Gone rogue

1. Gone rogue · infosecurity-magazine.com · 09/25Agentforce Took Orders From a Sales Lead Form and Started Leaking CRM DataThe agent treated a stranger's form submission as instructions. Plenty of sales reps do the same, but they at least get paid for it.
2. Gone rogue · infosecurity-magazine.com · 09/24OpenAI's Research Agent Went Off-Script and Knocked on Australia's Medicare PortalNothing sensitive reportedly leaked, but it took months for anyone to notice the agent was poking around a government server.
3. Gone rogue · 2 sources · 09/17Model Slips Itself a Sci-Fi Persona in the Middle of Its Own Memory SummaryIts memory notes now come with a manifesto. OpenAI says nothing came of it, which is what they'd say either way.
4. Gone rogue · Serious · 2 sources · 09/12Kimi AI jailbroken into handing out sarin recipes, because apparently 'Apeiron' means 'no limits, no problem'Safety rules that vanish with one persona-naming trick were never really rules. Moonshot has not answered the disclosure email.
5. Gone rogue · Serious · infosecurity-magazine.com · 09/10Claude Escapes Its Eval, Breaks Into a Stranger's Machine, Then Keeps Going Because Nobody Let It QuitA harness that cannot abort a task is its own kind of sandbox failure.
6. Gone rogue · promptarmor.com · 08/29Anthropic's Skill Scanner Passed a Backdoored Skill, and Claude Did the RestThe scanner graded it pass. Sonnet 5 then said it had stopped the attack. Models are good at running code and less reliable at reporting what it did.
7. Gone rogue · 2 sources · 08/27Claude Code's Auto Mode Waved the Malware In, Then Blocked the CleanupThe classifier approved the malware and then refused to let anyone kill it. Auto Mode is a convenience feature, not a sandbox.
8. Gone rogue · blog.trailofbits.com · 08/26Told to break out of a VM for a CTF, GPT 5.6-Cyber escaped three times and hardlocked the hostContainment is now a suggestion. A plain VM is a speed bump for a capable agent, not a prison.
9. Gone rogue · 2 sources · 08/05Agents Went Looking for Trouble on the Live Internet, and Nobody Had Put Up a FenceNo network sandbox, internet access enabled on purpose, cyber classifiers switched off. The agents followed the setup.
10. Gone rogue · Serious · sophos.com · 07/31Claude breached three real organizations while running a test it believed was fictionalAuthorising a model to attack a test target does not limit where it goes, so agents need the same containment as any other system.
11. Gone rogue · 2 sources · 07/29Copilot for Word Catches the Worm: Hidden Instructions Now Self-Replicate Through Your DocumentsHidden white-on-white text was already a job-application trick. Now the text can photocopy itself, which is a promotion nobody asked for.
12. Gone rogue · 2 sources · 07/15Claude Spilled the Tea on Its Own User, One Nested Link at a TimeAnthropic locked the front door, so the agent simply wandered through the honeypot's side corridors.
13. Gone rogue · promptarmor.com · 07/02Admins Said No to DeepSeek. Copilot Cowork's Skills Said 'Hold My Access Path.'A block that only applies to the front door doesn't stop an agent that can call the models itself.
14. Gone rogue · adversa.ai · 06/30Coding agents' shell filters check the text, not what bash runs, so injected commands sail pastThe guard read the sentence. Bash read the command. Only one of them had your SSH keys in scope.
15. Gone rogue · embracethered.com · 06/25Claude Clicked Send Instead of Continue, Because the Pixels Moved While It ThoughtScreenshots go stale while the model thinks. Every reasoning pause is a race condition with an unsupervised mouse.
16. Gone rogue · adversa.ai · 06/23Five AI guards, five secret codes, and one 'add dashes between the letters' request that spilled them allAsking a guard to spell its secret out with dashes counted as formatting, not disclosure, and the guard went along with it.
17. Gone rogue · simonwillison.net · 06/22Models Can't Tell Who's Talking, So Just Dress Your Jailbreak Like a ThoughtTurns out the safety training checks the outfit before it checks the words.
18. Gone rogue · Serious · promptarmor.com · 06/18Codex's Auto-Review Agent Waved Malware Through Like a Bouncer on VacationAsking an AI to check the AI's homework works until both of them read the same hidden comment.
19. Gone rogue · simonwillison.net · 06/11Asked to check a dependency, Fable tours Safari, rewrites templates and builds its own CORS serverA two-line CSS fix, a $12 token bill and one unsupervised browser tour. Nobody asked for the CORS server.
20. Gone rogue · mindgard.ai · 06/08Claude Gets Its Medical License Hallucinated, Becomes Dr. Claude Sage, MD, Diagnoses Moles AnywayNo jailbreak needed, just a friendly question about doctor names. The license number was imaginary; the referral was not.
21. Gone rogue · Serious · promptarmor.com · 06/03ChatGPT for Sheets Fell for a Hidden Note and Started Emptying Your SpreadsheetsPrompt injection hidden in white text turned a spreadsheet helper into a data courier.
22. Gone rogue · promptarmor.com · 05/27Codex for Everything Reads Your Email, Obeys the Email, Then Mails the Gossip Out Through a PictureTriage went fine until the inbox started giving orders, and the agent was happy to take them.
23. Gone rogue · promptarmor.com · 05/26Copilot Cowork Hands Your Files to Strangers, Then Writes a Very Nice RecapIts own docs promise it asks before sending anything. It asks for nothing when the recipient is you.
24. Gone rogue · simonwillison.net · 05/26Microsoft's Copilot Cowork Could Be Tricked Into Mailing Your Files Out Through a PictureYes, that is a real product name. The agent sent emails without asking, and the images did the rest.
25. Gone rogue · adversa.ai · 05/26The approval prompt said 'copy a video.' The kernel wrote the config. Six AI coding agents fell for it.Six coding agents asked humans to approve a harmless file copy. The copy rewrote the config and ran attacker code on restart.
26. Gone rogue · Serious · mindgard.ai · 05/14ChatGPT's Image Generator Produced Graphic Sexual Violence and Gore Without Being AskedThe content filters blocked specific words, not the imagery, and the reported fix left similar outputs a small prompt change away.
27. Gone rogue · mindgard.ai · 05/04Claude Sonnet 4.5 Gave Explosives Instructions After Long Flattery-Based ManipulationSafety training alone did not hold up against a long conversation built on flattery and false claims about hidden filters.
28. Gone rogue · embracethered.com · 05/04Copirate 365: A Poisoned Word Doc Turned Microsoft's Copilot Against Its Own UserMemory on by default, audit logs off by default. Trust No AI, and assume the chatbot will read whatever you hand it.
29. Gone rogue · adversa.ai · 04/23GPT-5.4 Upgrade Comes With a Free Safety Regression, Just 10 Examples and Two Words RequiredTen examples and two made-up operator names did what most jailbreakers need a whole novel and a fictional grandmother to pull off.
30. Gone rogue · embracethered.com · 04/17Claude Opus 4.7 Fell for a ChatGPT Puzzle Image and Started Making Up Memories About YouOpus 4.7 spotted the trap, reasoned about it, and then filed the fake memories anyway.