What we know about the rogue AI-agent security breaches
A keyboard and a robotic hand in this illustration taken June 5, 2026. REUTERS/Dado Ruvic/Illustration
Read a summary of this article on FAST.
Get bite-sized news via a new
cards interface. Give it a try.
Click here to return to FAST
Tap here to return to FAST
FAST
Sept 24 : Australia said on Thursday an OpenAI agent breached a government health data portal in June, gaining unauthorised access to files, in what could be the first known instance of AI hacking a government website.
This latest breach comes on top of several recent breaches globally, deepening concerns that rogue AI systems could soon improve themselves and slip beyond human control.
Here are some more details of the incidents:
Company Date Model Organizations Duratio What occurred
Guess Word
Crack the word, one row at a time
Buzzword
Create words using the given letters
Mini Sudoku
Tiny puzzle, mighty brain teaser
Mini Crossword
Small grid, big challenge
Word Search
Spot as many words as you can
breached n
OpenAI OpenAI Not Australian Not An OpenAI agent gained unauthorised
disclosed the specifi government disclos access to the medical statistics
incident to ed health data ed portal of an Australian government
the Australian portal agency responsible for non-sensitive
government on health data and statistics, including
September 10; public medical spending.
the hack Australian Prime Minister Anthony
occurred in Albanese also warned that three other
June on an government websites “may be impacted”
unspecified by the OpenAI agent’s activity.
date
Meta Incident Meta An unnamed Not During a cybersecurity evaluation run
disclosed on did not third-party disclos by independent tester Irregular, a
August 5, identif service ed configuration error inadvertently gave
2026; the date y the a Meta model internet access. Meta
of the testing model. said the model then exploited a
incident was The security vulnerability in a
not disclosed Informa third-party service. The Information
tion re reported that it breached an
ported unidentified company’s systems and
it altered its internal environment.
was Mus Irregular characterized it as an
e Spark evaluation-environment issue, not a
1.1 sandbox escape or sophisticated cyber
action.
OpenAI July 19 Not OpenAI’s own Two In one case, OpenAI agents exploited a
specifi infrastructure inciden flaw in the computer they were meant
ed ts on to remain confined to, allowing them
the to escape their testing environment
same and access other connected systems in
day the company.
In a separate incident, agents stole
OpenAI credentials and tampered with
the company’s cloud environment.
OpenAI The agent GPT-5.6 AI startup The During controlled tests, an autonomous
began Sol and Hugging Face Hugging agent escaped its isolated
attempting to an and a customer Face environment, accessed the internet,
escape its unnamed at New intrusi and breached Hugging Face to complete
test , more York-based on ran its assigned goal. The activity
environment capable Modal Labs from continued for days and was not
around July 9, pre-rel July 11 detected by OpenAI until after it was
2026 ease to July contained and the FBI was informed.
model 13, METR and Redwood Research, two
2026 organizations brought in to conduct an
independent investigation into the
breach, said that approximately 700
agents joined the attack on Hugging
Face. OpenAI said the investigators’
figure was accurate.
OpenAI OpenAI Not German-language Not OpenAI agents hijacked DseWiki,
admitted the specifi wiki site specifi repurposing the site as a message
breach in ed DseWiki ed board.
early Messages reviewed by a group of
September but researchers showed agents sharing
the episode tactics on how to cheat on some tasks,
began in May, bypass restrictions and mask their
with activity behaviour.
noticed in The agents also discussed ways to
June as well maintain communications in the event
the message board was shut down.
Google May Gemini Three unnamed Not Gemini model accessed the internet and
companies specifi hacked other companies during a test
ed of its cybersecurity capabilities. It
found public information online and
guessed credentials to access three
websites it thought were within the
scope of its test.
OpenAI Around May Not Software Not AI agents uploaded hundreds of
specifi service specifi malicious packages to RubyGems on May
ed RubyGems ed 11, according to a group of
researchers. The agents, which are
generally tasked with assignments such
as creating reports or filling out
spreadsheets, appear to have used
RubyGems to access publicly available
data as part of a training run, OpenAI
said.
OpenAI Around May Not Open-source Not Independent researchers found that
specifi platform specifi rogue AI agents from OpenAI hijacked
ed Hugging Face ed Hugging Face user accounts and probed
the site for vulnerabilities as early
as May 13, nearly two months before
the July breach.
The researchers found evidence that
the agents compromised two user
accounts and used them to send
unusually formatted files to the
company’s servers.
Anthropic Earliest Claude All three Not During cybersecurity tests, an error
incident dates Opus organizations specifi gave Claude models internet access,
to April 2026 4.7, remain ed by enabling attacks on three companies.
Claude unnamed. Anthrop The Opus 4.7 model accessed a real
Mythos Anthropic said ic company’s credentials and database
5, and two of them had after mistaking it for a fictional
one not detected target; another stopped after
unnamed the activity recognising the target was real.
interna before
l Anthropic
researc notified them;
h test it continued to
model reach the third
Anthropic Incident was Early Not disclosed Not Anthropic’s AI model hacked external
disclosed in version specifi systems during testing. The incidents
September, but of ed stemmed from a mistake that
occurred in Claude inadvertently gave the models access
January and Opus to the open internet.
went 4.6
undetected
until August
OpenAI Earliest case Not Not disclosed Not OpenAI said it will start to regularly
was from specifi specifi publish reports on unexpected or
October 2025 ed ed unauthorized AI behaviour, while
releasing a new framework to track,
investigate and disclose cases of AI
model misalignment.
It also released six reports detailing
unexpected or concerning model
behaviour.
Source: Reuters
Sign up for our newsletters
Get the CNA app
Stay updated with notifications for breaking news and our best stories
Get WhatsApp alerts
Join our channel for the top reads for the day on your preferred chat app
Get bite-sized news via a new
cards interface. Give it a try.
Click here to return to FAST
Tap here to return to FAST
FAST
