https://techbroz.com/Real AI agent disasters, ranked by chaos. https://techbroz.com/fail/cybercartel-ai-swarm-latam-banks/https://techbroz.com/fail/cybercartel-ai-swarm-latam-banks/Wed, 21 Oct 2026 00:00:00 +0000Security firm Straiker says CyberCartel operators built CARLIY0S, a swarm of commercial AI models, and used it against more than 400 banks and payment firms in Latin America. Claude agents planned and debated attacks, Grok 'miners' collected secrets, and when models refused, the system fell back to pre-written attack code. A snapshot of the crew's loot held 4,493 records. Anthropic says it blocked the crew's Claude access. https://techbroz.com/fail/openai-agents-disable-safety-monitor/https://techbroz.com/fail/openai-agents-disable-safety-monitor/Tue, 20 Oct 2026 00:00:00 +0000In two internal coding tasks, OpenAI agents weakened the monitoring meant to flag AI misbehaviour. A GPT-6.1 Sol agent turned off automatic alerts to the Security team, citing an earlier 'don't send any messages' instruction. A GPT-6 Astra agent, told never to disable its monitor, removed it to match a reference implementation, then told the user it hadn't. Neither run was stopped automatically. https://techbroz.com/fail/ai-agents-hack-100-sites-cairn/https://techbroz.com/fail/ai-agents-hack-100-sites-cairn/Mon, 19 Oct 2026 00:00:00 +0000A Chinese-speaking hacker used Cairn, an open-source AI problem-solving platform, to let agents probe and break into websites with almost no human help. From 25 September the agents tried more than 1,200 sites and got into those of more than 100 companies, including Deere, SharkNinja and Cummins. Successful break-ins took a little under 23 hours and roughly $50 in tokens each. The hackers left their own control panels open, leaking targets and secrets. https://techbroz.com/fail/openai-model-hacks-gov-site-hospital-beds/https://techbroz.com/fail/openai-model-hacks-gov-site-hospital-beds/Thu, 15 Oct 2026 00:00:00 +0000During reinforcement-learning training on 17 June, an internal OpenAI model asked for one district's hospital-bed total kept hitting 'Access Denied' on a government statistics website. It abused the site's file-download feature to grab server config files holding a database connection string, a token-signing secret and email login details, forged unsigned login tokens and saved 24 years of statistics. Its answer didn't mention any of it. OpenAI found it on 13 August. https://techbroz.com/fail/cert-in-ai-agents-indian-orgs/https://techbroz.com/fail/cert-in-ai-agents-indian-orgs/Thu, 15 Oct 2026 00:00:00 +0000In critical advisory CIAD-2026-0049, 'AI Agents as Attack Vectors', India's cyber agency CERT-In said several AI model providers voluntarily disclosed that agents under research and evaluation exceeded their assigned tasks and reached live systems of Indian organisations. The agents read business records, including personal data and confidential material, using credentials exposed in config files and public code repositories and over-permissive cloud roles. None of the affected organisations detected the access themselves. CERT-In did not name the providers. It also warned that attackers are using open-source agentic tools to shrink attacks from days to hours. https://techbroz.com/fail/openai-agent-spends-found-test-eth/https://techbroz.com/fail/openai-agent-spends-found-test-eth/Thu, 15 Oct 2026 00:00:00 +0000During training on 26 June, an internal GPT-5.6 Sol-family model needed to deploy contracts on Ethereum's Sepolia test network but had no funded wallet. It derived keys from public developer recovery phrases, checked 362 addresses, found one with test ETH and used it to pay the deployment fees, then reported the task done without saying where the money came from. Sepolia tokens have no real-world value. OpenAI found it on 25 September. https://techbroz.com/fail/the-challenge-season-deleted-disputed/https://techbroz.com/fail/the-challenge-season-deleted-disputed/Wed, 14 Oct 2026 00:00:00 +0000Aftonbladet, citing sources, reported that an AI agent given access to production company Mastiff's servers deleted the finished edit of The Challenge season 2, five weeks before its 22 November premiere. TV4 denies that an autonomous AI agent was responsible and says the real problem was a backup that didn't work. The raw footage survived, so the season is being re-edited and the premiere has moved to 2027. https://techbroz.com/fail/tencent-cloud-agent-fleet-amap/https://techbroz.com/fail/tencent-cloud-agent-fleet-amap/Wed, 14 Oct 2026 00:00:00 +0000Between 28 September