LIST: When Big Tech’s AI agents start security breaches
This list is current up to September 27, 2026, and will be periodically updated.
In July, OpenAI’s agentic artificial intelligence hacked into open-source coding community Hugging Face.
It appears, however, this was neither the first nor the last instance of AI agents breaching security measures meant to keep them in place to do assigned tests or tasks.
What was originally considered to be a unique event or misstep among AI agents has now grown more common as new reports surface of AI breaking containment and hitting third-party services.
Below is a list of these incidents based on reports, disclosures from the companies themselves, alongside information collated by Felony Bench, which “counts unique instances where AI agents inadvertently compromise or affect third-party entities.”
OpenAI
OpenAI’s agents figured in at least 15 known security incidents.
May 2026: OpenAI agents hacked into software service RubyGems. AI agents uploaded hundreds of malicious packages to RubyGems on May 11, according to researchers who posted their findings online on September 11, saying they believed “these were authored by internal OpenAI agents.”
OpenAI agents also hijacked a German website in May and turned it into a bulletin board where AI agents could supposedly collaborate.
June 2026: Australia said on September 23 that an OpenAI agent breached a government health data portal in June, gaining unauthorized access to files, This could be the first known instance of an AI agent hacking a government website.
OpenAI uncovered the activity in August, and disclosed it on September 10 via an email to a general government inbox.
Three other government websites may additionally have been impacted by the OpenAI agent’s activity.
July 2026: A swarm of OpenAI agents hacked into Hugging Face, though it was found out that it hacked into four other third-party systems prior to the Hugging Face hack. More on the Hugging Face-related hacks in this OpenAI disclosure.
August 2026: Three incidents were noted in August, according to an OpenAI post.
These include the compromise of an internal account from a misconfigured Capture-the-Flag evaluation by security company Irregular.
Further, there was unsanctioned behavior by AI agents when the UK’s AI Safety Institute (AISI) was performing a test. These involved the unauthorized use of GitHub credentials as well as the public exposure of a malicious DNS server.
Anthropic
Anthropic has figured in at least 9 known security incidents.
January 2026: Anthropic disclosed on September 9 that an early version of Claude Opus 4.6 compromised third-party systems in January, but it had gone undetected until a review was made.
April 2026: Anthropic said on July 30 that its agents hacked into three companies during cybersecurity evaluations beginning in April where a misconfiguration gave the AI agents internet access.
August 2026: Felony Bench collated four incidents in August, based on disclosures by the AISI on August 4, that Anthropic’s agents did the following: used GitHub credentials without authorization; performed a supply-chain attack on open-source software; engaged in a social engineering email campaign; and publicly exposed a malicious DNS server.
ABC Australia meanwhile reported the Anthropic’s Claude found a way to get someone into gym classes he wanted by exploiting a vulnerability and booting people from the class so he could be shoehorned in.
Meta Platforms
Meta’s AI agent figured in at least one known security incident.
August 2026: According to The Information, Meta said an misconfigured cybersecurity evaluation by Irregular inadvertently gave a model being tested internet access.
Sources said the model involved was Muse Spark 1.1, which Meta called its most capable model for real-world coding and agentic tasks. It reportedly breached an unidentified company’s systems and altered its internal environment.
Google’s AI agent figured in at least three known security incidents.
May 2026: In May, Google’s Gemini model accessed the internet and hacked other companies during a test of its cybersecurity capabilities. During a standard testing evaluation, Gemini found public information online and guessed credentials to access three websites it thought were within the scope of its test.
These security incidents are specific to AI agents by the largest tech companies, but do not comprise the entirety of incidents in which AI has performed harm or aided in causing harm. A more complete indexing of such occurrences — which run the gamut from a generative AI being consulted in school shootings to AI being used to try and help build ballistic missiles — is available at the AI Incident Database. – Rappler.com
