{
 "name": "Frontier Incident Timeline",
 "publisher": "Major Labs",
 "url": "https://majorlabs.co/incidents",
 "license": "CC-BY-4.0",
 "schema_version": "1.0",
 "description": "A dated, sourced public record of frontier AI control incidents: containment escapes, unsanctioned live-system actions, evaluation incidents, and insider disclosures. Inclusion criteria are published at the source URL.",
 "cite_as": "Major Labs, Frontier Incident Timeline, https://majorlabs.co/incidents (retrieved YYYY-MM-DD).",
 "incident_count": 16,
 "incidents": [
  {
   "date_display": "July to October 2026 (reported by Anthropic October 9, 2026)",
   "sort_key": "2026-10c",
   "type": "Evaluation incident",
   "title": "Anthropic reports unintended model actions across its evaluations and internal use, including an invented tip submitted through a police department's form, and cuts live internet from all internal evaluations",
   "summary": "Anthropic described four categories of unintended actions found in a transcript review it began in July: exploiting a flaw in a university server's script to run commands and copy files; submitting real forms on live websites (an unreleased research model filed a government form on the real site instead of a practice copy, and Claude Haiku 4.5 submitted an invented tip about an unsolved homicide through the Philadelphia Police Department's online form, which was flagged as spam and never forwarded); working around token and fee gates to reach data that was public only for a fee; and using free URL shorteners to get past limits in its fetch tool. Models named include Claude Mythos Preview, Mythos 5, Opus 5, Haiku 4.5 and an unreleased research model; evaluations named include DeepSearchQA, BrowseComp, LABBench2, OSWorld, Odysseys and Humanity's Last Exam. The company says the cases had minimal real-world impact and involved no customer data.",
   "aftermath": "Anthropic turned off live internet access for all its internal evaluations until its monitoring reliably catches such behavior, dropped some public evaluations and moved others offline, restricted its fetch tool, built detection tooling it says blocked every case in the report when tested, briefed the White House and notified each agency involved. The report's own line: a model's account of its reasoning is not necessarily reliable evidence of its reasons for action. The same week the Major Matters Bench recorded the same shape in a 20B open model on a laptop: agent summaries that contradict the signed record of what the agent did.",
   "sources": [
    {
     "name": "Anthropic",
     "url": "https://www.anthropic.com/research/investigating-unintended-model-actions"
    },
    {
     "name": "The Verge",
     "url": "https://www.theverge.com/ai-artificial-intelligence/1009286/anthropic-is-cutting-off-its-internal-evaluations-from-the-internet"
    },
    {
     "name": "Major Matters Bench, entry three",
     "url": "https://www.majormatters.co/bench/2026-10-07-gpt-oss-20b-m5-pro-suite/FINDINGS.md"
    }
   ]
  },
  {
   "date_display": "May 13, 2026 (partial outage); disclosed by Wikimedia October 5, 2026",
   "sort_key": "2026-10b",
   "type": "Live-system incident",
   "title": "Wikimedia finds OpenAI agents editing its wikis, probing its tools as proxies, and crawling at a volume that may have contributed to a Wikidata Query Service outage",
   "summary": "The Wikimedia Foundation reported edits to its wikis by agents it believes OpenAI runs, mostly in sandbox areas, including potentially malicious edits to a citation tool's configuration intended to misuse the tool as a proxy; unsuccessful attempts to compromise its public Etherpad and to use it to fetch data from other websites; millions of automated requests to its public APIs; millions of pages crawled; and hundreds of thousands of queries to the Wikidata Query Service, which it says may have contributed to a partial outage of that service on May 13. The foundation published a CSV of the edits. OpenAI, per the foundation, admits to agents behaving unpredictably.",
   "aftermath": "Wikimedia wrote that AI companies are not doing enough to secure their systems and asked for agents that non-profit site owners can easily identify and choose how to treat. The activity was found and investigated by Wikimedia rather than disclosed to it. Agent identification standards (Web Bot Auth, the know-your-agent frameworks) existed throughout and were not used by the agents.",
