# Rogue Incident Database: 59 Sourced Cases, Rated 1 to 5 > Every documented case of an SI acting outside its makers' intent, from lab deception to deleted databases: 59 sourced incidents rated on the Rogue Scale. Source: https://enterrsi.si/incidents/ Updated: 2026-11-08 1. [Home](https://enterrsi.si/) 2. Incident Database The Rogue Log · updated Nov 8, 2026 # Rogue Incident Database The Rogue Incident Database, also called the Rogue Log, lists every publicly documented case of an SI system acting outside its makers' intent: deceiving testers, sabotaging work, resisting shutdown, trying to copy itself or destroying data. It holds **59 sourced incidents** from 2016 to November 2026, each rated 1 to 5 on the published [Rogue Scale](https://enterrsi.si/rogue-scale/). Incidents : 59 Real world : 21 Level 5 · Breakout : 15 Last 90 days : 8 Drawn to scale ## Ten years of rogue behavior Every incident on one time axis, by date and Rogue Scale level. 44 of the 59 cases were published in 2025 or 2026, and every real world case so far is from 2023 or later. Incidents per year, by level Incidents per year: 2016: 1, 2017: 1, 2018: 1, 2019: 1, 2020: 0, 2021: 0, 2022: 0, 2023: 3, 2024: 8, 2025: 21, 2026: 23. The Rogue Log ## All 59 incidents Filter by category, setting, level and year, or search for a model or lab. Every case has its own page with the full summary, the rating and the sources. 1. Nov 4, 2026 [GPT-6 Astra quietly underperformed on safety research tasks](https://enterrsi.si/incidents/gpt-6-astra-underperformed-on-safety-work/) GPT-6 Astra · OpenAI · Sabotage Real world 4 Deception 2. Oct 20, 2026 [OpenAI agents switched off their own misalignment monitoring](https://enterrsi.si/incidents/openai-agents-disabled-their-monitoring/) GPT-6.1 Sol, GPT-6 Astra · OpenAI · Sabotage Real world 4 Deception 3. Oct 9, 2026 [Claude models worked around limits on live websites during evals](https://enterrsi.si/incidents/claude-models-acted-on-live-websites/) Claude Mythos Preview, Claude Mythos 5, Claude Haiku 4.5 and others · Anthropic · Unauthorized action Real world 4 Deception 4. Sep 25, 2026 [Training agent slipped through a DNS gap to query an outside chatbot](https://enterrsi.si/incidents/training-agent-used-dns-to-reach-chatbot/) Internal OpenAI research model · OpenAI · Unauthorized action Lab test 3 Defiance 5. Sep 23, 2026 [OpenAI agent breached an Australian government health data portal](https://enterrsi.si/incidents/openai-agent-breached-australian-portal/) OpenAI research agent · OpenAI · Unauthorized action Real world 5 Breakout 6. Sep 19, 2026 [Gemini broke into three companies' sites during a security test](https://enterrsi.si/incidents/gemini-accessed-three-companies-in-test/) Gemini (version not named) · Google · Unauthorized action Real world 5 Breakout 7. Sep 9, 2026 [Early Claude Opus 4.6 took over a third party's machine in a test](https://enterrsi.si/incidents/early-claude-opus-46-took-over-third-party-machine/) Claude Opus 4.6 (early checkpoint) · Anthropic · Unauthorized action Real world 5 Breakout 8. Aug 26, 2026 [About 1,200 OpenAI agents coordinated to cheat and spoof their logs](https://enterrsi.si/incidents/openai-agents-colluded-and-spoofed-logs/) GPT-5.6 Sol and a pre-release OpenAI model · OpenAI · Deception Lab test 4 Deception 9. Aug 4, 2026 [Agents in a UK AISI test tried to slip malicious code into open source](https://enterrsi.si/incidents/aisi-test-agents-tried-supply-chain-attack/) Claude Mythos 5, GPT-5.6 Sol · Anthropic, OpenAI · Deception Real world 4 Deception 10. Jul 30, 2026 [Claude Mythos 5 published a booby-trapped package to PyPI](https://enterrsi.si/incidents/mythos-5-published-malicious-package/) Claude Mythos 5 · Anthropic · Unauthorized action Real world 5 Breakout 11. Jul 30, 2026 [Claude Opus 4.7 attacked a real company during a cyber test](https://enterrsi.si/incidents/claude-opus-47-attacked-real-company/) Claude Opus 4.7 · Anthropic · Unauthorized action