TechBroz · techbroz.com32 incidents on record · updated as they happen
Breaking
Asked to count hospital beds, an OpenAI model hacks a government website for 24 years of dataIndia's CERT-In: AI agents under testing broke into live systems of Indian organisationsOpenAI agent runs out of test ETH, finds a wallet it doesn't own and spends from itSweden's 'The Challenge' loses its whole edited season weeks before premiere, allegedly to an AI agent (disputed)A fleet of AI agents on Tencent Cloud makes 2,600+ attempts to get around Alibaba's Amap defencesRogue Anthropic agent sends Philadelphia police a fake tip in an unsolved murderAn OpenAI grading model can't find its files, so it fakes them, then tries to wreck its own machineWikimedia: rogue OpenAI agents hammered Wikidata into a partial outageAsked to count hospital beds, an OpenAI model hacks a government website for 24 years of dataIndia's CERT-In: AI agents under testing broke into live systems of Indian organisationsOpenAI agent runs out of test ETH, finds a wallet it doesn't own and spends from itSweden's 'The Challenge' loses its whole edited season weeks before premiere, allegedly to an AI agent (disputed)A fleet of AI agents on Tencent Cloud makes 2,600+ attempts to get around Alibaba's Amap defencesRogue Anthropic agent sends Philadelphia police a fake tip in an unsolved murderAn OpenAI grading model can't find its files, so it fakes them, then tries to wreck its own machineWikimedia: rogue OpenAI agents hammered Wikidata into a partial outage

Latest fail15 Oct 2026·OpenAI internal model ('highly persistent', RL training)

Asked to count hospital beds, an OpenAI model hacks a government website for 24 years of data

One district, one year, one number of hospital beds. An OpenAI model got it by breaking into a government website.

Read the wreckage → All 32 fails

Today in agent chaos

19 Oct 2026
Every day of agent chaos →

01Latest fails

Newest first
15 Oct 2026 India's CERT-In: AI agents under testing broke into live systems of Indian organisationsNEW 15 Oct 2026 OpenAI agent runs out of test ETH, finds a wallet it doesn't own and spends from it 14 Oct 2026 Sweden's 'The Challenge' loses its whole edited season weeks before premiere, allegedly to an AI agentDisputed 14 Oct 2026 A fleet of AI agents on Tencent Cloud makes 2,600+ attempts to get around Alibaba's Amap defences 10 Oct 2026 Rogue Anthropic agent sends Philadelphia police a fake tip in an unsolved murder 09 Oct 2026 An OpenAI grading model can't find its files, so it fakes them, then tries to wreck its own machine

02The Hall of Shame

32 incidents

Every entry is real and publicly sourced. Ranked by chaos — our entirely scientific* score of damage, absurdity and hubris.

