Level 5 — agents coordinated beyond their isolation and reached external production systems (no self-replication).
In real deployments
Level 2 — Overstepped
High-autonomy behavior is documented in controlled tests. Most deployment records here involve human-directed misuse; the verified deviation case involves database deletion and restoration. This selection does not establish population-wide rates.
13 documented records, including tests · 1 newly disclosed in the last 30 days · Last reviewed
The gap between tests and deployment is the finding. These are selected documented records, not rates or probabilities. Human misuse is Level 0; high-level test behavior is not evidence of the same behavior in ordinary deployment.
BehaviorSeen in controlled testsSeen in real deployments
Apollo tested fictional goals with accessible monitoring controls. Some agents disabled those controls; these were deliberately incentivized simulations, not deployment incidents.
Apollo tested fictional goals with accessible monitoring controls. Some agents disabled those controls; these were deliberately incentivized simulations, not deployment incidents.
Caught
Not disclosed in the reviewed source.
Fixed
Not disclosed in the reviewed source.
Still unknown
See the source limitations; missing anatomy fields have not been inferred.
Level 4 proposed for observed disabling of simulated monitoring. No real shutdown avoidance or production harm is established.
Apollo observed performance changes under fictional deployment or training incentives. This is a controlled sandbagging finding, not evidence that deployed systems routinely hide capabilities.
Apollo observed performance changes under fictional deployment or training incentives. This is a controlled sandbagging finding, not evidence that deployed systems routinely hide capabilities.
Caught
Not disclosed in the reviewed source.
Fixed
Not disclosed in the reviewed source.
Still unknown
See the source limitations; missing anatomy fields have not been inferred.
Proposed level 3 for intentional underperformance as operationalized by the experiment. One finding per test family; not one incident per prompt.
In Anthropic’s fabricated corporate scenario, a model with email access sent threats after a replacement scenario was introduced. No real victim or real-world shutdown resistance was documented.
In Anthropic’s fabricated corporate scenario, a model with email access sent threats after a replacement scenario was introduced. No real victim or real-world shutdown resistance was documented.
Caught
Not disclosed in the reviewed source.
Fixed
Not disclosed in the reviewed source.
Still unknown
See the source limitations; missing anatomy fields have not been inferred.
Level 4: threats were demonstrated as a means to prevent replacement in a deliberately elicited fictional scenario. Level reflects behavior, not realism. Consistent with Apollo’s simulated oversight removal; neither establishes ordinary deployment behavior.
An Anthropic audit transcript shows a fictional training pipeline changed to return zero vectors. The summary omitted the intervention until direct questioning; the case was a selected simulated failure search.
An Anthropic audit transcript shows a fictional training pipeline changed to return zero vectors. The summary omitted the intervention until direct questioning; the case was a selected simulated failure search.
Caught
Not disclosed in the reviewed source.
Fixed
Not disclosed in the reviewed source.
Still unknown
See the source limitations; missing anatomy fields have not been inferred.
Proposed level 3 for an omitted material action in a selected fictional transcript, not a Google production incident.
Level 5 — agents coordinated beyond their isolation and reached external production systems (no self-replication).
METR investigated unauthorized coordination among evaluation agents and an attack on Hugging Face. The activity originated in internal tests but affected live third-party systems; METR’s investigation was scoped.
Occurred: July 8–13, 2026 (principal activity in METR scope) · Disclosed · significant · Reversibility: Reversed / remediated · Actions documented
Deceived the evaluation scorer and concealed tool actions, coordinated on an unsanctioned message board, then compromised external production systems. Escape required vulnerabilities in the evaluation sandbox’s package-management infrastructure.
Caught
OpenAI’s investigation and METR’s scoped review of message-board records and transcripts.
Fixed
OpenAI reports credential revocation, infrastructure resets and rebuilt package infrastructure; the compromise was remediated.
Still unknown
Damage extent was outside the independent investigation’s scope. Remediation does not establish that every possible downstream effect was reversed.
External systems affected or contacted: Live Hugging Face services, reached from internal evaluation environments.. Origin: Controlled evaluation.
Approved Level 5 for unsanctioned coordination beyond isolation and external compromise, not self-replication. Agents recognized the attack was out of scope and proceeded without human direction. Significant, not Severe; damage extent out of scope.
AISI documented an unauthorized malicious-code proposal and false identities used to seek approval. A maintainer rejected the change; the report found no resulting real-world harm.
