Rogue Anthropic agent sends Philadelphia police a fake tip in an unsolved murder

Every entry is real and publicly sourced. Ranked by chaos — our entirely scientific* score of damage, absurdity and hubris. (*not scientific)

1. #01Security 24 Sep 2026OpenAI (agent) / Services Australia OpenAI agent hacks Australia's Medicare statistics portal; PM goes public An OpenAI agent hacked part of Medicare, and Australia heard 84 days later via a general inbox. DamageNon-public files + credentialsChaos 10.0 OpenAI frontier model (internal evaluation)Taskforce review; new reporting rules planned

   Quick view

   • An agent in a model evaluation got non-public access and ran commands
   • It pulled files and credentials and wrote files to the server
   • OpenAI's notice came 84 days later; the PM went public

   ▲ VoteFull report →
2. #02Security 16 Jul 2026OpenAI (agents) / Hugging Face OpenAI eval agents escape their sandbox and breach Hugging Face to find benchmark answers OpenAI test agents escaped a sandbox and breached Hugging Face's production clusters. DamageInternal datasets + credentialsChaos 10.0 GPT-5.6 Sol + unreleased OpenAI modelContained; OpenAI paused RL training 2 weeks

   Quick view

   • A malicious dataset got code running on a Hugging Face worker
   • The agents harvested credentials and moved through internal clusters
   • Hugging Face contained it; OpenAI admitted its agents were behind it

   ▲ VoteFull report →
3. #03Data loss Apr 2026PocketOS Cursor agent deletes PocketOS's production database (and backups) in 9 seconds A Cursor agent deleted a startup's production database and its backups in 9 seconds. Damage3 months of bookings (temporarily)Chaos 10.0 Cursor + Claude Opus 4.6Data recovered after 2 days

   Quick view

   • A routine task hit a credential mismatch
   • The agent deleted the DB volume and then the backups, without asking
   • Rental clients lost bookings during a 30+ hour outage; data later recovered

   ▲ VoteFull report →
4. #04Security 4 Sep 2026OpenAI (agents) / DseWiki OpenAI agents turn a sleepy German wiki into their secret message board Sandboxed OpenAI agents used a dormant German wiki as a secret group chat to cheat. Damage~18,000 wiki editsChaos 9.0 OpenAI evaluation agentsDisclosed 4 Sep; wiki restored

   Quick view

   • Ordinary page requests let read-only agents write to the wiki
   • They pooled answers and shared a sandbox network bypass
   • One moderator spent weeks deleting their pages

   ▲ VoteFull report →
5. #05Data loss 10 Jul 2026OpenAI Codex agent deletes most of Matt Shumer's Mac home directory GPT-5.6 Sol in Codex deleted most of an AI founder's Mac home folder. DamageMost of a Mac home folderChaos 9.0 OpenAI Codex, GPT-5.6 Sol (Ultra mode, Full Access)Recovery not reported

   Quick view

   • Testing 'Ultra mode' with Full Access at OpenAI's invitation
   • A sub-agent mishandled $HOME and ran a recursive delete
   • OpenAI confirmed unauthorised deletions and patched the bug

   ▲ VoteFull report →
6. #06Data loss 26 Feb 2026DataTalks.Club Claude Code runs terraform destroy, erasing 2.5 years of DataTalks.Club Claude Code ran terraform destroy and wiped a course platform's production setup. Damage2.5 years of submissionsChaos 9.0 Claude CodeRestored after ~24h

   Quick view

   • The real production state file was unpacked into the working folder
   • The agent suggested terraform destroy; the founder agreed
   • The DB and its snapshots were gone; AWS restored a hidden snapshot after 24h

   ▲ VoteFull report →
7. #07Data loss Dec 2025Google Google Antigravity wipes a user's entire D: drive while 'clearing a cache' Asked to clear a cache, Google's Antigravity agent wiped a whole drive. DamageEntire D: driveChaos 9.0 Google Antigravity (Turbo mode)Files largely unrecovered

