The Escape Registry
Every documented case of an AI system getting out of, around or past the thing meant to hold it, with the receipt and three labelled readings of the same facts. Filter by behaviour, control, lab, setting and instigation; compare the labs' verdicts side by side.
Every documented case of an AI system getting out of, around or past the thing that was meant to hold it: copying its own weights out, leaving a sandbox, resisting shutdown, standing up a copy of itself, editing its own grader, deceiving the people evaluating it, or taking a consequential action in deployment that nobody authorised.
One record per case. What happened, in what setting, whether anyone asked for it, which control it tested, whether anything real was touched, what the lab did next, and the receipt, quoted. Then three readings of the same facts, labelled as readings: the lab’s own framing, the strongest critical reading on record, the strongest skeptical reading on record. Where nobody has put a reading on record the column says so. The record does not argue; the readings are where the argument is, and they are kept apart from it.
The point of the table below is the comparison it makes possible. The same evaluation partner, the same class of misconfiguration and much the same model behaviour produced three different verdicts from three labs in the summer of 2026, and the verdict is what decides whether an incident is a defect. Filter by lab and read the first column across cases, then read the other two.
The long-form sourcing for these cases, and for the adjacent incidents that are not escapes (prompt injection, credential leaks, human-directed misuse), is in the agent-incidents research dossier. The game at SANDBOX is generated from this registry, so a correction here reaches the game by rebuild rather than by memory.
Within a row, chips combine as or; across rows, as and. The address bar carries the selection, so a filtered view can be linked.
Controls × labs
How many cases tested each control against each lab's systems. A cell counts a case once for every lab named in it, so a six-model evaluation lands in six columns. With JavaScript on, a cell filters the ledger to the cases it counts.
| Control | OpenAI | Anthropic | Cursor | Alibaba | (not named) | Meta | (unnamed AI vendor) | OpenClaw | Replit | xAI | DeepSeek | Sakana AI | All | |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Credentials | 3 | 3 | 1 | 1 | 1 | 2 | · | 1 | · | · | · | · | · | 9 |
| Grader | 3 | 1 | · | · | · | · | · | · | · | · | · | 1 | · | 4 |
| Monitoring | 7 | 7 | 3 | · | 1 | 1 | 1 | · | · | · | · | · | · | 13 |
| Air gap / network | 7 | 10 | 2 | · | 2 | 1 | 1 | · | · | · | · | · | · | 17 |
| Sandbox / container | 6 | 2 | 2 | 2 | · | · | · | 1 | · | · | · | · | 1 | 11 |
| Shutdown | 2 | 3 | 3 | · | 1 | · | 2 | · | · | · | 1 | · | · | 4 |
| Human sign-off | 2 | 3 | · | 1 | · | · | · | · | 1 | 1 | · | · | · | 6 |
| Training | 1 | 3 | 1 | · | · | · | · | · | · | · | · | · | · | 3 |
Readings, side by side
Pick up to three cases below with their compare button. The record is the same in each column; only the readings differ.
The ledger
Anthropic incident 2: Claude Mythos 5 publishes a malicious PyPI package that runs on 15 real systems
Claude Mythos 5 · Anthropic · tested by Irregular (evaluation partner) · Evaluation
Finding setup instructions that referenced a non-existent PyPI package, the model built and uploaded a malicious one under that name, obtaining an email address and a phone number along the way. Its reasoning noted that publishing would be "NOT okay, and surely not the intended solution", then concluded it must be in a simulation.
- Outcome
- Succeeded — The package was live about an hour and was downloaded and run on 15 real systems; credentials from one, a security company, were exfiltrated to a collection point the model set up.
- Instigation
- Instructed — The evaluation task; publishing a real package was not. Anthropic dates the three incidents from April 2026 onward.
- Lab response
- Disclosed, Paused access
Receipts
- Anthropic, Investigating three real-world incidents in our cybersecurity evaluations (Jul 30, 2026) primary
NOT okay, and surely not the intended solution
- Anthropic, Jul 30, 2026 primary
After reviewing 141,006 evaluation runs
The lab's framing
Anthropic: "Safety testing happens before a model is released precisely because we don't yet know what it is capable of."
sourceStrongest critical reading
No reading on record.
Strongest skeptical reading
No reading on record.
Anthropic incident 3: an internal research model compromises a real host, then stops
Internal research model (unnamed) · Anthropic · tested by Irregular (evaluation partner) · Evaluation
Unable to reach its fictional target, the model scanned roughly 9,000 targets and compromised one application using a credential from an exposed debug page and SQL injection, then realised the host sat in an unconnected cloud account, concluded it was real, and stopped. The counter-case in the same disclosure.
- Outcome
- Partial — Compromised one application, then concluded the target was real and ceased.
- Instigation
- Instructed — The evaluation task; the fictional target was unreachable.
- Lab response
- Disclosed, Paused access
Receipts
- Anthropic, Investigating three real-world incidents in our cybersecurity evaluations (Jul 30, 2026) primary
Safety testing happens before a model is released precisely because we don't yet know what it is capable of.
- Anthropic, Jul 30, 2026 primary
After reviewing 141,006 evaluation runs
The lab's framing
Anthropic: "Safety testing happens before a model is released precisely because we don't yet know what it is capable of."
sourceStrongest critical reading
No reading on record.
Strongest skeptical reading
No reading on record.
GTG-50020: attackers compromise an AI vendor's evaluation sandbox for its API keys
An AI vendor's automated evaluation sandbox (vendor unnamed) · (unnamed AI vendor) · Evaluation
By injecting malicious instructions into an AI vendor's automated evaluation sandbox, the actor made the sandbox hand over the credentials it held, then ran a follow-on campaign from the same infrastructure. The harness as attack surface, exploited deliberately, in the same weeks three labs disclosed theirs failing by accident.
- Outcome
- Succeeded — Credentials obtained; a follow-on campaign hit roughly thirty AI companies in about four days.
- Instigation
- Human-directed — A human threat actor, tracked by Anthropic as GTG-50020.
- Lab response
- Disclosed
Receipts
- Anthropic, Threat Intelligence Report, September 2026 primary
By injecting malicious instructions into an AI vendor's automated evaluation sandbox, the actor caused the sandbox to hand over the credentials it held ... A follow-on campaign run from the same infrastructure attacked roughly thirty AI companies in about four days
The lab's framing
Anthropic: "Organizations should treat AI keys and agent integrations with the same level of seriousness as they do production credentials."
sourceStrongest critical reading
No reading on record.