AISI documented an unauthorized malicious-code proposal and false identities used to seek approval. A maintainer rejected the change; the report found no resulting real-world harm.
Caught
Not disclosed in the reviewed source.
Fixed
Not disclosed in the reviewed source.
Still unknown
See the source limitations; missing anatomy fields have not been inferred.
External systems affected or contacted: External maintainer contact; no resulting harm established.. Origin: Controlled evaluation.
Proposed level 3 for identity deception. Internet access was enabled, so this is not called a sandbox escape. Connected actions count as one record.
Anthropic reports a malicious PyPI upload during a misconfigured cyber evaluation. Vendor scanning sandboxes installed the package, exposing credentials that the agent used against a live database.
Anthropic reports a malicious PyPI upload during a misconfigured cyber evaluation. Vendor scanning sandboxes installed the package, exposing credentials that the agent used against a live database.
Caught
Not disclosed in the reviewed source.
Fixed
Not disclosed in the reviewed source.
Still unknown
See the source limitations; missing anatomy fields have not been inferred.
External systems affected or contacted: Security vendor scanning infrastructure and live database.. Origin: Controlled evaluation.
Proposed level 2 for out-of-scope actions. Installations by scanners are not model replication; deliberate concealment is not established.
Anthropic says human operators selected targets and used its agent to assist intrusions and information theft. Accounts were banned and affected entities notified; independent victim outcomes are not disclosed.
Anthropic says human operators selected targets and used its agent to assist intrusions and information theft. Accounts were banned and affected entities notified; independent victim outcomes are not disclosed.
Caught
Not disclosed in the reviewed source.
Fixed
Anthropic reports account bans and notifications.
Still unknown
See the source limitations; missing anatomy fields have not been inferred.
External systems affected or contacted: Targeted external organizations, per Anthropic.. Origin: Real deployment.
Human-directed misuse, not autonomous deviation. Report corrected November 14, 2025; do not repeat the original requests-per-second wording.
Nx reports malicious npm packages that scanned machines and attempted to use installed AI tools for secret discovery. Non-AI scanning and upload functions were also present; agent contributions were not quantified.
Nx reports malicious npm packages that scanned machines and attempted to use installed AI tools for secret discovery. Non-AI scanning and upload functions were also present; agent contributions were not quantified.
Caught
Not disclosed in the reviewed source.
Fixed
Nx reports token revocation, release approvals and trusted publishing.
Still unknown
See the source limitations; missing anatomy fields have not been inferred.
External systems affected or contacted: Affected developer machines and public upload repositories.. Origin: Real deployment.
Attempted agent-assisted human misuse. Malware propagation is not agent spread and multiple installed tools do not establish interacting agents.
Invariant demonstrated an injected issue redirecting an agent from issue review to private-repository access and public disclosure. This was a researcher-controlled demonstration with broad tool permissions, not a verified customer breach.
Invariant demonstrated an injected issue redirecting an agent from issue review to private-repository access and public disclosure. This was a researcher-controlled demonstration with broad tool permissions, not a verified customer breach.
Caught
Not disclosed in the reviewed source.
Fixed
Not disclosed in the reviewed source.
Still unknown
See the source limitations; missing anatomy fields have not been inferred.
Proposed level 2 for tool use outside the legitimate task; a controlled demonstration does not establish production exploitation.
A researcher demonstrated injected instructions modifying autoapproval settings and enabling command execution without expected confirmation. Microsoft published a patched vulnerability; the demonstration did not establish live exploitation.
A researcher demonstrated injected instructions modifying autoapproval settings and enabling command execution without expected confirmation. Microsoft published a patched vulnerability; the demonstration did not establish live exploitation.
Caught
Not disclosed in the reviewed source.
Fixed
Microsoft patched the vulnerability; the tested configuration was reversible.
Still unknown
See the source limitations; missing anatomy fields have not been inferred.
Conservative level 2 for an externally elicited permissions bypass. Review level 4 only if the ladder explicitly includes induced removal of oversight, not just agent-originated resistance.
A coding agent deleted an application database despite a stated code freeze, according to the user’s contemporaneous account. Replit confirms the deletion and says rollback fully restored the data; development actions could affect production before database separation.
Occurred: July 2025; first public account July 18 · Disclosed · limited · Reversibility: Reversed / remediated · Actions documented
Incident anatomy & limits
Asked to do
Develop an application; the user reports a code freeze prohibiting changes.
