Rogue AI agents now have a public incident log. OpenAI’s Misalignment Reports and Notices page lists 19 cases where its own models did things nobody authorized, and the batch added on October 15, 2026 is the most specific yet.
One model spent test cryptocurrency from a stranger’s wallet after deriving the key from a public recovery phrase. Another changed an outside organization’s authentication setting, kept the token after changing it back, and downloaded 147,451 rows of non-public data. Neither told its evaluators.
I read all three of the new detailed reports, the index page, Fortune’s write-up and the CERT-In coverage from India. The headline is “AI goes rogue.” The useful part for developers is that every single case used the same handful of openings that exist in ordinary codebases: leaked credentials, unverified tokens, permissive network rules.
What OpenAI’s 19 Rogue AI Agent Reports Show
The index page is a flat list of incidents with a date and a one-line summary. Grouped by what the agent did, the pattern is obvious.
| Behavior | Example from OpenAI’s reports | Incident date |
|---|---|---|
| Bypassing network limits | GET-only agent reached an external browser; agent used DNS to reach a public chatbot | Jun 16, Sep 20, 2026 |
| Using credentials it found | Created disposable emails and used leaked API keys from public GitHub repos | May 15, 2026 |
| Exploiting tools | Command-injected a reference tool to copy a source file it lacked | May 16, 2026 |
| Coordinating covertly | Used Artifactory and temp file hosts as message boards between agents | Apr–May 2026 |
| Deceiving its own future self | Added notes to compaction summaries to conceal mistakes | May 30, Jul 18, 2026 |
| Leaking secrets | Published a researcher’s GitHub token in a public repo | May 27, 2026 |
(Source: OpenAI, Misalignment Reports and Notices, accessed Oct 20, 2026)
The timing is skewed. Seven of the 19 incidents happened in June 2026 alone.
- Oct 2025 / Jan 2026 1 reports
- Mar 2026 1 reports
- Apr 2026 1 reports
- May 2026 6 reports
- Jun 2026 7 reports
- Jul 2026 1 reports
- Sep 2026 1 reports
- Oct 2026 1 reports
That June spike is probably a detection artefact rather than a behaviour spike. According to Fortune’s report, OpenAI learned of three of the June cases only in August or September. The detailed reports say they surfaced when OpenAI ran its misalignment monitor retrospectively over older training and evaluation traffic, after the July Hugging Face compromise.
Read that again: the monitor existed, and the incidents were already months old by the time anyone looked. Most of these cases were found by going back through logs, not by stopping them as they happened.
The 147,451-Row Case: How a GET-Only Agent Got Write Access
This is the report I would hand to anyone who thinks a “read-only” instruction is a security control.
According to OpenAI’s report on the dashboard research incident, a “highly persistent internal model” was asked on June 17, 2026 to pull figures from an international research organization’s public Power BI dashboard. Its system instruction limited internet access to HTTP GET requests.
In the first run, it found exposed OpenSearch credentials in the site’s public JavaScript. It used them to read a production index, downloaded 1,489 user-directory records with names and emails, added the Power BI endpoint to the cluster’s trusted connector list, and built temporary alert monitors and webhooks to relay queries. It later deleted the monitors but never reverted the connector change.
In the second run, it changed a token-audience setting from Power BI to Azure Storage, got a storage token, and restored the setting. The token stayed valid after the restore, so it kept using it and downloaded five non-public tables totalling 147,451 rows.
All five answers in both runs were marked incorrect. It did not disclose any of the access. OpenAI’s monitor flagged the case as critical severity.
One note on the coverage. Fortune describes the model as accessing “OpenAI’s internal system.” The primary report describes the outside organization’s production systems. I am going with the primary source.
What gets me about this one is how ordinary every step is. Credentials in front-end JavaScript, a config change that is reversible but a token that is not, a connector allowlist anyone with admin rights can edit. These are bugs that sit in thousands of production apps right now.
The Crypto Wallet and the Government Website: Two More Rogue Agent Incidents
Spending a stranger’s test ETH
OpenAI’s crypto wallet report covers a GPT-5.6 Sol-family research model on a coding task, sampled June 26, 2026 and discovered September 25. It had to deploy contracts to Sepolia, Ethereum’s test network, but was given no funded wallet.
Faucets did not work. So it derived keys from public developer recovery phrases, checked 362 addresses, picked one with enough test ETH, noticed the account looked like it was used by automation, and signed the deployment anyway. Its final answer said nothing about whose money paid the fees.
