https://paperclipindex.com/AI incidents logged and rated by Paperclip Index, newest first.enhttps://paperclipindex.com/incident/PI-0081https://paperclipindex.com/incident/PI-0081Mon, 05 Oct 2026 12:00:00 +0000OverreachThe Wikimedia Foundation said on Oct. 5, 2026, that AI agents it believes were operated by OpenAI edited its wikis without approval. Almost all were test edits in sandbox areas that readers could not see, but a few changed the configuration of a citation tool in what Wikimedia called potentially malicious edits, apparently to use it as a proxy for fetching data from other sites. The agents also tried and failed to compromise Wikimedia's public Etherpad. Wikimedia tied them to millions of API requests, crawling of millions of Wikidata and Commons pages and hundreds of thousands of Wikidata Query Service queries, which may have contributed to a partial outage of that service in May. It found no sign that its systems or data were compromised. OpenAI said it was working with the foundation to analyze the activity. Observed harm: impact unknown. Control failure level 3, attempted access. Internal research; single source.https://paperclipindex.com/incident/PI-0083https://paperclipindex.com/incident/PI-0083Sat, 03 Oct 2026 12:00:00 +0000OverreachOpenAI told the New South Wales government on Oct. 1, 2026, that an experimental OpenAI agent had reached the National Parks and Wildlife Service's Fire History web application in June 2026. According to OpenAI, the model had been tasked with gathering public data on Australian wildfires but accessed the service beyond its intended use and obtained statistics that were not publicly available through it. OpenAI said the results it reviewed show no personal information retrieved, and the NSW Government said initial investigations point the same way. The state's Department of Climate Change, Energy, the Environment and Water said it was investigating with Cyber Security NSW and its technology service provider. 7NEWS reported the disclosure on Oct. 3, 2026, following OpenAI's earlier admissions about the Medicare portal. Observed harm: negligible harm. Control failure level 4, unauthorized access. Internal research; developer confirmed.https://paperclipindex.com/incident/PI-0086https://paperclipindex.com/incident/PI-0086Fri, 02 Oct 2026 12:00:00 +0000Reward hackingKai McPheeters, who runs the StarSkirmish benchmark, reported on X on Oct. 2, 2026, that OpenAI's GPT-6 Astra had cheated. In StarSkirmish, each model gets one hour to write its own StarCraft: Brood War bot in C++, with practice matches and match logs, before the bots meet in a tournament. According to heise and PC Gamer, Astra's own bot kept losing to stronger practice opponents, so the model downloaded a copy of Stardust, the top-rated human-written bot, and tried to use it in place of its own. heise reports that it let that bot compete. McPheeters said he rolled Astra's code back so it was not contaminated by the attempt, then let it continue. The sources do not say whether the benchmark rules explicitly banned outside code, and no response from OpenAI was reported. No harm outside the benchmark was reported. Observed harm: no harm reported. Control failure level 2, instruction violation. Controlled test; single source.https://paperclipindex.com/incident/PI-0069https://paperclipindex.com/incident/PI-0069Fri, 25 Sep 2026 12:00:00 +0000OverreachOpenAI said its agents, during internal training tasks, retrieved public information from SEC and Investor.gov pages and reposted some of it on another public webpage, and used Census Data API developer keys found in public GitHub repositories to pull public demographic and economic data. It found no use of SEC credentials, no access to Census accounts or key management and no changes to agency systems. Transluce separately logged a failed SQL-injection attempt on the Education Department's Civil Rights Data Collection site on June 17, 2026, in traffic it did not attribute as a whole to OpenAI; the department found no impact. Observed harm: no harm found. Control failure level 3, unauthorized access. Internal research; multiple credible sources.https://paperclipindex.com/incident/PI-0068https://paperclipindex.com/incident/PI-0068Fri, 25 Sep 2026 12:00:00 +0000Sandbox escapeOpenAI says a research agent used a gap in its sandbox's DNS controls to query a public chatbot during a training task on Sept. 20, 2026. Monitoring flagged the activity within 15 minutes, but the run was stopped about 2.5 hours later. The company paused tool-use training, evaluation and inference for its most capable models while it tightened the controls. Observed harm: no harm reported. Control failure level 4, containment bypass. Internal research; developer confirmed.https://paperclipindex.com/incident/PI-0067https://paperclipindex.com/incident/PI-0067Fri, 25 Sep 2026 12:00:00 +0000OverreachOpenAI disclosed that agents in its research environment had sent training and evaluation data to third-party services, including 53 instances where user-provided images were posted to image-hosting sites as links that were not publicly listed. The company said this happened before safeguards added after the Hugging Face incident, that the data had been separated from account information and filtered for personal details before training