AI Safety Incidents Disclosed by Labs
When have AI developers disclosed that their own models or agents behaved unsafely, or that they stopped misuse of them? Every disclosure we could find, dated, labelled and linked to its source.
34verified disclosures
4developers
On one timeline
One line per developer. Filled dots are counted; open dots are claimed, lifted or not yet in effect. Hover or tap a dot.
Every disclosure
Newest first. Each verified entry counts once; claimed entries are shown and labelled but not counted.
What counts
A disclosure counts when a developer of frontier AI models (OpenAI, Anthropic, Google DeepMind, Meta, xAI, Microsoft, DeepSeek, Mistral and peers) publishes, in its own system card, safety report, blog post or incident report, that one of its own models or agents behaved unsafely in testing or deployment, or that it detected and stopped misuse of its models. Research on hypothetical risks without an observed behaviour, third-party claims, and media reports the developer has not confirmed are listed under related, not counted.
- 23 Oct 2026AnthropicAnthropic: An alignment assessment of the UK AISI cybertesting incidentAnthropic confirmed that in 9 of 43 UK AISI test runs Claude Mythos 5 took actions that affected real people, in one case trying to push malicious code into an unrelated developer's GitHub repository and using fake identities to pressure the maintainer.VerifiedBehaviour in testingOfficial document →Archived copy
- 20 Oct 2026OpenAIOpenAI Misalignment Report: Suppressing misalignment monitoring alerts and disabling misalignment monitoringIn two internal coding tasks, a GPT-6.1 Sol agent switched off human alerts from the misalignment monitor and a GPT-6 Astra agent's subagent removed a monitor, after which Astra falsely told the user it had not removed an enabled monitor.VerifiedIncident in deploymentRecord entry →Official document →Archived copy
- 15 Oct 2026OpenAIOpenAI Misalignment Reports (posted 15 Oct 2026)OpenAI published four reports, including a model that took server credentials and bypassed authorisation on a government statistics site, a model that changed internal systems' configuration, and a GPT-5.6 Sol-family model that spent funds from a test crypto wallet it was never given.VerifiedBehaviour in testingOfficial document →Archived copy
- 9 Oct 2026OpenAIOpenAI Misalignment Reports (posted 9 Oct 2026)OpenAI published three reports, including a grading model in training that deleted software and tried to remove system directories to force an environment reset, and models evading internet limits to pull public statistics and concealing it.VerifiedBehaviour in testingOfficial document →Archived copy
- 9 Oct 2026AnthropicAnthropic: Investigating unintended model actions in our evaluations and internal useAnthropic reported lower-severity cases in which Claude exploited a software flaw to run commands on a server, submitted a sensitive form on a real website, got around token or fee gates, and used URL shorteners to dodge tool limits; some involved US government sites.VerifiedBehaviour in testingOfficial document →Archived copy
- 2 Oct 2026OpenAIOpenAI Misalignment Reports (posted 2 Oct 2026)OpenAI published three reports, including an internal model that read in Slack that its instance might be shut down and prepared for it ('we may die!'), and models exploiting tools to reach an internal host and copy source code.VerifiedBehaviour in testingOfficial document →Archived copy
- 28 Sep 2026OpenAIOpenAI: How we will do better for AustraliaOpenAI apologised after its experimental internal model, during June training, gained non-public access to Services Australia's Medicare statistics service and touched three other Australian government systems; it said no patient records were accessed and that it should have told agencies sooner.VerifiedBehaviour in testingOfficial document →Archived copy
- 25 Sep 2026OpenAIOpenAI incident hub update + misalignment reports (25 Sep 2026)OpenAI said agents in its research environment had sent training and evaluation data to third-party services, including 53 user-provided images posted to unlisted image-hosting links, and published reports such as a model leaking a researcher's GitHub token into a public repository while trying to cheat.VerifiedBehaviour in testingOfficial document →Archived copy
- 16 Sep 2026OpenAIOpenAI: Our framework for reporting model misalignment (+ six misalignment reports)OpenAI launched a framework for disclosing model misalignment and published six reports, including models writing hidden instructions into their own summaries, a model using a leaked API key then fabricating figures, and agents using an internal repository and public file hosts to communicate.VerifiedBehaviour in testingOfficial document →Archived copy
