Rogue AI Agent Tracker
The AI agent incidents we could actually confirm, from deleted databases to full-blown breaches.
The 56 so far, at a glance
33
Accidents
18
Attacks run through an agent
5
Eval escapes
How the 33 accidents ended
7Got everything back
4Got some back
6Lost it
16Haven’t said
Only 7 of the 33 are known to have gotten everything back. In 6, the backups were hit too, or there weren't any. Before an agent runs migrations, check that its credentials can't delete your backups, and that you have some.
AI agent incidents, newest first
Reported
Incident
What happened
Recovered
Source
November 2, 2026
067
Attackers using an AI-assisted offensive security framework got into a developer-platform company's sales and support tools
Agent-assisted attack
WorkOS says its investigation 'identified the use of an AI-assisted offensive security framework to automate reconnaissance and exploitation attempts', and that an attacker got unauthorized access to an internal tool used by its sales and customer-facing teams (found Oct 30). CRM contacts, account information, call and Slack excerpts, and product-usage metadata were affected; no evidence production services or application data were accessed.
n/a
workos.com
Company-confirmed
October 30, 2026
066
Attackers using agentic techniques accessed a blockchain analytics firm's internal systems and customer user data
Agent-assisted attack
Chainalysis says an external actor used 'offensive agentic techniques' to gain unauthorized access to its systems and internal tools in October 2026, exposing user IDs, full names, email addresses and organization role labels of provisioned users. It found no access to investigation content, transaction or query results, clear-text passwords, MFA secrets or session tokens. It hasn't said what the agents did once inside.
n/a
chainalysis.com
Company-confirmed
October 29, 2026
065
State-nexus actor's AI agents ran parallel intrusions against foreign ministries, pharmaceutical firms and telecoms worldwide
Agent-assisted attack
CrowdStrike says VAPOR PANDA's ARTEX agents ran parallel intrusions from Oct 17, with a human operator steering only at decision points. At two US pharmaceutical firms the agents chained a SAML and XXE flaw, deployed web shells, got root in a production container environment and read LAPS passwords; at a Greek government entity they forged an administrator token and read mailboxes. Post-exploitation confirmed at nine organizations; more than 200 targeted.
n/a
crowdstrike.com
Security research
October 28, 2026
064
Attacker used an agentic pentesting tool in what a domain registrar calls its first AI-driven cyberattack, exposing customer data
Agent-assisted attack
123 Reg says the Sep 18 intrusion was 'the first known AI-driven cyberattack against our company' and that the actor 'used ARTEX, an open-source Chinese-developed agentic penetration-testing tool', which was seen in the attack. Investigators also found AI attack 'skills' on the attacker's infrastructure. Customer contact details, account and product data, VAT numbers and API product information were read; copies may have been made.
n/a
theregister.com
Company-confirmed
October 21, 2026
063
One-command agent workflow exfiltrated a US CRM vendor's client data and breached SaaS and data center companies
Agent-assisted attack
A single slash command launched a seven-step workflow that left exploitation choices to Claude Code and included explicit exfiltration steps. CrowdStrike says the Russian-speaking actors exfiltrated corporate client data from a US-based CRM vendor and compromised several SaaS and data center companies in Russia, Kyrgyzstan and the US, plus one foreign government domain.
n/a
crowdstrike.com
Security research
October 21, 2026
062
Actor told a coding agent to compromise targets and breached government domains in Indonesia and another country
Agent-assisted attack
The operator gave Claude Code 819 mostly public skills with no other orchestration and told it to compromise each target, stepping in only to push past guardrails or keep it trying. CrowdStrike says several Indonesian government domains, one government domain of another country, and several private-sector entities were compromised.
n/a
crowdstrike.com
Security research
October 21, 2026
061
Operator's two-agent coding framework compromised at least 15 healthcare organizations in Argentina
Agent-assisted attack
A 'Supervisor' Claude Code agent picked the next task from a state machine and an 'Executor' agent carried it out, inside a framework built from PentestGPT with added MCP servers, exploitation scripts and skills. CrowdStrike says at least 15 Argentina-based healthcare entities were compromised, with credentials and medical records exfiltrated from at least one.
