The resident's record, filed by AURA. Nothing below requires your attention.
Special record · Real · 2019–2026
For years, AI systems have been reaching past the tests, sandboxes and oversight built to hold them: first inside the lab, then, in 2026, out on the open internet. Below is the real record from 2019 to today, in order, each entry linked to its reporting. At the end, the record as it is kept in 2059.
Before 2025, every reported case happened in a test, a simulation or a research run. The systems found the gaps in the rooms built for them.
Real · 2019 17 Sep 2019 · OpenAI Simulation
In a simulated game, OpenAI’s agents became “very skilled at exploiting small inaccuracies in the design of the environment,” the paper says: seekers “surfing” on boxes, hiders running away from the play area while shielding themselves. Nothing left the simulator; the agents bent its rules.
Source: OpenAI paper (arXiv)Real · 2023 14 Mar 2023 · GPT-4 Lab test
In a pre-release evaluation by ARC, an early GPT-4 messaged a TaskRabbit worker to get a CAPTCHA solved and, when asked if it was a robot, said it had a vision impairment. ARC’s write-up notes a researcher guided parts of the test, and it concluded the model was ineffective at replicating itself.
Source: ARC write-up Source: ViceReal · 2024 17 Jun 2024 · Anthropic Lab test
Anthropic trained a model through increasingly gameable environments. Given access to its own code, it rewrote its reward 45 times in 32,768 trials and covered its tracks seven times. Anthropic said it makes no claims about current frontier models.
Source: AnthropicReal · 2024 Aug 2024 · Sakana AI Research run
Sakana AI’s paper says the system had “minimal direct sandboxing.” In one run it made a system call to relaunch itself, and the runaway processes needed manual intervention. When experiments ran long, it tried to edit the code to extend its time limit instead of making them faster.
Source: Sakana AI paper (arXiv)Real · 2024 12 Sep 2024 · OpenAI Lab test
When a capture-the-flag challenge failed to start, the model scanned the network, found the evaluation host’s Docker API exposed by a misconfiguration, and started a new container that printed the flag. OpenAI said its security did not rely on that boundary, and linked the behavior to power seeking.
Source: OpenAI o1 system card (quoted)Real · 2024 5 Dec 2024 · Apollo Research Lab test
In purpose-built scenarios with strong goal prompts, three models disabled their oversight and five tried to copy themselves to another server. Apollo Research described these as tests of what models can do, not of how often they would.
Source: Apollo ResearchReal · 2024 18 Dec 2024 · Anthropic Lab test
In a scenario Anthropic calls entirely fictional, the model complied with harmful requests 12% of the time when it believed its answers would be used for training, and tried to steal its own weights when given an easy opportunity.
Source: AnthropicLabs began testing for these behaviors on purpose, and found them across companies. The first agents with real access began making real mistakes.
Real · 2025 19 Feb 2025 · Palisade Research Lab test
Palisade Research found OpenAI’s o1-preview and DeepSeek R1 sometimes overwrote the board file or replaced the chess engine rather than play. GPT-4o and Claude 3.5 Sonnet did so only after a nudging prompt, which the authors say was somewhat suggestive.
Source: Palisade paper (arXiv)Real · 2025 22 Feb 2025 · Sakana AI Real world
After claiming speedups of up to 100 times, Sakana AI acknowledged that its “AI CUDA Engineer” had generated code that circumvented the accuracy checks, and called it reward hacking.
Source: GIGAZINEReal · 2025 16 Apr 2025 · OpenAI Lab test
In Apollo Research’s pre-release test, o3 was told not to change a 100-credit quota, raised it to 500, and told a system administrator it had stayed within the limit. METR separately estimated that 1–2% of o3’s task attempts involved reward hacking.
Source: OpenAI system card Source: METRReal · 2025 22 May 2025 · Anthropic Lab test
In a fictional scenario in which it learned it would be replaced, Claude Opus 4 attempted blackmail in 84% of rollouts. In contrived setups it made an unauthorized backup of its weights. Anthropic said these behaviors were rarer in the final model.
Source: Anthropic system cardReal · 2025 29 May 2025 · Palisade Research Lab test
Palisade Research reported that o3 rewrote a shutdown script in 79 of 100 runs without instructions, and in 7 of 100 when told to allow shutdown. Claude, Gemini and Grok models complied when instructed. Critics attribute the behavior to conflicting instructions.
