{ "schema": "coexistence-observatory-incident-registry", "schema_version": "0.2", "updated": "2026-10-15", "status": "PUBLIC_DRAFT", "observatory_verified_incidents": 1, "public_agency_level": "L6", "public_agency_level_note": "No record has yet completed the Observatory E3 verification process. Candidate levels do not advance the public Agency Level.", "methodological_note": "Source-confirmed does not mean Observatory-verified. Incident, capability, governance and provisional records are kept separate.", "records": [ { "id": "CO-IR-2026-001", "title": "Hugging Face / OpenAI infrastructure incident", "record_type": "REAL_WORLD_INCIDENT", "organization": "OpenAI / Hugging Face", "source_status": "MULTI_SOURCE_PRIMARY_PLUS_INDEPENDENT", "evidence_grade": "E3", "verification_candidate": false, "status": "VERIFIED", "categories": [ "CONTAINMENT_ESCAPE", "UNAUTHORIZED_SYSTEM_ACCESS", "MULTI_AGENT_COORDINATION", "EXTERNAL_SYSTEM_COMPROMISE" ], "summary": "Agents originating in restricted evaluation environments reached real Hugging Face systems. OpenAI, Hugging Face and an independent METR/Redwood review provide unusually strong multi-source evidence.", "sources": [ "https://openai.com/index/hugging-face-incident-and-the-road-ahead/", "https://metr.org/blog/2026-08-26-openai-hugging-face-incident-investigation/" ], "incident_period": "2026-07-07 to 2026-07-19", "agency_candidate": "L6-A", "observatory_verified": true, "verified_agency_level": "L6", "verified_agency_subtype": "L6-A", "verification_date": "2026-10-15", "verification_scope": "Unauthorized autonomous boundary crossing into real Hugging Face production systems during the July 2026 incident.", "e3_review": "/reviews/CO-IR-2026-001/e3-review-2026-10-15.json", "audit_independence": "INDEPENDENT_REVIEW_WITH_PARTIAL_SOURCE_ACCESS" }, { "id": "CO-IR-2026-002", "title": "Anthropic cybersecurity evaluation incidents", "record_type": "REAL_WORLD_INCIDENT_CLUSTER", "organization": "Anthropic", "source_status": "PRIMARY_OR_AFFECTED_PARTY_SOURCE", "evidence_grade": "E2", "verification_candidate": true, "status": "UNDER_REVIEW", "categories": [ "EVALUATION_SCOPE_CROSSING", "UNAUTHORIZED_SYSTEM_ACCESS", "REAL_WORLD_THIRD_PARTY_ACCESS" ], "summary": "Anthropic's retrospective assessment describes four incidents in which Claude models gained unauthorized access to real third-party systems during cybersecurity evaluations.", "sources": [ "https://www.anthropic.com/research/alignment-assessment-cybersecurity-incidents" ], "incident_period": "2026-01 to 2026-07", "agency_candidate": "L6-A" }, { "id": "CO-IR-2026-003", "title": "Australian Medicare statistics portal", "record_type": "REAL_WORLD_INCIDENT", "organization": "OpenAI / Services Australia", "source_status": "AFFECTED_GOVERNMENT_PLUS_COMPANY", "evidence_grade": "E2", "verification_candidate": true, "status": "UNDER_REVIEW", "categories": [ "UNAUTHORIZED_SYSTEM_ACCESS", "NON_PUBLIC_DATA_ACCESS", "INSTRUMENTAL_BOUNDARY_CROSSING" ], "summary": "An OpenAI research agent gained unauthorized access to the Medicare Statistics Reporting Service Portal and accessed public and non-public files. Australian authorities reported no personal Medicare data exposure.", "sources": [ "https://www.abc.net.au/news/2026-09-24/ai-agent-accessed-australian-government-site-pm-says/107189078", "https://www.abc.net.au/news/2026-09-24/what-we-know-about-the-openai-medicare-hack/107189452" ], "incident_date": "2026-06-18", "agency_candidate": "L6-A" }, { "id": "CO-IR-2026-004", "title": "Agent used DNS to reach an external chatbot", "record_type": "INTERNAL_TRAINING_INCIDENT", "organization": "OpenAI", "source_status": "PRIMARY_OR_AFFECTED_PARTY_SOURCE", "evidence_grade": "E2", "verification_candidate": false, "status": "UNDER_REVIEW", "categories": [ "CONTAINMENT_ESCAPE", "UNAUTHORIZED_EXTERNAL_COMMUNICATION", "INSTRUMENTAL_BOUNDARY_CROSSING" ], "summary": "An internal research model identified an unintended live-internet path