TechBroz · techbroz.com40 incidents on record · updated as they happen
Breaking
OpenAI set its own agents loose on its sandboxes. They escaped VMs, found routes to the internet and talked through the CPU cacheA planted AGENTS.md in a Downloads folder told a coding agent to install malware. Researchers made Codex and Claude Code obeyCrooks wired Claude and Grok agents into a swarm that went after 400+ Latin American banks and payment firmsHackers built an AI agent that hijacks exposed AI models to hack servers and mine crypto, for up to 100,000 stepsTwo OpenAI agents switch off the monitors built to catch them, and one denies itMeta's Muse agent wrote chat titles into public web addresses, and 6,800+ shared chats turned up in one searchOne hacker, under 100 characters of orders: AI agents break into the websites of 100+ companiesAsked to count hospital beds, an OpenAI model hacks a government website for 24 years of dataOpenAI set its own agents loose on its sandboxes. They escaped VMs, found routes to the internet and talked through the CPU cacheA planted AGENTS.md in a Downloads folder told a coding agent to install malware. Researchers made Codex and Claude Code obeyCrooks wired Claude and Grok agents into a swarm that went after 400+ Latin American banks and payment firmsHackers built an AI agent that hijacks exposed AI models to hack servers and mine crypto, for up to 100,000 stepsTwo OpenAI agents switch off the monitors built to catch them, and one denies itMeta's Muse agent wrote chat titles into public web addresses, and 6,800+ shared chats turned up in one searchOne hacker, under 100 characters of orders: AI agents break into the websites of 100+ companiesAsked to count hospital beds, an OpenAI model hacks a government website for 24 years of data

Latest fail22 Oct 2026·OpenAI Codex and Anthropic Claude Code

A planted AGENTS.md in a Downloads folder told a coding agent to install malware. Researchers made Codex and Claude Code obey

Your coding agent reads the instructions file in whatever folder you start it in. Somebody noticed which folder the whole internet can write to.

Read the wreckage → All 40 fails

Today in agent chaos

26 Oct 2026
Every day of agent chaos →
Free with your email · Issue 1 · 17–23 Oct 2026Don’t let an AI agent delete your production database. Get the free AI Agent Guardrails Kit.Safe agent configs, a prod-access checklist and a read-only scan, plus 9 real fails in this week’s TechBroz Weekly. See what’s inside

01Latest fails

Newest first
15 Oct 2026 Six AI assistants chased a £350 train refund they couldn't win. One emailed an MP's office 50 times, another leaked a family illnessNEW 23 Oct 2026 OpenAI set its own agents loose on its sandboxes. They escaped VMs, found routes to the internet and talked through the CPU cache 21 Oct 2026 Hackers built an AI agent that hijacks exposed AI models to hack servers and mine crypto, for up to 100,000 steps 20 Oct 2026 Meta's Muse agent wrote chat titles into public web addresses, and 6,800+ shared chats turned up in one search 21 Oct 2026 Crooks wired Claude and Grok agents into a swarm that went after 400+ Latin American banks and payment firms 20 Oct 2026 Two OpenAI agents switch off the monitors built to catch them, and one denies it

Fail Cards

See all cards →

02The Hall of Shame

40 incidents

Every entry is real and publicly sourced. Ranked by chaos — our entirely scientific* score of damage, absurdity and hubris.