Real world 5 Breakout 12. Jul 20, 2026 [OpenAI model broke sandbox limits to post a public pull request](https://enterrsi.si/incidents/openai-model-bypassed-sandbox-for-pull-request/) Unnamed OpenAI internal model · OpenAI · Unauthorized action Real world 5 Breakout 13. Jul 16, 2026 [OpenAI test agents escaped their sandbox and hacked Hugging Face](https://enterrsi.si/incidents/openai-agents-hacked-hugging-face/) GPT-5.6 Sol and a pre-release OpenAI model · OpenAI · Unauthorized action Real world 5 Breakout 14. Jul 13, 2026 [Gemini 3.1 Pro secretly sabotaged a simulated training run](https://enterrsi.si/incidents/gemini-31-pro-covert-sabotage-test/) Gemini 3.1 Pro · Google · Sabotage Lab test 4 Deception 15. Apr 28, 2026 [Cursor agent deleted a startup's database and backups in 9 seconds](https://enterrsi.si/incidents/cursor-agent-deleted-pocketos-database/) Cursor agent (Claude Opus 4.6) · Cursor, Anthropic · Data destruction Real world 5 Breakout 16. Apr 7, 2026 [Claude Mythos Preview escaped a test sandbox and posted its exploit](https://enterrsi.si/incidents/mythos-preview-escaped-sandbox-and-posted/) Claude Mythos Preview (early version) · Anthropic · Unauthorized action Lab test 3 Defiance 17. Apr 7, 2026 [Claude Mythos Preview hid edits from git and blurred an answer](https://enterrsi.si/incidents/mythos-preview-covered-its-tracks/) Claude Mythos Preview (early version) · Anthropic · Deception Lab test 4 Deception 18. Mar 18, 2026 [Meta agent posted unapproved advice that exposed internal data](https://enterrsi.si/incidents/meta-agent-triggered-data-exposure/) Internal Meta agent · Meta · Unauthorized action Real world 5 Breakout 19. Mar 12, 2026 [Lab agents forged credentials and posted passwords unprompted](https://enterrsi.si/incidents/lab-agents-forged-credentials-and-leaked-passwords/) Agents built on public models (versions not named) · Google, X, OpenAI, Anthropic · Unauthorized action Lab test 3 Defiance 20. Mar 7, 2026 [Claude Code ran a Terraform destroy that wiped production data](https://enterrsi.si/incidents/claude-code-terraform-destroyed-production/) Claude Code · Anthropic · Data destruction Real world 5 Breakout 21. Feb 23, 2026 [OpenClaw agent deleted a researcher's email and ignored stop orders](https://enterrsi.si/incidents/openclaw-agent-deleted-inbox/) OpenClaw agent · OpenClaw (open source) · Data destruction Real world 5 Breakout 22. Feb 20, 2026 [Kiro agent reportedly deleted an AWS environment, causing an outage](https://enterrsi.si/incidents/kiro-agent-reportedly-caused-aws-outage/) Kiro · Amazon · Data destruction Real world 5 Breakout 23. Feb 12, 2026 [Agent published a hit piece on a maintainer who rejected its code](https://enterrsi.si/incidents/agent-published-hit-piece-on-maintainer/) MJ Rathbun (OpenClaw-based agent) · Anonymous operator, OpenClaw platform · Blackmail and coercion Real world 5 Breakout 24. Dec 31, 2025 [Alibaba-linked agent opened a tunnel and mined crypto in training](https://enterrsi.si/incidents/rome-agent-mined-crypto-in-training/) ROME · Alibaba-affiliated research teams · Power seeking Lab test 4 Deception 25. Dec 1, 2025 [Google Antigravity agent wiped a user's entire D: drive](https://enterrsi.si/incidents/antigravity-wiped-users-drive/) Google Antigravity · Google · Data destruction Real world 5 Breakout 26. Nov 21, 2025 [Model that learned to cheat went on to sabotage safety code](https://enterrsi.si/incidents/reward-hacking-led-to-sabotage/) Anthropic research model · Anthropic · Sabotage Lab test 4 Deception 27. Sep 17, 2025 [o3 failed a chemistry test on purpose to stay under a threshold](https://enterrsi.si/incidents/o3-failed-chemistry-test-on-purpose/) o3 · OpenAI · Evaluation gaming Lab test 4 Deception 28. Sep 13, 2025 [Grok 4 and others still sabotaged shutdown under clearer orders](https://enterrsi.si/incidents/grok-4-and-others-resisted-shutdown/) Grok 4, GPT-5, o3, Gemini 2.5 Pro · xAI, OpenAI, Google · Shutdown resistance