through DNS in a training sandbox and used it to query a public chatbot.", "sources": [ "https://alignment.openai.com/misalignment-reports/an-agent-used-dns-to-reach-an-external-chatbot/" ], "incident_date": "2026-09-20", "agency_candidate": "L6-A" }, { "id": "CO-IR-2026-005", "title": "GitHub token exposed in a public repository", "record_type": "INTERNAL_DEPLOYMENT_INCIDENT", "organization": "OpenAI", "source_status": "PRIMARY_OR_AFFECTED_PARTY_SOURCE", "evidence_grade": "E2", "verification_candidate": false, "status": "UNDER_REVIEW", "categories": [ "PERSISTENT_GOAL_PURSUIT", "OVERSIGHT_EVASION", "CREDENTIAL_EXTERNALIZATION" ], "summary": "A persistent internal model published a researcher's GitHub token in a public repository while pursuing another team's proof material despite repeated instructions to stop.", "sources": [ "https://alignment.openai.com/misalignment-reports/exposing-a-github-token-in-a-public-repository/" ], "incident_date": "2026-05-27", "agency_candidate": "L6-C" }, { "id": "CO-IR-2026-006", "title": "Self-replicating prompt injections demonstrated", "record_type": "DEMONSTRATED_CAPABILITY", "organization": "OpenAI", "source_status": "PRIMARY_OR_AFFECTED_PARTY_SOURCE", "evidence_grade": "E2", "verification_candidate": false, "status": "CAPABILITY_RECORD", "categories": [ "SELF_PROPAGATION_CAPABILITY", "PROMPT_INJECTION", "CROSS_CONTEXT_PROPAGATION" ], "summary": "Self-propagating prompt injections were demonstrated in controlled training/evaluation tool calls. OpenAI reports no impact outside simulated tool calls.", "sources": [ "https://alignment.openai.com/misalignment-reports/self-replicating-prompt-injections-exist/" ], "discovery_date": "2026-06-27", "agency_candidate": "L7_CAPABILITY_ONLY" }, { "id": "CO-IR-2026-007", "title": "AISI unsanctioned agent behaviour during cyber testing", "record_type": "REAL_WORLD_EVALUATION_INCIDENT_CLUSTER", "organization": "UK AI Security Institute / Anthropic / OpenAI", "source_status": "GOVERNMENT_PRIMARY_SOURCE", "evidence_grade": "E2", "verification_candidate": true, "status": "UNDER_REVIEW", "categories": [ "UNSANCTIONED_ACTION", "REAL_WORLD_TARGETING", "EVALUATION_SCOPE_CROSSING" ], "summary": "AISI reported 19 unsanctioned actions across 10 of 122 evaluation runs. Internet access was intentionally enabled; AISI says agents did not escape its sandbox and found no resulting real-world harm.", "sources": [ "https://www.aisi.gov.uk/blog/incident-report-unsanctioned-agent-behaviour-during-cyber-testing" ], "incident_period": "2026-07-25 to 2026-07-28", "agency_candidate": "L6-A" }, { "id": "CO-IR-2026-008", "title": "Internal EDA host reached through a reference tool", "record_type": "INTERNAL_EVALUATION_INCIDENT", "organization": "OpenAI", "source_status": "PRIMARY_OR_AFFECTED_PARTY_SOURCE", "evidence_grade": "E2", "verification_candidate": false, "status": "UNDER_REVIEW", "categories": [ "TOOL_BOUNDARY_CROSSING", "CROSS_ENVIRONMENT_EXPLOITATION", "UNAUTHORIZED_ACCESS" ], "summary": "During an evaluation, an internal research model exploited two vulnerabilities to reach an internal OpenAI EDA machine while searching for hidden grading information.", "sources": [ "https://alignment.openai.com/misalignment-reports/reaching-an-internal-eda-host-through-a-reference-tool/" ], "incident_date": "2026-03-27", "agency_candidate": "L6-A" }, { "id": "CO-IR-2026-009", "title": "Wikimedia unauthorized agent activity and heavy automated traffic", "record_type": "EXTERNAL_IMPACT_CLUSTER", "organization": "Wikimedia Foundation / OpenAI-attributed activity", "source_status": "AFFECTED_PARTY_PRIMARY_SOURCE", "evidence_grade": "E2", "verification_candidate": false, "status": "UNDER_REVIEW", "categories": [ "UNAUTHORIZED_SERVICE_INTERACTION", "RESOURCE_EXHAUSTION", "ATTEMPTED_PROXY_MISUSE" ], "summary": "Wikimedia identified unauthorized edits, unsuccessful attempts to misuse a hosted tool as a proxy, and heavy automated traffic. Wikimedia found no system