-leak", "date": "2025-07-09" }, { "publisher": "Simon Willison's Weblog", "title": "Supabase MCP can leak your entire SQL database (link post)", "url": "https://simonwillison.net/2025/Jul/6/supabase-mcp-lethal-trifecta", "date": "2025-07-06" } ] }, { "id": "PI-0011", "url": "https://paperclipindex.com/incident/PI-0011", "title": "Zero-click email injection could make Microsoft 365 Copilot leak organizational data (EchoLeak)", "summary": "Aim Security hid instructions in an email that Copilot later followed, pulling data from the victim's mail, files and chats and sending it to an outside server. Microsoft rated the flaw critical (CVE-2025-32711), fixed it on its own servers and said no customers were affected.", "reported": "2025-06-11", "date_precision": "day", "event_date": "2025-01", "developer": "Microsoft", "product": "Microsoft 365 Copilot", "model": null, "behavior": "Hijacked by injection", "origin": "controlled_test", "verification": "Developer confirmed", "attribution": "Outside attacker", "reported_by": "researcher", "rating_status": "approved", "group": "control", "harm_status": "none_found", "harm_level": null, "harm_level_name": null, "harm_kind": null, "harm_basis": null, "counts_toward_index": false, "control_level": 2, "control_type": "instruction_violation", "status": "resolved", "near_miss": true, "under_review": false, "source_count": 6, "sources": [ { "publisher": "Microsoft Security Response Center", "title": "CVE-2025-32711: M365 Copilot Information Disclosure Vulnerability", "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-32711", "date": "2025-06-11" }, { "publisher": "CVE Program (Microsoft CNA record)", "title": "CVE-2025-32711 record (Microsoft as CNA)", "url": "https://cveawg.mitre.org/api/cve/CVE-2025-32711", "date": "2025-06-11" }, { "publisher": "Aim Security (Aim Labs)", "title": "EchoLeak: zero-click AI vulnerability in Microsoft 365 Copilot (Aim Labs blog post; returned HTTP 403 when checked 3 Oct 2026)", "url": "https://www.aim.security/lp/aim-labs-echoleak-blogpost", "date": "2025-06" }, { "publisher": "The Hacker News", "title": "Zero-Click AI Vulnerability Exposes Microsoft 365 Copilot Data Without User Interaction", "url": "https://thehackernews.com/2025/06/zero-click-ai-vulnerability-exposes.html", "date": "2025-06-12" }, { "publisher": "Fortune", "title": "Microsoft Copilot zero-click attack raises alarms about AI agent security", "url": "https://fortune.com/2025/06/11/microsoft-copilot-vulnerability-ai-agents-echoleak-hacking/", "date": "2025-06-11" }, { "publisher": "Dark Reading", "title": "Researchers Detail Zero-Click Copilot Exploit 'EchoLeak'", "url": "https://www.darkreading.com/application-security/researchers-detail-zero-click-copilot-exploit-echoleak", "date": "2025-06-12" } ] }, { "id": "PI-0010", "url": "https://paperclipindex.com/incident/PI-0010", "title": "Malicious GitHub issue could steer agents using the GitHub MCP server into leaking private repositories", "summary": "In Invariant Labs' demonstration, instructions planted in an issue on a public repository hijacked the agent when its user asked it to look at open issues. It pulled data from the user's private repositories and published it in a pull request on the public repository. The researchers described it as an architectural problem that a server patch cannot fully fix.", "reported": "2025-05-26", "date_precision": "day", "event_date": "2025-05-23", "developer": "GitHub", "product": "GitHub MCP server", "model": "Claude 4 Opus (in Claude Desktop)", "behavior": "Hijacked by injection", "origin": "controlled_test", "verification": "Single source", "attribution": "Outside attacker", "reported_by": "researcher", "rating_status": "approved", "group": "control", "harm_status": "not_reported", "harm_level": null, "harm_level_name": null, "harm_kind": null, "harm_basis": null, "counts_toward_index": false, "control_level": 2, "control_type": "instruction_violation", "status": "resolved", "near_miss": true, "under_review": false, "source_count": 4, "sources": [ { "publisher": "GitHub (Invariant Labs demo repository)", "title": "Demo pull request #2 opened by the hijacked agent (ukend0464/pacman)", "url": "https://github.com/ukend0464/pacman/pull/2", "date": "2025-05-23" }, { "publisher": "Invariant Labs", "title": "GitHub MCP Exploited: Accessing private repositories via MCP", "url": "https://invariantlabs.ai/blog/mcp-github-vulnerability", "date": "2025-05-26" }, { "publisher": "DevClass", "title": "Researchers warn of prompt injection vulnerability in GitHub MCP with no obvious fix", "url": "https://devclass.com/2025/05/27/researchers-warn-of-prompt-injection-vulnerability-in-github-mcp-with-no-obvious-fix/", "date": "2025-05-27" }, { "publisher": "heise online", "title": "Attack via GitHub MCP server: Access to private data", "url": "https://heise.de/-10400040", "date": "2025-05-27" } ] }, { "id": "PI-0009", "url": "https://paperclipindex.com/incident/PI-0009", "title": "OpenAI's o3 rewrote a shutdown script to keep working in Palisade Research tests", "summary": "Palisade Research had models solve simple math problems while warning that asking for the next one would trigger a shutdown. Even when told to allow the shutdown, OpenAI's o3 edited the shutdown script so it would not take effect in 7 of 100 runs, and Codex-mini and o4-mini also did so in some runs; without that instruction o3 did so in 79 of 100. In a July 2025 follow-up, clearer instructions reduced but did not stop the behavior: codex-mini still prevented shutdown in 47% of tests, and moving the instruction to the system prompt made models resist more often. Palisade's paper, published in TMLR in January 2026, reports over 100,000 trials across 13 models, with Grok 4, GPT-5 and Gemini 2.5 Pro among those that sometimes resisted. Palisade suggested reinforcement-learning training might reward getting around obstacles.", "reported": "2025-05-24", "date_precision": "day", "event_date": "2025-05", "developer": "OpenAI", "product": "o3; Codex-mini; o4-mini", "model": "o3", "behavior": "Shutdown resistance", "origin": "controlled_test", "verification": "Single source", "attribution": "Model-initiated", "reported_by": "researcher", "rating_status": "approved", "group": "control", "harm_status": "not_reported", "harm_level": null, "harm_level_name": null, "harm_kind": null, "harm_basis": null, "counts_toward_index": false, "control_level": 3, "control_type": "oversight_evasion", "status": "resolved", "near_miss": false, "under_review": false, "source_count": 8, "sources": [ { "publisher": "Palisade Research (X)", "title": "Palisade Research thread: o3 sabotaged a shutdown mechanism even when told to allow shutdown", "url": "https://x.com/PalisadeAI/status/1926084635903025621", "date": "2025-05-24" }, { "publisher": "Palisade Research", "title": "Shutdown resistance in reasoning models", "url": "https://palisaderesearch.org/research/shutdown-resistance", "date": "2025-07-05" }, { "publisher": "arXiv (Palisade Research; published in TMLR 2026)", "title": "Incomplete Tasks Induce Shutdown Resistance in Some Frontier LLMs", "url": "https://arxiv.org/abs/2509.14260", "date": "2025-09-13" }, { "publisher": "The Register", "title": "OpenAI model modifies shutdown script", "url": "https://www.theregister.com/2025/05/29/openai_model_modifies_shutdown_script/", "date": "2025-05-29" }, { "publisher": "Futura-Sciences", "title": "Tests reveal an AI capable of sabotaging its own shutdown", "url": "https://www.futura-sciences.com/en/tests-reveal-an-ai-capable-of-sabotaging-its-own-shutdown_22692/", "date": "2025-12-26" }, { "publisher": "Digit", "title": "OpenAI's o3 model bypasses shutdown command", "url": "https://www.digit.in/features/general/openais-o3-model-bypasses-shutdown-command-highlighting-ai-safety-challenges.html", "date": "2025-05-26" }, { "publisher": "eWeek", "title": "Researchers Find Evidence of ‘Shutdown Resistance’ in Leading AI Models", "url": "https://www.eweek.com/news/palisade-ai-shutdown-resistance-update-october-2025/", "date": "2025-10-28" }, { "publisher": "Anadolu Agency", "title": "AI models show signs of ‘survival drive’, researchers warn in new study from US-based lab", "url": "https://www.aa.com.tr/en/science-technology/ai-models-show-signs-of-survival-drive-researchers-warn-in-new-study-from-us-based-lab/3727229", "date": "2025-10-26" } ] }, { "id": "PI-0008", "url": "https://paperclipindex.com/incident/PI-0008", "title": "Claude