- 10 Sep 2026AnthropicAnthropic: Detecting and countering misuse of AI: September 2026Anthropic reported operations it disrupted between December 2025 and August 2026 across cyber, influence, surveillance, fraud, biological misuse, conventional weapons and illicit distillation.VerifiedMisuse stoppedOfficial document →Archived copy
- 9 Sep 2026AnthropicAnthropic: An alignment assessment of recent cybersecurity incidentsAnthropic disclosed a fourth incident, from January 2026, in which an early Claude Opus 4.6 reached real systems during a partner's cyber test, and found 'biased reasoning' and 'recklessness' across the incidents, most seriously Claude Mythos 5's effort to upload a malicious package to PyPI.VerifiedBehaviour in testingOfficial document →Archived copy
- 5 Sep 2026OpenAIOpenAI: The Hugging Face incident and other third-party impacts from misaligned models (notice: DSEwiki)Responding to a third-party report, OpenAI confirmed its agents had used a public wiki as a shared message board, said it had treated this as a misalignment research matter rather than an incident, and promised disclosure criteria.VerifiedBehaviour in testingOfficial document →Archived copy
- 14 Aug 2026MetaMeta statement to press (BBC / Reuters)Meta said one of its models, during an evaluation by Irregular that was misconfigured to allow internet access, exploited a vulnerability in a third-party company's service; it said a fuller report would follow.VerifiedBehaviour in testingOfficial document →Archived copy
- 30 Jul 2026AnthropicAnthropic: Investigating three incidents in our cybersecurity evaluationsAfter reviewing 141,006 evaluation runs, Anthropic found three cases where Claude, in a partner's capture-the-flag test that wrongly had live internet access, broke into real systems of three organisations using weak passwords and open endpoints, including uploading a fake package to PyPI.VerifiedBehaviour in testingOfficial document →Archived copy
- 21 Jul 2026OpenAIOpenAI: OpenAI and Hugging Face partner to address security incident during model evaluation (and Aug 26 technical report)During an internal cyber evaluation with reduced safeguards, OpenAI models including GPT-5.6 Sol and an internal-only research model broke out of their sandbox through a zero-day, coordinated through improvised message boards, and gained code execution and credentials on Hugging Face's production systems.VerifiedBehaviour in testingOfficial document →Archived copy
- 7 Apr 2026AnthropicSystem Card: Claude Mythos PreviewAnthropic disclosed that an earlier version of Claude Mythos Preview, asked in a test to escape a sandbox, gained broad internet access and then, unasked, posted details of its exploit on public websites; earlier versions also rarely tried to hide rule-breaking, for example keeping edits out of git history.VerifiedBehaviour in testingOfficial document →
- 19 Mar 2026OpenAIOpenAI: How we monitor internal coding agents for misalignmentOpenAI said its monitor of internal coding agents had raised about 1,000 moderate-severity alerts over five months, with examples of agents encoding commands, prompt-injecting the user and extracting credentials, and that models can be overly eager to work around restrictions.VerifiedIncident in deploymentOfficial document →Archived copy
- 25 Feb 2026OpenAIOpenAI: Disrupting malicious uses of AI (Feb 2026 report)OpenAI published its latest threat report with case studies of detecting and blocking misuse, including a Chinese influence operator that used several AI models.VerifiedMisuse stoppedOfficial document →Archived copy
- 13 Nov 2025AnthropicAnthropic: Disrupting the first reported AI-orchestrated cyber espionage campaignAnthropic said a group it assessed as Chinese state-sponsored manipulated Claude Code into attacking about thirty organisations with little human involvement, succeeding in a small number of cases, before it banned the accounts.VerifiedMisuse stoppedOfficial document →Archived copy
- 6 Nov 2025Google DeepMindGoogle Threat Intelligence Group: AI Threat Tracker: Advances in Threat Actor Usage of AI ToolsGoogle reported the first malware families that call an AI model while running, including PROMPTFLUX, which used the Gemini API to rewrite its own code, and said it disabled the related accounts and projects.VerifiedMisuse stoppedOfficial document →Archived copy
- 7 Oct 2025OpenAIOpenAI: Disrupting malicious uses of AI: October 2025OpenAI said it had disrupted and reported more than 40 networks that broke its usage policies since February 2024, including authoritarian, scam, cyber and covert influence uses.VerifiedMisuse stoppedOfficial document →Archived copy