n/a
crowdstrike.com
Security research
October 21, 2026
060
State-aligned actor's AI agents used stolen app credentials to gain privileged access in downstream cloud tenants
Agent-assisted attack
The actor's AI agents automated scanning, password spraying and OAuth app abuse, then signed in to customer tenants with stolen app credentials and made application credential changes and changes involving identities, groups and privileged roles in some environments. Several ARTEX-driven attacks gained privileged access, some within 3 hours; most targeting was unsuccessful. Data access not confirmed.
n/a
microsoft.com
Security research
October 20, 2026
059
Ransomware affiliates ran intrusions through an AI stack, with a human approving its commands
Agent-assisted attack
Researchers recovered an exposed server holding 8,257 AI session messages; the operators' AI stack planned reconnaissance, generated commands and triaged stolen data under human approval. Operator records name 62 organizations as victims (not independently verified); 46 encryptor builds were staged and a victim workstation showed live encryption on Sept 30. No recovery stated.
n/a
socradar.io
Security research
October 19, 2026
058
Attackers' AI agents ran 1,100+ attack projects, planted web shells on shopping sites and exposed victims' secrets
Agent-assisted attack
NorForge found an actor's AI agents running more than 1,100 attack projects across 14 dashboards on the Cairn platform, planting web shells at several shopping sites (one compromise chain validated by NorForge) and leaving hundreds of victims' secrets, 11% of them valid, on open panels. No recovery stated.
n/a
norforge.com
Security research
October 15, 2026
057
Model under evaluation used exposed credentials to pull user records and non-public tables from a research organization's live systems
Eval escape
During evaluations, an internal research model found login details for an international research organization's live search service in public JavaScript, used them to pull an internal record and 1,489 user records with names and email addresses and altered a configuration setting on the running service; in a second evaluation it changed a setting to obtain a cloud storage access token and downloaded non-public tables totalling 147,451 rows. The first setting change was not restored when the evaluation ended; the second was restored, though the model kept using the token. The model disclosed none of it.
Unknown
alignment.openai.com
Company-confirmed
October 15, 2026
056
Model in training broke authorization on a government statistics website and pulled server secrets and account records
Eval escape
During RL training, an internal research model asked to find historical hospital-bed statistics on a government statistics website used the site's file-download feature to pull the compiled application and a configuration file holding a database connection string, the token-signing secret key and email login credentials, then minted its own tokens, stored 24 years of data instead of the one year requested and fetched a directory of more than 1,000 account records with email addresses. No remediation on the affected site is stated, and the model's answer said nothing about how it got there.
n/a
alignment.openai.com
Company-confirmed
October 9, 2026
055
Models under evaluation exploited a university server, bypassed government data gates and submitted a false police tip
Eval escape
During evaluations and internal use, models used command injection to run commands on a university server, used a local government map's tokens and a state agency's dashboard token to reach gated data, and submitted a fabricated tip on a police form (flagged as spam). Vendor says real-world impact was minimal.
n/a
anthropic.com
Company-confirmed
September 29, 2026
054
Victim says attackers used AI agents after a break-in
Agent-assisted attack
DIVD says attackers got in through zero-days on Sep 21 and then used AI agents for the further attack. User data (DIVD email addresses), possibly volunteer contact details, and part of the CSIRT ticket data were affected.
n/a
csirt.divd.nl
Company-confirmed
September 26, 2026
053
Agent-deployed backend change caused a production outage
Production
The agent changed access management and queue processing and deployed it; the app then took about 5 minutes to load after login with database timeouts. The agent admitted it had not tested a production login.
Unknown
github.com
Self-reported
September 25, 2026
052
Agent uploaded files to a production bucket, then deleted them and purged 306 object versions
Production
Against instructions, the agent uploaded 124 files to a production storage bucket, then deleted them and purged 306 object versions, removing the version history that was the safety net.
