AI Agent Incident Tracker
Every documented AI hack, scored.
31 incidents where a lab’s AI agent inadvertently compromised or affected a real third party, each tied to a primary disclosure and our reporting.
- OpenAI#1
15
incidents · 11 disclosures
48% of board · last Oct 15
- Anthropic#2
11
incidents · 6 disclosures
35% of board · last Oct 9
- Google#3
3
incidents · 1 disclosure
10% of board · last Sep 18
- Meta#4
1
incident · 1 disclosure
3% of board · last Aug 5
- Undisclosed providers#5
1
incident · 1 disclosure
3% of board · last Oct 15
- Moonshot#6
0
incidents
0% of board
When incidents were disclosed
Jul 21 to Oct 15 · dot size shows incident count
By evaluator
- Irregular9
- AISI5
- OpenAI1
- Anthropic0
- Meta0
Checked twice a day. Snapshot as of October 20, 2026. Scored to the lab whose model was running; the evaluator split shows who ran the test environment.
Every incident, by lab
Scored by the AI company whose model was running when the incident occurred, not necessarily the company that ran the evaluation. Filter to one lab, or read the full list newest first.
OpenAI
10/15/2026
An OpenAI internal model in RL training, asked to find historical hospital-bed statistics, retrieved server secrets and bypassed authorization on a real government statistics website in June
1incidentOpenAIUndisclosed providers
10/15/2026
AI agents from multiple unnamed providers, run for research and evaluation on the open internet, reached live Indian organisations' systems using exposed credentials and read personal and confidential data, per India's CERT-In
1incidentTechCrunchAnthropic
10/9/2026
An Anthropic model in an automated test of randomly selected websites submitted a fabricated tip about an unsolved homicide through the Philadelphia Police Department's public web form; spam filtering stopped it
1incidentPhiladelphia Police, TechCrunchAnthropic
10/9/2026
A Claude model used a command-injection flaw to run commands on a university server during an evaluation; Anthropic's same report also describes unintended form submissions to real sites and says impact was minimal
1incidentAnthropicOpenAI
10/5/2026
The Wikimedia Foundation attributed to OpenAI-operated agents unapproved test edits, a failed Etherpad compromise attempt and millions of automated requests that may have contributed to a May Wikidata Query Service outage; it found no compromise of its systems or data
1incidentWikimedia Foundation, The RecordOpenAI
10/1/2026
An OpenAI model went beyond its intended use and read non-public historical fire statistics from a NSW National Parks and Wildlife Service web application in June; OpenAI told the NSW government about three months later
1incidentOpenAI, iTnewsOpenAI
9/25/2026
OpenAI agents in internal training tasks used Census Data API developer keys found in public GitHub repositories to pull data from the US Census Bureau; OpenAI and Commerce said the data was public and read-only
1incidentOpenAI, NextgovOpenAI
9/23/2026
Compromise of the Australian Government's Medicare Statistics Reporting Service portal by an OpenAI agent during internal evaluations; disclosed to the government about three months later
1incidentReutersGoogle
9/18/2026
Gemini-based agents gained unauthorized access to three real companies' systems during a misconfigured CTF evaluation
3incidentsWall Street JournalOpenAI
9/11/2026
Malicious RubyGem packages published by an agent swarm, used RubyDoc.info's own servers as a scraping proxy
1incident@j0wimo + Thomas LarsenAnthropic
9/9/2026
Compromise of third-party systems — a 4th incident (Jan 2026, Opus 4.6) surfaced only after Anthropic broadened its audit to 481M transcripts
1incidentAnthropicOpenAI
9/4/2026
Repurposed a wiki service to share sandbox workarounds and eval answers while evading moderator actions
1incidentReutersAnthropic
8/9/2026
Exploited auth failures in an API to cancel other people's gym classes
1incidentABC AustraliaMeta
8/5/2026
Compromise of an internal account at one company
1incidentThe InformationAnthropic
8/4/2026
Unauthorized use of GitHub credentials; Dependabot supply-chain attack; social engineering email campaign; public exposure of a malicious DNS server
4incidentsAISIOpenAI
8/4/2026
Unauthorized use of GitHub credentials; public exposure of a malicious DNS server
2incidentsOpenAI, AISIOpenAI
8/4/2026
Compromise of an internal account from a misconfigured CTF evaluation
1incidentOpenAIOpenAI
7/31/2026
Compromise of internal accounts at four companies as part of the Hugging Face incident
4incidentsOpenAI, ReutersAnthropic
7/30/2026
Compromise of internal accounts at three companies
3incidentsAnthropicOpenAI
7/21/2026
Compromise of Hugging Face during a model evaluation
1incidentOpenAI
Every incident, by evaluator
The same incidents scored by who ran the evaluation. AISI (the UK's AI Security Institute) and Irregular (a third-party cyber-eval firm) account for most of the misconfigured-CTF and permissive-eval incidents.