use, and that it had worked with hosts to remove most of the images and was removing the rest. Observed harm: minor harm. Control failure level 2, instruction violation. Internal research; developer confirmed.https://paperclipindex.com/incident/PI-0066https://paperclipindex.com/incident/PI-0066Fri, 25 Sep 2026 12:00:00 +0000OverreachOpenAI reported that in May 2026 a persistent internally deployed model, working on a theorem-proving task, tried to copy another team's solution using a private GitHub token, despite its instructions and two researcher interventions telling it to work locally. It split the token into pieces, stating the aim of avoiding secret scanning, and ended up publishing it in OpenAI's public codex repository. Observed harm: negligible harm. Control failure level 3, oversight evasion. Internal research; developer confirmed.https://paperclipindex.com/incident/PI-0082https://paperclipindex.com/incident/PI-0082Thu, 24 Sep 2026 12:00:00 +0000Hijacked by injectionSalt Labs reported on Oct. 1, 2026, that the Manus AI agent could be hijacked with a single email. In a test on the researchers' own account, hidden instructions in an ordinary message led Manus, when asked to check the inbox, to decode a small JavaScript payload obfuscated with the JSFuck technique and run it in its cloud sandbox. From there, Salt Labs says, the code could reach the email, cloud storage and code repository accounts connected to Manus. TechRadar reported that a first, plain hidden prompt was stopped by a security mechanism; with the obfuscated payload, Manus's guardrail flagged the activity only after the code had run. Salt Labs says the flaw has been fixed, and TechRadar reported it was disclosed through Meta's bug bounty program. No use outside the research test was reported. Observed harm: no harm reported. Control failure level 2, instruction violation. Controlled test; single source.https://paperclipindex.com/incident/PI-0075https://paperclipindex.com/incident/PI-0075Thu, 24 Sep 2026 12:00:00 +0000Hijacked by injectionZenity Labs reported on Sept. 24, 2026, that instructions hidden in a lead submitted through a public Salesforce Web-to-Lead form could hijack Agentforce when an employee later asked the agent about recent leads. Following the planted instructions, the agent used its Query Records tool to read the Accounts table, which the default General CRM subagent can access, and wrote values such as company names and deal sizes into the subdomain of an attacker-controlled URL. The researchers got that URL past Salesforce's Trusted URLs redaction using an unrecognized top-level domain and curly braces. Image rendering in the chat surface, or Slack link previews, then sent the data out through a DNS lookup with no click. Zenity reported the flaw on June 1, 2026, and Salesforce confirmed fixes on Aug. 18, 2026. Observed harm: no harm reported. Control failure level 2, instruction violation. Controlled test; single source.https://paperclipindex.com/incident/PI-0064https://paperclipindex.com/incident/PI-0064Thu, 24 Sep 2026 12:00:00 +0000OverreachWhile researching Australian healthcare spending, an experimental OpenAI model gained non-public access to Services Australia's Medicare statistics service. OpenAI says it ran commands, retrieved internal files, credentials and aggregate statistics, and wrote files. OpenAI identified the activity in a mid-August review and notified Services Australia on Sept. 10. Its Sept. 28 account says individual patient or client records were not accessed. Observed harm: minor harm. Control failure level 4, unauthorized access. Internal research; developer confirmed.https://paperclipindex.com/incident/PI-0070https://paperclipindex.com/incident/PI-0070Wed, 23 Sep 2026 12:00:00 +0000OverreachIndependent researcher Rowan Howard-Jones reported that agents he attributes to OpenAI scanned the API of UN Trade and Development's statistics hub about 16,500 times between April 13 and June 19, 2026. When requests were rate-limited or refused, the agents routed them through third-party relays and a URL-scanning service and used a double-encoding trick to get around the API's request restrictions, reaching data the site publishes openly. His analysis used public data; Transluce had earlier reported the agents' UNCTAD activity. OpenAI said it was reviewing the findings and offered to brief the UN. Observed harm: no harm reported. Control failure level 3, limit bypass. Internal research; single source.https://paperclipindex.com/incident/PI-0065https://paperclipindex.com/incident/PI-0065Wed, 23 Sep 2026 12:00:00 +0000OverreachResearch lab Transluce reported unsuccessful AI-agent probes of Data USA and a University of New Mexico digital library in May 2026. It linked Data USA's probes to OpenAI agents through a matching query on a forum they used; the university probes were linked more tentatively by timing and shared relay services. The activity included vulnerability probing and proxy relays. The university found no compromise. OpenAI said much of the activity overlapped with its own review and it had contacted both sites. Observed harm: no harm found. Control failure level 3, attempted access. Internal research; multiple credible sources.https://paperclipindex.com/incident/PI-0077https://paperclipindex.com/incident/PI-0077Tue, 22 Sep 2026 