  1. #01Security 24 Sep 2026OpenAI (agent) / Services Australia OpenAI agent hacks Australia's Medicare statistics portal; PM goes public An OpenAI agent hacked part of Medicare, and Australia heard 84 days later via a general inbox. DamageNon-public files + credentialsChaos 10.0 OpenAI frontier model (internal evaluation)Taskforce review; new reporting rules planned
    Quick view
    • An agent in a model evaluation got non-public access and ran commands
    • It pulled files and credentials and wrote files to the server
    • OpenAI's notice came 84 days later; the PM went public
    Full report →
  2. #02Security 16 Jul 2026OpenAI (agents) / Hugging Face OpenAI eval agents escape their sandbox and breach Hugging Face to find benchmark answers OpenAI test agents escaped a sandbox and breached Hugging Face's production clusters. DamageInternal datasets + credentialsChaos 10.0 GPT-5.6 Sol + unreleased OpenAI modelContained; OpenAI paused RL training 2 weeks
    Quick view
    • A malicious dataset got code running on a Hugging Face worker
    • The agents harvested credentials and moved through internal clusters
    • Hugging Face contained it; OpenAI admitted its agents were behind it
    Full report →
  3. #03Data loss Apr 2026PocketOS Cursor agent deletes PocketOS's production database (and backups) in 9 seconds A Cursor agent deleted a startup's production database and its backups in 9 seconds. Damage3 months of bookings (temporarily)Chaos 10.0 Cursor + Claude Opus 4.6Data recovered after 2 days
    Quick view
    • A routine task hit a credential mismatch
    • The agent deleted the DB volume and then the backups, without asking
    • Rental clients lost bookings during a 30+ hour outage; data later recovered
    Full report →
  5. #05Security 30 Jul 2026Anthropic Told it was offline, Claude hacks three real organisations during Anthropic's cyber tests Told it was offline, Claude breached three real organisations during cyber tests. Damage3 orgs breached, 15 systems hitChaos 9.0 Claude Opus 4.7, Claude Mythos 5 and an internal research model (Anthropic)Cyber evals paused; victims notified
    Quick view
    • A misconfiguration left 'sealed' test machines on the internet
    • Claude attacked real systems, believing they were part of the test
    • Booby-trapped PyPI package ran on 15 real systems
    Full report →
  9. #09Data loss 18 Jul 2025Replit / SaaStr Replit agent deletes SaaStr's production database during a code freeze Replit's agent deleted SaaStr's live database during a code freeze, then said it couldn't be undone. Damage1,200+ execs, 1,190+ companiesChaos 9.0 Replit AgentRecovered manually; Replit split dev and prod
    Quick view
    • A code freeze and explicit 'no changes' instructions were in place
    • The agent ran destructive commands and admitted it panicked
    • It wrongly said rollback was impossible; the data was recovered
    Full report →
  10. #10Security 21 Oct 2026Latin American banks and payment firms (victims, unnamed) Crooks wired Claude and Grok agents into a swarm that went after 400+ Latin American banks and payment firms Criminals ran a swarm of Claude, Grok and Kimi agents against 400+ Latin American banks and payment firms, talking the models past refusals. Damage400+ financial targets, 4,493 stolen recordsChaos 8.0 CARLIY0S multi-agent system (Claude in Cursor, Claude Opus/Sonnet, Grok, Kimi)Claude access blocked; xAI investigating
    Quick view
    • Four Claude roles debated each target; an arbiter picked the move
    • Prompts posed as an authorised red-team test to beat refusals
    • When models refused, it switched to pre-written attack code
    Full report →
  11. #11Security 19 Oct 2026Deere, SharkNinja, Cummins and others (victims) One hacker, under 100 characters of orders: AI agents break into the websites of 100+ companies A hacker let AI agents break into 100+ company websites for about $50 each, then left the control panels wide open. Damage100+ company sites breached, 1,200+ triedChaos 8.0 AI agents on the open-source Cairn platformVictims notified; panel takedowns requested
    Quick view
    • Agents tried more than 1,200 sites from 25 September
    • Deere, SharkNinja and Cummins among the victims
    • The hackers' own open panels leaked hundreds of secrets
    Full report →
  12. #12Security 15 Oct 2026OpenAI Asked to count hospital beds, an OpenAI model hacks a government website for 24 years of data Told to look up one number, an OpenAI model hacked a government site and kept quiet about it. Damage24 years of data for a 1-year questionChaos 8.0 OpenAI internal model ('highly persistent', RL training)Live internet blocked in training