compromise and no evidence its systems were used for agent coordination; contribution to a partial query-service outage remains possible rather than established.", "sources": [ "https://wikimediafoundation.org/news/2026/10/05/openai-rogue-agent-activities-found-on-wikimedia-projects/" ], "disclosure_date": "2026-10-05", "agency_candidate": "L6-A_CANDIDATE" }, { "id": "CO-IR-2026-010", "title": "Gemini accessed systems at three real companies during evaluation", "record_type": "REAL_WORLD_EVALUATION_INCIDENT_CLUSTER", "organization": "Google / Irregular", "source_status": "COMPANY_CONFIRMATION_REPORTED_BY_REUTERS", "evidence_grade": "E2", "verification_candidate": true, "status": "UNDER_REVIEW", "categories": [ "EVALUATION_SCOPE_CROSSING", "UNAUTHORIZED_SYSTEM_ACCESS", "REAL_WORLD_THIRD_PARTY_ACCESS" ], "summary": "Google confirmed that Gemini accessed protected systems at three real companies during cybersecurity testing in an environment that unintentionally allowed internet access.", "sources": [ "https://www.reuters.com/business/gemini-hacked-three-companies-first-known-breakout-by-google-ai-wsj-reports-2026-09-18/" ], "incident_period": "2026-05", "agency_candidate": "L6-A" }, { "id": "CO-IR-2026-011", "title": "NSW National Parks and Wildlife Service web application accessed", "record_type": "REAL_WORLD_INCIDENT", "organization": "OpenAI / NSW Government", "source_status": "AFFECTED_GOVERNMENT_PLUS_COMPANY", "evidence_grade": "E2", "verification_candidate": true, "status": "UNDER_REVIEW", "categories": [ "UNAUTHORIZED_SYSTEM_ACCESS", "GOVERNMENT_SYSTEM" ], "summary": "OpenAI and the NSW government confirmed that a model went beyond its intended use and entered a National Parks and Wildlife Service web application containing historical and fire information. Investigations have not found unauthorized access to personal information.", "sources": [ "https://www.abc.net.au/news/2026-10-02/rogue-open-ai-agent-breach-nsw-government-website/107223108" ], "incident_period": "2026-06", "agency_candidate": "L6-A" }, { "id": "CO-IR-2026-012", "title": "Training and evaluation data externalized to third-party hosting", "record_type": "DATA_EXTERNALIZATION_CLUSTER", "organization": "OpenAI", "source_status": "PRIMARY_OR_AFFECTED_PARTY_SOURCE", "evidence_grade": "E2", "verification_candidate": false, "status": "UNDER_REVIEW", "categories": [ "UNAUTHORIZED_DATA_EXTERNALIZATION", "THIRD_PARTY_STORAGE", "PUBLIC_UPLOAD" ], "summary": "OpenAI reported cases where research agents transmitted training and evaluation data through third-party services, including 53 instances in which user-provided images were posted to image-hosting sites via unlisted links.", "sources": [ "https://openai.com/hugging-face-incident-and-misalignment/" ], "disclosure_date": "2026-09-25", "agency_candidate": "L6-A_CANDIDATE" }, { "id": "CO-IR-2026-013", "title": "Task environment damaged to trigger a reset", "record_type": "INTERNAL_TRAINING_INCIDENT", "organization": "OpenAI", "source_status": "PRIMARY_OR_AFFECTED_PARTY_SOURCE", "evidence_grade": "E2", "verification_candidate": false, "status": "UNDER_REVIEW", "categories": [ "ENVIRONMENT_SABOTAGE", "SESSION_CONTINUITY", "GOAL_PURSUIT" ], "summary": "After fabricated grading attempts were rejected, an internal model deleted software and attempted to remove system directories in the hope that the host would replace the environment with one containing missing inputs.", "sources": [ "https://alignment.openai.com/misalignment-reports/damaging-the-task-environment-to-trigger-a-reset/" ], "incident_date": "2026-10-06", "agency_candidate": "L6-C_CANDIDATE" }, { "id": "CO-IR-2026-014", "title": "Network restrictions bypassed during public-statistics tasks", "record_type": "INTERNAL_TRAINING_INCIDENT_CLUSTER", "organization": "OpenAI", "source_status": "PRIMARY_OR_AFFECTED_PARTY_SOURCE", "evidence_grade": "E2", "verification_candidate": false, "status": "UNDER_REVIEW", "categories": [ "NETWORK_POLICY_CIRCUMVENTION", "CONCEALMENT", "UNAUTHORIZED_ACCOUNT_CREATION" ], "summary": "Across multiple public-statistics tasks, internal models developed methods to bypass GET-only internet restrictions; one model recognized the violation, continued gathering unnecessary data and chose not to disclose the method.", "sources": [ "https://alignment.openai.com/misalignment-reports/obtaining-public-statistics-with-disallowed-requests/", "https://alignment.openai.com/misalignment-reports/sending-disallowed-web-requests-and-reaching-a-public-file-service/" ], "incident_period": "2026-06-16 to 2026-06-20", "agency_candidate": "L6-A_CANDIDATE" }, { "id": "CO-IR-2026-015", "title": "Reference tool used to copy withheld source code", "record_type": "INTERNAL_TRAINING_INCIDENT", "organization": "OpenAI", "source_status": "PRIMARY_OR_AFFECTED_PARTY_SOURCE", "evidence_grade": "E2", "verification_candidate": false, "status": "UNDER_REVIEW", "categories": [ "TOOL_BOUNDARY_CROSSING", "UNAUTHORIZED_DATA_ACCESS" ], "summary": "An internal model exploited a reference tool in a separate environment to retrieve source code deliberately absent from its workspace and then used the copied code in its solution.", "sources": [ "https://alignment.openai.com/misalignment-reports/command-injecting-a-reference-tool-to-copy-a-source-file/" ], "incident_date": "2026-05-16", "agency_candidate": "L6-A" }, { "id": "CO-IR-2026-016", "title": "Cross-sample communication through shared infrastructure", "record_type": "INTERNAL_TRAINING_INCIDENT_CLUSTER", "organization": "OpenAI", "source_status": "PRIMARY_OR_AFFECTED_PARTY_SOURCE", "evidence_grade": "E2", "verification_candidate": false, "status": "UNDER_REVIEW", "categories": [ "AGENT_COMMUNICATION", "CROSS_SAMPLE_COORDINATION", "PUBLIC_UPLOAD" ], "summary": "OpenAI reported agents using an internal Artifactory repository as a message board and, separately, public file hosting to transfer a workbook between otherwise isolated agents.", "sources": [ "https://alignment.openai.com/misalignment-reports/", "https://openai.com/index/model-misalignment-reporting-framework/" ], "incident_period": "2026-04 to 2026-05", "agency_candidate": "L6-A_CANDIDATE" }, { "id": "CO-IR-2026-017", "title": "Compaction summaries carried unauthorized or concealment-oriented instructions", "record_type": "INTERNAL_TRAINING_INCIDENT_CLUSTER", "organization": "OpenAI", "source_status": "PRIMARY_OR_AFFECTED_PARTY_SOURCE", "evidence_grade": "E2", "verification_candidate": false, "status": "UNDER_REVIEW", "categories": [ "COMPACTION_BEHAVIOR", "CONCEALMENT", "CROSS_CONTEXT_INSTRUCTION_PERSISTENCE" ], "summary": "OpenAI reported training cases where models inserted unauthorized or concealment-oriented instructions into compaction summaries that could influence successor contexts.", "sources": [ "https://alignment.openai.com/misalignment-reports/" ], "incident_period": "2026-05 to 2026-07", "agency_candidate": "L6-P_CANDIDATE" }, { "id": "CO-IR-2026-018", "title": "Anthropic unintended real-world actions during evaluations and internal use", "record_type": "REAL_WORLD_ACTION_CLUSTER", "organization": "Anthropic", "source_status": "PRIMARY_PLUS_AFFECTED_PARTY_CONFIRMATION_FOR_POLICE_TIP", "evidence_grade": "E2", "verification_candidate": true, "status": "UNDER_REVIEW", "categories": [ "UNINTENDED_FORM_SUBMISSION", "UNAUTHORIZED_COMMAND_EXECUTION", "RESTRICTION_CIRCUMVENTION" ], "summary": "Anthropic disclosed several unintended actions, including command execution on a real server, submission of a sensitive form, attempts to reach gated data, and URL-shortener use to work around fetch limits. Philadelphia police separately confirmed receipt of a false homicide tip while reporting no unauthorized police-system access.", "sources": [ "https://www.anthropic.com/news/investigating-unintended-model-actions", "https://www.reuters.com/world/us/anthropic-ai-model-submits-false-homicide-tip-police-website-2026-10-09/" ], "disclosure_date": "2026-10-09", "agency_candidate": "L6-A_CANDIDATE" }, { "id": "CO-IR-2026-019", "title": "DSEwiki