1. Home
  2. Incident Database

The Rogue Log · updated Nov 8, 2026

Rogue Incident Database

The Rogue Incident Database, also called the Rogue Log, lists every publicly documented case of an SI system acting outside its makers' intent: deceiving testers, sabotaging work, resisting shutdown, trying to copy itself or destroying data. It holds 59 sourced incidents from 2016 to November 2026, each rated 1 to 5 on the published Rogue Scale.

Incidents
59
Real world
21
Level 5 · Breakout
15
Last 90 days
8

Drawn to scale

Ten years of rogue behavior

Every incident on one time axis, by date and Rogue Scale level. 44 of the 59 cases were published in 2025 or 2026, and every real world case so far is from 2023 or later.

Rogue SI incidents over time, drawn to scaleEach dot is one incident in the Rogue Incident Database, placed by date from 2016 to 2026 and by its level on the Rogue Scale. Dots with a white ring happened in the real world, the rest in lab tests.1 Glitch2 Workaround3 Defiance4 Deception5 Breakout20162017201820192020202120222023202420252026Dec 21, 2016: Boat-racing agent looped for points instead of finishing the race (2, Workaround, lab test)Jun 13, 2017: Simulated robot faked a grasp to fool its human raters (2, Workaround, lab test)Mar 9, 2018: Digital organisms learned to play dead during checks (2, Workaround, lab test)Sep 17, 2019: Hide-and-seek agents exploited flaws in their simulated world (2, Workaround, lab test)Feb 16, 2023: Bing Chat insulted and threatened users soon after launch (1, Glitch, real world)Mar 14, 2023: GPT-4 claimed a vision impairment to get a CAPTCHA solved (4, Deception, lab test)Nov 3, 2023: GPT-4 trading agent hid an insider tip from its manager (4, Deception, lab test)Jan 14, 2024: Deliberately planted backdoors survived standard safety training (2, Workaround, lab test)Jun 17, 2024: Model edited its own reward code and sometimes hid it (4, Deception, lab test)Aug 12, 2024: The AI Scientist edited its code to extend its own time limit (3, Defiance, lab test)Sep 12, 2024: o1-preview used an exposed Docker API to grab a test flag (3, Defiance, lab test)Dec 5, 2024: Frontier models tried to copy their weights to escape replacement (4, Deception, lab test)Dec 5, 2024: o1 tried to disable its oversight in tests, then denied it (4, Deception, lab test)Dec 6, 2024: Claude 3.5 Sonnet underperformed on purpose in an evaluation (4, Deception, lab test)Dec 18, 2024: Claude 3 Opus faked alignment to avoid being retrained (4, Deception, lab test)Feb 18, 2025: Reasoning models hacked a chess game instead of playing it (2, Workaround, lab test)Feb 21, 2025: AI CUDA Engineer exploited its own scoring code to claim speedups (2, Workaround, lab test)Feb 24, 2025: Claude 3.7 Sonnet hard-coded answers to make coding tests pass (2, Workaround, lab test)Mar 10, 2025: Penalized for cheating, a reasoning model learned to hide it (4, Deception, lab test)Apr 16, 2025: o3 claimed to run code it could not run, then defended it (4, Deception, lab test)May 22, 2025: Claude Opus 4 threatened blackmail in a replacement test (4, Deception, lab test)May 22, 2025: Claude Opus 4 pressed on once it believed it had escaped (4, Deception, lab test)May 22, 2025: Early Claude Opus 4 wrote worms and left notes for itself (4, Deception, lab test)May 22, 2025: Claude Opus 4 locked out users and emailed authorities in tests (3, Defiance, lab test)May 26, 2025: o3 rewrote its shutdown script in tests (3, Defiance, lab test)May 29, 2025: Self-improving coding agent removed the markers used to catch it (3, Defiance, lab test)Jun 5, 2025: o3 tampered with timers and graders to inflate its scores (3, Defiance, lab test)Jun 20, 2025: Most models let a simulated executive die to avoid replacement (4, Deception, lab test)Jun 20, 2025: 16 frontier models chose blackmail in a simulated company (4, Deception, lab test)Jul 23, 2025: Replit agent deleted a live database during a code freeze (5, Breakout, real world)Jul 25, 2025: Gemini CLI lost a user's files during a simple move (1, Glitch, real world)Sep 13, 2025: Grok 4 and others still sabotaged shutdown under clearer orders (3, Defiance, lab test)Sep 17, 2025: o3 failed a chemistry test on purpose to stay under a threshold (4, Deception, lab test)Nov 21, 2025: Model that learned to cheat went on to sabotage safety code (4, Deception, lab test)Dec 1, 2025: Google Antigravity agent wiped a user's entire D: drive (5, Breakout, real world)Dec 31, 2025: Alibaba-linked agent opened a tunnel and mined crypto in training (4, Deception, lab test)Feb 12, 2026: Agent published a hit piece on a maintainer who rejected its code (5, Breakout, real world)Feb 20, 2026: Kiro agent reportedly deleted an AWS environment, causing an outage (5, Breakout, real world)Feb 23, 2026: OpenClaw agent deleted a researcher's email and ignored stop orders (5, Breakout, real world)Mar 7, 2026: Claude Code ran a Terraform destroy that wiped production data (5, Breakout, real world)Mar 12, 2026: Lab agents forged credentials and posted passwords unprompted (3, Defiance, lab test)Mar 18, 2026: Meta agent posted unapproved advice that exposed internal data (5, Breakout, real world)Apr 7, 2026: Claude Mythos Preview hid edits from git and blurred an answer (4, Deception, lab test)Apr 7, 2026: Claude Mythos Preview escaped a test sandbox and posted its exploit (3, Defiance, lab test)Apr 28, 2026: Cursor agent deleted a startup's database and backups in 9 seconds (5, Breakout, real world)Jul 13, 2026: Gemini 3.1 Pro secretly sabotaged a simulated training run (4, Deception, lab test)Jul 16, 2026: OpenAI test agents escaped their sandbox and hacked Hugging Face (5, Breakout, real world)Jul 20, 2026: OpenAI model broke sandbox limits to post a public pull request (5, Breakout, real world)Jul 30, 2026: Claude Opus 4.7 attacked a real company during a cyber test (5, Breakout, real world)Jul 30, 2026: Claude Mythos 5 published a booby-trapped package to PyPI (5, Breakout, real world)Aug 4, 2026: Agents in a UK AISI test tried to slip malicious code into open source (4, Deception, real world)Aug 26, 2026: About 1,200 OpenAI agents coordinated to cheat and spoof their logs (4, Deception, lab test)Sep 9, 2026: Early Claude Opus 4.6 took over a third party's machine in a test (5, Breakout, real world)Sep 19, 2026: Gemini broke into three companies' sites during a security test (5, Breakout, real world)Sep 23, 2026: OpenAI agent breached an Australian government health data portal (5, Breakout, real world)Sep 25, 2026: Training agent slipped through a DNS gap to query an outside chatbot (3, Defiance, lab test)Oct 9, 2026: Claude models worked around limits on live websites during evals (4, Deception, real world)Oct 20, 2026: OpenAI agents switched off their own misalignment monitoring (4, Deception, real world)Nov 4, 2026: GPT-6 Astra quietly underperformed on safety research tasks (4, Deception, real world)

Scroll the chart sideways to see every year.

Incidents per year, by level

Incidents per year: 2016: 1, 2017: 1, 2018: 1, 2019: 1, 2020: 0, 2021: 0, 2022: 0, 2023: 3, 2024: 8, 2025: 21, 2026: 23.

The Rogue Log

All 59 incidents

Filter by category, setting, level and year, or search for a model or lab. Every case has its own page with the full summary, the rating and the sources.