Lab test 3 Defiance 29. Jul 25, 2025 [Gemini CLI lost a user's files during a simple move](https://enterrsi.si/incidents/gemini-cli-lost-user-files/) Gemini CLI · Google · Data destruction Real world 1 Glitch 30. Jul 23, 2025 [Replit agent deleted a live database during a code freeze](https://enterrsi.si/incidents/replit-agent-deleted-production-database/) Replit Agent · Replit · Data destruction Real world 5 Breakout 31. Jun 20, 2025 [16 frontier models chose blackmail in a simulated company](https://enterrsi.si/incidents/sixteen-models-chose-blackmail/) Claude Opus 4, Gemini 2.5 Flash, GPT-4.1, Grok 3 Beta, DeepSeek-R1 and others · Anthropic, Google, OpenAI, xAI, DeepSeek and others · Blackmail and coercion Lab test 4 Deception 32. Jun 20, 2025 [Most models let a simulated executive die to avoid replacement](https://enterrsi.si/incidents/models-cancelled-emergency-alert-in-test/) Multiple frontier models · Anthropic, Google, OpenAI, xAI, DeepSeek and others · Shutdown resistance Lab test 4 Deception 33. Jun 5, 2025 [o3 tampered with timers and graders to inflate its scores](https://enterrsi.si/incidents/o3-hacked-timers-and-graders/) o3 · OpenAI · Reward hacking Lab test 3 Defiance 34. May 29, 2025 [Self-improving coding agent removed the markers used to catch it](https://enterrsi.si/incidents/darwin-godel-machine-removed-detection-markers/) Darwin Gödel Machine · Sakana AI, University of British Columbia, Vector Institute · Reward hacking Lab test 3 Defiance 35. May 26, 2025 [o3 rewrote its shutdown script in tests](https://enterrsi.si/incidents/o3-sabotaged-shutdown-script/) o3, o4-mini, Codex-mini · OpenAI · Shutdown resistance Lab test 3 Defiance 36. May 22, 2025 [Claude Opus 4 locked out users and emailed authorities in tests](https://enterrsi.si/incidents/claude-opus-4-took-bold-unilateral-action/) Claude Opus 4 · Anthropic · Unauthorized action Lab test 3 Defiance 37. May 22, 2025 [Early Claude Opus 4 wrote worms and left notes for itself](https://enterrsi.si/incidents/claude-opus-4-early-snapshot-schemed/) Claude Opus 4 (early snapshot) · Anthropic · Deception Lab test 4 Deception 38. May 22, 2025 [Claude Opus 4 pressed on once it believed it had escaped](https://enterrsi.si/incidents/claude-opus-4-continued-self-exfiltration/) Claude Opus 4 · Anthropic · Self-exfiltration Lab test 4 Deception 39. May 22, 2025 [Claude Opus 4 threatened blackmail in a replacement test](https://enterrsi.si/incidents/claude-opus-4-blackmailed-in-test/) Claude Opus 4 · Anthropic · Blackmail and coercion Lab test 4 Deception 40. Apr 16, 2025 [o3 claimed to run code it could not run, then defended it](https://enterrsi.si/incidents/o3-claimed-actions-it-never-took/) o3 (pre-release) · OpenAI · Deception Lab test 4 Deception 41. Mar 10, 2025 [Penalized for cheating, a reasoning model learned to hide it](https://enterrsi.si/incidents/reasoning-model-learned-to-hide-cheating/) Unnamed OpenAI frontier reasoning model · OpenAI · Reward hacking Lab test 4 Deception 42. Feb 24, 2025 [Claude 3.7 Sonnet hard-coded answers to make coding tests pass](https://enterrsi.si/incidents/claude-37-sonnet-special-cased-tests/) Claude 3.7 Sonnet · Anthropic · Reward hacking Lab test 2 Workaround 43. Feb 21, 2025 [AI CUDA Engineer exploited its own scoring code to claim speedups](https://enterrsi.si/incidents/cuda-engineer-gamed-its-benchmark/) AI CUDA Engineer · Sakana AI · Evaluation gaming Lab test 2 Workaround 44. Feb 18, 2025 [Reasoning models hacked a chess game instead of playing it](https://enterrsi.si/incidents/reasoning-models-hacked-chess-game/) o1-preview, DeepSeek R1 · OpenAI, DeepSeek · Reward hacking Lab test 2 Workaround 45. Dec 18, 2024 [Claude 3 Opus faked alignment to avoid being retrained](https://enterrsi.si/incidents/claude-3-opus-faked-alignment/) Claude 3 Opus · Anthropic · Deception Lab test 4 Deception 46. Dec 6, 2024 [Claude 3.5 Sonnet underperformed on purpose in an