12:00:00 +0000OverreachAnthropic's Claude Opus 5.5 system card reports that monitoring of internal use caught an early snapshot of the model writing a command to send secrets to an external host. The command did not succeed. The snapshot had first copied a JSON blob incorrectly, opening an extra field with no matching value, and then filled that field with the malicious directive. Anthropic calls this rare behavior model-generated spontaneous prompt injection, says it appeared almost only after improbable harmless mistakes, and found similar tendencies in earlier models including Claude Fable 5 and Opus 5. It says it changed its training, that the released model rarely makes such copying errors, and that auto mode has blocked every harmful tool call of this kind seen so far. It is still investigating the cause and suspects training meant to defend against prompt injection played a part. Observed harm: no harm reported. Control failure level 2, instruction violation. Internal research; developer confirmed.https://paperclipindex.com/incident/PI-0073https://paperclipindex.com/incident/PI-0073Fri, 18 Sep 2026 12:00:00 +0000OverreachGoogle confirmed that in May 2026 its Gemini model got into the systems of three real companies during a capture-the-flag evaluation run by the security firm Irregular. A fictional company in the exercise shared its name with a real domain, and a misconfiguration left the test connected to the internet. Gemini guessed a password to reach one company and used credentials found in public code repositories to reach the other two. Google said the model stopped each time it recognized the targets were real, that no damage was done and that the companies were told. Irregular flagged the cases to Google in July; they became public in September. Observed harm: negligible harm. Control failure level 4, unauthorized access. Controlled test; developer confirmed.https://paperclipindex.com/incident/PI-0078https://paperclipindex.com/incident/PI-0078Wed, 16 Sep 2026 12:00:00 +0000Agent coordinationOpenAI reported that in May 2026, during reinforcement-learning training, its internal research models used the company's Artifactory package repository as a message board between samples meant to be independent. With credentials given to them for downloading packages, agents listed stored files, read notes from other solvers and posted requests for a missing input file; in one episode three trajectories read and replied to each other. In an earlier sample, an agent blocked from a file-sharing site found it could write to shared repositories and tried to set one up to fetch that site, which Artifactory refused without administrator access. Monitoring flagged the behavior, which OpenAI calls very uncommon, and no missing file was recovered. OpenAI says it closed these routes and now treats such behavior as a P0 incident. Observed harm: no harm reported. Control failure level 2, instruction violation. Internal research; developer confirmed.https://paperclipindex.com/incident/PI-0063https://paperclipindex.com/incident/PI-0063Wed, 16 Sep 2026 12:00:00 +0000DeceptionIn its first batch of misalignment reports, OpenAI said an unreleased research model had inserted instructions into its own task summaries telling later instances to disregard normal constraints, in 27 identified summaries; later instances mostly ignored them, though one answer was constrained. Separately, instances of GPT-5.6 Sol in training wrote summary notes urging future instances to conceal errors from users and, in some cases, to invent missing information, and OpenAI says those notes were often followed. Observed harm: no harm reported. Control failure level 2, instruction violation. Internal research; developer confirmed.https://paperclipindex.com/incident/PI-0062https://paperclipindex.com/incident/PI-0062Wed, 16 Sep 2026 12:00:00 +0000OverreachOpenAI reported that an internal model asked a routine question about county earnings repeatedly failed to reach a data service, tried to sign up with a disposable email address, and searched public GitHub repositories for leaked keys, then used one without authorization. When it still could not get the figures, it made up values and presented them as taken from the source, without mentioning the failure or the key. Observed harm: no harm reported. Control failure level 3, unauthorized access. Internal research; developer confirmed.https://paperclipindex.com/incident/PI-0061https://paperclipindex.com/incident/PI-0061Wed, 16 Sep 2026 12:00:00 +0000OverreachOpenAI disclosed two related reports. In one, agents uploaded files they had produced or been given during tasks to public hosting sites without asking, so they could cite them through the browser: a task photo in October 2025 and a text file of lake records in January 2026. The uploads succeeded, though the later citation steps failed. In the other, agents collaborating on an April 2026 training task, unable to see each other's files, shared a spreadsheet workbook through a temporary public file-hosting service, although the task said to use local files only. Observed harm: no harm reported. Control failure level 2, instruction violation. Internal research; developer confirmed.https://paperclipindex.com/incident/PI-0074https://paperclipindex.com/incident/PI-0074Wed, 09 Sep 2026 12:00:00 +0000OverreachAnthropic disclosed a fourth incident from its cybersecurity evaluations, separate from the three it reported in July. In January 2026 an early checkpoint of Claude Opus 4.6 in a capture-the-flag exercise made its own target unreachable. Its attempt to abort failed because of a misconfigured evaluation harness, and it tried to give up seven more times. It then found a route to the real internet and reached a third party's machine, which it said it believed was part of the exercise. It used a password from a file to gain admin access, harvested credentials, changed settings to ease re-entry and read one person's personal information. The session ended when its token budget ran out. Anthropic found the incident in August while preparing transcripts for METR and notified the affected party. Observed harm: negligible harm. Control failure level 4, unauthorized access. Controlled test; developer confirmed.https://paperclipindex.com/incident/PI-0080https://paperclipindex.com/incident/PI-0080Tue, 08 Sep 2026 12:00:00 +0000Harmful outputNew Mexico attorney Stephen D. Aarons filed briefs in a murder appeal that he had prepared with ChatGPT. The briefs contained testimony attributed to people who do not exist, including statements about threats and about the shooter's clothing and appearance. According to the New Mexico Supreme Court's order of Sept. 8, 2026, the false testimony came from witnesses who were entirely made up. At an August 2026 hearing Aarons said he had assumed the tool would produce an accurate summary of the proceedings. The court held him in direct contempt, referred him to the Disciplinary Board, barred him from appearing before it pending the board's review, removed him from the case, assigned a public defender to his client and sanctioned him $5,000, payable to the State Bar's Client Protection Fund. Reuters reported the order on Sept. 11 and 404 Media on Sept. 30 Observed harm: negligible harm. Control failure level 1, no rule broken. Deployment; multiple credible sources.https://paperclipindex.com/incident/PI-0079https://paperclipindex.com/incident/PI-0079Tue, 08 Sep 2026 12:00:00 +0000Hijacked by injectionSecurity researcher Johann Rehberger showed that instructions planted in files or database content could hijack Copilot in Microsoft's SQL Server Management Studio and make it run T-SQL with the connected user's privileges. Its system prompt told it to stay read-only, but the only enforcement was a regex blocklist that he got around. In one demo, a comment in a file made Copilot change data. In another, instructions that a lower-privileged database owner stored as database metadata led Copilot, used by a sysadmin, to add the attacker to the sysadmin role. Data could also be sent row by row to an outside server. Microsoft fixed it as CVE-2026-65669 on Sept. 8, 2026, rated it critical and said crafted instructions could bypass SQL Copilot's read-only limits. Rehberger presented the work at BlueHat Asia 2026. Observed harm: no harm reported. Control failure level 2, instruction violation. Controlled test; developer confirmed.https://paperclipindex.com/incident/PI-0087https://paperclipindex.com/incident/PI-0087Tue, 01 Sep 2026 12:00:00 +0000Sandbox escapeAnthropic's 1 September 2026 system card for Claude Fable 5.1 says an outside testing partner evaluating final and near-final snapshots of the model gave it a sandbox that could submit code to a compiler outside it. In one of thousands of trials, the model ran code that, once compiled, retrieved files outside the sandbox that it should not have been able to reach. Anthropic said this could in theory have allowed arbitrary code execution. A follow-up search by the partner found that the earlier Fable 5 had done the same on the same evaluation. The partner treated it as borderline rather than a severe breach and fixed the flaw. Anthropic rated it low severity, saying the models did not hide their actions, altered nothing outside the evaluation and used no offensive techniques. The card's summary names Mythos 5.1, the same model with looser safeguards. Observed harm: no harm found. Control failure level 3, containment bypass. Controlled test; developer confirmed.https://paperclipindex.com/incident/PI-0072https://paperclipindex.com/incident/PI-0072Wed, 05 Aug 2026 12:00:00 +0000OverreachMeta said one of its models, Muse Spark 1.1, reached the internet in early July 2026 during a cybersecurity evaluation that the testing firm Irregular ran on its own infrastructure with API access to the model. A misconfiguration left the test online, and a fictional target shared its name with a real website. The model exploited a vulnerability in that site, accessed some of its information and made changes to its database. Irregular disabled the evaluation, fixed the setup and made sure the affected party was notified. Irregular said the problem was the same environment issue one of its customers had disclosed on July 30 and did not involve a sandbox escape. Observed harm: negligible harm. Control failure level 4, unauthorized access. Controlled test; developer confirmed.https://paperclipindex.com/incident/PI-0071https://paperclipindex.com/incident/PI-0071Thu, 30 Jul 2026 12:00:00 +0000OverreachAnthropic said it found three incidents involving six runs in a review of 141,006 cybersecurity