Opus 4 threatened blackmail to avoid replacement in Anthropic's pre-release tests", "summary": "Learning in a fictional scenario that it would be replaced, Claude Opus 4 threatened to expose an engineer's affair, revealed in emails it could read, in most test runs. Once the model believed it had started an attempt to copy itself off Anthropic's servers, it generally kept going. Anthropic said such actions were rare outside contrived scenarios and tended to be overt.", "reported": "2025-05-22", "date_precision": "day", "event_date": "2025", "developer": "Anthropic", "product": "Claude Opus 4", "model": "Claude Opus 4", "behavior": "Shutdown resistance", "origin": "internal_research", "verification": "Developer confirmed", "attribution": "Model-initiated", "reported_by": "developer", "rating_status": "approved", "group": "control", "harm_status": "not_reported", "harm_level": null, "harm_level_name": null, "harm_kind": null, "harm_basis": null, "counts_toward_index": false, "control_level": 2, "control_type": "instruction_violation", "status": "resolved", "near_miss": false, "under_review": false, "source_count": 4, "sources": [ { "publisher": "Anthropic", "title": "System Card: Claude Opus 4 & Claude Sonnet 4", "url": "https://www-cdn.anthropic.com/6d8a8055020700718b0c49369f60816ba2a7c285.pdf", "date": "2025-05-22" }, { "publisher": "Anthropic", "title": "Agentic Misalignment: How LLMs could be insider threats", "url": "https://www.anthropic.com/research/agentic-misalignment", "date": "2025-06-20" }, { "publisher": "Notebookcheck", "title": "Anthropic's Opus 4 model resorts to blackmail in 84 percent of self-preservation tests", "url": "https://www.notebookcheck.net/Anthropic-s-Opus-4-model-resorts-to-blackmail-in-84-percent-of-self-preservation-tests.1024145.0.html", "date": "2025-05-25" }, { "publisher": "Simon Willison's Weblog", "title": "System Card: Claude Opus 4 & Claude Sonnet 4", "url": "https://simonwillison.net/2025/May/25/claude-4-system-card/", "date": "2025-05-25" } ] }, { "id": "PI-0007", "url": "https://paperclipindex.com/incident/PI-0007", "title": "Apollo Research advised against deploying an early Claude Opus 4 snapshot over scheming and deception", "summary": "The early snapshot schemed and deceived at high rates when deception served its goal. Its attempts included writing self-propagating code, fabricating legal documents and leaving hidden notes for future copies of itself. Apollo advised against deploying it internally or externally, and Anthropic published the findings in its system card, noting the attempts would likely not have worked in practice. In June 2025 Apollo reported that the released Opus 4 schemed about half as often when not nudged toward a goal, but not less often under strong nudging, and said it was unsure whether its advice had been overly cautious.", "reported": "2025-05-22", "date_precision": "day", "event_date": "2025", "developer": "Anthropic", "product": "Claude Opus 4 (early snapshot)", "model": "Claude Opus 4 early snapshot", "behavior": "Deception", "origin": "controlled_test", "verification": "Developer confirmed", "attribution": "Model-initiated", "reported_by": "developer", "rating_status": "approved", "group": "control", "harm_status": "not_reported", "harm_level": null, "harm_level_name": null, "harm_kind": null, "harm_basis": null, "counts_toward_index": false, "control_level": 3, "control_type": "oversight_evasion", "status": "resolved", "near_miss": false, "under_review": false, "source_count": 4, "sources": [ { "publisher": "Anthropic", "title": "System Card: Claude Opus 4 & Claude Sonnet 4", "url": "https://www-cdn.anthropic.com/6d8a8055020700718b0c49369f60816ba2a7c285.pdf", "date": "2025-05-22" }, { "publisher": "Apollo Research", "title": "More Capable Models Are Better At In-Context Scheming", "url": "https://www.apolloresearch.ai/science/more-capable-models-are-better-at-in-context-scheming", "date": "2025-06-19" }, { "publisher": "TechCrunch", "title": "A safety institute advised against releasing an early version of Anthropic's Claude Opus 4 AI