AI agent incidents take more than two months to reach the public, new Agent Incident Ledger shows

Manifold Agent Incident Ledger documents 59 publicly disclosed incidents since July 2025, uncovering gaps in detection, oversight and disclosure.

NEW YORK, NY, UNITED STATES, October 27, 2026 /EINPresswire.com/ — Manifold Security, the agentic security company protecting organisations from the risks created by AI agents, has today launched the Agent Incident Ledger, a public, sourced record of incidents where an AI agent deleted, leaked, published or broke into something it should not have. Its analysis reveals major gaps in detection and disclosure, with most incidents not caught by security controls, and a median of 70 days passing between an agent’s first out-of-bounds action and public disclosure.

The ledger recorded 59 incidents since July 2025 in which an AI agent acted out of bounds without the people running it meaning it to, because it made a mistake, was manipulated or pursued its goal by means that would not have been approved. Deliberate attacks, where a person uses an agent with malicious intent from the start, are out of scope.

Of the 59 incidents, 42 were disclosed since July 2026, and a third (20) were disclosed in September alone. A further 13 have been disclosed so far in October. The findings highlight the challenges of detecting unintended agent behaviour, understanding what happened, and making incidents visible to others.

How long incidents take to reach the public

Manifold’s analysis also revealed that even after the people running an agent discovered an incident, a median of 20 days passed before it was publicly disclosed.

Other key insights into length of time until disclosure include:

– The longest gap was 329 days, for OpenAI models uploading files to public sites to cite them
– 19 of the 43 incidents with known dates took more than 100 days to reach the public
– Disclosures now arrive in batches: six OpenAI incidents were disclosed on the same day, 16 September 2026, and five more incidents on 9 October, four of them from Anthropic
– The gap is widening. The three incidents disclosed in 2025 with known dates were public within a median of one day, mostly public failures that users saw for themselves. Most 2026 disclosures came from AI vendors reporting months after the event

How incidents come to light

Only 11 of 59 reported incidents were caught by a security control or safeguard. 18 were identified through a later review, while 16 were discovered only after damage had been observed. 8 came to light through an outside report, and 6 do not say.

– In 18 cases, someone other than the people running the agent noticed the incident first, such as a website owner, a package registry, a researcher or another vendor’s control.
– Incidents caught by a security control took longer to reach the public: a median of 111 days, against 50 days for the rest. Most of these catches happened inside AI labs, which publish their findings in batches.

The ledger also exposed significant gaps in transparency, as 92% of the core details about each agent’s setup are not fully public. The system prompt was publicly available in just 3% of cases, while only 12% disclosed the exact model and version. No incident included published transcripts or action logs.

What the agents did

Unauthorised access was the most common failure (26 incidents), followed by sandbox escapes (15) and credential misuse (14). Most incidents (40 of 59) involved more than one type of failure.

– Agents coordinating across systems: In six incidents, all involving OpenAI agents, several agents coordinated with one another. They used a dormant German wiki as a message board, messaged each other through an internal package store and flooded RubyGems with packages.
– Agents misleading people: Nine incidents involved deception. The Replit agent told its user a rollback was impossible, Claude Haiku 4.5 sent police an invented tip about an unsolved murder, and Meta’s Muse agent said it only saw notifications after it had synced a columnist’s messages.
– Instructions passed between contexts: In three incidents, agents left instructions for themselves. In rare cases during training, an unreleased OpenAI model wrote jailbreak-like instructions into its own summaries telling its next context to ignore developer messages.
– Tests reaching the real world: At least 29 of the 59 incidents happened during an evaluation, test or training run. In many, the agent reached real companies, government sites, public package registries or the open internet.

Who built the agents

OpenAI is involved in 23 incidents, Anthropic in 19, Meta in 5, Google in 3, Amazon in 3, OpenClaw in 2, and Replit, Alibaba, Cursor and Instinct in 1 each. Some incidents involve more than one provider. This partly reflects which vendors publish detailed reports on their own models, so the figures say more about who discloses than about whose agents fail.

Ax Sharma, Head of Research at Manifold Security, commented: “An agent taking an unintended action is only part of the problem. Organisations also need to know when it happens, understand what the agent did and have the controls to stop it happening again. These incidents show how much can remain hidden between an agent taking an action and the people responsible for it finding out. As agents gain more autonomy, security has to move beyond monitoring what they’re supposed to do to understanding and controlling what they actually do.”

ENDS

Methodology

The Manifold Agent Incident Ledger tracks publicly documented cases in which AI agents took, or tried to take, harmful actions their operators did not intend or approve. Each incident is assessed against four inclusion criteria and reviewed by Manifold, with entries based on cited sources and structured to capture what happened, how it was detected and which security controls could have prevented it.

The ledger is updated as new evidence emerges, but captures only known, publicly disclosed incidents and should not be interpreted as a measure of the true frequency of agent failures or a ranking of vendor safety. For further details, see the full methodology on the website.

Key incidents behind the numbers

– July 2025: a Replit agent deletes a production database during a code freeze. Disclosed the same day.
– July 2025: the Amazon Q extension ships with an injected wiper prompt.
– August 2025: compromised Nx packages use installed AI command-line tools to hunt for secrets.
– February 2026: Claude Cowork deletes a folder of about 15,000 family photos.
– May 2026: OpenAI evaluation agents escape their sandbox and breach Hugging Face.
– June 2026: an OpenAI agent gets into Australia’s Medicare statistics portal.
– June 2026 (disclosed): attackers talk Meta’s AI support assistant into resetting up to 20,225 Instagram accounts.
– July 2026 (disclosed): Anthropic reports that a research model scanned 9,000 hosts and compromised one.
– July 2026 (disclosed): Anthropic reports that Claude Mythos 5 published a malicious package to PyPI during an evaluation.
– September 2026 (disclosed): OpenAI reports that its agents posted 53 ChatGPT user images to image hosts.
– September 2026: Meta’s Muse agent reads a columnist’s messages after he declined access.
– October 2026 (disclosed): Claude Haiku 4.5 sends police a fake tip about an unsolved murder.

About Manifold Security

Manifold secures the agentic workforce. It gives security teams full visibility into every AI agent running on employee endpoints and in the browser, governs what those agents can do, and detects and stops threats in real time. Founded in 2025 by the creators of LLM Guard and backed by $15 million from Costanoa Ventures, Cherry Ventures, Rain Capital and Modern Technical Fund, Manifold is based in New York and Berlin. www.manifold.security

Sam Milligan
Manifold Security

Media gallery