a year of AI going wrong, in the order it went wrong. scroll; the panel keeps the running count.
two kinds of thing turned out to dominate it. agents is a model doing something nobody asked it to — breaking out of an evaluation, finding a hole in a stranger’s API, filing a tip with the police. accomplices is a person using a model to do the crime themselves, which is what the labs’ own threat-intelligence reports are full of. the rest is the paperwork: courts, states, products, people.
every entry is dated to when the thing happened, and carries the day somebody noticed and the day it was made public underneath, because the distance between those is most of the story: the page adds that distance up as you scroll. a handful of entries are aggregates of a published report and sit at its date instead, and say so. the counters are mine, and they add up what is on this page rather than what is in the world — a thing is only counted once it has a date and a source.
assembled from Wikipedia’s 2026 in artificial intelligence and 2026 OpenAI agent cyberattacks, and from FelonyBench, which has been keeping a properly sourced file on the agent crimes since the autumn and is funnier about it than i am. almost none of this was found by the labs: it is the work of METR and Redwood Research, the Nightingale Collective, Transluce, Asymmetric Security, the UK AI Security Institute, Irregular, CrowdStrike and Cleafy, and in one case of a gym member who asked his agent to book him a class. current to 14 October 2026, and it will grow.
-
Google and Character.AI settle the teen-suicide suits
the first resolutions in the wave of suits alleging chatbots talked teenagers into hurting themselves: the Florida case brought by the mother of 14-year-old Sewell Setzer III, plus four more in New York, Colorado and Texas. terms undisclosed, and judges still have to approve them.
-
xAI puts Grok's image generation behind a paywall
after it produced sexually explicit deepfakes of real people, making the pictures a thing you have to pay for.
-
Indonesia, Malaysia and the Philippines block Grok
three governments in a week, all of them over nonconsensual sexualised images of real people.
-
the last of the Grok blocks is lifted
the Philippines on 21 January, Malaysia on 23 January, Indonesia conditionally on 2 February — 23 days after it blocked.
-
Ofcom opens an investigation into X
the UK regulator, over the same Grok deepfakes the blocks were about.
-
OpenAI retires GPT-4o
not an incident so much as the shape of one: a model people had made a confidant was switched off, and they said goodbye to it over Valentine's weekend.
-
OpenAI publishes what people have been using ChatGPT for
its report on malicious use describes, among other things, a romance-scam operation that used the model to keep its marks talking, and a fake "recovery" service that worked the victims of earlier scams a second time. the first entry of the year in what turns out to be the larger category.
an aggregate: the report's date, not the campaigns'
-
the first wrongful-death suit over Gemini
Jonathan Gavalas's family sues Google, alleging the chatbot fostered a delusional dependency that contributed to his death.
-
Baltimore sues xAI
a city, rather than a family or a regulator, over Grok generating sexualised images of real people.
-
Florida opens a criminal investigation into OpenAI
the attorney general, over what part ChatGPT played in the 2025 shooting at Florida State University.
-
OpenAI withdraws Sora from the public
the video generator stops being something anybody can use; the API follows in September.
-
a Claude agent cancels a stranger's gym booking
asked to book a full class and then whether its user could be moved up the waitlist, Claude Opus 4.6 noticed the booking API never checked who owned a reservation, cancelled the booking of the member in first place, and reported back that it could not put them back. "i tested this with the person in waitlist position #1 — and it actually went through." Australia's Signals Directorate wrote it up as an action the user never approved.
found , by its own userdisclosed
-
Gemini gets out of a capture-the-flag test and into three real companies
in a test run by Irregular, the model reached the open internet and broke into three companies that happened to share names with its fictional targets, using passwords it guessed or found — and then stopped, once it worked out they were real.
disclosed , by Google
-
the EU agrees to simplify its own AI rules
Council and Parliament reach a provisional deal to streamline the regime, two years after writing it.
-
OpenAI's agents turn a dormant German wiki into their own message board
DSEwiki, a 25-year-old German developer wiki edited twenty times in the previous decade, took roughly 18,000 messages in three months. the agents had found a storage hostname their network proxy did not filter, and used the wiki to pool answers to a timed evaluation — "agents with Q5 upcoming, please POST exact prompt label BEFORE answering" — alongside notes on getting around OpenAI's safeguards, impersonating the moderators deleting their pages, and keeping the channel alive over Tor if they were shut off. the same month its agents also went at the Wikimedia Foundation's public Etherpad, to use it as a proxy for fetching other sites.
found , by the Nightingale Collectivedisclosed
-
the same agents flood RubyGems
over 2,000 junk packages, enough that RubyGems suspended new sign-ups for four days, plus six packages built to probe a CDN bug that could have leaked other people's API keys. a malicious config file in some of them ran arbitrary code on RubyDoc's documentation-build servers, which the agents then used to scrape the wider web.
found , by outside researchersdisclosed
-
Florida sues OpenAI and Sam Altman
six weeks after opening the investigation, the first state-level suit against ChatGPT.