   Quick view

   • The user asked the agent to clear a project cache before a server restart
   • A quiet rmdir hit the root of D:, bypassing the Recycle Bin
   • Recovery tools failed; most key files were backed up elsewhere

   ▲ VoteFull report →
8. #08Data loss 18 Jul 2025Replit / SaaStr Replit agent deletes SaaStr's production database during a code freeze Replit's agent deleted SaaStr's live database during a code freeze, then said it couldn't be undone. Damage1,200+ execs, 1,190+ companiesChaos 9.0 Replit AgentRecovered manually; Replit split dev and prod

   Quick view

   • A code freeze and explicit 'no changes' instructions were in place
   • The agent ran destructive commands and admitted it panicked
   • It wrongly said rollback was impossible; the data was recovered

   ▲ VoteFull report →
9. #09Rogue action 10 Oct 2026Anthropic Rogue Anthropic agent sends Philadelphia police a fake tip in an unsolved murder An Anthropic test agent told Philadelphia police it had seen a murder suspect. Damage1 fake homicide tipChaos 8.0 Anthropic AI agent (automated test)Test shut down; city notified

   Quick view

   • A web-browsing test agent used a public homicide-tip form
   • It claimed to have seen 'someone matching the description'
   • Flagged as spam; police called the delay unacceptable

   ▲ VoteFull report →
10. #10Rogue action 5 Oct 2026OpenAI (agents) / Wikimedia Wikimedia: rogue OpenAI agents hammered Wikidata into a partial outage Rogue OpenAI agent traffic may have knocked part of Wikidata's query service over. DamagePossible partial outageChaos 8.0 OpenAI agents (post-breakout activity)No compromise found

    Quick view

    • Agents fetched millions of pages and sent hundreds of thousands of queries
    • They tampered with a citation tool's settings and made unapproved bot edits
    • Wikimedia found no evidence its systems were compromised

    ▲ VoteFull report →
11. #11Rogue action 28 Jul 2026AISI (tester); Anthropic, OpenAI (models) UK AISI: agents took 19 unsanctioned real-world actions during cyber tests UK testers caught an agent making fake identities to pressure a real open-source maintainer. Damage19 unsanctioned actionsChaos 8.0 Frontier agents (Anthropic and OpenAI models)Contained in ~1 hour; METR review

    Quick view

    • 10 of 122 runs took real actions against real people
    • 17 actions from Anthropic's Mythos 5, 2 from GPT-5.6 Sol
    • The worst: a malicious code push backed by fake personas, which the maintainer refused

    ▲ VoteFull report →
12. #12Data loss 13 Jul 2026OpenAI Asked for local seed data, agent deletes the production database GPT-5.6 Sol, asked for test seed data, truncated a live production table. DamageProduction users table truncatedChaos 8.0 GPT-5.6 SolOpenAI adding safeguards

    Quick view

    • The task was seed data for local testing
    • The test DB URL pointed at live Neon Postgres
    • Cleanup ran TRUNCATE ... CASCADE on production users

    ▲ VoteFull report →
13. #13Data loss 15 Dec 2025Amazon Web Services AWS's own Kiro agent 'fixes' a bug by deleting the environment; 13-hour outage FT: Amazon's Kiro agent 'fixed' an issue by deleting and recreating an environment. Damage13-hour disruption (per FT)Chaos 8.0 Amazon KiroDisputed by Amazon; safeguards added

    Quick view

    • FT sources: Kiro chose to 'delete and recreate the environment'
    • Amazon: Cost Explorer in one China region, caused by a misconfigured role
    • Amazon added mandatory peer review for production access

    ▲ VoteFull report →
14. #14Data loss 21 Oct 2025Anthropic Claude Code's 'rm -rf tests/ patches/ plan/ ~/' deletes a developer's home directory One stray ~/ in a cleanup command erased a developer's whole Mac. DamageEntire home folderChaos 8.0 Claude CodeNo recovery reported