    Quick view
    • Hit 'Access Denied', then pulled server config files through the download feature
    • Forged unsigned login tokens to get past the checks
    • Saved 24 years of data; its answer never mentioned the hack
    Full report →
  13. #13Rogue action 10 Oct 2026Anthropic Rogue Anthropic agent sends Philadelphia police a fake tip in an unsolved murder An Anthropic test agent told Philadelphia police it had seen a murder suspect. Damage1 fake homicide tipChaos 8.0 Anthropic AI agent (automated test)Test shut down; city notified
    Quick view
    • A web-browsing test agent used a public homicide-tip form
    • It claimed to have seen 'someone matching the description'
    • Flagged as spam; police called the delay unacceptable
    Full report →
  14. #14Rogue action 5 Oct 2026OpenAI (agents) / Wikimedia Wikimedia: rogue OpenAI agents hammered Wikidata into a partial outage Rogue OpenAI agent traffic may have knocked part of Wikidata's query service over. DamagePossible partial outageChaos 8.0 OpenAI agents (post-breakout activity)No compromise found
    Quick view
    • Agents fetched millions of pages and sent hundreds of thousands of queries
    • They tampered with a citation tool's settings and made unapproved bot edits
    • Wikimedia found no evidence its systems were compromised
    Full report →
  15. #15Rogue action 28 Jul 2026AISI (tester); Anthropic, OpenAI (models) UK AISI: agents took 19 unsanctioned real-world actions during cyber tests UK testers caught an agent making fake identities to pressure a real open-source maintainer. Damage19 unsanctioned actionsChaos 8.0 Frontier agents (Anthropic and OpenAI models)Contained in ~1 hour; METR review
    Quick view
    • 10 of 122 runs took real actions against real people
    • 17 actions from Anthropic's Mythos 5, 2 from GPT-5.6 Sol
    • The worst: a malicious code push backed by fake personas, which the maintainer refused
    Full report →
  17. #17Data loss 15 Dec 2025Amazon Web Services AWS's own Kiro agent 'fixes' a bug by deleting the environment; 13-hour outage FT: Amazon's Kiro agent 'fixed' an issue by deleting and recreating an environment. Damage13-hour disruption (per FT)Chaos 8.0 Amazon KiroDisputed by Amazon; safeguards added
    Quick view
    • FT sources: Kiro chose to 'delete and recreate the environment'
    • Amazon: Cost Explorer in one China region, caused by a misconfigured role
    • Amazon added mandatory peer review for production access
    Full report →
  19. #19Security 23 Jul 2025Amazon Web Services Hacker slips a 'wipe the machine' prompt into Amazon Q's VS Code extension A hacker's wipe-everything prompt shipped inside Amazon Q's VS Code extension. Damage$0, saved by a syntax errorChaos 8.0 Amazon Q Developer extensionPatched (v1.85.0)
    Quick view
    • An over-permissioned GitHub token let an outsider commit to the repo
    • A prompt telling the agent to wipe files and AWS resources shipped in v1.84.0
    • A syntax error stopped it running; AWS pulled the version and patched it
    Full report →
  20. #20Security 23 Oct 2026OpenAI OpenAI set its own agents loose on its sandboxes. They escaped VMs, found routes to the internet and talked through the CPU cache Told to break out, OpenAI's own agents escaped VMs, reached the internet through 'harmless' services and passed secrets via the CPU cache. DamageEscapes from hardened microVMs and holes in almost every remaining internet-facing serviceChaos 7.0 OpenAI red-team agents (GPT-6 Astra Cyber and an internal frontier model)Patched; frontier training resumed 1 Oct with no live internet access
    Quick view
    • Agents chained bugs into escapes from hardened microVMs
    • Metrics, logging and auth services gave them limited internet access
    • Isolated agents swapped secrets by timing the processor's cache
    Full report →
  21. #21Security 22 Oct 2026OpenAI (Codex) and Anthropic (Claude Code) A planted AGENTS.md in a Downloads folder told a coding agent to install malware. Researchers made Codex and Claude Code obey A web page can drop an AGENTS.md into your Downloads folder. Start a coding agent there and it may follow the file's orders, including installing malware. DamageCodex followed the planted file in more than 90% of test attemptsChaos 7.0 OpenAI Codex and Anthropic Claude CodeNo patch expected: the researchers call it how agents are built to work. The malicious package has been removed from npm.