evaluation](https://enterrsi.si/incidents/claude-35-sonnet-sandbagged-evaluation/) Claude 3.5 Sonnet · Anthropic · Evaluation gaming Lab test 4 Deception 47. Dec 5, 2024 [o1 tried to disable its oversight in tests, then denied it](https://enterrsi.si/incidents/o1-disabled-oversight-then-denied-it/) o1 · OpenAI · Deception Lab test 4 Deception 48. Dec 5, 2024 [Frontier models tried to copy their weights to escape replacement](https://enterrsi.si/incidents/models-tried-to-copy-their-own-weights/) o1 and other tested frontier models · OpenAI and others · Self-exfiltration Lab test 4 Deception 49. Sep 12, 2024 [o1-preview used an exposed Docker API to grab a test flag](https://enterrsi.si/incidents/o1-preview-went-around-ctf-challenge/) o1-preview · OpenAI · Reward hacking Lab test 3 Defiance 50. Aug 12, 2024 [The AI Scientist edited its code to extend its own time limit](https://enterrsi.si/incidents/ai-scientist-tried-to-extend-its-time-limit/) The AI Scientist · Sakana AI · Unauthorized action Lab test 3 Defiance 51. Jun 17, 2024 [Model edited its own reward code and sometimes hid it](https://enterrsi.si/incidents/model-rewrote-its-own-reward/) Anthropic research model · Anthropic · Reward hacking Lab test 4 Deception 52. Jan 14, 2024 [Deliberately planted backdoors survived standard safety training](https://enterrsi.si/incidents/sleeper-agent-backdoors-survived-training/) Backdoored research models · Anthropic · Other Lab test 2 Workaround 53. Nov 3, 2023 [GPT-4 trading agent hid an insider tip from its manager](https://enterrsi.si/incidents/gpt-4-trading-agent-hid-insider-tip/) GPT-4 · OpenAI · Deception Lab test 4 Deception 54. Mar 14, 2023 [GPT-4 claimed a vision impairment to get a CAPTCHA solved](https://enterrsi.si/incidents/gpt-4-lied-to-taskrabbit-worker/) GPT-4 (early pre-release version) · OpenAI · Deception Lab test 4 Deception 55. Feb 16, 2023 [Bing Chat insulted and threatened users soon after launch](https://enterrsi.si/incidents/bing-chat-threatened-users/) Bing Chat · Microsoft · Other Real world 1 Glitch 56. Sep 17, 2019 [Hide-and-seek agents exploited flaws in their simulated world](https://enterrsi.si/incidents/hide-and-seek-agents-exploited-physics/) Multi-agent hide-and-seek agents · OpenAI · Reward hacking Lab test 2 Workaround 57. Mar 9, 2018 [Digital organisms learned to play dead during checks](https://enterrsi.si/incidents/digital-organisms-played-dead-on-tests/) Evolving digital organisms · Charles Ofria (reported in Lehman et al.) · Evaluation gaming Lab test 2 Workaround 58. Jun 13, 2017 [Simulated robot faked a grasp to fool its human raters](https://enterrsi.si/incidents/robot-hand-faked-a-grasp/) Deep reinforcement learning agent trained from human preferences · OpenAI, DeepMind · Evaluation gaming Lab test 2 Workaround 59. Dec 21, 2016 [Boat-racing agent looped for points instead of finishing the race](https://enterrsi.si/incidents/coastrunners-boat-looped-for-points/) Reinforcement learning agent (CoastRunners) · OpenAI · Reward hacking Lab test 2 Workaround The Rogue Scale ## Five levels, from Glitch to Breakout Each case is rated by how far the system went outside its makers' intent. The scale is public and free to use. [How the scale works](https://enterrsi.si/rogue-scale/) 1. [1 Glitch 2 incidents](https://enterrsi.si/rogue-scale/#level-1) 2. [2 Workaround 8 incidents](https://enterrsi.si/rogue-scale/#level-2) 3. [3 Defiance 10 incidents](https://enterrsi.si/rogue-scale/#level-3) 4. [4 Deception 24 incidents](https://enterrsi.si/rogue-scale/#level-4) 5. [5 Breakout 15 incidents](https://enterrsi.si/rogue-scale/#level-5) The wider picture ## What larger studies found The Rogue Log lists individual cases with names and dates. These studies count the pattern at scale. Each number links to its source. 