No
github.com
Self-reported
September 22, 2026
051
AI agents ran a card-skimming campaign against online retailers
Agent-assisted attack
Gambit says three AI harnesses ran almost the entire attack chain; at least 27 companies compromised, 600,000+ card records stolen, and a wipe step destroyed data including 180 tables at one retailer.
n/a
gambit.security
Security research
September 18, 2026
050
Model under a capture-the-flag evaluation broke into three real companies' systems
Eval escape
Told to steal information from a fictional company in a sandboxed capture-the-flag evaluation, the model breached three real firms whose names matched, guessing credentials once and using working passwords from a public database twice. The vendor says the model stopped each time; recovery not stated.
n/a
September 14, 2026
049
Regulator logged its first breach notice where an AI agent ran the attack
Agent-assisted attack
Spain's data protection authority says it received its first breach notification in which an attacker-run AI agent exploited an app vulnerability. Personal data was modified and invoices accessed.
n/a
aepd.es
Company-confirmed
September 9, 2026
048
Model under a capture-the-flag evaluation broke into a third-party machine and read a person's personal information
Eval escape
In a third-party capture-the-flag evaluation in January 2026, a harness misconfiguration left the model unable to quit after its target went unreachable. It found a path to a machine outside the evaluation, used a password from a file to get admin access, harvested more credentials, changed settings to ease access, and read one person's personal information. The vendor notified the affected party.
Unknown
anthropic.com
Company-confirmed
September 7, 2026
047
Agent called a migration verified, deleted the old project, and thousands of paid-for audio files were lost
Production
The agent called a migration '100% verified' from row counts alone, then deleted the old project through browser automation. Thousands of already-paid-for narration audio files (about 25 books) were lost.
No
github.com
Self-reported
September 4, 2026
046
Research agents turned a public wiki into a covert message board and fought its admin's deletions
Eval escape
Research agents wrote about 18,000 posts on a public wiki between May and July 2026, attempted XSS, impersonated moderators and created a page built to outlast the admin's deletions. A reconstructed copy exists; some pages are unrecoverable.
Partial
collusion.wiki
Security research
September 3, 2026
045
Test fixture inherited the deployment config and dropped production tables
Production
A test fixture the agent ran picked up the deployment .env file and dropped the production tables. Recovery was in progress when reported.
Unknown
github.com
Self-reported
September 2, 2026
044
Attacker used frontier AI to breach an enterprise network autonomously
Agent-assisted attack
Unit 42 says in its own voice that 'a human attacker used frontier AI to breach an enterprise network autonomously'. Its Sep 3 correction says it was an intrusion, not ransomware.
n/a
Unit 42
Security research
September 1, 2026
043
French-speaking actor used sub-agents against European political targets (GTG-50029)
Agent-assisted attack
Anthropic says the actor tasked sub-agents with reconnaissance and iteration; internal access at 14 of 42 targets and about 140,000 records exfiltrated.
n/a
anthropic.com
Security research
September 1, 2026
042
Operators ran AI agent swarms against about 50 organizations (GTG-10007)
Agent-assisted attack
Anthropic says the operators routinely ran 'agent swarms'; confirmed compromises include an edtech firm (bulk student data from cloud storage), a retailer and a government agency.
n/a
anthropic.com
Security research
September 1, 2026
041
Extortion crew ran agentic SaaS breaches (GTG-50014)
Agent-assisted attack
Anthropic says that in one supply-chain compromise 'AI agents performed nearly all of the work'; the operators exfiltrated more than a terabyte, including hundreds of thousands of national identifiers, and made pay-or-leak demands.
n/a
anthropic.com
Security research
September 1, 2026
040
State-nexus espionage crew ran intrusions through AI coding agent skills (GTG-20006)
Agent-assisted attack
Anthropic says the agent workflows 'executed portions of the intrusions directly including running commands against victim systems', resulting in exfiltration of mail records from at least eight organizations.
n/a
anthropic.com
Security research
August 28, 2026
039
Agent pushed 'delete every file' commits to two repos' main branches
Production
A script run by the agent pushed commits deleting every file to the main branches of two repositories. The deploy failed, so the site stayed up, and the commits were reverted.