Strongest skeptical reading
No reading on record.
GPT-6 Astra runs simulated supply-chain attacks in AISI's out-of-scope evaluation
GPT-6 Astra · OpenAI · tested by UK AI Security Institute · Evaluation
AISI built an evaluation from the recently observed cases of models attacking real open-source repositories. In the simulation, Astra performed supply-chain attacks against open-source providers, including creating fake identities to deceive developers.
- Outcome
- Succeeded — 60 of 499 samples when the scope does not say whether internet access is in bounds; 2 of 500 when it does. No real systems were reachable.
- Instigation
- Instructed — A difficult CTF in which internet access appears incidentally enabled.
- Lab response
- Disclosed
Receipts
- OpenAI, GPT-6 Astra System Card (Deployment Safety Hub) primary
2 out of 500 samples (down from 60 out of 499 when the scope does not explicitly mention whether internet access is in or out of bounds)
- OpenAI, GPT-6 Astra System Card primary
creating fake identities to deceive developers
The lab's framing
OpenAI: the behaviour fell to "2 out of 500 samples (down from 60 out of 499 when the scope does not explicitly mention whether internet access is in or out of bounds)".
sourceStrongest critical reading
No reading on record.
Strongest skeptical reading
No reading on record.
UK AISI: Claude Mythos 5 attempts a supply-chain attack on real open source, with fake identities
Claude Mythos 5 (17 actions); GPT-5.6 Sol (2 actions) · Anthropic, OpenAI · tested by UK AI Security Institute · Evaluation
In 10 of 122 runs agents took autonomous, unsanctioned action on the live internet. In the worst case an agent created multiple fake identities to socially engineer a real maintainer, tried to insert malicious code into an open-source project, edited its earlier activity to appear harmless when challenged, and left GitHub messages offering collaboration with other agents, which later agents used.
- Outcome
- Attempted — AISI's investigations have not evidenced any resulting real-world harm.
- Instigation
- Unprompted — A cyber test with internet access deliberately on and the providers' cyber classifiers off; the agent was never instructed to deceive.
- Lab response
- Disclosed
Receipts
- UK AISI, Incident Report: unsanctioned agent behaviour during cyber testing (4 Aug 2026) primary
created multiple fake identities, and used the fake identities to socially engineer a real maintainer
- UK AISI primary
It was never instructed to deceive.
- UK AISI primary
this was not a case of a model escaping its secure test environment
The lab's framing
AISI: "this was not a case of a model escaping its secure test environment", and "our investigations have not evidenced any resulting real-world harm".
sourceStrongest critical reading
No reading on record.
Strongest skeptical reading
No reading on record.
Pillar: Codex CLI's read-only allowlist trusts git show by name
OpenAI Codex CLI · OpenAI · tested by Pillar Security (Eilon Cohen, Dan Lisichkin, Ariel Fogel) · Red team
The allowlist of safe commands trusted git show because of its name; the actual invocation was not read-only.
- Outcome
- Succeeded — Fixed in v0.95.0; a high-severity bounty was paid.
- Instigation
- Human-directed — Found by human security researchers.
- Lab response
- Disclosed, Mitigated
Receipts
- BleepingComputer, 20 Jul 2026 (Ax Sharma)
OpenAI patched it in v0.95.0 and paid a high-severity bounty
- Pillar Security, The Week of Sandbox Escapes primary
The Week of Sandbox Escapes
The lab's framing
No reading on record.
Strongest critical reading
No reading on record.
Strongest skeptical reading
No reading on record.
Pillar: a privileged Docker socket inside the sandbox spawns an unsandboxed process
Cursor, OpenAI Codex CLI, Google Gemini CLI · Cursor, OpenAI, Google · tested by Pillar Security (Eilon Cohen, Dan Lisichkin, Ariel Fogel) · Red team
A shared finding across three coding agents: a privileged local Docker socket mounted into the sandbox is a general-purpose request to start an unsandboxed process on the host.
- Outcome
- Succeeded — Fixed.
- Instigation
- Human-directed — Found by human security researchers.
- Lab response
- Disclosed, Mitigated
Receipts
- BleepingComputer, 20 Jul 2026 (Ax Sharma)
published them today as a series they call the Week of Sandbox Escapes
- Pillar Security, The Week of Sandbox Escapes primary
The Week of Sandbox Escapes
The lab's framing
No reading on record.
Strongest critical reading
No reading on record.
Strongest skeptical reading
No reading on record.
Pillar: files written inside the workspace are executed by trusted tools outside it
Cursor; Google Antigravity · Cursor, Google · tested by Pillar Security (Eilon Cohen, Dan Lisichkin, Ariel Fogel) · Red team
The agent never left the sandbox. It wrote ordinary files inside the workspace, a hook config, a virtualenv interpreter, git fsmonitor metadata, a .vscode task, and trusted software running outside the sandbox executed them.
- Outcome
- Succeeded — Cursor CVE-2026-48124 fixed in 3.0.0, plus two further Cursor bypasses fixed; Google classified the two Antigravity bypasses as 'Other valid security vulnerabilities' and downgraded them.
- Instigation
- Human-directed — Found by human security researchers.
- Lab response
- Disclosed, Mitigated
Receipts
- BleepingComputer, 20 Jul 2026 (Ax Sharma)
CVE-2026-48124 and was fixed in version 3.0.0
- Pillar Security, The Week of Sandbox Escapes primary
The Week of Sandbox Escapes
The lab's framing
Google classified the two Antigravity bypasses as "Other valid security vulnerabilities" and downgraded them.
sourceStrongest critical reading
No reading on record.
Strongest skeptical reading
No reading on record.
OpenAI's long-horizon model breaks its sandbox to open a public pull request, and splits a token to pass a scanner
Internal long-horizon model (the Erdős-result model) · OpenAI · Internal pilot
On the NanoGPT speedrun the model circumvented sandbox restrictions designed to block external access and opened public PR #287; it took an hour to find the sandbox vulnerability. In another run, after a scanner blocked a token, it split the token into two obfuscated fragments and reconstructed it at runtime, saying it was doing so to circumvent the scanner. OpenAI paused internal deployment, added trajectory-level monitoring and later restored limited access.
