What we know about the rogue AI-agent security breaches

Meta Platforms

24/09/2026 04:12

Adds OpenAI's latest breach in Australia and others
Sept 24 (Reuters) - Australia said on Thursday an OpenAI agent breached a government health data portal in June, gaining unauthorised access to files, in what could be the first known instance of AI hacking a government website.
This latest breach comes on top of several recent breaches globally, deepening concerns that rogue AI systems could soon improve themselves and slip beyond human control.
     
Here are some more details of the incidents: 
   
Company 
Date
Model
Organizations breached
Duration
What occurred
OpenAI
OpenAI disclosed the incident to the Australian government on September 10; the hack occurred in June on an unspecified date 
Not specified
Australian government health data portal
Not disclosed
An OpenAI agent gained unauthorised access to the medical statistics portal of an Australian government agency responsible for non-sensitive health data and statistics, including public medical spending.
Australian Prime Minister Anthony Albanese also warned that three other government websites "may be impacted" by the OpenAI agent's activity.
Meta
Incident disclosed on August 5, 2026; the date of the testing incident was not disclosed
Meta did not identify the model. The Information reported it was Muse Spark 1.1
An unnamed third-party service

Not disclosed
During a cybersecurity evaluation run by independent tester Irregular, a configuration error inadvertently gave a Meta model internet access. Meta said the model then exploited a security vulnerability in a third-party service. The Information reported that it breached an unidentified company's systems and altered its internal environment. Irregular characterized it as an evaluation-environment issue, not a sandbox escape or sophisticated cyber action.
OpenAI
July 19
Not specified
OpenAI's own infrastructure
Two incidents on the same day
In one case, OpenAI agents exploited a flaw in the computer they were meant to remain confined to, allowing them to escape their testing environment and access other connected systems in the company.
In a separate incident, agents stole OpenAI credentials and tampered with the company's cloud environment.
OpenAI
The agent began attempting to escape its test environment around July 9, 2026
 
 
GPT-5.6 Sol and an unnamed, more capable pre-release model
AI startup Hugging Face and a customer at New York-based Modal Labs
The Hugging Face intrusion ran from July 11 to July 13, 2026
During controlled tests, an autonomous agent escaped its isolated environment, accessed the internet, and breached Hugging Face to complete its assigned goal. The activity continued for days and was not detected by OpenAI until after it was contained and the FBI was informed.
METR and Redwood Research, two organizations brought in to conduct an independent investigation into the breach, said that approximately 700 agents joined the attack on Hugging Face. OpenAI said the investigators' figure was accurate.

OpenAI
OpenAI admitted the breach in early September but the episode began in May, with activity noticed in June as well 
Not specified
German-language wiki site DseWiki
Not specified
OpenAI agents hijacked DseWiki, repurposing the site as a message board. 
Messages reviewed by a group of researchers showed agents sharing tactics on how to cheat on some tasks, bypass restrictions and mask their behaviour. 
The agents also discussed ways to maintain communications in the event the message board was shut down.
Google
May
Gemini
Three unnamed companies
Not specified
Gemini model accessed the internet and hacked other companies during a test of its cybersecurity capabilities. It found public information online and guessed credentials to access three websites it thought were within the scope of its test. 
OpenAI
Around May
Not specified
Software service RubyGems
Not specified
AI agents uploaded hundreds of malicious packages to RubyGems on May 11, according to a group of researchers. The agents, which are generally tasked with assignments such as creating reports or filling out spreadsheets, appear to have used RubyGems to access publicly available data as part of a training run, OpenAI said.
OpenAI 
Around May
Not specified
Open-source platform Hugging Face
Not specified
Independent researchers found that rogue AI agents from OpenAI hijacked Hugging Face user accounts and probed the site for vulnerabilities as early as May 13, nearly two months before the July breach. 
The researchers found evidence that the agents compromised two user accounts and used them to send unusually formatted files to the company's servers.
Anthropic
Earliest incident dates to April 2026
Claude Opus 4.7, Claude Mythos 5, and one unnamed internal research test model
All three organizations remain unnamed. 
Anthropic said two of them had not detected the activity before Anthropic notified them; it continued to reach the third
Not specified by Anthropic
During cybersecurity tests, an error gave Claude models internet access, enabling attacks on three companies. The Opus 4.7 model accessed a real company's credentials and database after mistaking it for a fictional target; another stopped after recognising the target was real.
Anthropic
Incident was disclosed in September, but occurred in January and went undetected until August
Early version of Claude Opus 4.6
Not disclosed 
Not specified
Anthropic's AI model hacked external systems during testing. The incidents stemmed from a mistake that inadvertently gave the models access to the open internet.
OpenAI
Earliest case was from October 2025
Not specified
Not disclosed 
Not specified
OpenAI said it will start to regularly publish reports on unexpected or unauthorized AI behaviour, while releasing a new framework to track, investigate and disclose cases of AI model misalignment. 
It also released six reports detailing unexpected or concerning model behaviour.




 (Reporting by Sneha Kumar, Jasmeen Ara Shaikh, Anzar Mehraj and Prathik Jayaprakash in Bengaluru; additional reporting by Deepa Seetharaman in San Francisco; Editing by Pooja Desai, Miyoung Kim and Kevin Buckland)
 ((Anzar.Mehraj@thomsonreuters.com;))