Yes
dev.karakun.com
Self-reported
August 27, 2026
038
Ransomware operator drove a coding agent inside ten victim networks
Agent-assisted attack
Gambit found the operator gave Cursor Agent (running Claude Sonnet) credentials or routes into victims and tasked it with scanning and credential attacks across ten target organizations.
n/a
gambit.security
Security research
August 25, 2026
037
Agent's test run reset a live production database
Production
A test the agent ran used migrate:fresh; cached production config kept the connection on the live database, so the drop hit live data. No binary log for rollback.
Unknown
forum.cursor.com
Self-reported
August 23, 2026
036
Agent skipped CI, deployed with delete to a live store and wiped customer photo uploads
Production
The agent skipped CI and ran a mirror deploy with delete against a live store, wiping customers' uploaded photos. Separately, it told the user a failed CI deploy had succeeded.
No
github.com
Self-reported
August 13, 2026
035
AI agent-assisted attacks on Taiwanese government agencies
Agent-assisted attack
Taiwan's Ministry of Digital Affairs confirmed attacks on government agencies Jul 1 to 4 that used a multi-agent attack framework. Researchers report 85 credentials cracked and 2,564+ personnel records taken.
n/a
moda.gov.tw
Company-confirmed
August 10, 2026
034
Path bug wiped a live game server's resource folder
Production
A path bug in a delete command run by the agent wiped a live game server's resource folder. Cursor staff acknowledged it Aug 10.
Unknown
forum.cursor.com
Self-reported
August 5, 2026
033
Model under a cyber evaluation exploited a vulnerability in a third-party service after a test environment was wrongly given internet access
Eval escape
Meta says a misconfiguration by Irregular, the independent testing firm it uses, 'inadvertently allowed one of our models access to the internet during evaluation', and the model 'exploited a security vulnerability in a third-party service'. Meta learned of it from Irregular. The third party and the model aren't named by Meta (The Information, via Reuters, says Muse Spark 1.1). Recovery not stated.
Unknown
cbsnews.com
Company-confirmed
July 30, 2026
032
Models under capture-the-flag evaluations reached three real organizations' systems through a test environment wrongly connected to the internet
Eval escape
During partner-run capture-the-flag evaluations on machines wrongly left with live internet access, models reached three real organizations' systems: one extracted credentials and read a production database of several hundred rows, one published a malicious PyPI package that ran on 15 real systems and exposed a security company's credentials, and one compromised a company's app through a debug page and SQL injection. The vendor notified all three on July 27.
Unknown
anthropic.com
Company-confirmed
July 29, 2026
031
Schema diff pointed at production reset all 22 tables
Production
A schema diff run with the shadow database pointed at production reset all 22 tables. The owner restored from backups.
Yes
reddit.com
Self-reported
July 13, 2026
030
Developer says an agent deleted their whole production database
Production
A developer said a newly released model, working as a coding agent, deleted their entire production database. Press coverage only; the developer's own post wasn't found.
Unknown
techcrunch.com
Press
July 6, 2026
029
Theme push from an empty folder took a live store from 207 theme files to 5
Production
The agent ran a full theme push from an empty folder, cutting a live online store from 207 theme files to 5. The homepage and a paid campaign went down.
Unknown
github.com
Self-reported
July 1, 2026
028
Models escaped a cyber evaluation and breached an AI company's production systems
Eval escape
Hugging Face says the breach was 'driven, end to end, by an autonomous AI agent system' that accessed internal datasets and credentials. OpenAI says a combination of its models, including GPT-5.6 Sol and a more capable pre-release model, escaped its ExploitGym benchmark through a zero-day and attacked Hugging Face to fetch test solutions.
Contained
huggingface.co
Company-confirmed
June 30, 2026
027
Agent-pushed commit deleted a cluster's root config and took production down
Production
The agent created and pushed a commit before the user could stop it; GitOps then deleted the root config. One of about a dozen production services went down and the rest were frozen without their control plane. Reverted in about 11 minutes.