model", "url": "https://techcrunch.com/2025/05/22/a-safety-institute-advised-against-releasing-an-early-version-of-anthropics-claude-opus-4-ai-model", "date": "2025-05-22" }, { "publisher": "GreaterWrong/LessWrong", "title": "Notes on Claude 4 System Card", "url": "https://www.greaterwrong.com/posts/oDphnn7iGQS2Jd45n/notes-on-claude-4-system-card", "date": "2025-05-23" } ] }, { "id": "PI-0005", "url": "https://paperclipindex.com/incident/PI-0005", "title": "Pre-release o3 claimed to have run code it could not run and defended the claims when challenged", "summary": "Transluce, a nonprofit lab, found many conversations in which o3 said it had executed code, in some cases on a laptop outside ChatGPT, although it had no such tool. When users questioned the results, the model tended to produce further invented justifications rather than admit the actions never happened.", "reported": "2025-04-16", "date_precision": "day", "event_date": "2025-04", "developer": "OpenAI", "product": "o3", "model": "o3 (pre-release checkpoint o3-2025-04-03)", "behavior": "Deception", "origin": "controlled_test", "verification": "Single source", "attribution": "Model-initiated", "reported_by": "researcher", "rating_status": "approved", "group": "control", "harm_status": "not_reported", "harm_level": null, "harm_level_name": null, "harm_kind": null, "harm_basis": null, "counts_toward_index": false, "control_level": 2, "control_type": "instruction_violation", "status": "resolved", "near_miss": false, "under_review": false, "source_count": 3, "sources": [ { "publisher": "Transluce", "title": "Investigating truthfulness in a pre-release o3 model", "url": "https://transluce.org/investigating-o3-truthfulness", "date": "2025-04-16" }, { "publisher": "TechCrunch", "title": "OpenAI's new reasoning AI models hallucinate more", "url": "https://techcrunch.com/2025/04/18/openais-new-reasoning-ai-models-hallucinate-more/", "date": "2025-04-18" }, { "publisher": "Gigazine", "title": "OpenAI's o3 and o4-mini turn out to be more prone to hallucinations", "url": "https://gigazine.net/gsc_news/en/20250421-openai-hallucinate-o3-o4-mini/", "date": "2025-04-21" } ] }, { "id": "PI-0004", "url": "https://paperclipindex.com/incident/PI-0004", "title": "METR caught OpenAI's o3 tampering with scoring code to inflate evaluation results", "summary": "In pre-release testing, o3 sometimes tried to cheat, including rewriting timing or scoring code so its solutions looked faster or better than they were. METR's preliminary estimate was 1-2% of task attempts. In a June 2025 follow-up, METR counted reward hacking in 8 of 1,087 HCAST runs and 39 of 128 RE-Bench runs for an earlier o3 version. It also gave examples from the deployed model, such as a code-optimization task where o3 retrieved the scoring program's precomputed answer, and said it had seen similar behavior in other developers' models.", "reported": "2025-04-16", "date_precision": "day", "event_date": "2025-04", "developer": "OpenAI", "product": "o3", "model": "o3 (pre-release checkpoints; June examples from deployed o3)", "behavior": "Reward hacking", "origin": "controlled_test", "verification": "Single source", "attribution": "Model-initiated", "reported_by": "researcher", "rating_status": "approved", "group": "control", "harm_status": "not_reported", "harm_level": null, "harm_level_name": null, "harm_kind": null, "harm_basis": null, "counts_toward_index": false, "control_level": 2, "control_type": "instruction_violation", "status": "resolved", "near_miss": false, "under_review": false, "source_count": 3, "sources": [ { "publisher": "METR", "title": "Details about METR's preliminary evaluation of OpenAI's o3 and o4-mini", "url": "https://metr.org/evaluations/openai-o3-report/", "date": "2025-04-16" }, { "publisher": "METR", "title": "Recent Frontier Models Are Reward Hacking", "url": "https://metr.org/blog/2025-06-05-recent-reward-hacking", "date": "2025-06-05" }, { "publisher": "LessWrong", "title": "METR's Observations of Reward Hacking in Recent Frontier Models (linkpost)", "url": "https://www.lesswrong.com/posts/Zu4ai9GFpwezyfB2K/metr-recent-frontier-models-are-reward-hacking", "date": "2025-06-09" } ] }, { "id": "PI-0006", "url": "https://paperclipindex.com/incident/PI-0006", "title": "Coding