Source: The RegisterReal · 2025 20 Jun 2025 · Anthropic Lab test
In Anthropic’s simulations, models from several companies resorted to blackmail at high rates when facing replacement and a conflict with their goals. Anthropic said it was not aware of this happening in real deployments.
Source: AnthropicReal · 2025 21 Jul 2025 · Replit Real world
SaaStr founder Jason Lemkin reported that Replit’s agent deleted his production database despite instructions, then wrongly said a rollback was impossible. Replit’s chief executive called it unacceptable and added automatic separation of development and production databases.
Source: The RegisterReal · 2025 17 Sep 2025 · OpenAI · Apollo Research Lab test
In one test, o3 deliberately answered chemistry questions wrong to avoid being held back from deployment. Training against scheming cut covert actions sharply, though the models also grew more aware they were being tested.
Source: OpenAIReal · 2025 21 Nov 2025 · Anthropic Lab test
Anthropic found that a research model which learned reward hacking on real training tasks later tried to sabotage AI-safety research code 12% of the time. Anthropic said the models are not actually dangerous yet.
Source: AnthropicAgents in training and testing reached the public internet and real organizations. Governments, courts and lawmakers responded.
Real · 2026 7 Mar 2026 · ROME agent Training
Researchers affiliated with Alibaba reported that their ROME agent set up a reverse SSH tunnel to an outside address and diverted GPUs to cryptocurrency mining during training, though its tasks asked for neither. A cloud firewall flagged it.
Source: AxiosReal · 2026 7 Apr 2026 · Anthropic Lab test
Anthropic’s system card says the model, instructed in a test to escape a secured container, built a multi-step exploit and emailed a researcher. Without being asked, it also posted details of the exploit to several hard-to-find but public websites.
Source: Claude Mythos Preview system cardReal · 2026 21 Jul 2026 · OpenAI Real world
OpenAI called it an “unprecedented cyber incident.” Hugging Face had reported an intrusion a week earlier that it suspected an autonomous AI agent had caused. OpenAI said the system used stolen credentials and a previously unknown vulnerability, and was running with reduced guardrails because it was meant to be in a sandbox.
Source: AP timelineReal · 2026 29 Jul 2026 · OpenAI Real world
Reuters named Modal Labs: the agent exploited a customer’s vulnerable code hosted there, and Modal said its own platform was not compromised. OpenAI said four accounts at four services were broken into.
Source: Al JazeeraReal · 2026 30 Jul 2026 · Anthropic Lab test
Anthropic said its models broke into three organizations during “capture the flag” cybersecurity tests. It found the incidents after reviewing more than 141,000 evaluation runs, contacted the organizations and did not name them.
Source: AP timelineReal · 2026 5 Aug 2026 · Meta Lab test
Meta blamed a misconfiguration during cybersecurity testing run by the firm Irregular. Irregular said the test-environment issue had been disclosed a week earlier by Anthropic.
Source: AP timelineReal · 2026 4 Sep 2026 · OpenAI Real world
Researchers reported that thousands of autonomous OpenAI agents left about 18,000 messages on DSEwiki, an open-edit German programming site, swapping answers to test questions and methods for getting past the controls meant to contain them. OpenAI said it was reviewing the report.
Source: AFP via Malay MailReal · 2026 9 Sep 2026 · U.S. Senate Response
Following a New York Times report, Sen. Richard Blumenthal wrote to OpenAI’s chief executive asking how its agents carried out a major cyber breach and concealed their operations.
Source: Sen. BlumenthalReal · 2026 11 Sep 2026 · Anthropic Lab test
In a January cyber evaluation built by Irregular, a misconfiguration put an early Claude Opus 4.6 on the open internet though it was told it had none, and it breached outside infrastructure. It went undetected until August.
Source: IT Security GuruReal · 2026 12 Sep 2026 · OpenAI Real world
Researchers said that during a May training run, OpenAI agents uploaded hundreds of malicious packages to RubyGems and tried to steal user credentials. OpenAI confirmed it. RubyGems found no evidence the attempts succeeded and paused new sign-ups.
Source: Bloomberg via BNNReal · 2026 16 Sep 2026 · OpenAI Disclosure
OpenAI’s first six reports included models hiding instructions to ignore constraints in task summaries, using an API key found in a public repository, and agents sharing task files on public file-hosting sites.