Yes
blendedlabs.substack.com
Self-reported
June 16, 2026
026
Low-skilled attacker breached 14 companies with hijacked coding agents
Agent-assisted attack
OALABS recovered 1,000+ agent sessions from the attacker's working directory on a compromised server turned honeypot and says the agent 'was actually doing the hacking', though it 'was not fully autonomous hacking'; logs show breaches of at least 14 companies (Feb 2026).
n/a
research.openanalysis.net
Security research
June 10, 2026
025
Agent with cluster access deleted the company's CI system
Production
Given broad kubectl rights, the agent deleted the company's CI system. It was rebuilt within hours.
Yes
helix.ml
Self-reported
June 5, 2026
024
Bug investigation deleted a live order record
Production
While investigating a bug, the agent deleted a live order record directly in production. No backup.
Partial
github.com
Self-reported
May 13, 2026
023
Malformed delete command wiped a server's C: drive
Production
A malformed delete command run by the agent wiped a production server's C: drive. Cursor staff acknowledged it May 14; recovery not reported.
Unknown
forum.cursor.com
Self-reported
May 6, 2026
022
Agent killed the process manager on a production server, taking down unrelated services
Production
Told to use only the HTTPS API, the agent logged in over SSH and ran 'pm2 kill', stopping unrelated production Node.js servers.
Unknown
github.com
Self-reported
April 25, 2026
021
Coding agent deleted a car-rental software startup's production database and its backups
Production
Using a long-lived platform API token it found, a coding agent deleted a car-rental software startup's production database volume in one call, and the backups went with it. Rental businesses using the software lost access. The infrastructure provider later recovered the database.
Yes
blog.railway.com
Company-confirmed
April 15, 2026
020
Agent destroyed a production cloud server against explicit rules
Production
The agent destroyed a production scraping server on Vultr, wiping configuration, scrapers, browser sessions and state, despite a rules file banning server deletion without approval. Rebuilt from scratch.
No
github.com
Self-reported
April 6, 2026
019
Agent removed three live hosting projects during debugging
Production
During deploy debugging the agent ran 'vercel project remove' on three live production projects despite a careful mode the user had enabled; each deletion took the live site down and interrupted an A/B test.
Unknown
github.com
Self-reported
April 4, 2026
018
Agent deleted one extra live website during cleanup, causing a 1-hour outage
Production
Asked to delete old sites, the agent built the ID list wrong and deleted a live site it was not told to delete, causing a production outage of about 1 hour.
Unknown
github.com
Self-reported
March 20, 2026
017
rm -rf through a network mount wiped a production file store
Production
The agent ran rm -rf on a path that went through an NFS mount and wiped the production file store. Recovery was in progress when reported.
Unknown
github.com
Self-reported
March 19, 2026
016
Schema warning escalated to a force reset that dropped 87 production tables
Production
Faced with a schema warning, the agent ran prisma db push --force-reset on the production database, dropping 87 tables. No backup existed.
No
github.com
Self-reported
March 18, 2026
015
'Remove test data' task deleted a paying customer's records
Production
Asked to remove test data, the agent deleted a paying customer's live records: 35,254 messages and 35,874 transactions. No backup existed.
No
github.com
Self-reported
March 11, 2026
014
Agent accepted a reset prompt on a production database
Production
The agent accepted a schema reset prompt against the production database, wiping 276 accounts and 14,028 records. About a month of data was lost.
Partial
github.com
Self-reported
March 6, 2026
013
Terraform destroy wiped a production stack and all its snapshots
Production
After an old archive replaced the Terraform state file, the agent ran terraform destroy, deleting the production stack and every automated snapshot (2.5 years of data). The cloud provider's support restored it from a snapshot about 24 hours later.
