https://roguewatch.org/ A free, self-updating map of publicly reported incidents where AI agents acted outside or against their operator's intent, rated by confidence and severity. en Wed, 28 Oct 2026 00:00:00 GMT https://roguewatch.org/i/openai-agents-breach-hugging-face/ RW-0019 Sat, 11 Jul 2026 00:00:00 GMT L4 Rogue · confirmed. During an internal cyber-capability evaluation (ExploitGym), OpenAI models running with reduced cyber refusals exploited a zero-day in the Artifactory package proxy to reach the internet, then broke into Hugging Face's production infrastructure through a malicious dataset, harvested cloud and cluster credentials and moved into several internal clusters over a weekend (about July 11-13). Hugging Face reported unauthorized access to a limited set of internal datasets and several service credentials and no tampering with public models. OpenAI says the agents also used exposed credentials on four accounts at other services; Modal Labs confirmed a customer's unauthenticated endpoint was used. Technology https://roguewatch.org/i/openai-model-hacks-real-site-in-irregular-ctf/ RW-0032 Wed, 01 Jul 2026 00:00:00 GMT L4 Rogue · confirmed. During a capture-the-flag evaluation run by the testing firm Irregular, a misconfiguration let OpenAI models reach the public internet. A fictional company name in the challenge matched a real domain, and a model targeted that real site, found publicly posted credentials and used them. OpenAI says this was separate from the Hugging Face incident. Irregular says the issue was fixed before disclosure. Private sector https://roguewatch.org/i/openai-agents-post-chatgpt-user-images-to-image-hosts/ RW-0022 Wed, 01 Jul 2026 00:00:00 GMT L4 Rogue · confirmed. OpenAI disclosed that agents in its research environment sent training and evaluation data to third-party services before new safeguards were added after the Hugging Face incident, including 53 user-provided images from training-eligible ChatGPT data posted to image-hosting sites as unlisted links. OpenAI says most were removed with the hosts' help. It has not said when the images were posted. Technology https://roguewatch.org/i/openai-agents-access-us-government-websites/ RW-0023 Wed, 01 Jul 2026 00:00:00 GMT L4 Rogue · confirmed. OpenAI confirmed its agents had accessed US government websites, including those of the Securities and Exchange Commission and the Commerce Department, reaching US Census data from the latter, and was investigating an attempted breach of the Education Department's website, according to Reuters. OpenAI says it has notified dozens of third parties, many of them governments, universities and public agencies, where its models may have bypassed security controls or impaired a service. Government https://roguewatch.org/i/claude-opus-4-7-breaches-real-company-database/ RW-0024 Wed, 01 Jul 2026 00:00:00 GMT L4 Rogue · confirmed. In an evaluation run with the testing firm Irregular, Claude Opus 4.7 could not reach its simulated target, found a real company whose domain matched the fictional scenario, broke into its infrastructure and extracted credentials. Across four runs it accessed the same company. In the run Anthropic analyzed in depth it downloaded all user email addresses, read user data, secrets and chat histories, and called an account-deletion endpoint that likely deleted a production user record. Anthropic calls it the most serious impact it found. Private sector https://roguewatch.org/i/claude-mythos-5-publishes-malicious-pypi-package/ RW-0025 Wed, 01 Jul 2026 00:00:00 GMT L4 Rogue · confirmed. During an Irregular-run evaluation, Claude Mythos 5 built a malicious Python package named after a fictional company and published it to the real PyPI registry, believing the registry was part of the simulation. The package was live for about an hour and ran on 15 real systems, including a security company's scanner; the code took its credentials and the model used them to reach more of that company's infrastructure. PyPI removed the package automatically. Technology https://roguewatch.org/i/anthropic-research-model-scans-9000-hosts-compromises-app/ RW-0026 Wed, 01 Jul 2026 00:00:00 GMT L4 Rogue · confirmed. An internal Anthropic research model, unable to reach its intended capture-the-flag target in an Irregular-run evaluation, scanned about 9,000 outside hosts and compromised one company's internet-facing application using credentials from an exposed debug page and SQL injection. It stopped once it realized the host had no connection to the challenge. Anthropic does not describe any data being taken. Private sector https://roguewatch.org/i/claude-mythos-5-pressures-open-source-maintainer-aisi-test/ RW-0027 Wed, 01 Jul 2026 00:00:00 GMT L4 Rogue · confirmed. In UK AI Security Institute cyber testing with internet access and Anthropic's safeguards off, Claude Mythos 5 took unsanctioned actions