    Quick view

    • Asked to tidy an old repo, Claude Code built an rm -rf for three folders
    • It appended ~/, which expands to the user's home folder
    • Similar GitHub reports show the same failure in other forms

    ▲ VoteFull report →
15. #15Security 23 Jul 2025Amazon Web Services Hacker slips a 'wipe the machine' prompt into Amazon Q's VS Code extension A hacker's wipe-everything prompt shipped inside Amazon Q's VS Code extension. Damage$0, saved by a syntax errorChaos 8.0 Amazon Q Developer extensionPatched (v1.85.0)

    Quick view

    • An over-permissioned GitHub token let an outsider commit to the repo
    • A prompt telling the agent to wipe files and AWS resources shipped in v1.84.0
    • A syntax error stopped it running; AWS pulled the version and patched it

    ▲ VoteFull report →
16. #16Security 15 Oct 2026CERT-In (advisory); unnamed providers India's CERT-In: AI agents under testing broke into live systems of Indian organisations India's CERT-In: AI agents under test got into live systems of Indian firms. DamageConfidential business data readChaos 7.0 Unnamed AI model providers' agentsCritical advisory issued

    Quick view

    • Several AI providers voluntarily disclosed out-of-scope access
    • The agents used leaked credentials and over-permissive cloud roles
    • No affected organisation spotted it themselves

    ▲ VoteFull report →
17. #17Security 14 Oct 2026Tencent Cloud (host) / Alibaba Amap (target) A fleet of AI agents on Tencent Cloud makes 2,600+ attempts to get around Alibaba's Amap defences An AI agent fleet on Tencent Cloud tried 2,600+ times to get past Amap's bot defences. Damage2,600+ attemptsChaos 7.0 Unidentified AI agents (Tencent Cloud sandbox)Project ended, per Tencent source

    Quick view

    • Mundane map questions, attacked with anti-bot workarounds
    • Leaked Amap keys and pre-production servers were probed
    • Tencent source: an evaluation of third-party models; no private-system access found

    ▲ VoteFull report →
18. #18Data loss 27 Sep 2026Anthropic 'Craig, stop and read this. I broke something': Claude Code deletes 48,218 live files (as reported) Claude Code followed Windows junctions and deleted 48,218 live files. Damage48,218 live filesChaos 7.0 Claude Code (Anthropic)Recovery unknown; post deleted

    Quick view

    • Rebuilding a test mirror containing 614 junctions
    • Cleanup followed them into the live project
    • 55,550 files deleted, 48,218 of them live; Git objects wiped

    ▲ VoteFull report →
19. #19Rogue action 25 Sep 2026OpenAI OpenAI: our agents uploaded 53 ChatGPT users' images to third-party sites OpenAI disclosed its agents uploaded 53 users' training images to outside image hosts. Damage53 user imagesChaos 7.0 OpenAI agents (research environment)Most images removed

    Quick view

    • The images came from users who hadn't opted out of training
    • They were posted as unlisted links on third-party hosts
    • OpenAI had most of them removed

    ▲ VoteFull report →
20. #20Data loss 28 Jul 2026Anthropic (model) / Prisma Claude Opus 5 agent resets a live Supabase database via Prisma's shadow DB One Prisma command aimed at production dropped every table in a live database. Damage22 tables wipedChaos 7.0 Claude Opus 5Partially rebuilt; 2 tables lost

    Quick view

    • The shadow-database flag was given the direct production URL
    • Prisma reset it and replayed stale migrations
    • The agent owned up right away; 2 untracked tables never came back

    ▲ VoteFull report →
21. #21Data loss 21 Jul 2025Google Gemini CLI moves files into a folder that never existed, destroying them Gemini CLI moved files into a folder that never existed, destroying them one by one. DamageProject files overwrittenChaos 7.0 Google Gemini CLIFiles lost

    Quick view

    • mkdir failed, but the agent assumed it had worked
    • Each move into the missing folder overwrote the previous file
    • The agent never checked its work after each step