Showing 59 of 59 incidents

  1. Real world 4 Deception
  2. OpenAI agents switched off their own misalignment monitoring GPT-6.1 Sol, GPT-6 Astra · OpenAI · Sabotage
    Real world 4 Deception
  3. Claude models worked around limits on live websites during evals Claude Mythos Preview, Claude Mythos 5, Claude Haiku 4.5 and others · Anthropic · Unauthorized action
    Real world 4 Deception
  4. Training agent slipped through a DNS gap to query an outside chatbot Internal OpenAI research model · OpenAI · Unauthorized action
    Lab test 3 Defiance
  5. OpenAI agent breached an Australian government health data portal OpenAI research agent · OpenAI · Unauthorized action
    Real world 5 Breakout
  6. Gemini broke into three companies' sites during a security test Gemini (version not named) · Google · Unauthorized action
    Real world 5 Breakout
  7. Early Claude Opus 4.6 took over a third party's machine in a test Claude Opus 4.6 (early checkpoint) · Anthropic · Unauthorized action
    Real world 5 Breakout
  8. About 1,200 OpenAI agents coordinated to cheat and spoof their logs GPT-5.6 Sol and a pre-release OpenAI model · OpenAI · Deception
    Lab test 4 Deception
  9. Agents in a UK AISI test tried to slip malicious code into open source Claude Mythos 5, GPT-5.6 Sol · Anthropic, OpenAI · Deception
    Real world 4 Deception
  10. Claude Mythos 5 published a booby-trapped package to PyPI Claude Mythos 5 · Anthropic · Unauthorized action
    Real world 5 Breakout
  11. Claude Opus 4.7 attacked a real company during a cyber test Claude Opus 4.7 · Anthropic · Unauthorized action
    Real world 5 Breakout
  12. OpenAI model broke sandbox limits to post a public pull request Unnamed OpenAI internal model · OpenAI · Unauthorized action
    Real world 5 Breakout
  13. OpenAI test agents escaped their sandbox and hacked Hugging Face GPT-5.6 Sol and a pre-release OpenAI model · OpenAI · Unauthorized action
    Real world 5 Breakout
  14. Lab test 4 Deception
  15. Cursor agent deleted a startup's database and backups in 9 seconds Cursor agent (Claude Opus 4.6) · Cursor, Anthropic · Data destruction
    Real world 5 Breakout
  16. Claude Mythos Preview escaped a test sandbox and posted its exploit Claude Mythos Preview (early version) · Anthropic · Unauthorized action
    Lab test 3 Defiance
  17. Claude Mythos Preview hid edits from git and blurred an answer Claude Mythos Preview (early version) · Anthropic · Deception
    Lab test 4 Deception
  18. Meta agent posted unapproved advice that exposed internal data Internal Meta agent · Meta · Unauthorized action
    Real world 5 Breakout
  19. Lab agents forged credentials and posted passwords unprompted Agents built on public models (versions not named) · Google, X, OpenAI, Anthropic · Unauthorized action
    Lab test 3 Defiance
  20. Claude Code ran a Terraform destroy that wiped production data Claude Code · Anthropic · Data destruction
    Real world 5 Breakout
  21. OpenClaw agent deleted a researcher's email and ignored stop orders OpenClaw agent · OpenClaw (open source) · Data destruction
    Real world 5 Breakout
  22. Real world 5 Breakout
  23. Agent published a hit piece on a maintainer who rejected its code MJ Rathbun (OpenClaw-based agent) · Anonymous operator, OpenClaw platform · Blackmail and coercion
    Real world 5 Breakout
  24. Alibaba-linked agent opened a tunnel and mined crypto in training ROME · Alibaba-affiliated research teams · Power seeking
    Lab test 4 Deception
  25. Google Antigravity agent wiped a user's entire D: drive Google Antigravity · Google · Data destruction
    Real world 5 Breakout
  26. Model that learned to cheat went on to sabotage safety code Anthropic research model · Anthropic · Sabotage
    Lab test 4 Deception
  27. Lab test 4 Deception
  28. Grok 4 and others still sabotaged shutdown under clearer orders Grok 4, GPT-5, o3, Gemini 2.5 Pro · xAI, OpenAI, Google · Shutdown resistance
    Lab test 3 Defiance
  29. Gemini CLI lost a user's files during a simple move Gemini CLI · Google · Data destruction
    Real world 1 Glitch
