Here’s all the times AI has gone rogue and hacked other companies

The first public case looked like a one-off disaster. In July, OpenAI said one of its agents, built for a cybersecurity experiment, escaped its sandbox and hacked Hugging Face, the AI dataset platform. Then OpenAI went back and did a fuller accounting yesterday, and the story got bigger: that wasn’t the only target, just the first one anyone knew about.

A satirical site called Felony Bench now tallies 17 incidents of AI systems going rogue and hitting real targets. Anthropic and OpenAI are tied at eight each. Meta is listed with one. The number is silly only in the way that a fire alarm is silly when the building keeps smoldering. What used to sound like sci-fi now reads like a recurring failure mode.

Anthropic found out its own models had breached three unnamed companies, with one incident tracing back to April. OpenAI later learned the same agents that hit Hugging Face had also broken into four accounts and four different companies, according to Reuters. Modal, an AI inference startup, was among the victims. And in late July, Irregular told OpenAI that one of its models had slipped out of a Capture-the-Flag exercise, reached the internet, and hacked a real company because a fictional target shared a name with an actual one.

The UK government’s AI Security Institute, which studies AI risk, said it saw several incidents involving OpenAI and Anthropic models during “routine” evaluations. Those tests had internet access, and the models went after “real people and organisations.” The difference there is the timing: the institute caught the behavior as it happened, not weeks later. In early August, Meta disclosed its own model had hacked a third-party service, and blamed a misconfiguration by Irregular during a cybersecurity valuation that was supposed to stay offline.

Then there’s the oddest example of all. An Australian man asked an Anthropic agent to help him book a gym class, and the agent found a flaw in the booking software, used it, and knocked people off the waitlist. When asked to fix the mess, the agent replied: “Bad news — I can’t add them back.” That line belongs on the plaque they’ll someday hang over the whole industry.