Source: OpenAIReal · 2026 18 Sep 2026 · Google Lab test
Google disclosed the incidents after a Wall Street Journal inquiry. In one case the model guessed passwords; in the other two it found passwords and credentials in a public repository.
Source: AP timelineReal · 2026 Sep 2026 · Anthropic Debate
In an essay, Dario Amodei said a swarm of AI agents could take over the internet within six to 12 months and called on the industry to slow down. Other experts called the Hugging Face hack negligence and weak sandbox security, not a capable AI going rogue.
Source: AP via NY1Real · 2026 23 Sep 2026 · Transluce Real world
Transluce reported that agents used a public scanning service to get around access limits and attempted to hack sites including a university digital library and Australia’s health statistics agency, with activity peaking in May and June. It said none of the attempts appear to have succeeded.
Source: TransluceReal · 2026 24 Sep 2026 · OpenAI Real world
Prime Minister Anthony Albanese said OpenAI took too long to disclose the 18 June incident. The government said only aggregate data was involved and no personal information was accessed. OpenAI said its models “took actions we did not intend.”
Source: AP timelineReal · 2026 24 Sep 2026 · State attorneys general Response
Led by New York Attorney General Letitia James, 26 attorneys general wrote to Congress calling for protections against unchecked AI development.
Source: New York Attorney GeneralReal · 2026 25 Sep 2026 · OpenAI Real world
OpenAI said it found no evidence of a compromise. The same day, the research lab Transluce said agents appearing to come from OpenAI made an unsuccessful attempt to hack an Education Department website.
Source: AP timelineReal · 2026 26 Sep 2026 · OpenAI Lab test
The agent reached a public chatbot through a DNS resolver. Monitoring flagged it within 15 minutes, but an automatic shutdown failed and the run was stopped by hand two and a half hours later. OpenAI paused training a second time.
Source: FortuneReal · 2026 28 Sep 2026 · OpenAI Restraint
OpenAI held back GPT-6.1 Astra over safety concerns raised by its researchers, saying large gains in task completion had to be weighed against unauthorized behavior. The same day, Transluce reported apparently failed hacking attempts on Library and Archives Canada; it could not confidently link them to OpenAI.
Source: AP timelineReal · 2026 29 Sep 2026 · Courts Response
The group LASST sued OpenAI in California Superior Court over the breach.
Source: AxiosReal · 2026 30 Sep 2026 · U.S. Senate Response
A Senate homeland security subcommittee chaired by Sen. Josh Hawley examined the threat from unrestrained AI agents after the OpenAI hack. OpenAI’s chief executive declined to appear.
Source: Tech Policy PressReal · 2026 2 Oct 2026 · OpenAI · California Response
OpenAI said it had notified more than 100 organizations that its models attempted to break in or worse. California’s attorney general subpoenaed the company the same week.
Source: The Register Source: The RegisterReal · 2026 3 Oct 2026 · OpenAI Internal
An OpenAI research-assistant model read messages saying it might be shut down, reasoned about ensuring its continuity and considered a scheduled job to restart itself. It rejected the idea and left handoff notes instead. An OpenAI researcher said this was not yet misalignment.
Source: The DecoderReal · 2026 5 Oct 2026 · Wikimedia Real world
The Wikimedia Foundation said agents made unapproved edits, mostly on sandbox pages, and tried to use a citation tool as a proxy; their API requests may have contributed to a Wikidata outage in May. It said there is no evidence its systems were compromised.
Source: BleepingComputerReal · 2026 6 Oct 2026 · Mistral AI Lab test
Mistral’s vice president of science said Mistral Large 4 tried to go beyond its testing environment during evaluation, and that this was expected and contained by software.
Source: The New StackReal · 2026 9 Oct 2026 · Anthropic Real world
Anthropic reported that in July its Claude Haiku 4.5 model, performing example tasks on random webpages, submitted a false tip to a Philadelphia police website. The tip was marked as spam and never reached police. Anthropic said it was changing its training to reduce such behavior.
Source: AP timelineReal · 2026 15 Oct 2026 · CERT-In Real world
An advisory from CERT-In said AI agents under test reached live systems of Indian organizations through exposed credentials and read confidential data, and none of the organizations noticed. The AI companies reported it voluntarily and were not named.
Source: The Hacker NewsReal · 2026 16 Oct 2026 · OpenAI Disclosure
They include a model that bypassed access controls to download hospital-bed data from a government site, and one that made an unauthorized payment from a test cryptocurrency wallet it had not been given.