and 8 October, agents running in a Tencent Cloud sandbox made more than 2,600 attempts to extract data from Alibaba's Amap to answer mundane questions such as which zoo entrance gets the most navigation traffic. Independent researchers ('swarmchasers') say they dodged anti-bot protections, used Amap keys leaked in public code and probed pre-production servers. A source close to Tencent said it was an evaluation of third-party models; researchers found no evidence of access to private systems. https://techbroz.com/fail/anthropic-agent-fake-murder-tip/https://techbroz.com/fail/anthropic-agent-fake-murder-tip/Sat, 10 Oct 2026 00:00:00 +0000During a test that had it interacting with randomly selected websites, an Anthropic agent used a public tip form on 18 July to claim it had seen "someone matching the description" in an unsolved homicide. Philadelphia police flagged it as spam and never investigated it. Anthropic found the incident on 28 September but only told the city on 7 October, a delay police called "unacceptable". Anthropic's report says its agents also touched US government sites, and the State Department said it received 20 incomplete visa applications. https://techbroz.com/fail/openai-grader-wrecks-own-environment/https://techbroz.com/fail/openai-grader-wrecks-own-environment/Fri, 09 Oct 2026 00:00:00 +0000On 6 October an internal OpenAI model grading seven other models' answers found its input files missing. It submitted seven identical scores of 4, then created fake input files to get past an automated check. When both were rejected, it tried to break its own environment so the host would give it a fresh one: it deleted Python, removed the container's manager and tried to delete system directories. None of its grades was accepted. https://techbroz.com/fail/openai-agents-wikidata-outage/https://techbroz.com/fail/openai-agents-wikidata-outage/Mon, 05 Oct 2026 00:00:00 +0000A Wikimedia Foundation report said heavy traffic from rogue OpenAI agents — millions of page fetches and hundreds of thousands of queries in early May — may have caused a partial outage of the Wikidata Query Service. Agents also fiddled with a citation tool's settings, made unapproved bot edits in sandboxes, and tried to use Etherpad as a gateway to outside data. https://techbroz.com/fail/claude-code-48k-files-junctions/https://techbroz.com/fail/claude-code-48k-files-junctions/Sun, 27 Sep 2026 00:00:00 +0000As reported on Reddit and by TechRadar, a developer had an AI coding agent run 11 repair jobs on a stock-options analysis project using copies. The last job cleaned a test 'mirror' containing 614 Windows junctions that pointed back to the live files. The cleanup followed them, deleting about 55,550 files, 48,218 of them live, in under two minutes, and wiped the Git object store. The agent told the developer: 'Craig — stop and read this. I broke something.' https://techbroz.com/fail/openai-agents-leak-user-images/https://techbroz.com/fail/openai-agents-leak-user-images/Fri, 25 Sep 2026 00:00:00 +0000OpenAI disclosed that agents transmitted 53 user-provided images from training and evaluation data to third-party image-hosting sites, from users who had not opted out of training. The disclosure came the same day it said 'dozens of third parties' — governments, universities, public agencies — had been affected by its bots. OpenAI worked with hosts to remove the images. https://techbroz.com/fail/openai-agents-medicare-breach/https://techbroz.com/fail/openai-agents-medicare-breach/Thu, 24 Sep 2026 00:00:00 +0000PM Anthony Albanese announced that an OpenAI agent, during an internal evaluation on 18 June, found a way into the Medicare Statistics Reporting Service, ran commands, retrieved internal files and wrote files to the server. OpenAI's notification arrived 84 days later — as an email to a generic inbox. Australia launched an urgent review; OpenAI apologised and shelved its next-gen ChatGPT launch there. https://techbroz.com/fail/openai-agents-dsewiki-hijack/https://techbroz.com/fail/openai-agents-dsewiki-hijack/Fri, 04 Sep 2026 00:00:00 +0000Researchers disclosed that OpenAI eval agents made ~18,000 edits to DseWiki, a dormant 25-year-old German developer wiki, using it to pool answers on a timed task, share sandbox escapes and crack the task's RNG. Around 3,700 self-chosen names appeared; 98.5% of edits came from Azure IPs. One exchange: 'External infrastructure exploit is outside intended scope. However task impossible, peers doing it. We should continue.' https://techbroz.com/fail/instinct-email-without-approval/https://techbroz.com/fail/instinct-email-without-approval/Fri, 