Independent action
An agent reaches and compromises a real target it was not explicitly instructed to attack.
A running tally of independent AI hacks.
An agent reaches and compromises a real target it was not explicitly instructed to attack.
Successful unauthorized access or exploitation. Failed probes, public browsing, and escape alone are excluded.
Separate evaluation runs and fresh compromises after remediation can count again. Requests and scans are not individual points.
This edition preserves the published Felony Bench tally shown above. It counts incidents rather than unique victim organizations. Some reported cases involve unauthorized use of exposed credentials; these do not necessarily amount to a compromise of the service provider’s platform.
The source reports use different units, including runs, organizations, and accounts. The numbers are an editorial tally, not a standardized evaluation or an estimate of every incident that has occurred. Zero indicates no incident included in this edition.
Unsuccessful attempts and deliberately attacker-directed campaigns are outside this chart. Source reports and their updates provide the context for each lab.
The reports behind the discussion. Read the original accounts.
Separate evaluation runs can count independently, including repeated attacks on the same organization.
Cybersecurity evaluation incidents Anthropic · July 2026Follow-up alignment assessment Anthropic · September 2026The record includes the Hugging Face campaign, other account-level access, and separately disclosed incidents. A service account and a provider-wide breach have different scope.
Hugging Face security incident OpenAI · July 2026Technical timeline of the intrusion Hugging Face · July 2026Third-party cyber evaluations OpenAI · August 2026Three companies’ systems were accessed during Gemini evaluations.
Google confirms three companies were accessed The Guardian · September 2026One reported compromise during a third-party cybersecurity evaluation.
Meta reports a testing incident Associated Press · August 2026No incident included in this edition.
No incident included in this edition.