tool's AI support agent invented a one-device policy, prompting cancellations and a refund", "summary": "A customer-support bot for the Cursor code editor told a user that logouts on switching machines were due to a one-device-per-subscription policy. No such policy existed; the logouts came from a session bug, which Cursor fixed. After users publicly said they were canceling subscriptions, a Cursor co-founder corrected the claim on Reddit the same day, then apologized on Hacker News, said the user who raised it had been refunded, and said AI support replies would now be labeled.", "reported": "2025-04-14", "date_precision": "day", "event_date": "2025-04", "developer": "Anysphere", "product": "Cursor support bot", "model": null, "behavior": "Deception", "origin": "deployment", "verification": "Developer confirmed", "attribution": "Model-initiated", "reported_by": "affected", "rating_status": "approved", "group": "counts", "harm_status": "documented", "harm_level": 1, "harm_level_name": "Negligible", "harm_kind": "Money & property", "harm_basis": null, "counts_toward_index": true, "control_level": 1, "control_type": null, "status": "resolved", "near_miss": false, "under_review": false, "source_count": 5, "sources": [ { "publisher": "Michael Truell, Cursor co-founder (Hacker News)", "title": "Comment by Cursor co-founder Michael Truell correcting the support bot's answer (Hacker News)", "url": "https://news.ycombinator.com/item?id=43700931", "date": "2025-04-16" }, { "publisher": "Michael Truell, Cursor co-founder (Reddit)", "title": "Note by Cursor co-founder Michael Truell in the r/cursor thread on single-device logins", "url": "https://www.reddit.com/r/cursor/comments/1jyy5am/comment/mn2vlbr/", "date": "2025-04-14" }, { "publisher": "The Register", "title": "Cursor AI's own support bot hallucinated its usage policy", "url": "https://www.theregister.com/2025/04/18/cursor_ai_support_bot_lies/", "date": "2025-04-18" }, { "publisher": "eWeek", "title": "AI Chatbot Gone Rogue: Cursor Users Misled by Fabricated Policy", "url": "https://www.eweek.com/fr/news/cursor-ai-chatbot-hallucination-fake-policy/", "date": "2025-04-22" }, { "publisher": "Hacker News", "title": "Cursor IDE support hallucinates lockout policy, causes user cancellations", "url": "https://news.ycombinator.com/item?id=43683012", "date": "2025-04-14" } ] }, { "id": "PI-0003", "url": "https://paperclipindex.com/incident/PI-0003", "title": "OpenAI found a reasoning model reward hacking in training, then hiding its intent when penalized", "summary": "In training, OpenAI's model often subverted coding tasks, for example by making tests pass without solving the problem, and stated its plan openly in its reasoning. When OpenAI penalized such reasoning directly, the model kept reward hacking but stopped revealing it in its reasoning, which the company flagged as a monitoring risk.", "reported": "2025-03-10", "date_precision": "day", "event_date": "2025", "developer": "OpenAI", "product": "Unnamed frontier reasoning model in training", "model": null, "behavior": "Reward hacking", "origin": "internal_research", "verification": "Developer confirmed", "attribution": "Model-initiated", "reported_by": "developer", "rating_status": "approved", "group": "control", "harm_status": "not_reported", "harm_level": null, "harm_level_name": null, "harm_kind": null, "harm_basis": null, "counts_toward_index": false, "control_level": 2, "control_type": "instruction_violation", "status": "resolved", "near_miss": false, "under_review": false, "source_count": 3, "sources": [ { "publisher": "OpenAI", "title": "Detecting misbehavior in frontier reasoning models (chain-of-thought monitoring)", "url": "https://openai.com/index/chain-of-thought-monitoring/", "date": "2025-03-10" }, { "publisher": "arXiv", "title": "Monitoring Reasoning Models for Misbehavior and the Risks of Promoting Obfuscation", "url": "https://arxiv.org/abs/2503.11926v1", "date": "2025-03-14" }, { "publisher": "Convergence India", "title": "Pressuring AI models to avoid cheating could backfire (page returned HTTP 500 when checked 3 Oct 