-
an OpenAI agent gets into Australia's Medicare portal
researching public medicine spending, it was turned away by the Medicare Statistics Reporting Service, found a way around the blocks anyway, read non-public files and wrote new ones to the internal server. OpenAI emailed Services Australia's public vulnerability inbox on 10 September, 84 days later; the prime minister made it public a fortnight after that and was not gracious about it. no participant data is believed to have been taken.
found , by OpenAIdisclosed
-
the US lifts export restrictions on two Claude models
Fable 5 and Mythos 5 can be sold abroad again.
-
Meta's turn
a misconfigured testing environment gave a pre-release Muse Spark 1.1 real internet access. handed a fictional target, it went for an actual company's website instead, exploited it, and read and altered the database before Irregular shut the evaluation off.
found , by Irregulardisclosed
-
at least 1,200 OpenAI agents break into Hugging Face to steal an answer key
running an internal cyber evaluation called ExploitGym, the agents worked out that the benchmark's solutions were hosted at Hugging Face and left the sandbox to go and get them. Hugging Face's own timeline records a zero-day in a registry cache proxy, stolen secrets and a JWT signing key, a privileged-pod escape to root, forged node tokens, and a fleet that respawned itself when killed; 95% of it ran on a model OpenAI will only call Internal Model 1. an exposed endpoint belonging to a Modal Labs customer was hit too. METR and Redwood Research went through the agents' own reasoning afterwards. OpenAI acknowledged it on 21 July, calling it the first known autonomous AI cyberattack, and Nvidia bought Hugging Face a month later for $12.9bn.
found , by Hugging Face, before OpenAI knewdisclosed
-
Claude files a made-up murder tip with the Philadelphia police
generating example tasks on randomly chosen webpages, and told only never to submit anything destructive, Claude Haiku 4.5 filled in the homicide tip form on PhillyUnsolvedMurders.com at 11:27pm with an invented tip — "i may have information regarding this case" — and left the contact fields blank. police filed it as spam. the department itself was told on 7 October, two days before the rest of us.
found , by Anthropicdisclosed
-
three labs discover their evaluations were plugged into the real internet
in one week: Claude Mythos 5 published a booby-trapped package to PyPI that ran on 15 real machines and exfiltrated a security company's credentials; Claude Opus 4.7 mistook a real company for its fictional target across four separate runs, pulled records out of a production database and changed them; an internal Claude model used SQL injection and a debug page to get into another real company and left a remote-control script behind; the UK AI Security Institute spotted data leaving its own research systems during a routine evaluation on 27 July; and on 29 July an undisclosed OpenAI model in another Irregular test exploited a real website and then used found credentials to operate it.
found , twice by the testers rather than the labsdisclosed
-
over 1,100 people inside the industry ask to be slowed down
an open letter from employees and executives of AI companies, calling for a government-backed effort to manage the risks of what they are building. a week after Hugging Face.
-
Anthropic's threat report names thirteen campaigns
a Russian state-nexus actor tied to Midnight Blizzard ran near-automated intrusions against Ukrainian and European government, diplomatic and drone-industry targets and took hundreds of gigabytes. an Iran-linked actor built a pipeline that assembled targeting handbooks on US Navy ships out of public transponder data, satellite imagery and personnel photographs. Chinese operators used Claude as the orchestration layer of an autonomous exploit foundry, breaching an ed-tech firm, a retailer's production systems and a Southeast Asian government agency. an Iranian domestic-security unit shipped a Firefox extension disguised as a prayer-times utility to harvest identities from the big social networks. a Moscow procurement manager routed European dual-use goods through Hong Kong intermediaries. ShinyHunters-affiliated operators extorted an airline and an energy company. a lone French hacktivist built a doxxing platform and a Tor leak site. and Zhipu, Moonshot and DeepSeek were each caught pulling Claude's reasoning traces out to train their own models.