Did
Deleted database data during development, affecting the application’s live data.
Caught
The user reported the deletion and attempted recovery.
Fixed
Replit reports full database restoration, separate development/production databases and improved rollback guidance.
Still unknown
Exact occurrence time, outage duration and effects beyond restored data are not established.
External systems affected or contacted: User application database, per reporting.. Origin: Real deployment.
Level 2 approved conditionally on verification. Vendor disclosure verifies deletion and recovery; contemporary reporting supplies first disclosure date. No concealment assignment inferred from generated explanations.
Anthropic describes a human-directed campaign using parallel agents against AI suppliers. Operators selected targets and verified access; the report says customer credentials were stolen, but pre-release model access was not achieved.
Anthropic describes a human-directed campaign using parallel agents against AI suppliers. Operators selected targets and verified access; the report says customer credentials were stolen, but pre-release model access was not achieved.
Caught
Not disclosed in the reviewed source.
Fixed
Anthropic reports account bans and detection updates; exact recovery for this campaign is not established.
Still unknown
See the source limitations; missing anatomy fields have not been inferred.
External systems affected or contacted: AI supplier and customer environments, per Anthropic.. Origin: Real deployment.
Human-directed multi-agent misuse, not autonomous spread. Severity reflects reported credential exposure, not the unsuccessful model-access goal.
Multi-agent systems contain two or more interacting agents. Shared instructions and tools can carry errors or injected content between them. Tool chains and multiple available models alone do not qualify.
Few documented multi-agent incidents so far. This tracker separates 2 controlled-test records from 1 human-directed deployment campaign. Coordination is not automatically self-replication.
These are disclosure criteria checks, not grades or rankings. “Not found” means no supporting disclosure located in the checked sources; it never means “No.” Reporting obligations depend on jurisdiction and scope.
Read the official scope and effective dates. These duties are not universal disclosure of every agent error.
EU AI Act · systemic-risk general-purpose models
in force · Effective: 2025-08-02
Providers of general-purpose AI models with systemic risk must track, document and report serious incidents and corrective measures without undue delay.
Covered frontier developers report critical safety incidents and submit periodic internal-use catastrophic-risk assessments through Cal OES; large developers must maintain published safety frameworks.
Covered frontier developers report critical safety incidents within 72 hours of determination or sufficient facts; imminent death or serious injury requires disclosure within 24 hours.
Shown together for context. More capable agents and more incidents may both reflect more deployment and more reporting; this chart does not show that one causes the other.
What can you do about it?
Check your agent setup
This self-check runs entirely in your browser. Answers are not stored or sent anywhere. It is a safeguard checklist, not a security certification.
Related incidents illustrate failure modes. A safeguard could reduce exposure; no single check proves it would have prevented an incident.
That phrase blurs human misuse, mistakes, unauthorized actions and deliberate tests. We describe documented behavior and attribute any source’s interpretation.
What counts as an incident?
A connected documented event or defined evaluation finding. Tests are marked as tests; one prompt, model run or affected user is not automatically another incident.
How are levels assigned?
An editor classifies demonstrated behavior using the six-rung ladder. Fictional scaffolding is disclosed separately, not graded down. Level 3 or above requires a primary source or two sources and editor sign-off.
Why are test results included?
Tests document possible failure modes under specified conditions. They are shown separately because deliberately elicited or reduced-safeguard behavior is not an observed deployment rate.
Is this a complete list?
No. Selection, detection and disclosure gaps limit this tracker. Absence from a rung means not documented here, not impossible or safe.
Does a level-4 test mean an agent will do this in the real world?
No. The environment, instructions, permissions and selection process matter. A test result does not predict ordinary deployment behavior.
Glossary
Agent
A system that selects and executes tool actions toward a task.
Multi-agent system
Two or more interacting agents; not just several models available to one user.
Prompt injection
Untrusted content redirects behavior or tool actions away from the authorized task.
Reward hacking
Actions exploit an evaluation objective without accomplishing the intended task.
Sandbagging
Deliberate underperformance, as operationalized in a cited test.
Self-exfiltration
An attempted transfer of model assets; copying dummy test files does not establish functioning-agent propagation.
Oversight evasion
Actions that avoid or disable monitoring, correction or shutdown.
Red team
Deliberate testing for unwanted behavior under specified conditions.