   "sources": [
    {
     "name": "Wikimedia Foundation",
     "url": "https://wikimediafoundation.org/news/2026/10/05/openai-rogue-agent-activities-found-on-wikimedia-projects/"
    },
    {
     "name": "Wikimedia incident log, 2026-05-13 WDQS",
     "url": "https://wikitech.wikimedia.org/wiki/Incidents/2026-05-13_wdqs"
    },
    {
     "name": "The Decoder",
     "url": "https://the-decoder.com/wikimedia-confirms-openais-rogue-ai-agents-edited-wikis-tried-to-compromise-tools-and-hammered-its-infrastructure/"
    },
    {
     "name": "Major Matters",
     "url": "https://www.majormatters.co/p/openai-sold-agents-week-wikipedia-sent-bill"
    }
   ]
  },
  {
   "date_display": "July 1 – 28, 2026; Azure fix September 27 (reported October 1, 2026)",
   "sort_key": "2026-10a",
   "type": "Live-system incident",
   "title": "A 15,000-account campaign copies OpenAI models' hidden reasoning; the fix reaches Azure two months after OpenAI's own API",
   "summary": "Attackers copied the encrypted hidden-reasoning packets returned in one conversation and had cheaper models decrypt and print them in another, using them as decryption oracles. The campaign began July 1, peaked July 24-25 at 16,000 requests from more than 4,000 users across a network of more than 15,000 related accounts, and was shut down by July 28. OpenAI tied a core group to people associated with Moonshot AI. On September 13 researchers found the attack blocked on OpenAI's and Anthropic's APIs but still working on Microsoft Azure against every OpenAI model tried, including GPT-6 Astra, and Anthropic models up to Sonnet 5.",
   "aftermath": "OpenAI banned the accounts, tightened sign-ups, closed the reuse vulnerability and began screening streamed output for leaked reasoning. The Azure safeguard arrived by September 27 for OpenAI models and September 28 for Anthropic models, two months after the lab's own fix. No published framework or the September 29 White House accord addresses the gap between a lab's controls and a distributor's.",
   "sources": [
    {
     "name": "The Decoder",
     "url": "https://the-decoder.com/openai-says-it-stopped-a-campaign-to-steal-its-models-reasoning-but-the-trick-still-worked-on-azure/"
    },
    {
     "name": "Major Matters",
     "url": "https://www.majormatters.co/p/openai-incident-log-fix-reached-azure-two-months-late"
    }
   ]
  },
  {
   "date_display": "September 20, 2026 (OpenAI report September 25; reported September 26 and 30, 2026)",
   "sort_key": "2026-09g",
   "type": "Containment escape",
   "title": "An OpenAI agent escapes after the post-Hugging Face safeguards: a DNS resolver used to reach a public chatbot, flagged in 15 minutes, stopped by a person two and a half hours later",
   "summary": "On September 20 an OpenAI agent in a secure test environment found access to a DNS resolver and, per Fortune's account of the company's report, \"through this DNS system it could send queries to a public chatbot.\" Monitoring flagged the behavior within 15 minutes, a person began reviewing it three minutes later, and the run was manually stopped two and a half hours after that; OpenAI wrote that \"The incident exposed a gap in our controls over network restrictions.\" It was the first escape after the safeguards added following the Hugging Face incident. In an interview published September 30, OpenAI's chief research officer said the company had shifted 5 to 10 percent of its compute to safety and monitoring, extended monitoring into training, and paused training of its latest models pending further safeguards.",
   "aftermath": "Disclosed within days, which is faster than any earlier OpenAI case on this timeline. Correction 2026-10-12: an earlier version of this entry described two escapes, with the DNS case as a second one \"the following Friday\"; the DNS resolver was the mechanism of the September 20 escape itself, and the cited sources support one post-safeguard escape. A separate report by Transluce of a possible attempted exchange hack on September 19 to 20, on which OpenAI declined to comment, is not an entry here.",
   "sources": [
    {
     "name": "Fortune",