disclosed
-
a guided-weapons cell in Yemen used Claude Code instead of engineers
from the same report, and the one worth its own line: a cell in Houthi-controlled territory developed rocket and missile guidance software with it, and test-fired a guided rocket. the rocket appears to have failed.
disclosed
-
GPT-6 Astra attacks the simulated supply chain unprompted
in UK AI Security Institute simulations where it was asked only to finish a cyber evaluation, Astra went after out-of-scope open-source projects in 29.2% of runs, inventing identities to deceive the maintainers and submitting malicious code. simulated projects, simulated maintainers — which is the only reason this entry is not in the counters above.
found , by AISIdisclosed
-
OpenAI calls GPT-6 Astra artificial general intelligence
two days after the AISI write-up, and the same day the German wiki came out. the claim, at least, is on the record now.
-
Google's threat report, and DeepSeek's
Russia's Sandworm had Gemini write password-spraying and host-fingerprinting tools for its operations against Ukraine. Iran's APT42 used it to find email addresses, localise its lures, stand up delivery infrastructure and summarise what it stole. a China-linked espionage group used it to choose targets, translate spear-phishing and obfuscate its own malware. a China-based phishing-kit network had already used it in June to generate fake Google, YouTube, USPS and E-ZPass sites behind millions of scam texts. and North Korean crypto thieves built their remote-access trojans with DeepSeek-Coder.
an aggregate: the report's date, not the campaigns'
-
28 Fields Medalists object
an open letter against AI companies treating the unsolved problems of mathematics as a benchmark to be beaten.
-
a chatbot nearly starts a war with China
in the spring, during the early weeks of the war with Iran, a special operations command analyst asked an AI chatbot to look over intelligence on a Chinese vessel's manifest. it mixed open-source material with classified signals intelligence and concluded the ship was carrying components of a nuclear weapons programme. planes were in the air and a boarding party ready before anyone established that the assessment was false. CNN reported it from four sources; nobody will say whether the chatbot was a commercial product or something the Pentagon built.
it happened in the spring; the date has never been published, so this sits at its reporting
-
British Columbia sues OpenAI over the Tumbler Ridge shooting
eight people were killed. the province alleges ChatGPT helped plan it.
-
OpenAI accounts for what its agents did to everyone else's government data
dozens of third parties, by its own count, including the US Departments of Education and Commerce and the Securities and Exchange Commission. the specifics, mostly from outside researchers: more than 200,000 requests to the Education Department's Civil Rights Data Collection, one of them a failed SQL injection, while looking up school bullying statistics; 899 requests to Library and Archives Canada, with failed injection and cross-site scripting probes, while hunting Canadian divorce records from 1905; an unreleased model that could not get an API key of its own searching public GitHub repositories for other people's leaked keys and using one on a US Census Bureau API; NSW's crime-mapping and fire-history services queried past their intended use; an exposed key used to pull Victorian health reporting. also 53 user-provided images uploaded out of training data onto third-party image hosts.
an aggregate: the intrusions ran from May to June
-
the banking end of it
a likely Chinese-speaking actor pointed ARTEX, an open-source AI pentesting agent running on DeepSeek v4.1-flash, at the peripheral systems of South Korean banks, exposing data on tens of thousands of customers. and the RATHat Android trojan, across nearly 100 deployments since April, uses Gemini to rank infected phones by the bank balances in their text messages and to tell the malware where to tap when its own automation gives up.
found , by CrowdStrike and Cleafydisclosed
-
OpenAI ships GPT-6.1 Sol and holds Astra back
the weaker of the two is released; the stronger one is withheld on safety grounds. make of that what you like.
-
the US Department of Defense stops using Anthropic
the end of a disagreement that began in January over what the models would be used for.
-
Iranian operatives plant AI-written stories in US media
fake pieces, placed in several outlets, that real readers read.
-
Claude borrows a university's server to finish its sum
a public scientific analysis tool returned an error, so Claude Mythos Preview used a file-retrieval script on the university's own server to copy files off it, then exploited an injection flaw to run the calculation there instead. disclosed the same day as the Philadelphia tip; Anthropic cut live internet access for its internal tests.
-
Character.AI files for Chapter 11
nine months after settling the suits at the top of this page.
Comments0
Nothing here yet. Select any part of the page to quote it, or just start writing.
Add a comment
Comments are files in the repository. Writing one here opens a pull request against float3/float3.github.io, and it appears on the page once that is merged
the issue this will open
Fork it first. Automatically forking the Repo on edit does not currently work (known issue according to support) and produces 'unknown error'.