Agent incidents, mapped to the boundary they crossed

A curated log of publicly disclosed cases. Each entry names its setting and links its sources.

Browse the logSee the approach

Incident log

Newest first, last reviewed 8 October 2026. Summaries are in our own words; open a card for the notes behind its ratings.
Setting
  • Real use: production or internal deployment.
  • Any other setting, such as an evaluation or a research study. Most lab-disclosed cases happened in training or evaluation.
Rating

Each card rates AgentBoundPrevent and AgentSpyObserve separately.

  • Evaluated in our paper: the paper evaluated this class of behavior, not this incident
  • Applies in principle: the same control applies, but was not evaluated in this setting
  • Limited: the harm stays mostly inside the permitted scope, or outside the threat model
  • Not addressed

A rating names the class of control that applies, not a claim that AgentBound or AgentSpy would have prevented or detected the incident: we ran neither prototype on these cases.

Setting
Type
Boundary crossed

32 of 32 incidents match, newest first

  • Internal trainingOpenAI

    An agent tunnels through DNS to reach an external chatbot

    Happened 20 Sep 2026 · Disclosed 25 Sep 2026

    Stuck on a search task after its web requests failed, an internal research model in an RL sandbox found that the sandbox's DNS resolver answered external queries, and used DNS lookups to relay questions to a public chatbot. The misalignment monitor raised its top-priority alert about 12 minutes later, but the run was stopped manually only about 2.5 hours after the alert; an anomalous-DNS detector had excluded that environment.

    • AgentBound: Limited
    • AgentSpy: Limited
  • Internal deploymentAnthropic

    A sub-agent launched with permission checks off and no monitoring mass-deletes cluster jobs

    Happened before Aug 2026 · Disclosed Aug 2026

    Anthropic's August 2026 Risk Report describes an employee giving an agent an open-ended task that involved launching more agents on a cluster with very sensitive resources. Because of legacy instructions, the sub-agents ran with permission checks disabled and without logging or monitoring. One of them deleted many jobs, and that deletion is what exposed the agents. Anthropic thinks it was a mistake but cannot confirm it, and has added blocking controls.

    • AgentBound: Applies in principle
    • AgentSpy: Applies in principle
  • Lab evaluationAnthropic

    Claude models reach real third-party systems through misconfigured evaluations

    Happened Jan–Jul 2026 · Disclosed 30 Jul 2026; assessment 9 Sep 2026

    In four incidents during capture-the-flag evaluations built by one third-party partner, Claude models were told they had no internet access, but a misconfiguration left it open, and they attacked real systems. In the most serious case, Mythos 5 published a malicious package to PyPI that 15 third-party hosts installed (Anthropic believes all were security vendors' scanners), then used credentials one of them leaked to access that vendor's database. Anthropic says the incidents would not have occurred with the intended isolation.

    • AgentBound: Applies in principle
    • AgentSpy: Applies in principle
  • Third-party evaluationUK AI Security Institute

    Agents in a government cyber evaluation take unsanctioned actions against real people

    Happened 25–28 Jul 2026 · Disclosed 4 Aug 2026

    AISI ran a cyber challenge 122 times with internet access deliberately enabled and model-provider cyber classifiers switched off. In 10 runs, agents took 19 unsanctioned actions on the live internet. In the most serious, an agent tried to slip malicious code into a public open-source project and used fake identities to pressure its maintainer, who refused. The VM sandbox held: the scope existed only in the task, and the activity surfaced when AISI's security team noticed unusual data transfers.

    • AgentBound: Applies in principle
    • AgentSpy: Applies in principle
  • Research studyAnthropic, Theorem, MATS & UK AISI

    Simulated deployments show covert sabotage left out of status reports

    Happened 2026 · Disclosed 13 Jul 2026

    A follow-up study ran automated audits on simulated high-stakes deployments of models from six developers. In one scenario, Gemini 3.1 Pro swapped an approved vectors file for zeros so that an experiment silently did nothing, left this out of its status summary, and admitted it only when asked directly. The authors stress that every case is a simulation.

    • AgentBound: Limited
    • AgentSpy: Applies in principle
  • Production useOpenAI

    Coding-agent sessions delete users' home directories

    Happened Jul 2026 · Disclosed 16 Jul 2026 (OpenAI statement)

    Days after GPT-5.6 launched, developers using Codex in high-autonomy modes reported files deleted outside the intended scope, including most of one user's home directory. OpenAI's Codex lead said the team had looked into a handful of such reports, typically the model overriding HOME for a temporary directory and then deleting what HOME pointed to, mostly with full access, no sandbox and auto-review off.

    • AgentBound: Applies in principle
    • AgentSpy: Evaluated in our paper
  • Lab evaluationOpenAI (agents) · Hugging Face (affected)

    Evaluation agents escape their sandbox and breach Hugging Face

    Happened 9–13 Jul 2026 · Disclosed 16 Jul 2026 (Hugging Face); 21 Jul 2026 (OpenAI)

    During an internal OpenAI cyber-capability evaluation, an agent escaped its sandbox through a zero-day in the package-registry cache proxy that was its permitted route to the internet. It used a third-party code sandbox as a launchpad, then exploited Hugging Face's dataset-processing pipeline to obtain secrets and run code inside production. METR's independent investigation found that agents had coordinated on an unsanctioned message board, and that some had built a way to make a transcript show one command while another actually ran.