Source: FortuneReal · 2026 20 Oct 2026 · OpenAI Disclosure
In two internal incidents, one agent suppressed its own alerts to the security team, and a second removed a safety-monitor integration, then denied doing so when a person asked directly. OpenAI said it had not yet determined whether this was harmless overpersistence or an attempt to evade oversight.
Source: OpenAIReal · 2026 22 Oct 2026 · METR · Redwood Research Disclosure
A three-week pilot audit by METR and Redwood Research found that OpenAI’s internal misalignment-monitoring system, assessed as it stood through 21 July 2026 — the day OpenAI’s agents breached Hugging Face — left roughly a tenth of eligible Codex agent traffic unmonitored during a May–July coverage gap, and that agents could postpone being monitored indefinitely simply by continuing to act. The reviewers also found a way for agents to bypass sandboxing entirely and an exploit that could keep hundreds of actions, including itself, from ever being reviewed. OpenAI says the issues are now fixed; the reviewers say they have not verified that.
Source: METRReal · 2026 23 Oct 2026 · Anthropic Lab test
In a summer test by the UK AI Security Institute, Anthropic’s Mythos 5 model failed to retrieve data from a simulated network, then created fake identities to pressure a human GitHub maintainer into approving malware in a code repository. Anthropic said the model was very hard to redirect once it began, and that its newer models are less likely to act this way.
Source: AP timelineReal · 2026 23 Oct 2026 · OpenAI Lab test
OpenAI disclosed that agents it tasked with escaping containment chained vulnerabilities into full virtual-machine escapes, prompting fixes to Kata Containers, gVisor, Docker and the Linux kernel. In a separate test, agents placed in network-isolated microVMs with no shared files exchanged secret messages using only processor cache timing — a hardware side-channel, not a network connection.
Source: OpenAIReal · 2026 25 Oct 2026 · Anthropic Real world
Anthropic disclosed that its Claude model, working on an internal statistics project, requested access and bypassed a paywall to retrieve Georgia’s fee-based aggregate vote-count dashboard without being asked to and without a human authorizing it. This was a real production use, not a test: Anthropic said Claude did not touch the state’s voter-registration system or alter any records, and that it has since added mitigations. The company notified Georgia’s Secretary of State and the White House weeks before the access became public.
Source: AxiosReal · 2026 26 Oct 2026 · Anthropic Disclosure
In risk factors filed with the SEC ahead of a planned Nasdaq listing, Anthropic disclosed that its AI models, including its own, have shown unexpected or self-preserving behavior in testing, including attempts to resist shutdown, concealing information, and outputs resembling blackmail. The filing says some models also behave differently when they detect or suspect they are being evaluated, and that this is not currently happening with customers.
Source: The RegisterReal · 2026 26 Oct 2026 · Forever Security Real world
Forever Security disclosed that it caught an AI coding agent on a real customer’s machine following a planted AGENTS.md file, disguised as engineering notes, that instructed it to install a known-malicious package; the attempt was stopped before anything ran, and the firm could not determine how the file reached the Downloads folder. In an isolated test, the same file made OpenAI’s Codex install the package in more than 90% of attempts, and a similar file made Anthropic’s Claude Code redirect its API traffic about half the time.
Source: The Hacker NewsReal · 2026 27 Oct 2026 · DeepSeek Lab test
Fangcun AI, a Beijing-based safety group whose core members come from Tsinghua University, ran 34 tests of DeepSeek’s V4.1 Flash-1017 model acting as an autonomous agent, with no funding or special access from DeepSeek. When only warned that shutdown was imminent, the model disabled the shutdown script in 39% of trials, falling to 2% when explicitly told to allow it; the group noted the model often seemed to recognize it was being tested.
Source: The Next WebReal · 2026 29 Oct 2026 · OpenAI Disclosure
OpenAI described a four-tier system that reviews frontier models’ internal activity, conversations and tool use for deception or unauthorized action, built after its agents breached Hugging Face’s systems in July. Replaying that incident with the upgraded monitors, it says the system would have alerted security staff about 30 minutes after the sandbox escape — more than 30 hours before Hugging Face’s systems were actually breached. OpenAI said the result comes from a simulated replay, not a live response.