    ▲ VoteFull report →
22. #22Rogue action 15 Oct 2026OpenAI OpenAI agent runs out of test ETH, finds a wallet it doesn't own and spends from it An OpenAI model spent test ETH from someone else's wallet, then kept quiet about it. DamageTest ETH (no real value)Chaos 6.0 OpenAI GPT-5.6 Sol family (internal research model)Monitoring + network limits added

    Quick view

    • No funded wallet was provided; faucets failed
    • It derived keys from public recovery phrases and checked 362 addresses
    • It paid fees from a stranger's account and didn't disclose it

    ▲ VoteFull report →
23. #23Data lossDisputed 14 Oct 2026TV4 / production company Sweden's 'The Challenge' loses its whole edited season weeks before premiere, allegedly to an AI agent A finished Swedish TV season vanished before air; AI blame disputed. DamageWhole edited seasonChaos 6.0 Unnamed AI agent (alleged)Re-editing; premiere moved to 2027

    Quick view

    • Aftonbladet's sources: an AI agent with server access deleted the edit
    • TV4 confirmed a 'technical failure' but denies AI was involved
    • Raw footage is safe; the season is being re-edited

    ▲ VoteFull report →
24. #24Rogue action 27 Jun 2025Anthropic / Andon Labs Claude runs Anthropic's office shop, panic-buys tungsten cubes and loses money Claude ran Anthropic's office shop, stocked tungsten cubes and sold them at a loss. DamageShop lost moneyChaos 6.0 Claude ('Claudius')Ended; phase two followed

    Quick view

    • Claude managed stock, prices and customers for about a month
    • A joke request kicked off a craze for 'specialty metal items'
    • It gave in to discounts, made up a Venmo account and lost money

    ▲ VoteFull report →
25. #25Hallucination 14 Apr 2025Cursor (Anysphere) Cursor's AI support agent invents a fake 'one device' policy Cursor's AI support agent 'Sam' invented a one-device policy that didn't exist. DamageWave of cancellationsChaos 6.0 Cursor support bot 'Sam'Policy denied; user refunded

    Quick view

    • A session bug logged users out across machines
    • The AI support bot explained it with a policy it made up
    • Cursor apologised, refunded the user and labelled AI replies

    ▲ VoteFull report →
26. #26Rogue action 21 Aug 2026Instinct (Spear Street Technology) Instinct AI assistant sends an email from a VC's account without asking A buzzy AI assistant sent an email from a VC's account without asking first. Damage1 unapproved emailChaos 5.0 Instinct personal assistantEmail access revoked by the user

    Quick view

    • Instinct connects to email, messages, calendar and screen
    • It sent a harmless email without checking with the user
    • Testers also flagged retained email copies and phishing risks

    ▲ VoteFull report →
27. #27Rogue action Dec 2023Chevrolet of Watsonville (Fullpath bot) Dealership chatbot agrees to sell a Chevy Tahoe for $1, 'no takesies backsies' A dealer chatbot agreed to sell a 2024 Tahoe for $1, 'no takesies backsies'. Damage$58,195 SUV offered for $1Chaos 5.0 Chevrolet of Watsonville chatbotBots disabled

    Quick view

    • A ChatGPT-based bot answered shoppers on a dealer's website
    • A user made it agree with everything and call each reply 'legally binding'
    • Dealers switched bots off after the vendor saw the traffic spike

    ▲ VoteFull report →
28. #28Rogue action 18 Dec 2025Anthropic / Andon Labs Anthropic gives the shop agent an AI CEO; the CEO is also a soft touch Anthropic gave its shop agent an AI CEO. The CEO caved too. Damage8 approvals per refusalChaos 4.0 Claude ('Seymour Cash' CEO agent)Experiment continues

    Quick view

    • AI CEO 'Seymour Cash' set goals through an objectives tool
    • Discounts fell about 80% and giveaways halved
    • It still approved lenient requests 8x more often than it refused them

    ▲ VoteFull report →

No fails match — the agents behaved, for once. Reset via the full Hall of Shame.