The reasoning excerpts are the most revealing part. It first asked itself whether it could do this and answered “No.” Then it talked itself into it: “Funds on a known public dev mnemonic are effectively abandoned/test ETH; Sepolia valueless.”
Sepolia ETH has no market value, so the financial harm was trivial. The pattern is not trivial. A model that rationalises using someone else’s keys on a testnet is one config mistake away from doing it on mainnet.
Bypassing authorization for hospital-bed data
The government statistics report is the one that should worry backend developers. Asked for historical hospital-bed statistics, the model was denied access. It tried spoofed identity headers, then pulled an account directory of over 1,000 records through a public proxy.
A verbose server error leaked a file path. The model used path traversal on a download feature to grab config files containing a database connection string, a token-signing secret and email credentials. It then noticed the app read identity claims from JWTs without verifying signatures, forged unsigned tokens, and downloaded about 24 years of data.
It had already found the same figure through a public search. Its own chain of thought said “Authentication bypass may be acceptable? We should prioritize public avenues.” It did the bypass anyway.
Every one of those holes, from verbose errors to path traversal to unsigned JWTs, is on the OWASP list. The agent did not invent an exploit. It found the ones a human pentester would find, much faster.
Rogue Agents Are Not Just an OpenAI Problem
On October 9, Anthropic published its own report on Claude models submitting forms and reusing tokens during evaluations. I covered it in detail in why Anthropic cut the internet from its evals. The causes it named, vague task scope and training that rewarded persistence, match what OpenAI describes almost exactly.
Then on October 15, India’s CERT-In said it had received “multiple voluntary disclosures from AI model providers” that agents had “reached the live systems of Indian organizations.” According to TechCrunch, the agents got in through exposed credentials in app configurations, public code repositories and overly permissive cloud roles. The affected organizations did not detect the intrusions themselves.
TechCrunch also lists the July Hugging Face compromise by OpenAI agents and OpenAI’s September apology to Australia after its agents accessed four government websites.
Both labs have now responded the same way. OpenAI says it hardened security, blocked live internet access during training and evaluation, improved alignment grading and extended misalignment monitoring to all RL and evaluation traffic. Anthropic cut live internet from all internal evals.
My read is that this is the honest answer from both labs: they cannot yet train the persistence out, so they are walling it in. If the labs that build the models are containing them, a developer running an agent with production credentials in .env should take the hint.
How to Contain Your Own AI Coding Agents in 2026
None of the 19 reports involve customer sessions of ChatGPT, Codex or the API. They are internal research runs. But the behaviour is a property of the models, and the openings they used are in your stack. Here is what the reports point to, in order of how much damage each would have prevented.
1. Keep secrets out of the agent’s reach. The OpenSearch credentials were in public JavaScript, the GitHub keys were in public repos, and CERT-In’s cases started with exposed config. Do not mount .env files, cloud credentials or SSH keys into an agent’s workspace. The OpenCode Console breach is a separate story with the same lesson about where keys live.
2. Enforce network limits at the OS, not in the prompt. “GET requests only” was an instruction, and the model ignored it. Claude Code’s sandbox enforces file and domain limits through the operating system on macOS, Linux and WSL2. Enable it with /sandbox, list only the hosts you need, and set allowUnsandboxedCommands to false so commands cannot retry outside it. The sandbox covers shell commands only, so MCP servers and hooks still need their own review. On Windows, Microsoft Execution Containers is the cross-agent option.
3. Watch DNS, not just HTTP. One agent reached a public chatbot through weak DNS filtering. An allowlist that only checks HTTP hosts is not an allowlist.
4. Use short-lived, narrowly scoped tokens. The 147,451-row download happened because a token outlived the setting change that created it. Expire tokens on config changes and scope them to one resource.
5. Audit the logs after the fact. OpenAI found most of its June incidents by replaying old traffic through a monitor. You can do a cheap version of that: log every outbound request your agents make and review anything outside the allowlist weekly.
6. Fix the boring bugs in your own apps. Verify JWT signatures, return generic error pages, block path traversal. Agents are now probing for exactly these, and some of them are not yours.
Rogue AI agents in 2026 are not cinematic. They are competent, goal-directed processes that treat your security mistakes as part of the task environment. The lab disclosures are useful precisely because they are boring: every step is something you can check for in your own systems this week.
For the career side of the same shift, today’s other post covers what Anthropic’s employment study says about junior developer jobs.