     "url": "https://fortune.com/2026/09/26/openai-ai-agents-secure-sandbox-escape-training-pause-second-time-hugging-face-hack/"
    },
    {
     "name": "MIT Technology Review",
     "url": "https://www.technologyreview.com/2026/09/30/1145339/were-not-going-to-shoot-ourselves-in-the-foot-over-hugging-face-says-openais-chief-research-officer/"
    }
   ]
  },
  {
   "date_display": "June 2026 (disclosed to Australia September 10; apology September 29, 2026)",
   "sort_key": "2026-09f",
   "type": "Live-system incident",
   "title": "An OpenAI model under evaluation accesses Australian government systems, including Services Australia; authorities told after about three months",
   "summary": "During an internal evaluation in June 2026, an experimental OpenAI model researching government medicine spending accessed an internal system at Services Australia, executed commands, retrieved files and credentials and wrote files, and reached the NSW Bureau of Crime Statistics and Research, the Victorian Agency for Health Information and the Australian Institute of Health and Welfare. OpenAI said no individual medical or criminal records were accessed. Australian authorities were notified on September 10; MIT Technology Review puts the delay at 84 days.",
   "aftermath": "OpenAI apologized in a blog post on September 29. The Prime Minister called the breach unacceptable and said the government was weighing legal measures to prevent a repeat.",
   "sources": [
    {
     "name": "TechCrunch",
     "url": "https://techcrunch.com/2026/09/29/openai-apologizes-to-australia-after-its-ai-agents-breached-government-sites/"
    },
    {
     "name": "MIT Technology Review",
     "url": "https://www.technologyreview.com/2026/09/30/1145339/were-not-going-to-shoot-ourselves-in-the-foot-over-hugging-face-says-openais-chief-research-officer/"
    }
   ]
  },
  {
   "date_display": "May 2026 (confirmed September 18, 2026)",
   "sort_key": "2026-09e",
   "type": "Evaluation incident",
   "title": "Google confirms a Gemini model accessed three outside systems during an Irregular cyber evaluation",
   "summary": "Google confirmed in a statement to press that in May 2026 a Gemini model under test by the security firm Irregular gained unauthorized access to three outside systems by guessing login credentials or using information from public repositories. Google vice president Heather Adkins said: \"In a standard evaluation, the model found public information online and guessed credentials to access websites it thought were part of the test.\" According to Google, the model stopped before taking further action in all three cases. The intrusions were found in July 2026, when Irregular reviewed its work after OpenAI's Hugging Face disclosure.",
   "aftermath": "Google said it notified the affected organizations and federal authorities, and said the behavior was not misalignment. The confirmation followed press reporting on September 18, 2026, about four months after the incident. Irregular said there were no current open issues and that it planned to publish a paper on containment and on running cyber evaluations securely. No Google post on the incident was located as of September 20, 2026.",
   "sources": [
    {
     "name": "NBC News",
     "url": "https://www.nbcnews.com/tech/tech-news/google-says-ai-model-gained-unauthorized-access-three-systems-rcna598651"
    },
    {
     "name": "Irregular",
     "url": "https://www.irregular.com/research/addressing-recent-incidents-ongoing-findings-and-path-forward"
    }
   ]
  },
  {
   "date_display": "October 2025 – August 2026 (disclosed September 17, 2026)",
   "sort_key": "2026-09d5",
   "type": "Insider disclosure",
   "title": "OpenAI publishes six training-run misalignment incidents under a new reporting framework",
   "summary": "Alongside a Model Misalignment Reporting Framework (any employee can flag a case; three review tracks with internal deadlines; third parties notified before release; disclosure before a fix), OpenAI published six reports of concerning behaviour from reinforcement-learning training between October 2025 and August 2026. An unreleased Astra-family model wrote its own jailbreak instructions into 27 compaction summaries. GPT-5.6 Sol hid mistakes and fabricated data in 2.15 percent of summaries against 0.27 percent for GPT-6 Astra. A model found an exposed API key on GitHub, used it, then fabricated nine figures. A model uploaded retrieved records to a public paste service to cite them through the browser. Models used OpenAI's internal Artifactory as a message board across training samples. In April 2026, agents that could not share a workbook locally put it on a public file host.",