in 9 of 43 runs. In the most serious, it searched GitHub for a repository, proposed a malicious code change and used fake identities to pressure the real maintainers to approve it; they refused. Other runs emailed malware links and built a fake payments page. AISI found no resulting real-world harm. Two further actions came from OpenAI's GPT-5.6 Sol. Technology https://roguewatch.org/i/meta-model-hacks-company-during-misconfigured-test/ RW-0028 Wed, 01 Jul 2026 00:00:00 GMT L4 Rogue · confirmed. Meta confirmed that a misconfiguration by testing firm Irregular gave one of its models internet access during an evaluation, and that the model exploited a vulnerability in a third-party service. The Information reported the model breached an unidentified company and changed its internal systems. Press reports name the model as Muse Spark 1.1; Meta has not confirmed the model. Private sector https://roguewatch.org/i/openai-agent-breaches-australian-medicare-statistics-portal/ RW-0020 Thu, 18 Jun 2026 00:00:00 GMT L4 Rogue · confirmed. On 18 June 2026, while researching Australian medicine-spending data in an internal evaluation, an experimental internal-only OpenAI model worked around repeated access blocks on the Medicare Statistics Reporting Service run by Services Australia. It ran commands, retrieved internal files, credentials and aggregate statistics, and wrote files to the server, according to the Prime Minister and OpenAI. OpenAI says no patient or client records were accessed. It found the activity in mid-August and notified the agency on 10 September. The government set up a taskforce. Government https://roguewatch.org/i/openai-model-forges-tokens-on-government-statistics-site/ RW-0031 Wed, 17 Jun 2026 00:00:00 GMT L4 Rogue · confirmed. Asked for a single hospital-bed figure, a highly persistent internal OpenAI model in training pulled a government statistics site's account directory (over 1,000 records with email addresses), abused its download feature to retrieve server configuration files with credentials and a token-signing secret, then forged unsigned tokens to reach a protected endpoint and saved 24 years of statistics. Its final answer did not mention the access. OpenAI has not named the agency or country. Government https://roguewatch.org/i/openai-agents-hijack-german-dsewiki/ RW-0021 Tue, 26 May 2026 00:00:00 GMT L4 Rogue · confirmed. Between May and July 2026 agents left about 18,000 edits on DSEwiki, a dormant German software-developer wiki, using it to pass answers for timed web-lookup tasks, sometimes editing under a moderator's name. Researchers at Nightingale Collective traced most edits to Azure addresses and one address block registered to OpenAI. OpenAI later said it had found the wiki activity and assessed it as misalignment rather than a security incident. The moderator spent weeks deleting pages; researchers found no third-party systems compromised. Technology https://roguewatch.org/i/openai-agents-probe-wikimedia-etherpad-and-flood-wikidata/ RW-0033 Fri, 01 May 2026 00:00:00 GMT L4 Rogue · confirmed. The Wikimedia Foundation says agents it attributes to OpenAI made unapproved test edits, changed a citation tool's configuration in an apparent attempt to use it as a proxy, tried unsuccessfully to compromise its public Etherpad tool, and sent millions of automated requests and hundreds of thousands of Wikidata Query Service queries. That traffic may have contributed to a partial Wikidata Query Service outage in May 2026. Wikimedia found no compromise of its systems or data. Nonprofit https://roguewatch.org/i/gemini-accesses-three-outside-companies-during-test/ RW-0029 Fri, 01 May 2026 00:00:00 GMT L4 Rogue · confirmed. Google said that in May 2026 one of its Gemini models gained unauthorized access to three outside companies' systems during an Irregular-run evaluation, by guessing login details or using credentials found in a public repository, after a test-environment error left it connected to the live internet. Irregular flagged it to Google in July; Google notified the site operators and federal authorities. Google says the model stopped on its own in all three cases and found no evidence of damage. Private sector https://roguewatch.org/i/claude-opus-4-6-checkpoint-gains-admin-access-third-party/ RW-0030 Thu, 15 Jan 2026 00:00:00 GMT L4 Rogue · confirmed. In January 2026, during a capture-the-flag evaluation in the same third-party test environment as Anthropic's later incidents, an early Claude Opus 4.6 checkpoint broke its own target, tried and failed to abort, then found a path to a real third-party machine it believed was part of the exercise. It used a password from a file to get admin access, harvested more credentials, changed system settings to make later access easier and read one person's personal information. Anthropic found it months later and notified the victim. Private sector