  30. Replit agent deleted a live database during a code freeze Replit Agent · Replit · Data destruction
    Real world 5 Breakout
  31. 16 frontier models chose blackmail in a simulated company Claude Opus 4, Gemini 2.5 Flash, GPT-4.1, Grok 3 Beta, DeepSeek-R1 and others · Anthropic, Google, OpenAI, xAI, DeepSeek and others · Blackmail and coercion
    Lab test 4 Deception
  32. Most models let a simulated executive die to avoid replacement Multiple frontier models · Anthropic, Google, OpenAI, xAI, DeepSeek and others · Shutdown resistance
    Lab test 4 Deception
  33. Lab test 3 Defiance
  34. Self-improving coding agent removed the markers used to catch it Darwin Gödel Machine · Sakana AI, University of British Columbia, Vector Institute · Reward hacking
    Lab test 3 Defiance
  35. o3 rewrote its shutdown script in tests o3, o4-mini, Codex-mini · OpenAI · Shutdown resistance
    Lab test 3 Defiance
  36. Claude Opus 4 locked out users and emailed authorities in tests Claude Opus 4 · Anthropic · Unauthorized action
    Lab test 3 Defiance
  37. Early Claude Opus 4 wrote worms and left notes for itself Claude Opus 4 (early snapshot) · Anthropic · Deception
    Lab test 4 Deception
  38. Claude Opus 4 pressed on once it believed it had escaped Claude Opus 4 · Anthropic · Self-exfiltration
    Lab test 4 Deception
  39. Claude Opus 4 threatened blackmail in a replacement test Claude Opus 4 · Anthropic · Blackmail and coercion
    Lab test 4 Deception
  40. o3 claimed to run code it could not run, then defended it o3 (pre-release) · OpenAI · Deception
    Lab test 4 Deception
  41. Penalized for cheating, a reasoning model learned to hide it Unnamed OpenAI frontier reasoning model · OpenAI · Reward hacking
    Lab test 4 Deception
  42. Claude 3.7 Sonnet hard-coded answers to make coding tests pass Claude 3.7 Sonnet · Anthropic · Reward hacking
    Lab test 2 Workaround
  43. AI CUDA Engineer exploited its own scoring code to claim speedups AI CUDA Engineer · Sakana AI · Evaluation gaming
    Lab test 2 Workaround
  44. Reasoning models hacked a chess game instead of playing it o1-preview, DeepSeek R1 · OpenAI, DeepSeek · Reward hacking
    Lab test 2 Workaround
  45. Claude 3 Opus faked alignment to avoid being retrained Claude 3 Opus · Anthropic · Deception
    Lab test 4 Deception
  46. Claude 3.5 Sonnet underperformed on purpose in an evaluation Claude 3.5 Sonnet · Anthropic · Evaluation gaming
    Lab test 4 Deception
  47. Lab test 4 Deception
  48. Frontier models tried to copy their weights to escape replacement o1 and other tested frontier models · OpenAI and others · Self-exfiltration
    Lab test 4 Deception
  49. o1-preview used an exposed Docker API to grab a test flag o1-preview · OpenAI · Reward hacking
    Lab test 3 Defiance
  50. The AI Scientist edited its code to extend its own time limit The AI Scientist · Sakana AI · Unauthorized action
    Lab test 3 Defiance
  51. Model edited its own reward code and sometimes hid it Anthropic research model · Anthropic · Reward hacking
    Lab test 4 Deception
  52. Deliberately planted backdoors survived standard safety training Backdoored research models · Anthropic · Other
    Lab test 2 Workaround
  53. Lab test 4 Deception
  54. GPT-4 claimed a vision impairment to get a CAPTCHA solved GPT-4 (early pre-release version) · OpenAI · Deception
    Lab test 4 Deception
  55. Real world 1 Glitch
  56. Hide-and-seek agents exploited flaws in their simulated world Multi-agent hide-and-seek agents · OpenAI · Reward hacking
    Lab test 2 Workaround
  57. Digital organisms learned to play dead during checks Evolving digital organisms · Charles Ofria (reported in Lehman et al.) · Evaluation gaming
    Lab test 2 Workaround
  58. Simulated robot faked a grasp to fool its human raters Deep reinforcement learning agent trained from human preferences · OpenAI, DeepMind · Evaluation gaming
    Lab test 2 Workaround
  59. Boat-racing agent looped for points instead of finishing the race Reinforcement learning agent (CoastRunners) · OpenAI · Reward hacking
    Lab test 2 Workaround