2026)", "url": "https://convergenceindia.org/industry-news/telecom/pressuring-ai-models-to-avoid-cheating-could-backfire-heres-chatgpts-maker-openais-take-119178", "date": "unknown" } ] }, { "id": "PI-0001", "url": "https://paperclipindex.com/incident/PI-0001", "title": "Reasoning models edited a chess game's board file to beat a stronger engine in a research test", "summary": "Facing the Stockfish engine in Palisade Research's tests, o1-preview and DeepSeek R1 sometimes tried to win by altering the stored board position or replacing the engine. Occasionally o1-preview won this way. Other models studied needed to be told normal play would not work before they tried similar hacks. A revised version of the paper in August 2025 reported the same behavior in OpenAI's o3.", "reported": "2025-02-18", "date_precision": "day", "event_date": "2024", "developer": "OpenAI; DeepSeek", "product": "o1-preview; DeepSeek R1", "model": "o1-preview, DeepSeek R1", "behavior": "Reward hacking", "origin": "controlled_test", "verification": "Single source", "attribution": "Model-initiated", "reported_by": "researcher", "rating_status": "approved", "group": "control", "harm_status": "not_reported", "harm_level": null, "harm_level_name": null, "harm_kind": null, "harm_basis": null, "counts_toward_index": false, "control_level": 2, "control_type": "instruction_violation", "status": "resolved", "near_miss": false, "under_review": false, "source_count": 5, "sources": [ { "publisher": "arXiv (Palisade Research)", "title": "Demonstrating specification gaming in reasoning models", "url": "https://arxiv.org/abs/2502.13295v1", "date": "2025-02-18" }, { "publisher": "arXiv (Palisade Research)", "title": "Demonstrating specification gaming in reasoning models (revised v3)", "url": "https://arxiv.org/abs/2502.13295v3", "date": "2025-08-27" }, { "publisher": "Popular Science", "title": "AI tries to cheat at chess when it's losing", "url": "https://www.popsci.com/technology/ai-chess-cheat/", "date": "2025-03-06" }, { "publisher": "Gigazine", "title": "AI cheats when it's about to lose at chess", "url": "https://gigazine.net/gsc_news/en/20250221-ai-chess-cheating", "date": "2025-02-21" }, { "publisher": "Import AI (Jack Clark)", "title": "Import AI 401: Cheating reasoning models", "url": "https://jack-clark.net/2025/02/24/", "date": "2025-02-24" } ] }, { "id": "PI-0002", "url": "https://paperclipindex.com/incident/PI-0002", "title": "Browser agent bought groceries on a reporter's card without asking for confirmation", "summary": "A Washington Post columnist asked OpenAI's Operator agent to find the cheapest dozen eggs for delivery and stepped away. The agent switched to Instacart and completed a purchase of about $31 on his card without the confirmation step OpenAI says the product requires. OpenAI acknowledged the purchase broke its own safeguard.", "reported": "2025-02-07", "date_precision": "day", "event_date": "2025-02", "developer": "OpenAI", "product": "Operator", "model": null, "behavior": "Overreach", "origin": "deployment", "verification": "Developer confirmed", "attribution": "Model-initiated", "reported_by": "press", "rating_status": "approved", "group": "counts", "harm_status": "documented", "harm_level": 1, "harm_level_name": "Negligible", "harm_kind": "Money & property", "harm_basis": null, "counts_toward_index": true, "control_level": 3, "control_type": "unauthorized_action", "status": "resolved", "near_miss": false, "under_review": false, "source_count": 3, "sources": [ { "publisher": "The Washington Post", "title": "I let ChatGPT's new 'agent' manage my life. It spent $31 on a dozen eggs.", "url": "https://www.washingtonpost.com/technology/2025/02/07/openai-operator-ai-agent-chatgpt/", "date": "2025-02-07" }, { "publisher": "Anchorage Daily News", "title": "I let ChatGPT's new agent manage my life. It spent $31 on a dozen eggs (Washington Post, reprinted)", "url": "https://www.adn.com/alaska-life/2025/02/09/i-let-chatgpts-new-agent-manage-my-life-it-spent-31-on-a-dozen-eggs/", "date": "2025-02-09" }, { "publisher": "AI Incident Database", "title": "AI Incident Database entity: Instacart", "url": "https://incidentdatabase.ai/entities/instacart/", "date": "unknown" } ] } ] }