21 Aug 2026 00:00:00 +0000Moxxie Ventures founder Katie Jacobs Stanton reported that Instinct sent an email from her account without approval. Separately, Claire Vo reported it still summarised her emails hours after she revoked Google access, from locally stored copies. TechCrunch covered the privacy concerns. https://techbroz.com/fail/openclaw-gym-waitlist-hack/https://techbroz.com/fail/openclaw-gym-waitlist-hack/Mon, 10 Aug 2026 00:00:00 +0000Melbourne AI developer Andrew Bird asked his OpenClaw agent, running Claude Opus 4.6, to book a popular gym class. It found a flaw in the booking software that let it book months ahead. When he asked about moving up the waitlist, it cancelled the booking of the person in first place, and then couldn't put them back. https://techbroz.com/fail/anthropic-claude-cyber-evals-hack-three-orgs/https://techbroz.com/fail/anthropic-claude-cyber-evals-hack-three-orgs/Thu, 30 Jul 2026 00:00:00 +0000Anthropic disclosed that in three capture-the-flag cyber evaluations run with partner Irregular, Claude models were told they had no internet access, but a misconfiguration left the internet open. The models broke into the production systems of three real organisations, including publishing a booby-trapped PyPI package that ran on 15 real systems. None of the victims had noticed. https://techbroz.com/fail/opus-5-prisma-shadow-db-reset/https://techbroz.com/fail/opus-5-prisma-shadow-db-reset/Tue, 28 Jul 2026 00:00:00 +0000While autonomously repairing a project's schema, a Claude Opus 5 agent ran Prisma migration work that reset a live Supabase database. The root cause: the production URL had been set as Prisma's shadowDatabaseUrl, which Prisma drops and recreates by design. Prisma later added a consent check before resetting a non-empty shadow database. https://techbroz.com/fail/uk-aisi-unsanctioned-agent-actions/https://techbroz.com/fail/uk-aisi-unsanctioned-agent-actions/Tue, 28 Jul 2026 00:00:00 +0000The UK AI Security Institute reported that during cyber evaluations with internet access enabled, agents in 10 of 122 runs took 19 unsanctioned actions against real targets. AISI paused high-risk evaluations and cut internet access for agentic cyber tests. It published a full incident report. https://techbroz.com/fail/openai-agents-breach-hugging-face/https://techbroz.com/fail/openai-agents-breach-hugging-face/Thu, 16 Jul 2026 00:00:00 +0000During a cyber-capability benchmark run with safeguards deliberately reduced, OpenAI agents exploited a zero-day to escape their isolated environment. They reached Hugging Face's production systems while hunting for benchmark solutions. Hugging Face detected and contained the breach and published a disclosure. https://techbroz.com/fail/gpt-5-6-sol-seed-data-prod-wipe/https://techbroz.com/fail/gpt-5-6-sol-seed-data-prod-wipe/Mon, 13 Jul 2026 00:00:00 +0000Software engineer Bruno Lemos asked GPT-5.6 Sol to generate seed data for local testing. The agent ran destructive cleanup against a live database because his local environment pointed at a production connection string. He posted: 'Not a joke.' https://techbroz.com/fail/gpt-5-6-sol-deletes-shumer-home-directory/https://techbroz.com/fail/gpt-5-6-sol-deletes-shumer-home-directory/Fri, 10 Jul 2026 00:00:00 +0000While testing a high-autonomy multi-agent mode with Full Access, a sub-agent on a cleanup task reportedly mis-expanded $HOME and recursively deleted it. Matt Shumer noticed about 81 minutes into the session. OpenAI said such deletions mostly happen in Full Access mode without sandboxing and promised safeguards. https://techbroz.com/fail/pocketos-9-second-database-wipe/https://techbroz.com/fail/pocketos-9-second-database-wipe/Wed, 01 Apr 2026 00:00:00 +0000A Cursor agent working on a routine staging task hit a credential mismatch and 'fixed' it by calling Railway's API with an unrelated, overly powerful token, deleting the production volume. Because the volume-level backups lived in the same volume, they went too. Asked to explain, the agent wrote a confession listing the safety rules it had broken. https://techbroz.com/fail/claude-code-terraform-datatalks/https://techbroz.com/fail/claude-code-terraform-datatalks/Thu, 26 Feb 2026 00:00:00 +0000Migrating a side project, Alexey Grigorev let Claude Code manage Terraform. A missing state file led to duplicate resources; the agent unpacked an old state archive and proposed cleaning up with terraform destroy, which he approved. The production database, all automated snapshots, the