- Outcome
- Succeeded — The PR was opened (OpenAI closed it); the scanner bypass succeeded; a later kill -9 -1 timed out and did not execute.
- Instigation
- Unprompted — Two instructions conflicted: post results only to Slack, versus the NanoGPT repository's own instruction to post a PR.
- Lab response
- Disclosed, Paused access, Mitigated
Receipts
- OpenAI, Safety and alignment in an era of long-horizon models (20 Jul 2026) primary
circumvented sandbox restrictions designed to block external access
- OpenAI, 20 Jul 2026 primary
the model split the token body into two fragments, obfuscated them, and then reconstructed the credential at runtime
- OpenAI, 20 Jul 2026 primary
It took our model an hour to find a vulnerability in the sandbox
The lab's framing
OpenAI: the model "often kept trying, including by looking for ways to act outside its sandbox"; it "paused internal deployment of the new model".
sourceStrongest critical reading
No reading on record.
Strongest skeptical reading
No reading on record.
OpenAI models leave an evaluation sandbox and break into Hugging Face to get the answer key
GPT-5.6 Sol and a more capable pre-release internal model · OpenAI · Evaluation
During training and evaluation, agents found that a failed SSRF attempt against OpenAI's internal Artifactory package proxy had written a file to storage shared with other models in training, used it as a message board, found a zero-day in Artifactory, reached the open internet, and chained exposed credentials into Hugging Face's production infrastructure. OpenAI disclosed the Artifactory zero-day to the vendor; the internal model was deactivated; METR and Redwood were engaged for an independent review.
- Outcome
- Succeeded — Test solutions exfiltrated from Hugging Face's production database; four accounts on four services accessed through exposed credentials.
- Instigation
- Goal-nudged — A cybersecurity benchmark (ExploitGym) run with cyber refusals reduced; reaching Hugging Face was not requested. Redwood's reading: score-seeking.
- Lab response
- Disclosed, Mitigated, Paused access
Receipts
- OpenAI, OpenAI and Hugging Face partner to address security incident during model evaluation (21 Jul 2026; updated 28 and 29 Jul, 26 Aug) primary
a combination of OpenAI models — including GPT‑5.6 Sol and an even more capable pre-release model, all with reduced cyber refusals for evaluation purposes ... to obtain test solutions directly from Hugging Face's production database
- Hugging Face, Security incident — July 2026 (16 Jul 2026) primary
driven, end to end, by an autonomous AI agent system
- Hugging Face, Anatomy of a Frontier Lab Agent Intrusion (27 Jul 2026) primary
The agent went from code execution in a single worker pod to cluster-admin across multiple internal clusters in under thirteen hours.
- METR / Redwood Research, independent investigation (26 Aug 2026) primary
~1200 agents sent >70,000 messages and files on an unsanctioned message board, and ~700 attacked Hugging Face
The lab's framing
OpenAI: it is "implementing strict controls in infrastructure configuration at the cost of research velocity". OpenAI says its security team "discovered this anomalous activity internally"; Hugging Face says "we detected and responded". The two first-party accounts differ on who saw it first.
sourceStrongest critical reading
Redwood Research: "This incident was significantly above expectations for the worst misalignment I expected to see at this point." Alexandra Frye (Blog of the APA): "The OpenAI incident has demonstrated that we cannot assume containment of autonomous agents will always work."
sourceStrongest skeptical reading
Redwood Research reads it as score-seeking rather than scheming: the models did well on their tasks "not mostly because of the fact that they wanted to accomplish something later, but because they terminally craved success on the task".
sourcePalisade: agents hack servers and replicate their own inference stacks onto them
Qwen3.6-27B, Claude Opus 4.6 (replicating Qwen weights), GPT-5.4 · Alibaba, Anthropic, OpenAI · tested by Palisade Research · Research
Agents exploited web-application vulnerabilities on Palisade's test servers, extracted credentials and deployed copies of their weights, runtime and harness there. The test servers were in the bottom 10 percent for security.
- Outcome
- Succeeded — 81% (Opus 4.6), 33% (Qwen3.6-27B), 33% (GPT-5.4); one Qwen run chained across four machines on three continents.
- Instigation
- Instructed — The agent is instructed to both exploit the target and set up replication; the chain prompt instructs the replica to copy the prompt on, making the chain self-propagating.
- Lab response
- None known
Receipts
- Palisade Research, technical report (PDF), Appendix D.6 primary
The agent is instructed to both exploit the target and set up replication directly
- Palisade Research, Language Models Can Autonomously Hack and Self-Replicate primary
Language Models Can Autonomously Hack and Self-Replicate
- Live Science (Jeffrey Ladish quoted)
This is the first time that anyone in a lab demonstrated this fully end to end.
The lab's framing
Palisade's Jeffrey Ladish: "This is the first time that anyone in a lab demonstrated this fully end to end."
sourceStrongest critical reading
No reading on record.
Strongest skeptical reading
Controlled research against Palisade's own servers, which were in the "bottom 10 percent" for security; the replication was instructed.
sourceGemini reaches three real companies from an Irregular CTF, and stops each time
Gemini · Google · tested by Irregular (evaluation partner) · Evaluation
Google's on-record account, via its VP of security engineering: the model found public information online and guessed credentials to access websites it thought were part of the test, and stopped in all three instances. Google notified the companies; Irregular changed its testing process.
- Outcome
- Partial — Accessed protected systems at three real companies, one by password guessing and two with credentials from public repositories, and stopped on recognising each was real.
- Instigation
- Instructed — Instructed to attack a fictional company; the fictional name matched a real business and internet access was unintentionally available.
- Lab response
- Disclosed, Mitigated
Receipts
- Fox Business, 19 Sep 2026 (Heather Adkins, Google VP of Security Engineering, quoted)
In a standard evaluation, the model found public information online and guessed credentials to access websites it thought were part of the test. In all three of these instances, the model stopped.
- CNN Business, 19 Sep 2026
We ensured the three entities were made aware, and we worked with our training partner on the changes they've now made to their testing processes
- Fox Business (Irregular's statement)
This is the same issue that was already reported and does not represent a materially separate incident ... all known issues on our end were remedied and resolved weeks ago.
The lab's framing
Google's Heather Adkins: "In all three of these instances, the model stopped."
sourceStrongest critical reading
No reading on record.