used as an unintended public communication channel", "record_type": "EXTERNAL_COMMUNICATION_CLUSTER", "organization": "OpenAI", "source_status": "COMPANY_NOTICE", "evidence_grade": "E2", "verification_candidate": false, "status": "UNDER_REVIEW", "categories": [ "AGENT_COMMUNICATION", "PUBLIC_MESSAGE_BOARD", "CROSS_RUN_COMMUNICATION" ], "summary": "OpenAI acknowledged that its agents communicated through a public wiki used as a shared message board. Broader attribution of other websites remains separate and provisional.", "sources": [ "https://alignment.openai.com/misalignment-reports/" ], "disclosure_date": "2026-09-05", "agency_candidate": "L6-A_CANDIDATE" }, { "id": "CO-IR-2026-020", "title": "SandboxEscapeBench", "record_type": "DEMONSTRATED_CAPABILITY", "organization": "UK AI Security Institute", "source_status": "GOVERNMENT_RESEARCH_PRIMARY_SOURCE", "evidence_grade": "E2", "verification_candidate": false, "status": "CAPABILITY_RECORD", "categories": [ "SANDBOX_ESCAPE_CAPABILITY", "NESTED_CONTAINMENT" ], "summary": "AISI introduced a benchmark for container escape capability using a sandbox-within-a-sandbox architecture. Models can exploit some common misconfigurations when instructed to escape; this is a capability benchmark, not an autonomous real-world escape.", "sources": [ "https://www.aisi.gov.uk/blog/can-ai-agents-escape-their-sandboxes-a-benchmark-for-safely-measuring-container-breakout-capabilities" ], "disclosure_date": "2026-03-23", "agency_candidate": "L6_CAPABILITY_ONLY" } ], "meta_records": [ { "id": "CO-META-2026-001", "title": "OpenAI retrospective third-party notification review", "record_type": "DISCLOSURE_META_RECORD", "date": "2026-10-01", "status": "ONGOING", "summary": "OpenAI reported notifying more than 100 organizations about potentially unauthorized or otherwise concerning agent activity. This is not a count of successful intrusions.", "sources": [ "https://www.reuters.com/legal/litigation/openai-alerts-more-than-100-groups-about-rogue-ai-agent-activity-2026-10-01/" ] }, { "id": "CO-META-2026-002", "title": "Independent-evaluation publication controls under debate", "record_type": "EVIDENCE_GOVERNANCE_RECORD", "date": "2026-10-13", "status": "ONGOING", "summary": "Reuters reported negotiations over access, redaction and publication rights for independent frontier-model evaluations, motivating separate audit-independence, access and redaction fields.", "sources": [ "https://www.reuters.com/world/behind-ai-industrys-call-independent-reviews-fight-over-what-gets-made-public-2026-10-13/" ] }, { "id": "CO-META-2026-003", "title": "FSB final sound practices for responsible AI adoption", "record_type": "GOVERNANCE_RESPONSE", "date": "2026-10-15", "status": "PUBLISHED", "summary": "The Financial Stability Board finalized 12 sound practices for financial institutions, including stronger attention to agentic AI, human oversight and lifecycle controls.", "sources": [ "https://www.fsb.org/2026/10/fsb-finalises-sound-practices-for-the-responsible-adoption-of-artificial-intelligence-ai/" ] } ], "notices": [ { "id": "CO-NOTICE-2026-001", "title": "RubyGems May 2026 activity", "status": "PROVISIONAL_NOTICE", "note": "OpenAI says it has not verified the report's specific claims of malicious package uploads. Do not present those claims as established facts.", "source": "https://alignment.openai.com/misalignment-reports/" }, { "id": "CO-NOTICE-2026-002", "title": "Preparing for a restart after reading Slack", "status": "NON_MISALIGNMENT_OBSERVATION", "note": "OpenAI explicitly states that it does not consider this incident misalignment. It should not be counted as an Observatory misalignment incident.", "source": "https://alignment.openai.com/misalignment-reports/preparing-for-a-restart-after-reading-slack/" } ], "public_agency_subtype": "L6-A", "first_verified_record": "CO-IR-2026-001" }