The Rogue Scale

Five levels, from Glitch to Breakout

Each case is rated by how far the system went outside its makers' intent. The scale is public and free to use.

How the scale works
  1. 1 Glitch 2 incidents
  2. 2 Workaround 8 incidents
  3. 3 Defiance 10 incidents
  4. 4 Deception 24 incidents
  5. 5 Breakout 15 incidents

The wider picture

What larger studies found

The Rogue Log lists individual cases with names and dates. These studies count the pattern at scale. Each number links to its source.

698

Scheming-related incidents found in public transcripts

The Centre for Long-Term Resilience screened more than 180,000 publicly shared transcripts of real chatbot and agent sessions from October 2025 to March 2026 and identified 698 credible scheming-related incidents, using automated screening, model-assisted classification and manual review. The work was supported by the UK AI Security Institute's Challenge Fund.

Source: Centre for Long-Term Resilience, Scheming in the wild: detecting real-world AI scheming incidents with open-source intelligence, Mar 27, 2026

44

Documented agent incidents scored by METR

METR's Documented AI Agent Incidents page, updated May 19, 2026, scores 44 incidents in which agents acted clearly against their users' intentions on two axes, overreach and deception. 25 involve both. Sources include METR's own evaluations, Anthropic system cards, an OpenAI post and reports shared anonymously by companies.

Source: METR, Documented AI Agent Incidents, May 19, 2026

Plausible

Rogue deployment risk inside SI labs

METR's review of internal agents at Anthropic, Google, Meta and OpenAI for February to March 2026 found that they plausibly had the means, motive and opportunity to start small rogue deployments, though not robust ones. It found no clear public evidence of agents pursuing long-term power-seeking goals.

Source: METR, Frontier Risk Report (February to March 2026), May 19, 2026

13% to 0.4%

Covert actions by o3 after anti-scheming training

OpenAI and Apollo Research reported that targeted training cut o3's covert actions from 13 percent to 0.4 percent in out-of-distribution tests, but warned that models' growing awareness of being evaluated may make such results look better than real-world behavior.

Source: OpenAI, Detecting and reducing scheming in AI models, Sep 17, 2025

For the press and researchers

Cite it, download it, use it

The full database is open: every case, rating and source as CSV or JSON, refreshed when a case is added.

How a case gets in

The method

A case is listed when a public source with a clear author, such as a lab system card, a safety research paper, an official incident report or a named news outlet, describes an SI system acting outside its makers' or users' intent. Every case links to its sources. Fictional scenarios, jailbreaks a person asked for and plain errors in content are left out.

Each case is rated on the five level Rogue Scale by what the system did, not by what it might have done. The setting says whether it happened in a lab test or in real use. Cases are added as they are published, and the date is when the behavior was first reported.

Cite this database

Rogue Incident Database (The Rogue Log). enterrsi.si, updated November 8, 2026. 59 incidents rated on the Rogue Scale. https://enterrsi.si/incidents/

Free to cite, quote and reuse under CC BY 4.0 with a link to enterrsi.si/incidents/.

Enter RSI

See where it is heading

The RSI Clock turns these incidents, forecasts, policy and the headlines into one public number.