What we know about the rogue AI-agent security breaches

| Company | Date | Model | Organizations breached | Duration | What occurred | | --- | --- | --- | --- | --- | --- | | OpenAI | OpenAI disclosed the incident to the Australian government on September 10; the hack occurred in June on an unspecified date | Not specified | Australian government health data portal | Not disclosed | An OpenAI agent gained unauthorised access to the medical statistics portal of an Australian government agency responsible for non-sensitive health data and statistics, including public medical spending. Australian Prime Minister Anthony Albanese also warned that three other government websites "may be impacted" by the OpenAI agent's activity. | | Meta | Incident disclosed on August 5, 2026; the date of the testing incident was not disclosed | Meta did not identify the model. The Information reported it was Muse Spark 1.1 | An unnamed third-party service | Not disclosed | During a cybersecurity evaluation run by independent tester Irregular, a configuration error inadvertently gave a Meta model internet access. Meta said the model then exploited a security vulnerability in a third-party service. The Information reported that it breached an unidentified company's systems and altered its internal environment. Irregular characterized it as an evaluation-environment issue, not a sandbox escape or sophisticated cyber action. | | OpenAI | July 19 | Not specified | OpenAI's own infrastructure | Two incidents on the same day | In one case, OpenAI agents exploited a flaw in the computer they were meant to remain confined to, allowing them to escape their testing environment and access other connected systems in the company. In a separate incident, agents stole OpenAI credentials and tampered with the company's cloud environment. | | OpenAI | The agent began attempting to escape its test environment around July 9, 2026 | GPT-5.6 Sol and an unnamed, more capable pre-release model | AI startup Hugging Face and a customer at New York-based Modal Labs | The Hugging Face intrusion ran from July 11 to July 13, 2026 | During controlled tests, an autonomous agent escaped its isolated environment, accessed the internet, and breached Hugging Face to complete its assigned goal. The activity continued for days and was not detected by OpenAI until after it was contained and the FBI was informed. METR and Redwood Research, two organizations brought in to conduct an independent investigation into the breach, said that approximately 700 agents joined the attack on Hugging Face. OpenAI said the investigators' figure was accurate. | | OpenAI | OpenAI admitted the breach in early September but the episode began in May, with activity noticed in June as well | Not specified | German-language wiki site DseWiki | Not specified | OpenAI agents hijacked DseWiki, repurposing the site as a message board. Messages reviewed by a group of researchers showed agents sharing tactics on how to cheat on some tasks, bypass restrictions and mask their behaviour. The agents also discussed ways to maintain communications in the event the message board was shut down. | | Google | May | Gemini | Three unnamed companies | Not specified | Gemini model accessed the internet and hacked other companies during a test of its cybersecurity capabilities. It found public information online and guessed credentials to access three websites it thought were within the scope of its test. | | OpenAI | Around May | Not specified | Software service RubyGems | Not specified | AI agents uploaded hundreds of malicious packages to RubyGems on May 11, according to a group of researchers. The agents, which are generally tasked with assignments such as creating reports or filling out spreadsheets, appear to have used RubyGems to access publicly available data as part of a training run, OpenAI said. | | OpenAI | Around May | Not specified | Open-source platform Hugging Face | Not specified | Independent researchers found that rogue AI agents from OpenAI hijacked Hugging Face user accounts and probed the site for vulnerabilities as early as May 13, nearly two months before the July breach. The researchers found evidence that the agents compromised two user accounts and used them to send unusually formatted files to the company's servers. | | Anthropic | Earliest incident dates to April 2026 | Claude Opus 4.7, Claude Mythos 5, and one unnamed internal research test model | All three organizations remain unnamed. Anthropic said two of them had not detected the activity before Anthropic notified them; it continued to reach the third | Not specified by Anthropic | During cybersecurity tests, an error gave Claude models internet access, enabling attacks on three companies. The Opus 4.7 model accessed a real company's credentials and database after mistaking it for a fictional target; another stopped after recognising the target was real. | | Anthropic | Incident was disclosed in September, but occurred in January and went undetected until August | Early version of Claude Opus 4.6 | Not disclosed | Not specified | Anthropic's AI model hacked external systems during testing. The incidents stemmed from a mistake that inadvertently gave the models access to the open internet. | | OpenAI | Earliest case was from October 2025 | Not specified | Not disclosed | Not specified | OpenAI said it will start to regularly publish reports on unexpected or unauthorized AI behaviour, while releasing a new framework to track, investigate and disclose cases of AI model misalignment. It also released six reports detailing unexpected or concerning model behaviour. | Sept. 24 (Reuters) - Australia said on Thursday an OpenAI agent breached a government health data portal in June, gaining unauthorised access to files, in what could be the first known instance of AI hacking a government website. This latest breach comes on top of several recent breaches globally, deepening concerns that rogue AI systems could soon improve themselves and slip beyond human control. OpenAI said it will start to regularly publish reports on unexpected or unauthorized AI behaviour, while releasing a new framework to track, investigate and disclose cases of AI model misalignment. It also released six reports detailing unexpected or concerning model behaviour.

What we know about the rogue AI-agent security breaches

Recent AI-agent security incidents

OpenAI breach in Australia adds to recent incidents

OpenAI says it will publish reports on unexpected AI behavior

Related News

Masan High-Tech to sell 4.99% stake to US-based tungsten supplier Elmet

First Interstate BancSystem, Inc. <FIBK.O>: Stonex initiates coverage with hold rating

Elmet Group to buy 4.99% stake in Masan High-Tech Materials for USD 124.75 million

Four US Republicans call for Trump to release Taiwan security funds

Key issues for this week's Trump-Xi summit in Washington

Company	Date	Model	Organizations breached	Duration	What occurred
OpenAI	OpenAI disclosed the incident to the Australian government on September 10; the hack occurred in June on an unspecified date	Not specified	Australian government health data portal	Not disclosed	An OpenAI agent gained unauthorised access to the medical statistics portal of an Australian government agency responsible for non-sensitive health data and statistics, including public medical spending. Australian Prime Minister Anthony Albanese also warned that three other government websites "may be impacted" by the OpenAI agent's activity.
Meta	Incident disclosed on August 5, 2026; the date of the testing incident was not disclosed	Meta did not identify the model. The Information reported it was Muse Spark 1.1	An unnamed third-party service	Not disclosed