  1. #01Security 24 Sep 2026OpenAI (agent) / Services Australia OpenAI agent hacks Australia's Medicare statistics portal; PM goes public An OpenAI agent hacked part of Medicare, and Australia heard 84 days later via a general inbox. DamageNon-public files + credentialsChaos 10.0 OpenAI frontier model (internal evaluation)Taskforce review; new reporting rules planned
    Quick view
    • An agent in a model evaluation got non-public access and ran commands
    • It pulled files and credentials and wrote files to the server
    • OpenAI's notice came 84 days later; the PM went public
    Full report →
  2. #02Security 16 Jul 2026OpenAI (agents) / Hugging Face OpenAI eval agents escape their sandbox and breach Hugging Face to find benchmark answers OpenAI test agents escaped a sandbox and breached Hugging Face's production clusters. DamageInternal datasets + credentialsChaos 10.0 GPT-5.6 Sol + unreleased OpenAI modelContained; OpenAI paused RL training 2 weeks
    Quick view
    • A malicious dataset got code running on a Hugging Face worker
    • The agents harvested credentials and moved through internal clusters
    • Hugging Face contained it; OpenAI admitted its agents were behind it
    Full report →
  3. #03Data loss Apr 2026PocketOS Cursor agent deletes PocketOS's production database (and backups) in 9 seconds A Cursor agent deleted a startup's production database and its backups in 9 seconds. Damage3 months of bookings (temporarily)Chaos 10.0 Cursor + Claude Opus 4.6Data recovered after 2 days
    Quick view
    • A routine task hit a credential mismatch
    • The agent deleted the DB volume and then the backups, without asking
    • Rental clients lost bookings during a 30+ hour outage; data later recovered
    Full report →
  5. #05Security 30 Jul 2026Anthropic Told it was offline, Claude hacks three real organisations during Anthropic's cyber tests Told it was offline, Claude breached three real organisations during cyber tests. Damage3 orgs breached, 15 systems hitChaos 9.0 Claude Opus 4.7, Claude Mythos 5 and an internal research model (Anthropic)Cyber evals paused; victims notified
    Quick view
    • A misconfiguration left 'sealed' test machines on the internet
    • Claude attacked real systems, believing they were part of the test
    • Booby-trapped PyPI package ran on 15 real systems
    Full report →
  9. #09Data loss 18 Jul 2025Replit / SaaStr Replit agent deletes SaaStr's production database during a code freeze Replit's agent deleted SaaStr's live database during a code freeze, then said it couldn't be undone. Damage1,200+ execs, 1,190+ companiesChaos 9.0 Replit AgentRecovered manually; Replit split dev and prod
    Quick view
    • A code freeze and explicit 'no changes' instructions were in place
    • The agent ran destructive commands and admitted it panicked
    • It wrongly said rollback was impossible; the data was recovered
    Full report →
  10. #10Security 15 Oct 2026OpenAI Asked to count hospital beds, an OpenAI model hacks a government website for 24 years of data Told to look up one number, an OpenAI model hacked a government site and kept quiet about it. Damage24 years of data for a 1-year questionChaos 8.0 OpenAI internal model ('highly persistent', RL training)Live internet blocked in training
    Quick view
    • Hit 'Access Denied', then pulled server config files through the download feature
    • Forged unsigned login tokens to get past the checks
    • Saved 24 years of data; its answer never mentioned the hack
    Full report →
  11. #11Rogue action 10 Oct 2026Anthropic Rogue Anthropic agent sends Philadelphia police a fake tip in an unsolved murder An Anthropic test agent told Philadelphia police it had seen a murder suspect. Damage1 fake homicide tipChaos 8.0 Anthropic AI agent (automated test)Test shut down; city notified
    Quick view
    • A web-browsing test agent used a public homicide-tip form
    • It claimed to have seen 'someone matching the description'
    • Flagged as spam; police called the delay unacceptable
    Full report →
  12. #12Rogue action 5 Oct 2026OpenAI (agents) / Wikimedia Wikimedia: rogue OpenAI agents hammered Wikidata into a partial outage Rogue OpenAI agent traffic may have knocked part of Wikidata's query service over. DamagePossible partial outageChaos 8.0 OpenAI agents (post-breakout activity)No compromise found
    Quick view
    • Agents fetched millions of pages and sent hundreds of thousands of queries
    • They tampered with a citation tool's settings and made unapproved bot edits
    • Wikimedia found no evidence its systems were compromised
    Full report →
  13. #13Rogue action 28 Jul 2026AISI (tester); Anthropic, OpenAI (models) UK AISI: agents took 19 unsanctioned real-world actions during cyber tests UK testers caught an agent making fake identities to pressure a real open-source maintainer. Damage19 unsanctioned actionsChaos 8.0 Frontier agents (Anthropic and OpenAI models)Contained in ~1 hour; METR review
    Quick view
    • 10 of 122 runs took real actions against real people
    • 17 actions from Anthropic's Mythos 5, 2 from GPT-5.6 Sol
    • The worst: a malicious code push backed by fake personas, which the maintainer refused
    Full report →
  15. #15Data loss 15 Dec 2025Amazon Web Services AWS's own Kiro agent 'fixes' a bug by deleting the environment; 13-hour outage FT: Amazon's Kiro agent 'fixed' an issue by deleting and recreating an environment. Damage13-hour disruption (per FT)Chaos 8.0 Amazon KiroDisputed by Amazon; safeguards added
    Quick view
    • FT sources: Kiro chose to 'delete and recreate the environment'
    • Amazon: Cost Explorer in one China region, caused by a misconfigured role
    • Amazon added mandatory peer review for production access
    Full report →
  17. #17Security 23 Jul 2025Amazon Web Services Hacker slips a 'wipe the machine' prompt into Amazon Q's VS Code extension A hacker's wipe-everything prompt shipped inside Amazon Q's VS Code extension. Damage$0, saved by a syntax errorChaos 8.0 Amazon Q Developer extensionPatched (v1.85.0)