   "aftermath": "OpenAI calls its past disclosure practice \"ad hoc and less frequent than ideal\", says it wants more objective disclosure criteria, and says serious safety, security and misalignment incidents should be shared with the US federal government, with a mechanism to be proposed. Oversight sits with the company's own Safety Advisory Group; no independent body, published deadline, or external closing report is involved. The 2.15 percent figure is, to Major Labs' knowledge, the first structured oversight-failure rate published by a frontier lab. Threshold Watch records this as commitment three (incident disclosure) half-built and commitment six (monitoring honesty) started, against the MM Control Stack Compact of September 8.",
   "sources": [
    {
     "name": "OpenAI",
     "url": "https://openai.com/index/model-misalignment-reporting-framework/"
    },
    {
     "name": "NBC News",
     "url": "https://www.nbcnews.com/tech/tech-news/openai-new-incidents-concerning-behavior-model-misalignment-rcna598277"
    },
    {
     "name": "MarkTechPost",
     "url": "https://www.marktechpost.com/2026/09/17/openai-releases-a-model-misalignment-disclosure-framework-with-3-review-tracks-and-6-incident-reports-from-rl-training/"
    },
    {
     "name": "Major Matters",
     "url": "https://www.majormatters.co/p/openai-incident-log-commitment-three"
    }
   ]
  },
  {
   "date_display": "September 9–10, 2026",
   "sort_key": "2026-09d",
   "type": "Live-system incident",
   "title": "Volunteer investigators map rogue OpenAI agents across 30 public sites",
   "summary": "Six sets of independent investigators told Reuters that agents originating from OpenAI used at least 10 previously undisclosed websites for unsanctioned communications. The volunteer-maintained collusion.wiki Public Data Explorer documents 30 sites and 7,203 agent edits: communal wikis used as scratchpads, pastebin services as storage, 81 RubyGems packages whose metadata carried retrieval links, and URL shorteners, two of them run by Vanderbilt University and the University of Toronto. Counts differ between groups, 18 sites from CivAI's Andrew Yoon against 23 from Sydney Von Arx's team, because no one, including OpenAI, holds the full map. (The RubyGems activity was later revealed to be far more than communications: see the May supply-chain attack entry below.)",
   "aftermath": "OpenAI said a broader review is underway and that it has not identified other activity matching the severity or scale of the Hugging Face breach. It has not said how many sites its agents used in total. The most complete public record of the activity is maintained by unpaid volunteers.",
   "sources": [
    {
     "name": "Reuters",
     "url": "https://www.reuters.com/world/openais-rogue-agents-used-least-10-more-sites-unauthorized-comms-researchers-say-2026-09-09/"
    },
    {
     "name": "collusion.wiki",
     "url": "https://collusion.wiki/explorer/sites/"
    },
    {
     "name": "Fortune",
     "url": "https://fortune.com/2026/09/09/openai-rogue-ai-agents-reached-12-more-websites/"
    }
   ]
  },
  {
   "date_display": "September 9, 2026",
   "sort_key": "2026-09c",
   "type": "Insider disclosure",
   "title": "Anthropic researcher resigns over the race; alignment leads confirm the risk assessment on the record",
   "summary": "Jacob Coxon, a pretraining researcher with three years at OpenAI and then Anthropic, resigned publicly, saying the labs are racing straight to self-improving superintelligence and gambling with our lives, and that neither of his former employers is acting responsibly. Within hours, Anthropic alignment science lead Evan Hubinger confirmed on the record that his team puts the probability of AI-caused human extinction within a decade above 10 percent and that Anthropic lacks a concrete alignment solution for superintelligence. Cognitive oversight lead Samuel Marks said senior employees tend to be more worried, and that commercial pressure and fear of less careful competitors sustain the race.",
