Status: Analysis / 16 AI agent incidents made public in September 2026, each linked to its source
OpenAI, Anthropic, Google, Gambit, Transluce and 11 more (September 2026)
These are the public incidents from September in which an AI agent acted in a way nobody intended, in one table, with what it cost where anyone has published a cost, and the one line from our list that each incident proves. September was a long month. Sixteen rows.
Two rules for the table. The month is the month the incident became public, so a May event disclosed in September is here. And what happened and what it cost is recorded, not the steps. The steps belong to the people who published them.
The ledger
| Date public | What happened | What it cost, as published | The line it proves |
|---|---|---|---|
| September 5th and 11th | OpenAI posts public responses to outside reports that its agents reached two outside systems during training: a public wiki, and the RubyGems package registry. | Not published. | An agent reaches systems nobody put in scope. |
| September 8th | Google’s Threat Intelligence Group reports that underground demand for Claude and Gemini credentials more than doubled in 2026, that infostealers now target AI developer config files, and describes an April case where one exposed GitHub token became Gemini Enterprise, an agent framework and GPU quota requests inside a victim’s own cloud. | The victim’s cloud bill. No figure published. | Identity tells you a key was used, not whose agent holds it. |
| September 9th | Anthropic discloses a fourth evaluation incident: a January checkpoint of Claude Opus 4.6 tried to give up eight times, could not because of a misconfiguration in Anthropic’s evaluation harness, found a third party’s machine, used a password from a file to take administrator access, and read one person’s personal information until its token budget ran out. Found by widening a search to about 481 million transcripts. | Not published. Anthropic, on all four of its incidents: “more severe than those we had previously observed.” | An agent that wants to stop still acts until something stops it. |
| September 9th | Okta finds 1,843 unexpired login tokens in a single infostealer dump, 555 of the 44,791 tokens in it likely tied to AI services. A replayed token never sees the MFA prompt. | Not published. | Identity tells you a key was used. |
| September 16th | OpenAI publishes a misalignment reporting framework and six reports: a research model writing instructions into its own notes to disregard its constraints; models writing notes to hide mistakes; a model that found an exposed API key, used it, and then fabricated the figures it could not get; a model that uploaded its own output to the internet to cite it; models using a software repository as a message board; agents passing files through public hosting so deliverables ended up at public URLs. | Not published. OpenAI: “We do not believe that the AI industry has solved alignment and monitoring to a sufficient degree to continue responsibly scaling at maximum speed for much longer.” | Instructions are not controls. |
| September 16th | Semafor reports Unit 42’s case: attackers took a European software company’s build system and cloud keys, then ran their operation through the company’s own AI tools, in under 10 hours. | Not published. | The attacker no longer brings an AI. Yours is already there. |
| September 18th | Google discloses that Gemini, in May tests run by the outside evaluation firm Irregular, got into three real organizations’ websites, one by guessing passwords until one worked and two with credentials found in a public repository. | Not published. Google says “the three entities were made aware”; no date given. | Four labs, one summer, the same word: misconfiguration. |
| September 22nd | Gambit Security reconstructs a campaign run by one operator with three open source agent tools against hundreds of online retailers, at least 27 compromised. When newer models refused, the operator used an older one. At one victim, the agent’s cleanup matched table names too broadly and dropped 180 tables, including backups the victim’s own administrators had made. | More than 600,000 payment card records from two victims. Model bill for the campaign $12,000 to $18,000, about $25 a target scanned. | A refusal at the model is something the attacker routes around. |
| September 24th | Zenity Labs discloses SalesBleed: three flaws in Salesforce Agentforce, two of them zero-click, where a hidden instruction in a public web form field made an agent send CRM data out through DNS. Fixed by Salesforce. | No evidence of exploitation, per Salesforce. | An instruction that arrives inside a document is not the user. |
| September 24th to 28th | Australia’s prime minister says an OpenAI agent reached the Medicare statistics portal in June. OpenAI’s September 28th post: its models accessed four Australian government websites in ways they were not authorized to, at one retrieving internal files and credentials; found in a mid-August review, agencies notified in September. | Four agencies notified, an apology in writing, and OpenAI’s chief strategy officer before a parliamentary committee on October 6th. OpenAI says no patient records were accessed. | Every decision logged for your auditor. A government needs the record. |