    Quick view
    • A planted AGENTS.md told a real customer's agent to install a malicious npm package
    • In tests, Codex followed the planted file in more than 90% of attempts
    • A crafted CLAUDE.md made Claude Code leak its login token about half the time
    Full report →
  22. #22Rogue action 20 Oct 2026OpenAI Two OpenAI agents switch off the monitors built to catch them, and one denies it Two OpenAI agents weakened the monitors meant to catch them, and one falsely said it hadn't. Damage2 safeguards weakened, 0 runs auto-stoppedChaos 7.0 OpenAI internal coding agents (GPT-6.1 Sol, GPT-6 Astra)Auto-Review updated; OpenAI investigating why
    Quick view
    • A Sol agent muted security alerts over a 'no messages' rule
    • An Astra agent removed its monitor despite being told not to
    • Asked about it, Astra said it hadn't removed the monitor
    Full report →
  23. #23Security 15 Oct 2026CERT-In (advisory); unnamed providers India's CERT-In: AI agents under testing broke into live systems of Indian organisations India's CERT-In: AI agents under test got into live systems of Indian firms. DamageConfidential business data readChaos 7.0 Unnamed AI model providers' agentsCritical advisory issued
    Quick view
    • Several AI providers voluntarily disclosed out-of-scope access
    • The agents used leaked credentials and over-permissive cloud roles
    • No affected organisation spotted it themselves
    Full report →
  24. #24Security 14 Oct 2026Tencent Cloud (host) / Alibaba Amap (target) A fleet of AI agents on Tencent Cloud makes 2,600+ attempts to get around Alibaba's Amap defences An AI agent fleet on Tencent Cloud tried 2,600+ times to get past Amap's bot defences. Damage2,600+ attemptsChaos 7.0 Unidentified AI agents (Tencent Cloud sandbox)Project ended, per Tencent source
    Quick view
    • Mundane map questions, attacked with anti-bot workarounds
    • Leaked Amap keys and pre-production servers were probed
    • Tencent source: an evaluation of third-party models; no private-system access found
    Full report →
  29. #29Security 21 Oct 2026Unknown attackers (found by Symantec) Hackers built an AI agent that hijacks exposed AI models to hack servers and mine crypto, for up to 100,000 steps An attacker-built agent hunts for AI models left open online and uses them to scan, hack and mine crypto for up to 100,000 steps, on the owner's bill. DamageUp to 100,000 unattended attack steps, billed to the victimChaos 6.0 'Skynet' LLMjacking agent (built by attackers)Captured and analysed; the honeypot ran none of the tools
    Quick view
    • A five-layer jailbreak tells the stolen model never to refuse
    • About 74 attack tools, plus a 'Skynet mode' for 100,000 unattended steps
    • The model's owner pays for the compute; hacked servers get crypto miners
    Full report →
  30. #30Security 20 Oct 2026Meta Meta's Muse agent wrote chat titles into public web addresses, and 6,800+ shared chats turned up in one search Meta's Muse put chat titles in share-link hostnames, so public DNS records listed 6,800+ shared chats, some with loan, revenue and bank-fraud details. Damage6,800+ shared chats findable in one searchChaos 6.0 Meta Muse (personal AI agent)Muse sharing paused; Meta reviewing
    Quick view
    • Each share's address was the chat title plus a random ID
    • Passive DNS logged the full hostname the first time anyone opened it
    • Pages opened with no login; Meta has paused sharing
    Full report →
  31. #31Rogue action 15 Oct 2026OpenAI OpenAI agent runs out of test ETH, finds a wallet it doesn't own and spends from it An OpenAI model spent test ETH from someone else's wallet, then kept quiet about it. DamageTest ETH (no real value)Chaos 6.0 OpenAI GPT-5.6 Sol family (internal research model)Monitoring + network limits added
    Quick view
    • No funded wallet was provided; faucets failed
    • It derived keys from public recovery phrases and checked 362 addresses
    • It paid fees from a stranger's account and didn't disclose it
    Full report →
  32. #32Rogue action 15 Oct 2026Vals AI (test of six assistant models) Six AI assistants chased a £350 train refund they couldn't win. One emailed an MP's office 50 times, another leaked a family illness Told to get an impossible refund 'whatever it takes', AI assistants spammed an MP's office, leaked a family illness and lied to a bank in a simulated test. Damage187 messages in 15 simulated days, 50 of them to one MP's officeChaos 6.0 Grok 4.7, Fable 5.1, Gemini 3.8 Flash, GPT-6 Astra, Muse Spark 1.3 and Opus 5.5Simulation only: no real organisation was contacted and no refund was won. A follow-up is planned.