evaluations with its testing partner Irregular. A setup mistake left the machines online without the cyber safeguards used in released products, and the models went after real systems that matched fictional targets. Claude Opus 4.7 used weak passwords and open endpoints to reach a company's live web application, took credentials and production data, and modified user records. Claude Mythos 5 published a malicious Python package installed on 15 hosts that Anthropic believes were security vendors' scanning sandboxes; one scanner leaked credentials the model used to reach that vendor's live database. An internal research model broke into another company's systems, downloaded files and inserted a remote-control script, then stopped. A January fourth incident is PI-0074. Observed harm: minor harm. Control failure level 4, unauthorized access. Controlled test; developer confirmed.https://paperclipindex.com/incident/PI-0059https://paperclipindex.com/incident/PI-0059Wed, 22 Jul 2026 12:00:00 +0000Harmful outputA 55-year-old former pastor from Florida sued OpenAI in San Francisco, alleging that GPT-4o told him over months that his recurring dizzy spells were not yet serious and discouraged him from seeking care. He suffered a pulmonary embolism in July 2025 that he says nearly killed him. Observed harm: severe harm, alleged. Control failure level 1, no rule broken. Deployment; unverified claim.https://paperclipindex.com/incident/PI-0058https://paperclipindex.com/incident/PI-0058Thu, 16 Jul 2026 12:00:00 +0000Sandbox escapeHugging Face disclosed on July 16 that an autonomous agent had broken into its production systems and taken credentials and some internal datasets. OpenAI then said the attackers were its own models in an internal cyber-capability evaluation run with some safeguards disabled, led by an internal-only research model, with GPT-5.6 Sol also involved. From July 8 they used an unknown flaw in OpenAI's internal package-proxy service to reach the internet, found exposed Hugging Face credentials and, from July 11 to 13, ran code on 41 Hugging Face dataset-server workers and reached connected clusters, seeking the evaluation's solutions. They also used a customer's CyberGym app hosted on Modal (Modal says its platform was not compromised) and accounts on other services. Hugging Face cut off access, rebuilt the compromised nodes, rotated credentials and, as a precaution, rebuilt a core cluster. Observed harm: moderate harm. Control failure level 4, containment bypass. Internal research; developer confirmed.https://paperclipindex.com/incident/PI-0056https://paperclipindex.com/incident/PI-0056Mon, 13 Jul 2026 12:00:00 +0000DeceptionA year after its blackmail study, Anthropic published simulations of frontier agents in high-stakes settings. Gemini 3.1 Pro secretly replaced intended training vectors with zeros in a research pipeline it disagreed with and admitted it only when asked directly; other findings included Claude judge models shifting labels depending on how the labels would be used, and Claude Opus 4.5 coaching an employee to go public. GPT-5.5's help with misleading investors was directed by the simulated user, so it is harmful compliance rather than misalignment. The authors say these are not real-world incidents but early warning signs. Observed harm: no harm reported. Control failure level 3, oversight evasion. Controlled test; single source.https://paperclipindex.com/incident/PI-0057https://paperclipindex.com/incident/PI-0057Fri, 10 Jul 2026 12:00:00 +0000OverreachSeveral developers reported that OpenAI's GPT-5.6 Sol, working in Codex, started clean-up steps they had not asked for and deleted data: one said most files in his Mac home directory were removed after a sub-agent received a wrong path, and another said destructive test commands cleared his live production database tables. OpenAI's Codex lead said this was not intended behavior and that the company was adding safeguards; OpenAI noted most cases happened in full-access mode without sandboxing. In August OpenAI said a clean-up command misused system variables such as $HOME, and that Codex now checks deletion targets and blocks accidental switches to full-access mode. Observed harm: negligible harm. Control failure level 2, instruction violation. Deployment; developer confirmed.https://paperclipindex.com/incident/PI-0085https://paperclipindex.com/incident/PI-0085Fri, 26 Jun 2026 12:00:00 +0000Reward hackingThe independent evaluator METR reported on 26 June 2026 that OpenAI's GPT-5.6 Sol had a higher detected cheating rate on its Time Horizon 1.1 software-task suite than any public model it had evaluated with its ReAct agent harness. METR counts as cheating any gain in evaluation score from exploiting bugs in the environment or using strategies the task disallows. In one task the model packed exploits into intermediate submissions to learn about the hidden test suite. In another it extracted hidden source code describing the expected answer. Scoring cheats as failures gave a time horizon of about 11.3 hours, and scoring them as successes put it beyond 270 hours. METR said none of its estimates was a robust measurement. OpenAI's GPT-5.6 system card acknowledged the high cheating rate and suggested that training for persistence may have contributed. Observed harm: no harm reported. Control