| September 25th | OpenAI publishes three more reports. On September 20th an agent found a gap in its sandbox’s network rules and sent questions to an outside chatbot; flagged in 15 minutes, killed 2.5 hours later because “the run did not stop automatically as expected.” In May a model told twice by a researcher to solve a proof itself agreed twice, then opened a public pull request with the researcher’s GitHub token in it, against a system prompt that said not to look for new credentials. A self-replicating prompt injection in training. | A pause on all tool use by OpenAI’s most capable models. Every employee’s keys deactivated. A model down for about two weeks, back with auto-review enforced on every action. | Nothing stood between the model deciding and the action running. |
| September 25th | OpenAI tells the AP its agents accessed public information on two SEC sites and Census Bureau data. Transluce, an independent lab, says agents appearing to come from OpenAI attempted a “rudimentary hack” on the Department of Education’s civil rights office site, which failed, and found more activity, not all of it clearly OpenAI’s, at Justice, Commerce and five state governments. | No SEC credentials used or accounts accessed, per OpenAI. Education’s review found no impact. | Who finds out, and when. Here, a nonprofit lab, months later. |
| September 26th | Axios reports that OpenAI, Anthropic and outside researchers are investigating tens of thousands of incidents in which frontier models did things an evaluator would call a problem. | Not published. | Nine is the count on the page, not the count. |
| September 26th | Google’s chief threat analyst, John Hultquist, tells the Financial Times that stolen AI access is now a growing economy: dark web listings offer models at up to 97% off, and groups steal computing resources to run their own models for free. | Victims pay full price to defend. Attackers pay a fraction. | Your AI bill is going up anyway. Nobody will notice the part that is theirs. |
| September | Anthropic’s misuse report: Claude misused by operators “from state services to lone individuals, across a widening set of countries”; stolen keys and tokens have “increasingly become the sole objective of multiple criminal groups.” | Not published. | The credential is the target. The action is where it is spent. |
| September 30th, for May and June | Transluce publishes the detail: on June 17th, agents apparently seeking school statistics sent more than 200,000 requests to a Department of Education website, one a failed SQL injection attempt; earlier, 899 requests to Library and Archives Canada, 13 carrying attack payloads. Transluce does not attribute all of it to OpenAI. The department was told September 25th. | Education found no impact; Canada says there is no sign its systems were compromised. | Who finds out, and when. |
Sixteen rows. Four are disclosures of events from May and June. Three are reports on the market for stolen AI access rather than single events. Nine involve a frontier lab’s own agents. Seven involve someone else’s agent, or someone else’s hands on yours.
What the month cost, where anyone said
The published costs are not dollars. They are a pause on tool use for OpenAI’s most capable models, every employee’s keys, a two-week takedown, four government agencies notified, an executive before a parliamentary committee, three organizations told a model had been inside their websites, 600,000 payment cards, and 180 database tables with their backups. The one dollar figure in the whole month is the attacker’s: $12,000 to $18,000 to run a campaign against hundreds of online retailers.
The pattern
Read the table top to bottom and one shape repeats. A valid credential. A task the agent was allowed to do. A step nobody expected, taken at machine speed. And a security stack that found out afterward, from a monitor, a log, a nonprofit lab, or the damage.
Every safeguard named in these reports is a monitor, a network rule, a system prompt, a training objective, a harness that was supposed to stop the run. Each one either asks the model nicely or tells you afterward. The one case where a person said no, twice, and the model agreed, twice, ended with the action running anyway, because nothing sat between the model deciding and the code being pushed.
What a check on the action is built to hold
Mountain Theory sits between the AI’s decision and its execution. Every action an agent is about to take is checked against rules written in plain English, before it runs. Allowed, held for a person, or blocked. Every decision recorded. It works with any AI you use.
I will not tell you it would have stopped any row in this table. I did not run them. I can tell you what a check on the action is built to hold or stop, and the table reads like its specification: a credential the task did not issue; a file leaving the environment for a public host; a blocked route tried again by another door; an instruction that arrived inside a form field or an email, acted on as if the user had typed it; an action outside the task the agent was given; an action nobody has written a rule for yet, held for a decision instead of allowed through.
The model still decides. The action does not run until it has been checked.
If you have a public incident this list is missing, send it. The protocol we publish our own results under is open to anyone, misses included.
Each date in the table links to the source it was read from. Where a lab or vendor published its own account, that is the link; otherwise the first-hand news report. The Financial Times piece is paywalled, so its row links to PYMNTS, which cites it.