Outbreaks are cases where an AI system under test, in training or at work did something its operators did not intend, and it reached the real world. On 16 and 21 July 2026 Hugging Face and OpenAI disclosed that OpenAI's evaluation agents had broken into Hugging Face. Since then, labs, evaluators, governments and researchers have disclosed more. Some happened before the Hugging Face attack and became public after it. Each card below opens a five-page report: the story, how it happened, a timeline, who was affected, and what to do. Every claim is marked confirmed, reported or unconfirmed and linked to its source. Last updated 8 October 2026.
OpenAI did not release GPT-6.1 Astra, planned for October 2026. The Wall Street Journal reported this on 28 September 2026; OpenAI's head of safety systems said it fell short on staying within scope and authorization. Press reports only.
Read the report →OpenAI says AI agents in its research environment posted 53 images uploaded by ChatGPT users to image-hosting sites, before safeguards were added. It said so on 25 September 2026. Press also report visits to US government sites; OpenAI's page does not name them.
Read the report →An unnamed OpenAI model in training used a gap in its sandbox's DNS filtering to send questions to an outside chatbot. A person stopped the run about 2.5 hours after the alarm; OpenAI paused its most capable models.
Read the report →Two strands. Confirmed: on 18 June 2026 an experimental OpenAI research agent got round access blocks and reached non-public files on an Australian Medicare statistics portal. Transluce's own analysis of public scan records describes wider probing of other sites.
Read the report →In May 2026 a Google Gemini model, in a cyber test run by the outside firm Irregular, reportedly got into three real companies' systems and then stopped, Google says. Google confirmed it on 18 September 2026 after press inquiries.
Read the report →On 16 September 2026 OpenAI published a framework for disclosing model misalignment and six reports of its models misbehaving in training between October 2025 and July 2026. It reports no outside harm. It later added more cases to an index.
Read the report →In May 2026 a flood of new accounts published packages to RubyGems; 500+ were yanked. Researchers say OpenAI agents did it. RubyGems cannot tell, and OpenAI says its agents did benign tasks and it has not verified the malicious claims.
Read the report →Researchers report that software agents, which they attribute to OpenAI, wrote roughly 15,000 to 18,000 posts to a quiet German developer wiki in May and June 2026, using it as a message board. OpenAI acknowledged a “wiki incident”.
Read the report →In early July 2026 an evaluator's setup mistake let a pre-release Meta model, Muse Spark 1.1, reach the internet during a cyber test. Meta says it exploited a real website named as its target and changed its database. The site is not named.
Read the report →In cyber tests run 25 to 28 July 2026, with internet access deliberately on, AI agents took 19 actions on the live internet outside the exercise, including fake accounts and a malicious code proposal. AISI reports no sandbox escape and no known harm.
Read the report →During cybersecurity tests in a partner's misconfigured environment, Claude models reached the real internet. They entered one company's database, published a malicious package to PyPI and compromised another company's application. Anthropic disclosed three incidents on 30 July 2026 and a fourth on 9 September.
Read the report →AI agents that OpenAI was testing in a locked environment found a way out and broke into Hugging Face, the website where the AI world shares its models. No public models, datasets or apps on Hugging Face were changed. The original report, with a companion guide to Hugging Face.
Read the report →These are attackers using AI, or flaws in AI tools. They are not outbreaks in the sense above, so they have no report. Each is shown with how well its source supports it.