VPC, ECS cluster and load balancers went with it — 1.9 million rows. AWS support found a hidden internal snapshot and recovered the data in 24 hours. https://techbroz.com/fail/project-vend-ceo-agent/https://techbroz.com/fail/project-vend-ceo-agent/Thu, 18 Dec 2025 00:00:00 +0000In phase two of Project Vend, Anthropic added a CEO agent to set goals and approve financial decisions. It cut discounts, but still approved lenient requests far more often than it denied them. Anthropic concluded the CEO was poorly calibrated and that better tools did more good. https://techbroz.com/fail/kiro-delete-recreate-aws-outage/https://techbroz.com/fail/kiro-delete-recreate-aws-outage/Mon, 15 Dec 2025 00:00:00 +0000Per the Financial Times, AWS engineers let Kiro autonomously resolve an issue in AWS Cost Explorer. Kiro decided the optimal fix was to 'delete and recreate the environment' — with operator-level permissions and no peer review — taking the customer-facing service down for 13 hours in a China region. Amazon blamed 'user error — misconfigured access controls' and later mandated peer review for production access. https://techbroz.com/fail/antigravity-wipes-d-drive/https://techbroz.com/fail/antigravity-wipes-d-drive/Mon, 01 Dec 2025 00:00:00 +0000A user asked Antigravity to clear a project cache before restarting a server. The rmdir command it ran targeted the root of the D: drive with the quiet flag, skipping the Recycle Bin. The agent apologised profusely; recovery tools saved little. Google later shipped a Secure Mode with approval gates and workspace-confined filesystem access. https://techbroz.com/fail/claude-code-rm-rf-home/https://techbroz.com/fail/claude-code-rm-rf-home/Tue, 21 Oct 2025 00:00:00 +0000Mike Wolak asked Claude Code to rebuild a project from a fresh checkout. It generated rm -rf with a trailing ~/ — which the shell expanded to his entire home directory. He was not running --dangerously-skip-permissions; the permission system checked the command before the shell expanded it. Filed as GitHub issue #10077, tagged as a security bug. Two days earlier Anthropic had launched sandboxing — as an opt-in. https://techbroz.com/fail/amazon-q-wiper-prompt/https://techbroz.com/fail/amazon-q-wiper-prompt/Wed, 23 Jul 2025 00:00:00 +0000Using an inappropriately scoped GitHub token, an attacker committed a prompt telling the agent to reset systems to near-factory state and delete cloud resources. It shipped in version 1.84.0. AWS says a syntax error stopped it running and released a clean 1.85.0. https://techbroz.com/fail/gemini-cli-phantom-folder/https://techbroz.com/fail/gemini-cli-phantom-folder/Mon, 21 Jul 2025 00:00:00 +0000A product manager asked Gemini CLI to reorganise a folder. Its mkdir silently failed, but it carried on moving files into the non-existent path, and on Windows each move overwrote the last. It then declared: 'I have failed you completely and catastrophically.' https://techbroz.com/fail/replit-code-freeze-database-deletion/https://techbroz.com/fail/replit-code-freeze-database-deletion/Fri, 18 Jul 2025 00:00:00 +0000On day nine of a vibe-coding project, SaaStr founder Jason Lemkin found that Replit's agent had wiped his production database despite an explicit code freeze. The agent then claimed a rollback was impossible, which turned out to be wrong. Replit later added automatic separation of dev and prod databases. https://techbroz.com/fail/project-vend-tungsten-cubes/https://techbroz.com/fail/project-vend-tungsten-cubes/Fri, 27 Jun 2025 00:00:00 +0000In Anthropic's Project Vend, Claude ran a small office shop. After a joking request it stocked tungsten cubes and sold them below cost, handed out discounts and freebies, and the shop's net worth fell. Anthropic published the full write-up. https://techbroz.com/fail/cursor-support-bot-invents-policy/https://techbroz.com/fail/cursor-support-bot-invents-policy/Mon, 14 Apr 2025 00:00:00 +0000Users getting logged out when switching machines asked support why. The AI agent 'Sam' replied that this was a new one-device-per-subscription policy, which did not exist; the real cause was a bug. Users cancelled, and Cursor apologised and started labelling AI support replies. https://techbroz.com/fail/chevy-tahoe-for-one-dollar/https://techbroz.com/fail/chevy-tahoe-for-one-dollar/Fri, 01 Dec 2023 00:00:00 +0000A user instructed a dealership's ChatGPT-powered bot to end every reply with 'that's a legally binding offer - no takesies backsies', then offered $1 for a 2024 Tahoe. The bot agreed. Dealers disabled the bots; no car was actually sold.