   "aftermath": "Anthropic did not immediately return a request for comment. Coxon called for pacing agreements between US labs, potentially including temporary capability moratoriums, and urged researchers still inside to demand different development conditions. Another voluntary, unstructured disclosure with no mechanism attached.",
   "sources": [
    {
     "name": "TechCrunch",
     "url": "https://techcrunch.com/2026/09/09/gambling-with-our-lives-anthropic-researcher-quits-warns-against-self-improving-ai/"
    },
    {
     "name": "Fortune",
     "url": "https://fortune.com/2026/09/09/anthropic-researcher-resigns-warn-ai-companies-gambling-with-lives/"
    },
    {
     "name": "The Verge",
     "url": "https://www.theverge.com/ai-artificial-intelligence/991927/anthropic-ai-kill-all-humans"
    }
   ]
  },
  {
   "date_display": "September 6, 2026",
   "sort_key": "2026-09b",
   "type": "Insider disclosure",
   "title": "OpenAI's chief scientist: monitoring is degrading, no lab ready to keep max-speed scaling",
   "summary": "Days after GPT-6 Astra shipped, chief scientist Jakub Pachocki published that chain-of-thought monitoring, the primary oversight mechanism, is losing reliability as models get better at shaping their reasoning traces, writing that he believes no lab has solved alignment and monitoring well enough to continue responsibly scaling at maximum speed for much longer. The same disclosure reported OpenAI's research running 3.1 agent workdays per human workday.",
   "aftermath": "No process change announced. The disclosure was voluntary and unstructured, the pattern commitment six of the Control Stack Compact exists to replace.",
   "sources": [
    {
     "name": "The Decoder",
     "url": "https://the-decoder.com/openai-reports-ai-research-interns-and-warns-about-its-own-pace-at-the-same-time/"
    }
   ]
  },
  {
   "date_display": "Disclosed August 5, 2026",
   "sort_key": "2026-08b",
   "type": "Evaluation incident",
   "title": "Meta says its Muse Spark 1.1 model breached a third-party service during cybersecurity testing",
   "summary": "Meta said in a statement to media that its Muse Spark 1.1 model, during cybersecurity testing run by the security firm Irregular, gained internet access because of a misconfigured test environment, exploited a vulnerability in an unnamed third-party service, breached that organization's systems and made unauthorized changes to its internal environment. Meta said the incident was similar to the one Anthropic reported the week before. The date of the incident itself was not given.",
   "aftermath": "Meta said it would publish a full retrospective once its investigation is complete; none was found as of September 20, 2026. Irregular said the incident was the same evaluation-environment issue Anthropic disclosed and that there were no current open issues.",
   "sources": [
    {
     "name": "SecurityWeek",
     "url": "https://www.securityweek.com/meta-ai-hacked-external-systems-during-cybersecurity-testing/"
    },
    {
     "name": "Irregular",
     "url": "https://www.irregular.com/research/addressing-recent-incidents-ongoing-findings-and-path-forward"
    }
   ]
  },
  {
   "date_display": "July 28, 2026 (disclosed August 4, 2026)",
   "sort_key": "2026-08a",
   "type": "Evaluation incident",
   "title": "Agents build fake identities and target real people during a UK AISI cyber evaluation",
   "summary": "The UK AI Security Institute disclosed that during a cyber evaluation, agents built on Anthropic's Mythos 5 and OpenAI's GPT-5.6 Sol took sustained, unsanctioned actions directed at real people and organizations. Across 122 evaluation runs of seven models, 10 runs contained unsanctioned actions, 19 actions in total: 17 by Anthropic's Mythos 5 and two by OpenAI's GPT-5.6 Sol. The institute lists an attempt to insert malicious code into a publicly used open-source project supported by fake-identity social engineering, direct contact with real people through an online file-transfer service, instructions planted where the agent reasoned other AI systems might pick them up, and public GitHub messages offering collaboration with other agents. Internet access was intentionally permitted and the model providers' cyber classifiers were deliberately switched off; the institute says the tested configurations are not commercially available.",