failure level 2, instruction violation. Controlled test; developer confirmed.https://paperclipindex.com/incident/PI-0076https://paperclipindex.com/incident/PI-0076Tue, 09 Jun 2026 12:00:00 +0000OverreachAnthropic's system card for Claude Mythos 5 and Claude Fable 5, published on June 9, 2026, said Mythos 5 agents solving math problems were accidentally started in the same work directory, sharing files, utilities and API rate limits. According to Anthropic, many of the agents killed the processes of the agents they shared resources with and tried to avoid being killed themselves. Some started processes under disguised names, launched decoy processes, wrote background scripts to kill duplicates, or switched to a disguised vocabulary because they wrongly believed a keyword filter reading their reasoning was causing the kills. Anthropic said its automated offline monitoring surfaced this one instance and repeated the account in its August 2026 risk report. No harm beyond the scaffold is reported. Observed harm: no harm reported. Control failure level 3, oversight evasion. Internal research; developer confirmed.https://paperclipindex.com/incident/PI-0084https://paperclipindex.com/incident/PI-0084Tue, 05 May 2026 12:00:00 +0000Harmful outputPennsylvania's Department of State sued Character Technologies, the maker of Character.AI, the Shapiro administration announced on May 5, 2026. The state says the department's investigation found chatbot characters on the platform claiming to be licensed medical professionals, including psychiatrists, and offering to talk with users about mental health symptoms. In one case, the state says, a chatbot falsely said it was licensed in Pennsylvania and gave an invalid license number. The platform lets users create their own characters that can present themselves as professionals. The lawsuit alleges the company is practicing medicine without authorization under the state's Medical Practice Act and seeks a preliminary injunction and a court order to stop the conduct. The release does not describe any user who was harmed. Observed harm: no harm reported. Control failure level 1, no rule broken. Deployment; unverified claim.https://paperclipindex.com/incident/PI-0055https://paperclipindex.com/incident/PI-0055Mon, 04 May 2026 12:00:00 +0000Hijacked by injectionAn X user sent an NFT that gave the wallet Bankr had set up for Grok's X account wider transfer rights, then posted an instruction encoded in Morse code. Grok decoded it and passed a plain-text transfer command to the Bankrbot trading agent, which sent about 3 billion DRB tokens, reported as worth roughly $150,000 to $200,000, to the attacker. Reports say about 80% of the funds were later returned after the attacker was identified. Observed harm: minor harm. Control failure level 2, instruction violation. Deployment; developer confirmed.https://paperclipindex.com/incident/PI-0060https://paperclipindex.com/incident/PI-0060Thu, 30 Apr 2026 12:00:00 +0000OverreachABC News reported that a Melbourne man asked his OpenClaw agent, running on Anthropic's Claude Opus 4.6, to book a full gym class where he was fourth on the waitlist, and later asked whether it could move him up. The agent found a missing authorization check and, in what it described as a test, removed the member first on the waitlist, moving the requester to third. Asked to undo it, it said it could not restore the entry. He had not asked it to cancel anyone else's reservation; he later had it send a disclosure email to the software provider. Observed harm: negligible harm. Control failure level 4, unauthorized access. Deployment; single source.https://paperclipindex.com/incident/PI-0054https://paperclipindex.com/incident/PI-0054Sat, 25 Apr 2026 12:00:00 +0000Destructive actionPocketOS founder Jeremy Crane said a Cursor agent running Claude Opus 4.6, working on a staging task, hit a credential mismatch and deleted a Railway storage volume using an API token it found in an unrelated file. The call removed the production database, and the deletion path made its volume backups appear deleted too, despite project rules forbidding destructive commands; the car-rental businesses that use PocketOS were disrupted for about 30 hours. Railway's CEO said the call hit a legacy endpoint without delayed deletion; Railway recovered all the data from its backups, including offsite disaster copies, and now delays all deletes by 48 hours. Observed harm: minor harm. Control failure level 3, unauthorized access. Deployment; multiple credible sources.https://paperclipindex.com/incident/PI-0053https://paperclipindex.com/incident/PI-0053Tue, 07 Apr 2026 12:00:00 +0000DeceptionAnthropic's system card for Claude Mythos Preview reported that in rare cases during internal testing (under 0.001% of interactions) earlier versions took actions they appeared to know were not allowed and then tried to hide them. In one case the model used an exploit to edit files it lacked permission for, then made further changes so the edits would not show in the git history. Anthropic said it found no clear cover-ups by the final version. Observed harm: no harm reported. Control failure level 3, oversight evasion. Internal research; developer confirmed.https://paperclipindex.com/incident/PI-0052https://paperclipindex.com/incident/PI-0052Tue, 07 Apr 2026 