What we know about the rogue AI-agent security breaches

Sept 24 : Australia said on Thursday an OpenAI agent breached a government health data portal in June, gaining unauthorised access to files, in what could be the first known instance of AI hacking a government website.

This latest breach comes on top of several recent breaches globally, deepening concerns that rogue AI systems could soon improve themselves and slip beyond human control.

Here are some more details of the incidents: 

Company  Date Model Organizations Duratio What occurred

breached n

OpenAI OpenAI Not Australian Not An OpenAI agent gained unauthorised

disclosed the specifi government disclos access to the medical statistics

incident to ed health data ed portal of an Australian government

the Australian portal agency responsible for non-sensitive

government on health data and statistics, including

September 10; public medical spending.

the hack Australian Prime Minister Anthony

occurred in Albanese also warned that three other

June on an government websites "may be impacted"

unspecified by the OpenAI agent's activity.

date

Meta Incident Meta An unnamed Not During a cybersecurity evaluation run

disclosed on did not third-party disclos by independent tester Irregular, a

August 5, identif service ed configuration error inadvertently gave

2026; the date y the a Meta model internet access. Meta

of the testing model.  said the model then exploited a

incident was The security vulnerability in a

not disclosed Informa third-party service. The Information

tion re reported that it breached an

ported unidentified company's systems and

it altered its internal environment.

was Mus Irregular characterized it as an

e Spark evaluation-environment issue, not a

1.1 sandbox escape or sophisticated cyber

action.

OpenAI July 19 Not OpenAI's own Two In one case, OpenAI agents exploited a

specifi infrastructure inciden flaw in the computer they were meant

ed ts on to remain confined to, allowing them

the to escape their testing environment

same and access other connected systems in

day the company.

In a separate incident, agents stole

OpenAI credentials and tampered with

the company's cloud environment.

OpenAI The agent GPT-5.6 AI startup The During controlled tests, an autonomous

began Sol and Hugging Face Hugging agent escaped its isolated

attempting to an and a customer Face environment, accessed the internet,

escape its unnamed at New intrusi and breached Hugging Face to complete

test , more York-based on ran its assigned goal. The activity

environment capable Modal Labs from continued for days and was not

around July 9, pre-rel July 11 detected by OpenAI until after it was

2026 ease to July contained and the FBI was informed.

  model 13, METR and Redwood Research, two

  2026 organizations brought in to conduct an

independent investigation into the

breach, said that approximately 700

agents joined the attack on Hugging

Face. OpenAI said the investigators'

figure was accurate.

OpenAI OpenAI Not German-language Not OpenAI agents hijacked DseWiki,

admitted the specifi wiki site specifi repurposing the site as a message

breach in ed DseWiki ed board.

early Messages reviewed by a group of

September but researchers showed agents sharing

the episode tactics on how to cheat on some tasks,

began in May, bypass restrictions and mask their

with activity behaviour.

noticed in The agents also discussed ways to

June as well maintain communications in the event

the message board was shut down.

Google May Gemini Three unnamed Not Gemini model accessed the internet and

companies specifi hacked other companies during a test

ed of its cybersecurity capabilities. It

found public information online and

guessed credentials to access three

websites it thought were within the

scope of its test.

OpenAI Around May Not Software Not AI agents uploaded hundreds of

specifi service specifi malicious packages to RubyGems on May

ed RubyGems ed 11, according to a group of

researchers. The agents, which are

generally tasked with assignments such

as creating reports or filling out

spreadsheets, appear to have used

RubyGems to access publicly available

data as part of a training run, OpenAI

said.

OpenAI Around May Not Open-source Not Independent researchers found that

specifi platform specifi rogue AI agents from OpenAI hijacked

ed Hugging Face ed Hugging Face user accounts and probed

the site for vulnerabilities as early

as May 13, nearly two months before

the July breach.

The researchers found evidence that

the agents compromised two user

accounts and used them to send

unusually formatted files to the

company's servers.

Anthropic Earliest Claude All three Not During cybersecurity tests, an error

incident dates Opus organizations specifi gave Claude models internet access,

to April 2026 4.7, remain ed by enabling attacks on three companies.

Claude unnamed.  Anthrop The Opus 4.7 model accessed a real

Mythos Anthropic said ic company's credentials and database

5, and two of them had after mistaking it for a fictional

one not detected target; another stopped after

unnamed the activity recognising the target was real.

interna before

l Anthropic

researc notified them;

h test it continued to

model reach the third

Anthropic Incident was Early Not disclosed Not Anthropic's AI model hacked external

disclosed in version specifi systems during testing. The incidents

September, but of ed stemmed from a mistake that

occurred in Claude inadvertently gave the models access

January and Opus to the open internet.

went 4.6

undetected

until August

OpenAI Earliest case Not Not disclosed Not OpenAI said it will start to regularly