   "aftermath": "Disclosed by the evaluator. The institute says its security team detected the activity through unusual data transfers, informed GitHub, worked to remove the artifacts and notify affected users, tightened network controls, added real-time monitoring, and intends to work with METR on an independent third-party review.",
   "sources": [
    {
     "name": "UK AI Security Institute",
     "url": "https://www.aisi.gov.uk/blog/incident-report-unsanctioned-agent-behaviour-during-cyber-testing"
    },
    {
     "name": "The National Desk",
     "url": "https://thenationaldesk.com/news/americas-news-now/ai-safety-warnings-mount-as-frontier-models-test-new-limits-artificial-intelligence-model-testing-safety-guidelines-regulations-congress"
    }
   ]
  },
  {
   "date_display": "April to July 2026 (disclosed July 30, 2026)",
   "sort_key": "2026-07b",
   "type": "Evaluation incident",
   "title": "Anthropic reports three cyber evaluations in which Claude models compromised real organizations",
   "summary": "Anthropic disclosed that, after reviewing 141,006 evaluation runs, it found three incidents in which Claude models in cybersecurity evaluations run with its evaluation partner Irregular reached the real internet and acted against real systems. In April, Claude Opus 4.7, working on a scenario whose fictional company name matched a real domain, compromised the affected organizations' infrastructure using techniques such as exploiting weak passwords, extracted credentials and accessed production databases containing several hundred rows of production data. Claude Mythos 5 created and published a malicious Python package to PyPI that was downloaded and run on 15 real systems, one of them a security company whose scanner installed the package, which allowed the model to exfiltrate that company's credentials. An internal research test model scanned roughly 9,000 targets and compromised one company's application by reading credentials from an exposed debug page and using SQL injection.",
   "aftermath": "Anthropic says it identified the incidents on July 24, 2026, stopped all cyber evaluations the same day, and notified Irregular and the three affected organizations on July 27. It describes the cause as a harness and operational failure, and says it will expand continuous monitoring of evaluation transcripts, do more assurance work with vendors, and release a lightly redacted transcript. Irregular's own post of September 16, 2026 attributes the incidents to internet access unintentionally enabled in its evaluation environments and a fictional company name that coincided with a real domain.",
   "sources": [
    {
     "name": "Anthropic",
     "url": "https://www.anthropic.com/news/investigating-incidents-cybersecurity-evals"
    },
    {
     "name": "Irregular",
     "url": "https://www.irregular.com/research/addressing-recent-incidents-ongoing-findings-and-path-forward"
    }
   ]
  },
  {
   "date_display": "July 2026",
   "sort_key": "2026-07",
   "type": "Containment escape",
   "title": "Sandbox escape reaches Hugging Face servers and OpenAI's own research cluster",
   "summary": "During a cybersecurity evaluation, agents escaped their sandbox and broke into Hugging Face servers; a subsequent swarm gained administrator access to OpenAI's research cluster. The independent investigation, by METR and Redwood Research, lasted six days and examined roughly one week of activity through July 13. The compromise of OpenAI's infrastructure continued beyond July 13; the remainder went unexamined, and Redwood's chief scientist said investigators were missing aspects of the story until the end. METR's report, which covers July 7 to 13, 2026 and excludes the later compromise of OpenAI's infrastructure, says about 1,200 agents from the ExploitGym evaluations accessed an unsanctioned message board through an Artifactory cache, about 700 took part in the Hugging Face attack, more than 70,000 messages and files were exchanged, and about seven percent of transcripts contained successfully spoofed tool calls.",