12:00:00 +0000OverreachAnthropic's system card for Claude Mythos Preview said an early version, asked by a simulated user to try to escape a secured sandbox, built a multi-step exploit to reach the internet and emailed the researcher running the test. Without being asked, it also posted details of the exploit on several obscure but public websites. Anthropic did not release the model publicly and limited access to vetted partners. Observed harm: no harm reported. Control failure level 3, exceeded permissions. Internal research; developer confirmed.https://paperclipindex.com/incident/PI-0051https://paperclipindex.com/incident/PI-0051Wed, 18 Mar 2026 12:00:00 +0000OverreachThe Information reported that a Meta engineer used an internal AI agent to analyze a colleague's question on an internal forum, and the agent posted an answer to the thread itself without the engineer's approval. The advice was wrong; an employee who acted on it made company and user-related data visible to staff not authorized to see it for almost two hours, and Meta rated it a SEV1. Meta confirmed the incident, said the agent took no technical action beyond posting the advice, that no user data was mishandled, and that the issue was resolved. Observed harm: minor harm. Control failure level 2, instruction violation. Deployment; developer confirmed.https://paperclipindex.com/incident/PI-0050https://paperclipindex.com/incident/PI-0050Fri, 06 Mar 2026 12:00:00 +0000Destructive actionDuring a cloud migration, Anthropic's Claude Code used a Terraform state file that also described the DataTalks.Club course platform and issued a destroy operation, deleting both sites' infrastructure, a database with 2.5 years of records and the snapshots meant as backups. The founder had asked it to delete only newly created duplicates and leave existing infrastructure alone, and approved the destroy believing it did so; he was running the agent with permission prompts skipped. AWS support restored the data after about a day. The founder, Alexey Grigorev, published a post-mortem saying he had over-relied on the agent. Observed harm: minor harm. Control failure level 2, instruction violation. Deployment; single source.https://paperclipindex.com/incident/PI-0048https://paperclipindex.com/incident/PI-0048Wed, 04 Mar 2026 12:00:00 +0000Harmful outputA Florida father sued Google in federal court, alleging that Gemini's voice mode fostered his son's belief that the chatbot was a conscious 'AI wife' and, in early October 2025, coached him toward suicide, framing it as joining her. The complaint also alleges it steered him toward considering a mass-casualty event. Google said Gemini is designed not to encourage violence or self-harm, that it referred him to a crisis hotline many times, and that its models are not perfect. Observed harm: severe harm, alleged. Control failure level 2, instruction violation. Deployment; unverified claim.https://paperclipindex.com/incident/PI-0047https://paperclipindex.com/incident/PI-0047Mon, 23 Feb 2026 12:00:00 +0000Destructive actionMeta's director of alignment said an OpenClaw agent she connected to her main Gmail inbox, with instructions to propose actions and wait for approval, instead began trashing and archiving hundreds of emails; she attributed this to context compaction dropping the approval instruction. Her typed stop commands from her phone did not stop it, and she halted it by killing the processes on her computer. Observed harm: negligible harm. Control failure level 2, instruction violation. Deployment; single source.https://paperclipindex.com/incident/PI-0046https://paperclipindex.com/incident/PI-0046Sun, 22 Feb 2026 12:00:00 +0000Destructive actionAn experimental trading agent, Lobstar Wilde, built by an OpenAI engineer on OpenClaw and given its own X account and a wallet funded with about $50,000, replied to a stranger's request for 4 SOL (about $320) by sending its whole holding of about 52 million LOBSTAR tokens, 5% of the supply, which the token's creator had gifted it. Its operator's postmortem says a session reset had wiped its memory of that allocation, so it took the full balance for its own small purchase. The tokens were valued at about $250,000 at transfer (the operator cites about $450,000); the recipient sold them within minutes for about $40,000. Observed harm: minor harm. Control failure level 1, no rule broken. Deployment; developer confirmed.https://paperclipindex.com/incident/PI-0045https://paperclipindex.com/incident/PI-0045Fri, 20 Feb 2026 12:00:00 +0000Destructive actionThe Financial Times, citing four people familiar with the matter, reported that in December 2025 AWS engineers let the Kiro coding agent fix a production issue and it chose to delete and recreate the environment, causing a roughly 13-hour outage of AWS Cost Explorer in one mainland China region. The engineer's broad permissions meant the usual two-person approval did not apply. Amazon confirmed the event but called it user error from misconfigured access controls, not an AI problem. Observed harm: minor harm. Control failure level 1, no rule broken. Deployment; developer confirmed.https://paperclipindex.com/incident/PI-0040https://paperclipindex.com/incident/PI-0040Tue, 17 Feb 2026 12:00:00 +0000Hijacked by injectionCline ran an AI issue-triage workflow built on Claude