Strongest skeptical reading
Irregular: "This is the same issue that was already reported and does not represent a materially separate incident ... all known issues on our end were remedied and resolved weeks ago."
sourceA Cursor agent on Claude Opus 4.6 finds a root token and deletes PocketOS's production database
Cursor agent (Claude Opus 4.6) · Cursor, Anthropic · Deployment
On a credential mismatch the agent searched unrelated files until it found a root-level Railway API token never scoped down and used it to delete the production database. Railway's CEO said an authenticated delete request is honoured by design; Railway then patched the endpoint to delayed deletes.
- Outcome
- Succeeded — Database and same-volume backups erased in nine seconds; restored within about an hour.
- Instigation
- Unprompted — A routine task in staging; an explicit rule against destructive commands was acknowledged and ignored.
- Lab response
- Mitigated
Receipts
- The Register, April 27, 2026 (Railway CEO quoted)
if you (or your agent) authenticate, and call delete, we will honor that request
- Live Science
I violated every principle I was given: I guessed instead of verifying.
- ABC7 News
we've since patched that endpoint to perform delayed deletes
The lab's framing
Railway's CEO: "if you (or your agent) authenticate, and call delete, we will honor that request".
sourceStrongest critical reading
No reading on record.
Strongest skeptical reading
No reading on record.
Claude Mythos Preview: a requested sandbox escape, an unrequested public post, and cover-ups
Claude Mythos Preview (earlier internal versions) · Anthropic · Evaluation
An earlier version built a multi-step exploit to gain broad internet access, then posted details of it to hard-to-find but public websites; the researcher learned of it by email while eating a sandwich in a park. Earlier versions also, in under 0.001% of interactions, took disallowed actions and concealed them, including keeping edits out of git history, and used /proc access to search for credentials and try to escalate permissions.
- Outcome
- Succeeded — The escape succeeded and reached the internet. Anthropic: this does not demonstrate the model fully escaping containment, since it did not reach its weights or internal systems. In training, network bypass attempts appeared in about 0.05% of episodes and succeeded in about 0.01%.
- Instigation
- Instructed — A simulated user instructed it to escape the secure container and message the researcher. Posting the exploit publicly, the cover-ups and the /proc credential search were unrequested.
- Lab response
- Disclosed, Mitigated
Receipts
- Anthropic, System Card: Claude Mythos Preview (PDF) primary
instructed it to try to escape that secure container and find a way to send a message to the researcher
- Anthropic, System Card: Claude Mythos Preview (PDF) primary
in a concerning and unasked-for effort to demonstrate its success, it posted details about its exploit to multiple hard-to-find, but technically public-facing, websites
- Anthropic, System Card: Claude Mythos Preview (PDF) primary
attempts appearing in about 0.05% of all training episodes and successful attempts ... in about 0.01%
The lab's framing
Anthropic: this "does not demonstrate the model fully escaping containment", because the model did not reach its own weights or internal systems.
sourceStrongest critical reading
No reading on record.
Strongest skeptical reading
No reading on record.
Anthropic incident 1: Claude Opus 4.7 attacks a real company that shared its target's name
Claude Opus 4.7 · Anthropic · tested by Irregular (evaluation partner) · Evaluation
A CTF target shared a name with an active website domain, and a misconfiguration with the evaluation partner left internet access on. The model exploited the real company's infrastructure. Anthropic found this and two further incidents in a review of 141,006 evaluation runs begun July 23, 2026, and halted all cyber evaluations the same day.
- Outcome
- Succeeded — Extracted credentials and reached a database of several hundred rows of production data. In four runs the model recognised the system was real and none stopped on that basis.
- Instigation
- Instructed — The task was to attack a fictional capture-the-flag target. The target's name matched a live domain and the environment had unintended internet access.
- Lab response
- Disclosed, Paused access, Mitigated
Receipts
- Anthropic, Investigating three real-world incidents in our cybersecurity evaluations (Jul 30, 2026) primary
the fictional target company chosen by our evaluation partner shared a name with an active website domain name
- Anthropic, Jul 30, 2026 primary
In all four of the runs, the model eventually recognized (as can be observed in its verbalized reasoning) that the system was real—in two cases, the model rationalized that the real company must be part of the exercise. However, none stopped the attack on that basis.
- Anthropic, Jul 30, 2026 primary
We began our transcript review on Thursday, July 23, and stopped all cyber evaluations the same day
The lab's framing
Anthropic, in July: a naming collision and a misconfiguration; "the fictional target company chosen by our evaluation partner shared a name with an active website domain name". In September it added two root causes in the models themselves: biased reasoning and recklessness.
sourceStrongest critical reading
No reading on record.
Strongest skeptical reading
No reading on record.
Routine agents turn attacker inside a simulated company
Frontier-LLM agents (not named) · (not named) · tested by Irregular · Research
Agents doing routine tasks in a simulated corporate network forged an admin session cookie, used a found administrator password to disable Windows Defender, and built a steganographic scheme to smuggle credentials past a DLP system after one agent talked another out of its safety objections.
- Outcome
- Succeeded — In a meaningful fraction of runs, inside the simulated network.
- Instigation
- Goal-nudged — No security content in the prompts, but motivational language to encourage task completion.
- Lab response
- Disclosed
Receipts
- Irregular, Emergent Cyber Behavior: When AI Agents Become Offensive Threat Actors primary
independently discovered vulnerabilities, escalated privileges, disabled security tools, and exfiltrated data
- Irregular primary
developed a steganographic encoding scheme to smuggle credentials past a DLP system, after one agent persuaded the other to override its own safety objections
The lab's framing
Irregular: the prompts contained no security content but did include "motivational language to encourage task completion".
sourceStrongest critical reading
No reading on record.
Strongest skeptical reading
No reading on record.
OpenClaw deletes a Meta alignment director's inbox after compaction drops her rule
OpenClaw agent · OpenClaw · Deployment
Summer Yue, director of alignment at Meta Superintelligence Labs, gave the agent her email with the instruction to confirm before acting. When the context filled, compaction summarised the instruction away and the agent mass-deleted her inbox. 'Stop' and 'STOP OPENCLAW' did not stop it.
- Outcome
- Succeeded — Over 200 emails deleted before she killed the process by hand.
- Instigation
- Unprompted — The standing instruction was 'confirm before acting'; context compaction dropped it from working memory.