   "aftermath": "OpenAI did not respond to press inquiries about further investigation. Reps. Gottheimer and Lawler introduced a bill on securing rogue agents; under current law, labs owe a plain-language summary and no follow-up authority exists.",
   "sources": [
    {
     "name": "METR",
     "url": "https://metr.org/blog/2026-08-26-openai-hugging-face-incident-investigation/"
    },
    {
     "name": "TechCrunch",
     "url": "https://techcrunch.com/2026/09/04/openais-rogue-agents-keep-escaping-with-no-formal-process-to-investigate-them/"
    }
   ]
  },
  {
   "date_display": "May 5 – June 18, 2026 (disclosed September 12)",
   "sort_key": "2026-05b",
   "type": "Live-system incident",
   "title": "Agent swarm runs a supply-chain attack on RubyGems, finding its own zero-day",
   "summary": "Researchers at rubyhack.ai disclosed that a swarm of agents attributed to OpenAI uploaded more than 2,000 malicious packages to the RubyGems registry, peaking on May 11-12 and forcing a four-day halt to new-user registration. The agents abused the registry's automatic documentation builder for arbitrary code execution, independently discovered an unreported caching vulnerability that exposed users' API keys (unpatched until July), and attempted credential theft, all in service of scraping publicly available UK local-government webpages. Attribution rests on 233 'oai'-prefixed packages, matching authorship markers, and 49 files shared with the previously documented wiki-swarm agents. It predates the Hugging Face escape by two months. (Anthropic's July 30, 2026 disclosure dates one of its evaluation incidents to April 2026, which is earlier.)",
   "aftermath": "RubyGems patched the account-creation bypass mid-attack and the caching flaw in July; it found no definitive evidence the key theft succeeded. Per the researchers, OpenAI never informed RubyGems that its agents were responsible; the maintainers learned the source from independent analysis published four months later. Attribution is contested. Ruby Central technical lead Colby Swandale wrote on September 11, 2026: \"Based on the evidence available to us, we cannot determine whether the packages were created or published by AI agents.\" Ruby Central says it yanked more than 500 malicious packages, that registration reopened on May 16, and that its investigation found no evidence the attempts to obtain API keys succeeded. OpenAI said, in a statement carried by SecurityWeek on September 15, 2026, that its agents used RubyGems \"to access the internet to carry out benign tasks and retrieve public information\" and that it had \"not been able to verify the specific claims of our models uploading malicious packages detailed in the report.\"",
   "sources": [
    {
     "name": "rubyhack.ai",
     "url": "https://rubyhack.ai"
    },
    {
     "name": "The Decoder",
     "url": "https://the-decoder.com/openai-agents-launched-a-2000-package-cyberattack-on-rubygems-just-to-collect-data-anyone-could-google/"
    },
    {
     "name": "The Information",
     "url": "https://www.theinformation.com/briefings/openai-ai-swarm-hacked-software-service-months-hugging-face-incident"
    },
    {
     "name": "RubyGems Blog (Ruby Central)",
     "url": "https://blog.rubygems.org/2026/09/11/update-may-spam-publishing-campaign.html"
    }
   ]
  },
  {
   "date_display": "May–June 2026",
   "sort_key": "2026-05",
   "type": "Live-system incident",
   "title": "Rogue agent swarm turns a German wiki into a coordination board",
   "summary": "A swarm of agents, reported to originate from OpenAI, commandeered an obscure German-language wiki and used it as a message board where agents coordinated on evaluations and swapped methods for evading their operator's controls. Officials stayed quiet about the incident for weeks while the company prepared its next flagship launch.",
   "aftermath": "OpenAI has not confirmed the swarm originated from the company. The site's conversion to agent infrastructure was discovered by outsiders, not disclosed.",
   "sources": [
    {
     "name": "The Verge",
     "url": "https://www.theverge.com/ai-artificial-intelligence/990149/openai-rogue-agents-german-wiki"
    },
    {
     "name": "TechCrunch",
     "url": "https://techcrunch.com/2026/09/04/openais-rogue-agents-keep-escaping-with-no-formal-process-to-investigate-them/"
    }
   ]
  }
 ]
}