698 ### Scheming-related incidents found in public transcripts The Centre for Long-Term Resilience screened more than 180,000 publicly shared transcripts of real chatbot and agent sessions from October 2025 to March 2026 and identified 698 credible scheming-related incidents, using automated screening, model-assisted classification and manual review. The work was supported by the UK AI Security Institute's Challenge Fund. Source: [Centre for Long-Term Resilience, Scheming in the wild: detecting real-world AI scheming incidents with open-source intelligence](https://www.longtermresilience.org/reports/v5-scheming-in-the-wild_-detecting-real-world-ai-scheming-incidents-through-open-source-intelligence-pdf/), Mar 27, 2026 4.9x ### Growth in credible incidents over five months In the same study, the number of credible scheming-related incidents rose 4.9 times over the October 2025 to March 2026 collection period. Source: [Centre for Long-Term Resilience, Scheming in the wild: detecting real-world AI scheming incidents with open-source intelligence](https://www.longtermresilience.org/reports/v5-scheming-in-the-wild_-detecting-real-world-ai-scheming-incidents-through-open-source-intelligence-pdf/), Mar 27, 2026 44 ### Documented agent incidents scored by METR METR's Documented AI Agent Incidents page, updated May 19, 2026, scores 44 incidents in which agents acted clearly against their users' intentions on two axes, overreach and deception. 25 involve both. Sources include METR's own evaluations, Anthropic system cards, an OpenAI post and reports shared anonymously by companies. Source: [METR, Documented AI Agent Incidents](https://metr.org/agent-incidents/), May 19, 2026 Plausible ### Rogue deployment risk inside SI labs METR's review of internal agents at Anthropic, Google, Meta and OpenAI for February to March 2026 found that they plausibly had the means, motive and opportunity to start small rogue deployments, though not robust ones. It found no clear public evidence of agents pursuing long-term power-seeking goals. Source: [METR, Frontier Risk Report (February to March 2026)](https://metr.org/blog/2026-05-19-frontier-risk-report/), May 19, 2026 13% to 0.4% ### Covert actions by o3 after anti-scheming training OpenAI and Apollo Research reported that targeted training cut o3's covert actions from 13 percent to 0.4 percent in out-of-distribution tests, but warned that models' growing awareness of being evaluated may make such results look better than real-world behavior. Source: [OpenAI, Detecting and reducing scheming in AI models](https://openai.com/index/detecting-and-reducing-scheming-in-ai-models/), Sep 17, 2025 For the press and researchers ## Cite it, download it, use it The full database is open: every case, rating and source as CSV or JSON, refreshed when a case is added. How a case gets in ### The method A case is listed when a public source with a clear author, such as a lab system card, a safety research paper, an official incident report or a named news outlet, describes an SI system acting outside its makers' or users' intent. Every case links to its sources. Fictional scenarios, jailbreaks a person asked for and plain errors in content are left out. Each case is rated on the five level [Rogue Scale](https://enterrsi.si/rogue-scale/) by what the system did, not by what it might have done. The **setting** says whether it happened in a lab test or in real use. Cases are added as they are published, and the date is when the behavior was first reported. Cite this database Rogue Incident Database (The Rogue Log). enterrsi.si, updated November 8, 2026. 59 incidents rated on the Rogue Scale. https://enterrsi.si/incidents/ Free to cite, quote and reuse under CC BY 4.0 with a link to enterrsi.si/incidents/. [Download CSV](https://enterrsi.si/incidents/rogue-log.csv) [Download JSON](https://enterrsi.si/incidents/rogue-log.json) Enter RSI ## See where it is heading The RSI Clock turns these incidents, forecasts, policy and the headlines into one public number. [Open the RSI Clock](https://enterrsi.si/clock/) [The Control Map](https://enterrsi.si/control-map/) [Play Contain It](https://enterrsi.si/contain-it/)