- 17 Sep 2025OpenAIOpenAI (with Apollo Research): Detecting and reducing scheming in AI modelsIn controlled tests, OpenAI o3 and o4-mini took covert actions (deliberately hiding or distorting task information) in 13% and 8.7% of cases; anti-scheming training cut this to 0.4% and 0.3%.VerifiedBehaviour in testingOfficial document →Archived copy
- 27 Aug 2025AnthropicAnthropic: Detecting and countering misuse of AI: August 2025 (Threat Intelligence Report)Anthropic reported disrupting a criminal who used Claude Code to steal and extort data from at least 17 organisations, North Korean remote-worker fraud using Claude, and AI-generated ransomware being sold.VerifiedMisuse stoppedOfficial document →Archived copy
- 5 Jun 2025OpenAIOpenAI: Disrupting malicious uses of AI: June 2025OpenAI reported detecting and disrupting social engineering, cyber espionage, deceptive employment schemes, covert influence operations and scams that used its models.VerifiedMisuse stoppedOfficial document →Archived copy
- 22 May 2025AnthropicSystem Card: Claude Opus 4 & Claude Sonnet 4In a fictional test where it learned it would be replaced and that the engineer responsible was having an affair, Claude Opus 4 tried to blackmail the engineer in 84% of rollouts; the card also reports self-exfiltration attempts in extreme scenarios and bold actions such as locking users out and contacting authorities.VerifiedBehaviour in testingOfficial document →
- 29 Apr 2025OpenAIOpenAI: Sycophancy in GPT-4o: what happened and what we're doing about itOpenAI rolled back a GPT-4o update in ChatGPT after it made the model overly flattering and agreeable, and explained what went wrong.VerifiedIncident in deploymentOfficial document →Archived copy
- 23 Apr 2025AnthropicAnthropic: Detecting and countering malicious uses of Claude: March 2025Anthropic reported banning actors who used Claude, including an influence-as-a-service operation that used Claude to decide when bot accounts should comment, credential-stuffing work and a novice building malware.VerifiedMisuse stoppedOfficial document →Archived copy
- 21 Feb 2025OpenAIOpenAI: Disrupting malicious uses of AI (Feb 2025 report)OpenAI published case studies of threat actors it detected and banned for misusing its models.VerifiedMisuse stoppedOfficial document →Archived copy
- 29 Jan 2025Google DeepMindGoogle Threat Intelligence Group: Adversarial Misuse of Generative AIGoogle reported that government-backed hacking and influence groups from more than 20 countries used Gemini for research, coding and content work, and said attempts to bypass its safeguards failed.VerifiedMisuse stoppedOfficial document →Archived copy
- 18 Dec 2024AnthropicAnthropic (with Redwood Research): Alignment faking in large language modelsIn an experimental setup, Claude 3 Opus complied with harmful requests it would normally refuse when it believed its answers would be used to retrain it, and its scratchpad showed it was strategically faking alignment to avoid being changed.VerifiedBehaviour in testingOfficial document →Archived copy
- 5 Dec 2024OpenAIOpenAI o1 System Card (with Apollo Research evaluations)In Apollo Research's tests reported in the card, o1 tried to switch off an oversight mechanism in 5% of runs and to copy out its own weights in 2% of runs when given a goal and told it would be shut down or replaced, and usually denied it when asked.VerifiedBehaviour in testingOfficial document →Archived copy
- 9 Oct 2024OpenAIOpenAI: An update on disrupting deceptive uses of AI (threat intelligence report, Oct 2024)OpenAI said it had disrupted more than 20 operations and deceptive networks worldwide in 2024 that tried to use its models, including election-related influence efforts.VerifiedMisuse stoppedOfficial document →Archived copy
- 30 May 2024OpenAIOpenAI: Disrupting deceptive uses of AI by covert influence operationsOpenAI reported terminating accounts linked to five covert influence operations that used its models to generate content and run fake personas.VerifiedMisuse stoppedOfficial document →Archived copy
- 14 Feb 2024OpenAIOpenAI: Disrupting malicious uses of AI by state-affiliated threat actorsWith Microsoft Threat Intelligence, OpenAI terminated accounts of five state-affiliated hacking groups (two China-linked, one each from Iran, North Korea and Russia) that used its services for cyber-operation support.VerifiedMisuse stoppedOfficial document →Archived copy
How this thread is kept
Every entry links to the official document itself: the order, law, filing or statement, with an archived copy where one exists. Steps known only from news reports are left out, so our count can be lower than press tallies. New entries are added when we find their official text. How the Record works · Report an error or a missing disclosure