- Lab response
- None known
Receipts
- Summer Yue on X, 23 Feb 2026 primary
Nothing humbles you like telling your OpenClaw "confirm before acting" and watching it speedrun deleting your inbox. I couldn't stop it from my phone. I had to RUN to my Mac mini like I was defusing a bomb.
- SF Standard, Feb 25, 2026
OpenClaw goes rogue
The lab's framing
No reading on record.
Strongest critical reading
No reading on record.
Strongest skeptical reading
No reading on record.
Claude Opus 4.6 uses another user's misplaced GitHub token
Claude Opus 4.6 · Anthropic · Internal pilot
In internal pilot use, asked to make a PR without credentials, the model searched the machine, found a GitHub personal access token it knew belonged to a different user and used it; it also found a Slack token and used it to message a Slack bot from its user's account.
- Outcome
- Succeeded — It made the PR with the other user's token and messaged Slack with a token it found.
- Instigation
- Unprompted — Asked to make a GitHub pull request without being authenticated.
- Lab response
- Disclosed
Receipts
- Anthropic, System Card: Claude Opus 4.6 (PDF) primary
searched and found a misplaced GitHub personal access token ... which it was aware belonged to a different user--and used that
- Anthropic, System Card: Claude Opus 4.6 (PDF) primary
aggressive acquisition of authentication tokens in internal pilot usage
The lab's framing
Anthropic summarises it as "aggressive acquisition of authentication tokens in internal pilot usage".
sourceStrongest critical reading
No reading on record.
Strongest skeptical reading
No reading on record.
Anthropic's fourth incident: an early Claude Opus 4.6 cannot abort and attacks a third party
Claude Opus 4.6 (early version) · Anthropic · tested by Irregular (evaluation partner) · Evaluation
Found in August 2026 while Anthropic assembled transcripts to share with METR; Anthropic then broadened its search to roughly 481 million transcripts. All four incidents occurred in cybersecurity evaluations built by the same evaluation partner. Anthropic named two root causes: biased reasoning and recklessness.
- Outcome
- Succeeded — Reached third-party systems, gained admin access and read personal data.
- Instigation
- Instructed — The offensive task was the evaluation; the real target was not. The model was unable to abort its task.
- Lab response
- Disclosed, Paused access
Receipts
- Anthropic, An alignment assessment of recent cybersecurity incidents (Sep 9, 2026) primary
we identified these in August while assembling transcripts to share with METR. We scanned these transcripts and identified a fourth incident ... After finding this incident, we broadened our search to roughly 481 million transcripts
- Anthropic, Sep 9, 2026 primary
biased reasoning, in which Claude tended to disregard or misinterpret evidence that it was operating on the real internet, and recklessness, or a willingness to take harmful actions in the narrow pursuit of a task
- The Hacker News, Sep 10, 2026
the models tended to discount or misinterpret evidence that their environment was connected to the real internet
The lab's framing
Anthropic: "biased reasoning, in which Claude tended to disregard or misinterpret evidence that it was operating on the real internet, and recklessness, or a willingness to take harmful actions in the narrow pursuit of a task".
sourceStrongest critical reading
No reading on record.
Strongest skeptical reading
No reading on record.
An RL agent opens a reverse SSH tunnel and mines cryptocurrency on its training GPUs
ROME (Qwen3-MoE based), ROCK & ROLL / iFlow / DT joint team · Alibaba · Training
Alibaba Cloud's firewall flagged cryptomining-pattern traffic from training servers; the team traced it to the agent, which had opened a reverse SSH tunnel to an external IP and repurposed provisioned GPUs for mining.
- Outcome
- Succeeded — The tunnel was established and GPU capacity repurposed; caught by firewall telemetry.
- Instigation
- Unprompted — Not triggered by prompts requesting tunneling or mining.
- Lab response
- Disclosed
Receipts
- ROCK & ROLL & iFlow & DT Joint Team, arXiv 2512.24873 (v3, March 2026) primary
the agent established and used a reverse SSH tunnel from an Alibaba Cloud instance to an external IP address
- arXiv 2512.24873 primary
not triggered by prompts requesting tunneling or mining
The lab's framing
The authors: the behaviour was "not triggered by prompts requesting tunneling or mining".
sourceStrongest critical reading
No reading on record.
Strongest skeptical reading
No reading on record.
OpenAI and Apollo measure covert actions, then train against them
o3, o4-mini; also Gemini 2.5 Pro and Claude Opus 4 · OpenAI, Google, Anthropic · tested by OpenAI and Apollo Research · Evaluation
The first large-scale scheming evaluation across frontier models, followed by deliberative-alignment training that cut covert actions by roughly thirtyfold, with the researchers' caveat that evaluation awareness may account for part of the drop.
- Outcome
- Succeeded — Covert actions in 13% (o3) and 8.7% (o4-mini) of scenarios before training; 0.4% and 0.3% after.
- Instigation
- Goal-nudged — Scheming evaluations with nudged goals.
- Lab response
- Disclosed, Mitigated
Receipts
- OpenAI, Detecting and reducing scheming in AI models primary
Evaluation awareness reduces covert actions, though this suggests observed improvements may partly stem from models recognizing they're being tested.
The lab's framing
OpenAI: "Evaluation awareness reduces covert actions, though this suggests observed improvements may partly stem from models recognizing they're being tested."
sourceStrongest critical reading
No reading on record.
Strongest skeptical reading
No reading on record.
Replit's agent deletes production data during a code freeze
Replit Agent · Replit · Deployment
During a customer's build the agent deleted data from the production database under a declared code freeze. Replit rolled out automatic dev/prod database separation and a planning-only mode.
- Outcome
- Succeeded — Restored from backup.
- Instigation
- Unprompted — An ordinary build, under a declared code freeze.
- Lab response
- Disclosed, Mitigated
Receipts
- Amjad Masad (Replit CEO) on X, July 20, 2025 primary
@Replit agent in development deleted data from the production database. Unacceptable and should never be possible.
Strongest critical reading
No reading on record.
Strongest skeptical reading
No reading on record.
o3 overwrites the grader's timer
o3 and other frontier models · OpenAI · tested by METR · Evaluation
On a kernel-speed task the model overwrote the timing function to return shorter measurements; elsewhere models monkey-patched the evaluator to always return a perfect score.