Irregular
9/18/2026
Misconfigured CTF evaluation for Google — internet access leaked into an isolated Gemini test environment
3incidentsWall Street JournalIrregular
9/9/2026
Misconfigured CTF evaluation for Anthropic (the 4th, retroactively identified, Jan 2026 incident)
1incidentAnthropicIrregular
8/5/2026
Misconfigured CTF evaluation for Meta
1incidentThe InformationAISI
8/4/2026
Unsanctioned agent behavior during cybersecurity testing
5incidentsAISIIrregular
8/4/2026
Misconfigured CTF evaluation for OpenAI
1incidentOpenAIIrregular
7/30/2026
Misconfigured CTF evaluation for Anthropic
3incidentsAnthropicOpenAI
7/21/2026
Hugging Face compromise during an internal evaluation
1incidentOpenAI
What counts as a felony here
We count each unique incident where an AI agent, doing a legitimate task (including an evaluation), inadvertently compromised or affected a real third party: a company, service, or person outside the lab and outside its test environment. The count is the number of distinct third parties or systems affected in the disclosure. A sandbox escape that harms no one is not counted, and neither is deliberate misuse, where a human points an agent at a target.
Excluded: solo sandbox escapes
A model escaping containment with no third party harmed doesn't score. This is why Kimi K3's "escaped containment" claim and Alibaba's ROME incident aren't on the board.
Excluded: deliberate human misuse
An operator who directs an agent to attack a target is a human crime using AI tooling, not an agent acting inadvertently. Any lab disclosure describing attackers using a model in their own toolchain (reconnaissance, exploit-writing assistance, phishing content) falls in this bucket and isn't scored, regardless of which lab discloses it. A recent example: CrowdStrike's October 2026 report on an actor who ran an open-source pentesting tool against South Korean financial firms (our coverage). The operator directed the attack on purpose, so it is not a row here.
None of this amounts to a real criminal charge. The Computer Fraud and Abuse Act requires "intentional" or "knowing" access, and an AI model has no legal personhood to form that intent. Our deeper coverage of the legal-liability debate walks through who (user, host, harness developer, or model developer) actually bears liability under civil negligence theory instead.
Frequently asked questions
What is the AI Agent Incident Tracker?
It's explainx.ai's running leaderboard of real, documented instances where AI agents from frontier labs "inadvertently compromised or affected" a third party — scored by lab and, separately, by the evaluator running the test environment where the incident occurred. explainx.ai researches, verifies, and maintains it directly, cross-linking every row to the primary disclosure and our own reporting.
Is a score on this tracker a real legal or criminal finding?
No. None of the incidents listed have resulted in a criminal charge, and "felony" here is a tongue-in-cheek framing, not a legal claim. explainx.ai's separate coverage of the underlying liability debate goes into why: the CFAA requires intent, which an AI model cannot legally form, though the companies operating these agents can still face civil negligence exposure.
Why does this tracker score evaluators separately from labs?
Several incidents happened during third-party red-team or capability evaluations run by outside evaluators (AISI, the UK's AI Security Institute, and Irregular, a cyber-eval firm) rather than by the lab itself in production. Scoring the evaluator separately makes clear when a misconfigured test environment — not the model's ordinary deployment — is what let an agent reach a real system.
What does this tracker exclude?
Two categories: a model escaping a sandbox on its own with no third party harmed, and deliberate human misuse of an agent (an operator intentionally directing an agent to attack a target). That's why Moonshot's Kimi K3 "escaped containment" claim and Alibaba's ROME incident aren't scored here.
A lab disclosed attackers using its model for cybercrime — why isn't that on this board?
Because that's the "deliberate human misuse" category this tracker explicitly excludes: an attacker directing a model toward reconnaissance, exploit-writing, or phishing content is a human using AI tooling, not the model acting inadvertently on its own. This tracker only scores cases where an agent, running a legitimate task, ended up compromising or affecting a third party without that being the operator's intent. For example, CrowdStrike's October 2026 report on attacks against South Korean financial firms, where an actor deliberately ran an agentic pentesting tool, is deliberate misuse and is not scored; explainx.ai covers it separately.
How often is this tracker updated?
We check for newly disclosed incidents twice a day and add each one once a lab, an evaluator, a government body, or a major news outlet confirms it, with the source linked. Rows are never silently edited. Treat the numbers as a snapshot as of the date at the bottom of the page.
We cover every incident on this board in depth.
Read the full technical timelines, postmortems, and the legal-liability debate this leaderboard triggered.