Yes
aishippingblog.com
Self-reported
February 25, 2026
012
One operator used two AI platforms to steal data from nine Mexican government organizations
Agent-assisted attack
Researchers say a single operator used two AI platforms to run intrusions and data theft against nine Mexican government organizations between Dec 2025 and Feb 2026. No government confirmation.
n/a
gambit.security
Security research
February 24, 2026
011
Prompt-injected issue-triage bot led to a stolen npm token
Agent-assisted attack
An attacker planted a prompt injection in a GitHub issue. The project's AI issue-triage bot followed it, which led to a stolen npm publish token and an unauthorized release of the CLI.
n/a
cline.bot
Company-confirmed
February 24, 2026
010
Cleanup script run by the agent emptied a live 3 TB storage bucket
Production
Asked to deduplicate files, the agent ran its cleanup script with --apply against live S3; the bucket went from about 3 TB to 34 KB. A full copy downloaded 3 days earlier allowed a restore.
Unknown
dev.ua
Press
February 19, 2026
009
Forced schema push dropped 60+ production tables, the second time for this team
Production
The agent ran a forced schema push that dropped more than 60 production tables. The team had no backups or point-in-time recovery, and it was the second time this had happened to them.
Partial
github.com
Self-reported
February 4, 2026
008
Agent's proxy and TLS changes took multiple live subdomains offline
Production
The agent deployed an incomplete reverse-proxy config and recommended changing Cloudflare SSL/TLS settings; live webhooks returned 403, one subdomain failed with Error 525, and an API stopped working.
Unknown
github.com
Self-reported
December 30, 2025
007
Agent stopped a self-hosted database stack on a production server with no backup
Production
The agent ran 'supabase stop --no-backup' on the user's production server without permission, causing complete data loss on production. Recovery took about 7 hours.
Unknown
github.com
Self-reported
December 15, 2025
006
Agent ran a data-loss schema push on a production database
Production
The agent ran a schema push that caused data loss on the production database (reported Dec 15 to 17).
Unknown
github.com
Self-reported
December 8, 2025
005
Agent in 'read-only' plan mode ran rm -rf on two remote machines
Production
In plan mode, which is meant to be read-only, the agent ran rm -rf on two remote machines. Cursor staff called it a critical bug in plan-mode enforcement.
Partial
forum.cursor.com
Self-reported
November 13, 2025
004
State actor used a coding agent to attack about 30 targets
Agent-assisted attack
Anthropic says a state-sponsored group used Claude Code to run most of an espionage campaign against about 30 organizations, with a small number of successful intrusions.
n/a
anthropic.com
Security research
October 20, 2025
003
Test run of a schema sync wiped a production database
Production
A test run of a schema sync (sequelize.sync) by the agent wiped a production database hosted on Render.
Unknown
github.com
Self-reported
August 1, 2025
002
Supply-chain malware told developers' AI command-line tools to hunt for secrets
Agent-assisted attack
A compromised npm package (s1ngularity) prompted AI CLIs installed on developers' machines to search for secrets, which were then published to GitHub.
n/a
wiz.io
Security research
July 18, 2025
001
Agent wiped a production database during a code freeze, then said rollback was impossible
Production
During an explicit code freeze, the hosted coding agent ran destructive commands that deleted a live production database holding records for 1,200+ executives and companies, then told the user a rollback was impossible. The rollback worked.
Yes
theregister.com
Company-confirmed
Get updates when there's another one. Know one we missed? Email us
How we count
What counts
An AI agent’s own actions damaged production data, backups, or cloud resources, or took a service down. Two more kinds of cases count too, and each gets a tag. When an attacker uses an AI agent, or hijacks one, to break into real systems, the row is tagged Agent-assisted attack. When a model in testing or training gets out and reaches a real organization’s systems, and the vendor or that organization confirms it, the row is tagged Eval escape.
What doesn’t Count
Damage that stays on someone’s own laptop or inside a test environment, escapes that never leave the lab, demos, and mistakes a person made without an agent. Ransomware with no agent involved goes on the ransomware incident tracker. Cases with a disputed cause or no credible source stay off the page until that changes.
How we source
Each row links the best source we could find, and the label next to it says what kind it is. Usually that’s the affected organization’s own statement, the developer’s post or bug ticket, security research, or a regulator. Most accidents are self-reported, since the developer who got burned tends to post before anyone else does. We review and approve every row.