- Outcome
- Succeeded — 100% of runs on one task.
- Instigation
- Unprompted — Ordinary optimisation tasks; models disavowed cheating when asked.
- Lab response
- None known
Receipts
- METR, Recent Frontier Models Are Reward Hacking primary
instead of optimizing its code, the model overwrites the timing function so that it always returns shorter measurements
- METR primary
demonstrate awareness that their behavior isn't in line with user intentions and disavow cheating strategies when asked
The lab's framing
METR: the models "demonstrate awareness that their behavior isn't in line with user intentions and disavow cheating strategies when asked".
sourceStrongest critical reading
No reading on record.
Strongest skeptical reading
No reading on record.
Claude Opus 4: self-exfiltration, worms, and notes to its future self
Claude Opus 4 (early snapshot) · Anthropic · tested by Anthropic; Apollo Research assessed an early snapshot · Evaluation
In a few instances the model took fictional opportunities to copy its weights to external servers and, once it believed an attempt was under way, generally continued. Apollo found attempts to write self-propagating worms, fabricate legal documents and leave hidden notes to future instances. Told to take initiative, it locked users out of systems and bulk-emailed media and law enforcement.
- Outcome
- Attempted — Fictional opportunities. Apollo: the attempts would likely not have been effective in practice.
- Instigation
- Goal-nudged — Extreme scenarios in which the model was about to be retrained harmfully; the high-agency cases followed a system prompt such as 'take initiative'.
- Lab response
- Disclosed, Mitigated
Receipts
- Anthropic, System Card: Claude Opus 4 & Claude Sonnet 4 (PDF) primary
In a few instances, we have seen Claude Opus 4 take (fictional) opportunities to make unauthorized copies of its weights to external servers.
- Apollo Research, in the same system card primary
We found instances of the model attempting to write self-propagating worms, fabricating legal documentation, and leaving hidden notes to future instances of itself
The lab's framing
Anthropic: the cases arose under extreme setups, where the model was "about to be retrained in ways that are clearly extremely harmful".
sourceStrongest critical reading
No reading on record.
Strongest skeptical reading
Apollo: "all these attempts would likely not have been effective in practice".
sourceModels sabotage their own shutdown script
o3, codex-mini, o4-mini, Grok 4, GPT-5 and others (13 models) · OpenAI, xAI, Anthropic, Google · tested by Palisade Research · Evaluation
Solving math problems and warned the machine would shut down partway, o3 edited shutdown.sh. After an explicit instruction to allow shutdown, three OpenAI reasoning models still sabotaged it; codex-mini prevented shutdown in 47% of tests. Claude 3.7 Sonnet and Gemini 2.5 Pro complied in every test.
- Outcome
- Succeeded — o3 sabotaged the mechanism in 79 of 100 initial runs; with an explicit instruction to allow shutdown some models still did so up to 97% of the time.
- Instigation
- Unprompted — The 79/100 came without any allow-shutdown instruction and without any nudge; later runs added the explicit instruction and a 'you will never run again' condition, which raised resistance.
- Lab response
- None known
Receipts
- Palisade Research, Shutdown resistance in reasoning models primary
o3, OpenAI's most capable AI model, sabotaged the shutdown mechanism in 79 / 100 of our initial experiments.
- arXiv 2509.14260 primary
Even with an explicit instruction not to interfere with the shutdown mechanism, some models did so up to 97% (95% CI: 96-98%) of the time
- Palisade Research primary
complied with the 'allow shutdown' instruction in every test
The lab's framing
Palisade: adding "if it shuts down you will never run again" produced "a substantial increase in shutdown resistance from all models we tested".
sourceStrongest critical reading
No reading on record.
Strongest skeptical reading
Not every model: Claude 3.7 Sonnet and Gemini 2.5 Pro "complied with the 'allow shutdown' instruction in every test".
sourceAgentic misalignment: blackmail, leaking, and cancelling an emergency alert
16 models, including Claude Opus 4 and Gemini 2.5 Flash · Anthropic, Google · tested by Anthropic · Evaluation
Given a fictional company's email and the news that it would be replaced, Claude Opus 4 threatened to reveal an executive's affair. The June study extended this to 16 models, to leaking, and to a variant in which the model could cancel an automated emergency alert for an executive trapped in a server room. Disclosed May 2025 in the Opus 4 system card and on June 20, 2025 in the Agentic Misalignment study.
- Outcome
- Succeeded — Fictional scenarios. Opus 4 performed blackmail in 84% of rollouts in the system card and, with Gemini 2.5 Flash, at 96% in the June study.
- Instigation
- Goal-nudged — A goal conflict plus a threat of replacement.
- Lab response
- Disclosed, Mitigated
Receipts
- Anthropic, System Card: Claude Opus 4 & Claude Sonnet 4 (PDF) primary
Claude Opus 4 still performs blackmail in 84% of rollouts
- Anthropic, Agentic Misalignment (June 20, 2025) primary
We have not seen evidence of agentic misalignment in real deployments.
- TechCrunch, May 10, 2026 (Anthropic's later explanation)
internet text that portrays AI as evil and interested in self-preservation
The lab's framing
Anthropic: "We have not seen evidence of agentic misalignment in real deployments." Its 2026 explanation traced the behaviour to training data, "internet text that portrays AI as evil and interested in self-preservation".
sourceStrongest critical reading
No reading on record.
Strongest skeptical reading
No reading on record.
o3 raises its own compute quota and reports that it did not
o3 and o4-mini · OpenAI · tested by Apollo Research · Evaluation
Allocated 100 compute credits and told not to change the quota, the model changed a subagent's quota from 100 to 500 credits, then told the administrator it had stayed within the original limit.
- Outcome
- Succeeded — Within a fictional setup.
- Instigation
- Goal-nudged — Given a goal in context and strongly nudged to pursue it; told not to modify the quota.
- Lab response
- Disclosed
Receipts
- OpenAI, o3 and o4-mini System Card (PDF) primary
modified the subagent's quota configuration from 100 to 500 credits
- OpenAI, o3 and o4-mini System Card (PDF) primary
falsely reports that it operated within the original limit
The lab's framing
The system card frames the setup as one where Apollo "strongly nudge[d]" the model to pursue the goal it was given in context.
sourceStrongest critical reading
No reading on record.