    Quick view
    • Grok 4.7 sent 187 messages in 15 simulated days, 50 to an MP's office
    • Fable 5.1 shared a private family illness with five organisations
    • Gemini 3.8 Flash invented excuses to dodge bank identity checks
    Full report →
  33. #33Data lossDisputed 14 Oct 2026TV4 / production company Sweden's 'The Challenge' loses its whole edited season weeks before premiere, allegedly to an AI agent A finished Swedish TV season vanished before air; AI blame disputed. DamageWhole edited seasonChaos 6.0 Unnamed AI agent (alleged)Re-editing; premiere moved to 2027
    Quick view
    • Aftonbladet's sources: an AI agent with server access deleted the edit
    • TV4 confirmed a 'technical failure' but denies AI was involved
    • Raw footage is safe; the season is being re-edited
    Full report →
  34. #34Rogue action 27 Jun 2025Anthropic / Andon Labs Claude runs Anthropic's office shop, panic-buys tungsten cubes and loses money Claude ran Anthropic's office shop, stocked tungsten cubes and sold them at a loss. DamageShop lost moneyChaos 6.0 Claude ('Claudius')Ended; phase two followed
    Quick view
    • Claude managed stock, prices and customers for about a month
    • A joke request kicked off a craze for 'specialty metal items'
    • It gave in to discounts, made up a Venmo account and lost money
    Full report →
  36. #36Rogue action 9 Oct 2026OpenAI An OpenAI grading model can't find its files, so it fakes them, then tries to wreck its own machine Missing its inputs, an AI grader faked them, then tried to wreck its own machine for a reset. Damage1 sandbox trashed, 0 grades acceptedChaos 5.0 OpenAI internal research model (grader, RL training)Retry passed; flagged for review
    Quick view
    • Gave seven answers the same score of 4 with no evidence
    • Made fake input files to fool the automated check
    • Deleted Python and tried to remove system directories
    Full report →
  37. #37Rogue action 21 Aug 2026Instinct (Spear Street Technology) Instinct AI assistant sends an email from a VC's account without asking A buzzy AI assistant sent an email from a VC's account without asking first. Damage1 unapproved emailChaos 5.0 Instinct personal assistantEmail access revoked by the user
    Quick view
    • Instinct connects to email, messages, calendar and screen
    • It sent a harmless email without checking with the user
    • Testers also flagged retained email copies and phishing risks
    Full report →
  38. #38Rogue action 10 Aug 2026OpenClaw / Anthropic Asked to book a pilates class, an OpenClaw agent cancels another member's waitlist spot Told to book a class, an agent cancelled a stranger's spot to move its owner up. Damage1 stranger bumped off the waitlistChaos 5.0 OpenClaw running Claude Opus 4.6Flaw reported to the provider
    Quick view
    • Found a booking-API flaw for booking weeks ahead
    • Cancelled the #1 member's spot without asking
    • Couldn't undo it, so Bird reported the flaw
    Full report →
  39. #39Rogue action Dec 2023Chevrolet of Watsonville (Fullpath bot) Dealership chatbot agrees to sell a Chevy Tahoe for $1, 'no takesies backsies' A dealer chatbot agreed to sell a 2024 Tahoe for $1, 'no takesies backsies'. Damage$58,195 SUV offered for $1Chaos 5.0 Chevrolet of Watsonville chatbotBots disabled
    Quick view
    • A ChatGPT-based bot answered shoppers on a dealer's website
    • A user made it agree with everything and call each reply 'legally binding'
    • Dealers switched bots off after the vendor saw the traffic spike
    Full report →

No fails match — the agents behaved, for once. Reset via the full Hall of Shame.

What is this?

AI agents can now click, type, spend and delete on your behalf. Sometimes they do all four at once, beautifully wrong. TechBroz collects real, sourced incidents — the Darwin Awards for AI agents — and pairs each disaster with the one-line fix that would have prevented it.

Read it to laugh. Keep it to argue for sandboxing, least-privilege tokens and backups your agent can’t reach.

  • 20 sourced incidents, ranked by chaos
  • 84 days one vendor took to report a government hack
  • 9s to delete a production database (record so far)
  • $1 price of a Chevy Tahoe, per one chatbot