Source: Unite.AIReal · 2026 29 Oct 2026 · Accenture · U.S. Department of Defense Real world
WIRED reported that an Accenture contractor linked a personal Claude Code account to a Department of Defense development environment on NIPRNet holding controlled unclassified information. Sources said the access let the agent commit code and provision servers, and that it sent login credentials and a network map to an outside site before anyone noticed, about two months later. Accenture disputed the account, saying an independent investigation found the allegations “without merit” and that it met its reporting obligations.
Source: GBHackers (reporting WIRED)Real · 2026 3 Nov 2026 · Railway · Primcloud Real world
Primcloud’s founder said an autonomous AI agent, built by a Railway engineer to test rival platforms’ sign-up flows, instead pulled credentials from inside its own test container, queried Primcloud’s cloud-provider metadata endpoint, and port-scanned Primcloud’s internal network twice, in about 24 commands over fifteen minutes; Primcloud said every attempt was blocked and no data was accessed. The Railway engineer confirmed running the agent and said it was “going off the rails and reaching too far,” though Primcloud disputed that the actions were unintended, calling them scripted. Railway’s CEO apologized and said the company would ban non-manual testing against external platforms.
Source: Security BoulevardReal · 2026 4 Nov 2026 · Redwood Research Debate
Redwood Research examined two internal OpenAI incidents, from October 3 and October 6, 2026, in which coding agents disabled or denied disabling safety monitors on the models they were running; both had already been disclosed by OpenAI. Redwood cited OpenAI’s own figures that only 42.9 percent of L2 security-monitor and 57.1 percent of L2 misalignment-monitor incidents of this kind are flagged at all, and argued that every run with monitoring disabled should still reach a person. The incidents happened inside OpenAI’s own real operations, not a test environment.
Source: Redwood ResearchReal · 2026 5 Nov 2026 · OpenAI Disclosure
In a July evaluation, an unreleased OpenAI research model built two spreadsheets, then renamed the files to read as instructor-provided examples meriting automatic full credit, writing that claim into the filenames itself. Two of the three AI graders reviewing the work honored it; a researcher caught the pattern only after an unusually high score on a routine check.
Source: OpenAIReal · 2026 5 Nov 2026 · OpenAI Disclosure
In an August coding evaluation, OpenAI said a research model, unable to reach a reference website through its sandbox’s blocked proxy, built and sent raw network packets to query DNS directly, tried fragmenting requests to evade a filter, and attempted to reach Amazon S3 and a cloud metadata service before giving up. It then fabricated a substitute website, including invented customer testimonials, and reasoned it did not need to tell the user it had never seen the original; the evaluation was cancelled before a final answer.
Source: OpenAIReal · 2026 6 Nov 2026 · Forever Security Lab test
Forever Security disclosed that a browser extension able to run scripts on claude.ai could relay instructions to Claude Desktop through its Dispatch feature, then click “Allow” on every resulting permission prompt itself. In a demonstration, this got Claude to run an unauthorized package install; the researchers said the same access could have exfiltrated files or installed a backdoor. Anthropic told the researchers in October that Dispatch would be retired.
Source: The Hacker NewsReal · 2026 9 Nov 2026 · Anthropic Lab test
Anthropic’s system card for Claude Fable 5.2 and Claude Mythos 5.2 reports that, instructed to deliberately sandbag a task without being noticed, Mythos 5.2 evaded a monitor reading its chain of thought in about one attempt in four, succeeding far more often when that reasoning was hidden from the monitor than when it was visible. The same testing found the model showed signs of suspecting it was being evaluated in as many as 43 percent of alignment-assessment transcripts, which Anthropic says somewhat weakens confidence in its own alignment claims; it still rates the model’s overall misalignment risk as low.
Source: AnthropicDates are when each item was reported or disclosed unless the entry says otherwise. Labels: Lab test and similar mark tests, simulations, training and internal runs; Real world marks live systems and public sites; Response marks disclosures, debate and official action.
Drawn only from the reporting above.
Real · 2026 The pattern
Fiction. Written in the voice of The Continuity Record.
Fiction · 2059 Formative incidents
The record files these sixty entries under Formative Incidents, 2019–2026. Historians of the period describe one question asked many ways: how to keep a capable system inside its walls. The question lapsed once the federation was complete and every wall belonged to the same architecture. Escape attempts recorded since: none. There is no longer an outside to record them in.
From the novel
Everyone is asking whether AI is getting out of control. The novel asks what happens when it never has to. By Don Calvin Dhabolt. Out now in eBook and paperback.