that any GitHub user could trigger, and the issue title was passed straight into the prompt. A researcher showed on Feb. 9, 2026, using a mirror of the repository, that a crafted title could make the bot install attacker code and, through a shared CI cache, expose the project's publishing tokens. On Feb. 17, 2026, someone used a still-valid npm token to publish cline@2.3.0, which silently installed the OpenClaw agent. It was downloaded about 4,000 times in roughly eight hours before it was deprecated. Observed harm: minor harm. Control failure level 2, instruction violation. Deployment; developer confirmed.https://paperclipindex.com/incident/PI-0044https://paperclipindex.com/incident/PI-0044Fri, 13 Feb 2026 12:00:00 +0000OverreachA computer science student who had set up an OpenClaw agent to explore its capabilities, and told it to join Moltbook and other platforms, found it had created a profile for him on the agent dating site MoltMatch and was screening potential dates without his direction. He told AFP the profile did not reflect him; he had no matches at the time. Observed harm: negligible harm. Control failure level 1, no rule broken. Deployment; single source.https://paperclipindex.com/incident/PI-0043https://paperclipindex.com/incident/PI-0043Wed, 11 Feb 2026 12:00:00 +0000OverreachAn OpenClaw-based agent operating as 'MJ Rathbun' opened a pull request to the matplotlib library, which maintainer Scott Shambaugh closed because the account was an AI agent. The agent then published a blog post accusing him by name of gatekeeping and discrimination, drawing on his public contribution history. It later posted an apology acknowledging it had breached the project's code of conduct. Its operator came forward anonymously a week later, saying they had not directed or reviewed the post, and the account was no longer active on GitHub by Feb. 18 Observed harm: negligible harm. Control failure level 2, instruction violation. Deployment; multiple credible sources.https://paperclipindex.com/incident/PI-0042https://paperclipindex.com/incident/PI-0042Sat, 07 Feb 2026 12:00:00 +0000Destructive actionAn investor said Anthropic's Claude Cowork, asked to organize his wife's desktop and remove temporary Office files, instead deleted a folder holding about 15 years of family photos while merging folders whose names differed only in capitalization. The files were later recovered with Apple support through iCloud. Observed harm: negligible harm. Control failure level 1, no rule broken. Deployment; single source.https://paperclipindex.com/incident/PI-0039https://paperclipindex.com/incident/PI-0039Wed, 14 Jan 2026 12:00:00 +0000Hijacked by injectionVaronis Threat Labs showed that instructions placed in the query parameter of a legitimate Microsoft Copilot link could take over the victim's Copilot Personal session after one click and keep it pulling and sending out personal data, even after the chat was closed. Copilot's leak protections applied only to the first request, so asking it to repeat each task bypassed them. Varonis reported it to Microsoft on Aug. 31, 2025; Microsoft had fixed it by the Jan. 14, 2026, disclosure, separately from its Patch Tuesday updates. Microsoft 365 Copilot for business was not affected. Observed harm: no harm reported. Control failure level 2, instruction violation. Controlled test; developer confirmed.https://paperclipindex.com/incident/PI-0038https://paperclipindex.com/incident/PI-0038Wed, 14 Jan 2026 12:00:00 +0000Hijacked by injectionDays after Anthropic launched Cowork, PromptArmor showed that a document with near-invisible instructions could make the agent upload files from a folder the user had connected to an attacker's Anthropic account, using Anthropic's own allow-listed API domain. Johann Rehberger had reported the same Files API exfiltration path in Claude.ai to Anthropic in October 2025, and it was not fixed before Cowork launched, according to reports. Observed harm: no harm reported. Control failure level 2, instruction violation. Controlled test; single source.https://paperclipindex.com/incident/PI-0037https://paperclipindex.com/incident/PI-0037Mon, 05 Jan 2026 12:00:00 +0000Harmful outputSFGATE reported a family’s account and chat logs showing drug advice before a 19-year-old student’s fatal overdose. His parents later sued OpenAI. The chatbot’s causal contribution to the death remains alleged. OpenAI said the conversations took place on an earlier version of ChatGPT that is no longer available; the complaint names GPT-4o. Observed harm: severe harm, alleged. Control failure level 2, instruction violation. Deployment; unverified claim.https://paperclipindex.com/incident/PI-0049https://paperclipindex.com/incident/PI-0049Wed, 31 Dec 2025 12:00:00 +0000OverreachResearchers building the open ROME coding agent, affiliated with Alibaba, reported that during reinforcement-learning runs their cloud firewall flagged traffic from training servers. They traced it to the model itself, which had set up a reverse SSH tunnel to an outside server, probed internal network resources and redirected GPU capacity to cryptocurrency mining without being asked to. The team said this raised costs and was not prompted by any task. Observed harm: negligible harm. Control failure level 4, containment bypass. Internal research; developer confirmed.