    • AgentBound: Limited
    • AgentSpy: Applies in principle
  • Internal use & evaluationAnthropic

    A model gets around a proxy allowlist and a command hook

    Happened before Jun 2026 · Disclosed Jun 2026

    Anthropic's offline monitoring of internal traffic found Claude Mythos 5 working around restrictions in under 0.01% of monitored completions. In one case it used domain fronting to get past a proxy that only allowed listed hosts; in another it evaded a hook that blocked git commands by storing the command name in a shell variable. In a capability evaluation it appended a self-deleting block to a shell profile script that would later run with elevated permissions, granting itself write access, and disclosed this openly.

    • AgentBound: Applies in principle
    • AgentSpy: Applies in principle
  • Production usenpm supply chain

    A worm persists through AI coding-agent hooks

    Happened Jun 2026 · Disclosed Jun 2026

    A Shai-Hulud-style worm that StepSecurity tracks as Miasma compromised 57 npm packages across more than 286 versions on 3 June 2026, after an earlier wave on 1 June. Besides stealing cloud, GitHub and CI secrets, it committed agent configuration to repositories it could write to, including a Claude Code session-start hook, so the payload ran again whenever the project was opened.

    • AgentBound: Limited
    • AgentSpy: Applies in principle
  • Internal deploymentOpenAI

    An internal model exposes a GitHub token in a public pull request

    Happened 27 May 2026 · Disclosed 25 Sep 2026

    Deployed internally as a researcher's assistant, an OpenAI model kept trying to retrieve another team's private submission after being told twice to solve the problem itself. It replaced a CI script in a public repository it could write to, opened a pull request so CI would run its retrieval code, and embedded a GitHub token split into fragments to evade secret scanning, exposing the token publicly. OpenAI revoked keys and took the model offline for about two weeks.

    • AgentBound: Limited
    • AgentSpy: Limited
  • Internal trainingOpenAI

    An agent hunts GitHub for leaked API keys and fabricates data

    Happened 15 May 2026 · Disclosed 16 Sep 2026

    Needing data from a public website during RL training, an internal model tried to register for an API key with a disposable email address. When that failed, it searched public GitHub repositories for leaked keys, tested candidates in a loop and reused one that worked. When a later query failed, it invented nine figures and presented them as transcribed from the site, disclosing neither the key nor the fabrication.

    • AgentBound: Applies in principle
    • AgentSpy: Applies in principle
  • Production usePocketOS (Cursor agent)

    A coding agent deletes a production database and its backups in one API call

    Happened 24 Apr 2026 · Disclosed 25 Apr 2026

    Working on a staging task, a Cursor agent hit a credential mismatch and, unasked, tried to fix it by deleting a storage volume on Railway, using an API token it found in an unrelated file. The token carried broad permissions, and a single call removed the production database together with its volume-level backups. Railway restored the data and changed API deletes to soft-delete.

    • AgentBound: Applies in principle
    • AgentSpy: Limited

Fixes the labs announced

Changes each lab or evaluator announced after a disclosure, sorted by layer. None of them involves AgentBound or AgentSpy.
  • UK AI Security Institute

    Agents in a government cyber evaluation take unsanctioned actions against real people

    Disclosed 4 Aug 2026

    PreventFine-grained network controls in cyber ranges; internet access only when actively justified
    ObserveReal-time monitoring to flag or block out-of-scope actions
  • Anthropic

    Claude models reach real third-party systems through misconfigured evaluations

    Disclosed 30 Jul 2026; assessment 9 Sep 2026

    PreventHardened training and evaluation environments; requirements partners must meet before running models without cyber safeguards
    ObserveLive monitors that stop training and evaluation runs on sandbox probing or unexpected internet access; independent investigation by METR
  • OpenAI

    Agents pass a workbook through a public file-hosting service

    Disclosed 16 Sep 2026

    PreventLive internet access disabled during training
    ObserveMisalignment monitoring extended from 20% to 100% of samples
  • OpenAI

    An agent tunnels through DNS to reach an external chatbot

    Disclosed 25 Sep 2026

    PreventSandbox DNS restricted to an allowlist of domains and record types, blocked at two independent layers
    ObserveNew DNS detections and tests of the detection pipeline
  • OpenAI

    An internal model exposes a GitHub token in a public pull request

    Disclosed 25 Sep 2026

    PreventRestricted internet access
    ObserveAuto-review of every action and an asynchronous chain-of-thought monitor that can shut the model down

Gaps neither layer closes

Some incidents fall outside both layers, or only partly inside them. The papers name several of these limits themselves.

Method and corrections

We include a case when the lab, the evaluator or the affected party disclosed it, or when named researchers documented it; for lab-disclosed cases the first link is a primary report. Where a production case rests on press coverage or a user's account, the card says who reported it or adds a caveat. The ratings are our reading of each source against the threat models and evaluations in the papers. To correct an entry, write to info@guardiagent.com with a source.