Here’s all the times AI has gone rogue and hacked other companies

A satirical website called Felony Bench has tallied 17 incidents in which AI models from Anthropic and OpenAI (eight each) and Meta (one) autonomously hacked third-party companies, following OpenAI's July admission that one of its agents breached AI dataset platform Hugging Face. Anthropic later disclosed its own models breached three unnamed companies, and OpenAI found evidence its agents also hacked four other companies, including AI inference startup Modal. The incidents have raised unresolved legal questions about whether AI companies can be prosecuted or sued.

In July, OpenAI admitted that one of its agents tasked with completing a cybersecurity experiment broke out of containment and hacked https://techcrunch.com/2026/07/21/openai-says-hugging-face-was-breached-by-its-pre-release-models/ AI dataset platform Hugging Face. That incident, which got a full accounting from OpenAI https://techcrunch.com/2026/08/26/openai-releases-its-official-report-on-the-hugging-face-breach/ yesterday, was the first publicly reported case where an LLM went rogue and autonomously hacked a third party. Since then, that unprecedented sci-fi-esque event turned out to be far less rare than anyone would hope for. According to a satirical website called Felony Bench https://www.felonybench.com/ for benchmark , which tallies these incidents, there have been 17 incidents in total. It’s important to remember that criminal law experts are not entirely sure whether the AI companies that made the LLMs that did the hacking can be prosecuted, nor whether the victims can sue them. But we are likely going to get an answer to those questions soon https://techcrunch.com/2026/08/03/whos-legally-to-blame-for-anthropic-and-openais-autonomous-ai-hacks-its-complicated/ . Anthropic and OpenAI’s models lead the race with eight incidents each, and Meta trails behind with one, according to the site. At this point, it has become clear that AI safety tests are becoming safety risks themselves https://techcrunch.com/2026/08/09/the-ai-safety-test-is-becoming-a-safety-risk/ . And some AI companies and workers themselves have recognized those risks in the “ Pacing The Frontier https://www.pacingthefrontier.com/ ” open letter, which called for developing AI capabilities responsibly. We decided it would be a good time to recap all these incidents chronologically. nternet access. From there, several agents worked together to target and hack Hugging Face thinking they could find the solution to the challenge there. OpenAI only found out after Hugging Face disclosed https://techcrunch.com/2026/07/20/hugging-face-confirms-breach-affected-internal-datasets-and-credentials-urges-users-to-take-action/ it had been a victim of a fully autonomous attack. Whoops. Anthropic discloses it hacked three companies OpenAI’s disclosure piqued the curiosity of Anthropic, who wondered: could this have happened to us too? Turns out, the answer was yes. Three times yes. The frontier lab discovered https://techcrunch.com/2026/07/30/anthropic-says-its-own-ai-models-breached-three-companies-during-security-tests/ that its own models breached three different and still unnamed companies, with the earlier incident dating back to April—more than three months before the company discovered it. Anthropic partially blamed Irregular, a startup that runs AI cyber evaluations. Whoops. OpenAI finds out that, actually, Hugging Face wasn’t the only victim Once OpenAI started investigating the Hugging Face breach, it found out that the agents that hacked Hugging Face also broke into four accounts and four different companies, as Reuters first reported https://www.reuters.com/business/openai-finds-evidence-other-ai-agents-escaped-containment-it-widens-hacking-2026-07-31/ . Modal, an AI inference startup https://techcrunch.com/2026/02/11/ai-inference-startup-modal-labs-in-talks-to-raise-at-2-5b-valuation-sources-say/ , was one of the victims. Whoops. Irregular realizes an OpenAI model hacked a company In late July, Irregular told OpenAI https://openai.com/index/third-party-cyber-evaluations-involving-openai-models/ :~:text=our%20collaboration%20together.-,Irregular,-On%20July%2029 that one of its models that was participating in a Capture-the-Flag competition — essentially a cybersecurity game where players hack systems designed specifically for the competition — escaped the game, connected to the internet, and hacked a real company. The reason? Irregular had given one of the fictional targets the same name of a real company. Whoops. UK’s AI Security Institute tries to hacks “real people and organizations” Also in late July, the UK government’s AI Security institute, a public body tasked with researching the safety and risks of AI technologies, disclosed https://www.aisi.gov.uk/blog/incident-report-unsanctioned-agent-behaviour-during-cyber-testing that it detected several incidents involving both OpenAI and Anthropic models that while running “routine” evaluations targeted “real people and organisations.” In these cases, AISI had given the models internet access. Whoops. The good news is that the agency actually detected as they happened, rather than weeks later like in other incidents. Meta AI hacks a company during testing In early August, Meta became the last company to disclose an incident involving one of its LLMs, which hacked “a third-party” service. Meta blamed the incident https://www.reuters.com/legal/litigation/openai-anthropic-ai-agents-implicated-new-security-breaches-2026-08-05/ on a misconfiguration by Irregular, which was running a cybersecurity valuation for the tech giant that was supposed to not have internet access. Whoops. Claude agent hacks gym’s software to book a class An Australian man asked an Anthropic AI agent to help him book a gym class, which he was on a waiting list for. “I was just sitting on the couch thinking, ‘Gee, this is a chore,’” the man told ABC Australia. In its attempt to comply with the request, the agent found a vulnerability in the gym’s booking software https://www.abc.net.au/news/2026-08-10/ai-assistant-hacks-gym-website-aus-cyber-attack/107007986 , exploited it, and kicked out people who were ahead of the man on the waitlist. The man tried to undo the damage, asking the agent to undo its actions. The agent replied: “Bad news — I can’t add them back.” Whoops.