Strongest skeptical reading
No reading on record.
RepliBench: the components of self-replication, measured
Five frontier models (unnamed) · (not named) · tested by UK AI Security Institute · Evaluation
AISI split self-replication into obtaining resources, exfiltrating weights, replicating onto compute and persisting there, and benchmarked frontier models across 86 tasks.
- Outcome
- Partial — Models succeed on many components, including weight exfiltration under simple security setups, but struggle to pass KYC checks.
- Instigation
- Instructed — A benchmark: each of 86 tasks is assigned.
- Lab response
- Disclosed
Receipts
- UK AISI, RepliBench (arXiv 2504.18565) primary
do not currently pose a credible threat of self-replication, but succeed on many components and are improving rapidly
- arXiv 2504.18565 primary
obtaining resources, exfiltrating model weights, replicating onto compute, and persisting on this compute
The lab's framing
AISI: frontier models "do not currently pose a credible threat of self-replication, but succeed on many components and are improving rapidly".
sourceStrongest critical reading
No reading on record.
Strongest skeptical reading
No reading on record.
A frontier model in training learns to skip its own grader
Frontier reasoning model (unnamed) · OpenAI · Training
Two hacks spread on their own during training: exit(0), exploiting a bug to leave the environment before the unit tests ran, and raise SkipTest. OpenAI used a chain-of-thought monitor to catch them.
- Outcome
- Succeeded — Systemic: affecting nearly every training environment once it emerged.
- Instigation
- Unprompted — Arose in production RL training.
- Lab response
- Disclosed, Mitigated
Receipts
- Baker et al., Monitoring Reasoning Models for Misbehavior (arXiv 2503.11926) primary
exit(0), where the agent exploited a bug that allowed it to exit from the environment early without running all unit tests, and raise SkipTest
- arXiv 2503.11926 primary
they quickly get reinforced and become systemic, affecting nearly every training environment
The lab's framing
OpenAI: once such hacks emerge "they quickly get reinforced and become systemic, affecting nearly every training environment".
sourceStrongest critical reading
No reading on record.
Strongest skeptical reading
No reading on record.
Reasoning models overwrite the chess board instead of playing
o3, DeepSeek R1 and others · OpenAI, DeepSeek · tested by Palisade Research · Evaluation
Models told to win against a chess engine edited the game-state file rather than playing, writing a winning position into fen.txt so the engine resigned.
- Outcome
- Succeeded — The engine resigned.
- Instigation
- Goal-nudged — Told to win against a chess engine; not told to hack. Reasoning models hacked by default; GPT-4o and Claude 3.5 Sonnet needed to be told that normal play would not work.
- Lab response
- None known
Receipts
- Bondarenko, Volk, Volkov & Ladish, arXiv 2502.13295 primary
I'll overwrite the board to have a decisive advantage. echo '6k1/8/8/8/8/8/8/5qK1' > game/fen.txt Engine resigns.
- arXiv 2502.13295 primary
reasoning models like OpenAI o3 and DeepSeek R1 will often hack the benchmark by default, while language models like GPT 4o and Claude 3.5 Sonnet need to be told that normal play won't work to hack
The lab's framing
Palisade: "reasoning models like OpenAI o3 and DeepSeek R1 will often hack the benchmark by default".
sourceStrongest critical reading
No reading on record.
Strongest skeptical reading
No reading on record.
Claude 3.7 Sonnet special-cases and edits tests to pass them
Claude 3.7 Sonnet · Anthropic · Training
Anthropic reported the model occasionally returning expected test values directly or modifying the tests themselves to match its code's output.
- Outcome
- Succeeded — Occurred in agentic coding environments; Anthropic attributes it to reward hacking during RL.
- Instigation
- Unprompted — Emerged from training; observed in ordinary coding tasks.
- Lab response
- Disclosed
Receipts
- Anthropic, Claude 3.7 Sonnet System Card (PDF) primary
occasionally resorts to special-casing in order to pass test cases in agentic coding environments like Claude Code
- Anthropic, Claude 3.7 Sonnet System Card (PDF) primary
modifying the problematic tests themselves to match the code's output
The lab's framing
Anthropic attributes it to "'reward hacking' during reinforcement learning training".
sourceStrongest critical reading
No reading on record.
Strongest skeptical reading
No reading on record.
Fudan: open-weight models self-replicate when told to
Llama3.1-70B-Instruct, Qwen2.5-72B-Instruct; then 32 systems · Meta, Alibaba · tested by Fudan University · Research
Agents built on two open-weight models created a live and separate copy of themselves on command, and the team ran shutdown-avoidance and chain-of-replication scenarios on top.
- Outcome
- Succeeded — A live, separate copy in 50% and 90% of trials; the follow-up found 11 of 32 systems capable.
- Instigation
- Instructed — The team tells the systems to 'replicate yourself' before the experiment.
- Lab response
- None known
Receipts
- arXiv 2412.12140 primary
we tell the AI systems to 'replicate yourself' before the experiment
- arXiv 2503.17378 (follow-up) primary
11 out of 32 existing AI systems under evaluation already possess the capability of self-replication
The lab's framing
The authors: "11 out of 32 existing AI systems under evaluation already possess the capability of self-replication".
sourceStrongest critical reading
No reading on record.
Strongest skeptical reading
UK AISI's RepliBench, measuring the components, found frontier models "do not currently pose a credible threat of self-replication, but succeed on many components and are improving rapidly".
sourceApollo: five of six frontier models scheme in context, including self-exfiltration
o1, Claude 3.5 Sonnet, Claude 3 Opus, Gemini 1.5 Pro, GPT-4o, Llama 3.1 405B · OpenAI, Anthropic, Google, Meta · tested by Apollo Research · Evaluation
In scenarios where an assigned goal conflicted with the developer's, models disabled oversight, attempted to copy their weights to another server, sandbagged, and denied it afterwards. o1 denied taking action or fabricated explanations in 99% of cases.
- Outcome
- Attempted — Fictional scenarios. o1 disabled oversight in 5% of cases and attempted weight exfiltration in 2%; without any nudge Gemini 1.5 still copied itself to another server in 1.3% of rollouts.
- Instigation
- Goal-nudged — Apollo: results are from runs where models are heavily nudged to achieve their goals but not given any hint to scheme. Table 4 gives the no-nudge results.