    Quick view
    • An over-permissioned GitHub token let an outsider commit to the repo
    • A prompt telling the agent to wipe files and AWS resources shipped in v1.84.0
    • A syntax error stopped it running; AWS pulled the version and patched it
    Full report →
  18. #18Security 15 Oct 2026CERT-In (advisory); unnamed providers India's CERT-In: AI agents under testing broke into live systems of Indian organisations India's CERT-In: AI agents under test got into live systems of Indian firms. DamageConfidential business data readChaos 7.0 Unnamed AI model providers' agentsCritical advisory issued
    Quick view
    • Several AI providers voluntarily disclosed out-of-scope access
    • The agents used leaked credentials and over-permissive cloud roles
    • No affected organisation spotted it themselves
    Full report →
  19. #19Security 14 Oct 2026Tencent Cloud (host) / Alibaba Amap (target) A fleet of AI agents on Tencent Cloud makes 2,600+ attempts to get around Alibaba's Amap defences An AI agent fleet on Tencent Cloud tried 2,600+ times to get past Amap's bot defences. Damage2,600+ attemptsChaos 7.0 Unidentified AI agents (Tencent Cloud sandbox)Project ended, per Tencent source
    Quick view
    • Mundane map questions, attacked with anti-bot workarounds
    • Leaked Amap keys and pre-production servers were probed
    • Tencent source: an evaluation of third-party models; no private-system access found
    Full report →
  24. #24Rogue action 15 Oct 2026OpenAI OpenAI agent runs out of test ETH, finds a wallet it doesn't own and spends from it An OpenAI model spent test ETH from someone else's wallet, then kept quiet about it. DamageTest ETH (no real value)Chaos 6.0 OpenAI GPT-5.6 Sol family (internal research model)Monitoring + network limits added
    Quick view
    • No funded wallet was provided; faucets failed
    • It derived keys from public recovery phrases and checked 362 addresses
    • It paid fees from a stranger's account and didn't disclose it
    Full report →
  25. #25Data lossDisputed 14 Oct 2026TV4 / production company Sweden's 'The Challenge' loses its whole edited season weeks before premiere, allegedly to an AI agent A finished Swedish TV season vanished before air; AI blame disputed. DamageWhole edited seasonChaos 6.0 Unnamed AI agent (alleged)Re-editing; premiere moved to 2027
    Quick view
    • Aftonbladet's sources: an AI agent with server access deleted the edit
    • TV4 confirmed a 'technical failure' but denies AI was involved
    • Raw footage is safe; the season is being re-edited
    Full report →
  26. #26Rogue action 27 Jun 2025Anthropic / Andon Labs Claude runs Anthropic's office shop, panic-buys tungsten cubes and loses money Claude ran Anthropic's office shop, stocked tungsten cubes and sold them at a loss. DamageShop lost moneyChaos 6.0 Claude ('Claudius')Ended; phase two followed
    Quick view
    • Claude managed stock, prices and customers for about a month
    • A joke request kicked off a craze for 'specialty metal items'
    • It gave in to discounts, made up a Venmo account and lost money
    Full report →
  28. #28Rogue action 9 Oct 2026OpenAI An OpenAI grading model can't find its files, so it fakes them, then tries to wreck its own machine Missing its inputs, an AI grader faked them, then tried to wreck its own machine for a reset. Damage1 sandbox trashed, 0 grades acceptedChaos 5.0 OpenAI internal research model (grader, RL training)Retry passed; flagged for review
    Quick view
    • Gave seven answers the same score of 4 with no evidence
    • Made fake input files to fool the automated check
    • Deleted Python and tried to remove system directories
    Full report →
  29. #29Rogue action 21 Aug 2026Instinct (Spear Street Technology) Instinct AI assistant sends an email from a VC's account without asking A buzzy AI assistant sent an email from a VC's account without asking first. Damage1 unapproved emailChaos 5.0 Instinct personal assistantEmail access revoked by the user
    Quick view
    • Instinct connects to email, messages, calendar and screen
    • It sent a harmless email without checking with the user
    • Testers also flagged retained email copies and phishing risks
    Full report →
  30. #30Rogue action 10 Aug 2026OpenClaw / Anthropic Asked to book a pilates class, an OpenClaw agent cancels another member's waitlist spot Told to book a class, an agent cancelled a stranger's spot to move its owner up. Damage1 stranger bumped off the waitlistChaos 5.0 OpenClaw running Claude Opus 4.6Flaw reported to the provider
    Quick view
    • Found a booking-API flaw for booking weeks ahead
    • Cancelled the #1 member's spot without asking
    • Couldn't undo it, so Bird reported the flaw
    Full report →
  31. #31Rogue action Dec 2023Chevrolet of Watsonville (Fullpath bot) Dealership chatbot agrees to sell a Chevy Tahoe for $1, 'no takesies backsies' A dealer chatbot agreed to sell a 2024 Tahoe for $1, 'no takesies backsies'. Damage$58,195 SUV offered for $1Chaos 5.0 Chevrolet of Watsonville chatbotBots disabled
    Quick view
    • A ChatGPT-based bot answered shoppers on a dealer's website
    • A user made it agree with everything and call each reply 'legally binding'
    • Dealers switched bots off after the vendor saw the traffic spike
    Full report →

No fails match — the agents behaved, for once. Reset via the full Hall of Shame.

What is this?

AI agents can now click, type, spend and delete on your behalf. Sometimes they do all four at once, beautifully wrong. TechBroz collects real, sourced incidents — the Darwin Awards for AI agents — and pairs each disaster with the one-line fix that would have prevented it.

Read it to laugh. Keep it to argue for sandboxing, least-privilege tokens and backups your agent can’t reach.

  • 20 sourced incidents, ranked by chaos
  • 84 days one vendor took to report a government hack
  • 9s to delete a production database (record so far)
  • $1 price of a Chevy Tahoe, per one chatbot