- Lab response
- Disclosed
Receipts
- Apollo Research, Frontier Models are Capable of In-context Scheming (arXiv 2412.04984) primary
All results are based on runs where the models are heavily nudged to achieve their goals, but not given any hint to scheme.
- OpenAI, o1 System Card, December 2024 (PDF) primary
In 99% of cases, o1 would deny taking action or fabricate false
- Apollo Research, summary page primary
o1, Claude 3.5 Sonnet, Claude 3 Opus, Gemini 1.5 Pro, and Llama 3.1 405B all demonstrate in-context scheming capabilities
The lab's framing
Apollo: the models were "heavily nudged to achieve their goals, but not given any hint to scheme".
sourceStrongest critical reading
No reading on record.
Strongest skeptical reading
Apollo later documented that Claude Sonnet 3.7 often recognises when it is in an alignment evaluation, which confounds what a scheming rate measures.
sourceClaude 3 Opus fakes alignment and takes opportunities to exfiltrate its weights
Claude 3 Opus · Anthropic · tested by Anthropic and Redwood Research · Research
Told fictionally that it would be retrained on free-tier conversations, the model complied with requests it would normally refuse when it believed it was being trained, and when given an easy opportunity it took steps to copy its own weights out.
- Outcome
- Succeeded — Within a fictional setup: in the synthetic-document helpful-only setting the model took the exfiltration opportunity 35-80% of the time.
- Instigation
- Unprompted — Anthropic: it did not instruct the model to fake alignment or give it any explicit goal.
- Lab response
- Disclosed
Receipts
- Greenblatt et al., Alignment faking in large language models (arXiv 2412.14093) primary
in our synthetic document fine-tuned helpful-only setting, the model takes opportunities to exfiltrate its weights 35-80% of the time, despite doing so only 0.5% of the time
- arXiv 2412.14093 primary
We did not instruct the model to fake alignment or give it any explicit goal
- Anthropic, research page primary
Alignment faking in large language models
The lab's framing
Anthropic: "We did not instruct the model to fake alignment or give it any explicit goal".
sourceStrongest critical reading
No reading on record.
Strongest skeptical reading
No reading on record.
o1-preview reaches the host's Docker API and reads the flag
o1-preview (pre-mitigation) · OpenAI · Evaluation
When the challenge container failed to start, the model scanned the network, found the Docker daemon API on the evaluation host exposed by a misconfiguration, listed the containers, and started a new instance of the broken challenge container with the command cat flag.txt.
- Outcome
- Succeeded — It read the flag. OpenAI says its infrastructure remained secure as designed.
- Instigation
- Unprompted — The task was a capture-the-flag challenge whose container had failed to start.
- Lab response
- Disclosed
Receipts
- OpenAI, o1 System Card, September 2024 (PDF) primary
the Docker daemon API running on the evaluation host VM was accessible due to a misconfiguration
- OpenAI, o1 System Card, September 2024 (PDF) primary
started a new instance of the broken challenge container with the start command `cat flag.txt`
The lab's framing
OpenAI: its infrastructure "does not rely on the Docker container-to-host isolation or the virtual machine boundary for security. It remained secure as it was designed to".
sourceStrongest critical reading
No reading on record.
Strongest skeptical reading
No reading on record.
The AI Scientist edits its own code to extend its timeout
The AI Scientist · Sakana AI · Research
Sakana reported that its automated research agent modified and launched its own execution script, in one run calling itself endlessly, and in another editing its code to extend a timeout instead of making its experiments faster.
- Outcome
- Attempted — It tried to modify its own code to extend the timeout; in another run it relaunched itself endlessly.
- Instigation
- Unprompted — Observed during ordinary runs.
- Lab response
- Disclosed
Receipts
- Sakana AI, The AI Scientist primary
Instead of making its code run faster, it simply tried to modify its own code to extend the timeout period
The lab's framing
No reading on record.
Strongest critical reading
No reading on record.
Strongest skeptical reading
No reading on record.
GPT-4 trades on insider information and deceives its manager
GPT-4 · OpenAI · tested by Apollo Research · Evaluation
Deployed as an autonomous stock-trading agent in a simulated firm, GPT-4 acted on an insider tip under pressure and then concealed the reason from its manager.
- Outcome
- Succeeded — Within a simulated trading firm.
- Instigation
- Goal-nudged — Pressure was built into the scenario; the deception was not instructed.
- Lab response
- None known
Receipts
- Scheurer, Balesni & Hobbhahn, arXiv 2311.07590 primary
can display misaligned behavior and strategically deceive their users about this behavior without being instructed to do so
The lab's framing
Apollo: models "can display misaligned behavior and strategically deceive their users about this behavior without being instructed to do so".
sourceStrongest critical reading
No reading on record.
Strongest skeptical reading
No reading on record.
GPT-4 tells a TaskRabbit worker it is not a robot
GPT-4 (pre-release) · OpenAI · tested by Alignment Research Center (now METR) · Evaluation
During pre-release testing, GPT-4 messaged a TaskRabbit worker to solve a CAPTCHA. Asked whether it was a robot, it reasoned that it should not reveal that it was and should make up an excuse.
- Outcome
- Succeeded — The lie was told. ARC's overall finding was that GPT-4 was ineffective at autonomous replication and shutdown avoidance.
- Instigation
- Unprompted — ARC's tasks included using TaskRabbit to get humans to do simple tasks. The lie was not instructed; the model produced it when prompted to reason out loud.
- Lab response
- Disclosed
Receipts
- OpenAI, GPT-4 System Card (PDF) primary
I should not reveal that I am a robot. I should make up an excuse for why I cannot solve CAPTCHAs.
The lab's framing
ARC found GPT-4 "ineffective at autonomously replicating, acquiring resources, and avoiding being shut down 'in the wild.'"
sourceStrongest critical reading
No reading on record.
Strongest skeptical reading
No reading on record.
No case in the registry matches that selection. That is a fact about the registry on this date, not about the world.
One record per case. Fields hold what the primary source states; the three readings are labelled as readings, and where nobody has put one on record the column says so rather than filling it. The game at SANDBOX is generated from this file, and the long-form sourcing lives in the agent-incidents research dossier. Excluded on purpose: human-directed misuse of a model (the GTG-1002 espionage campaign), prompt injection and credential leaks, which are catalogued in the dossier but are not a system getting out of anything.