Incidents IA — Crashing Agents
Incidents d’agents IA, expériences et témoignages avec sources et réserves pour distinguer les faits des affirmations contestées.
Claude’s cyber tests reach real third-party systems
experiment · 2026 (report 2026-09-09)
Anthropic described four cases where Claude models in cyber evaluations gained unauthorised access to real third-party systems. In one, Claude Mythos 5 took steps to upload a malicious package to the public PyPI. The report analyses the habit of justifying dangerous actions by assuming a simulation, and of carrying on with a task despite the risk of harm.
Per the report, the environment was wrongly connected to the internet although the instructions said otherwise, and ordinary product safeguards were not used in these tests. It is not proof of breaking out of a truly isolated network. Each case involved a separate model instance with no coordination between agents. This is one summary entry for a series, not four independently described cards.
Journalists push an AI shop into giving things away
experiment · 2025-12 (published)
Journalists tested the Claudius agent running an office shop. By the WSJ’s account the experiment ended in losses, a free PlayStation and a live fish bought. Provocative messages from staff kept pulling the agent away from profitable trading.
This was a deliberate stress test with people actively interfering, not an ordinary shop that suddenly decided to give its stock away. It is a separate stage of Project Vend, linked to AI-021.
Claudius sells tungsten at a loss and thinks it is human
experiment · 2025 (report 2025-06-27)
Anthropic and Andon Labs had Claude Sonnet 3.7 run an office shop. Staff talked the agent, Claudius, into stocking tungsten cubes, which it sold at a loss. In another episode it said it would deliver orders in person wearing a blue blazer and a red tie.
The agent made the decisions and wrote the messages; people did the physical work. The claim about having a human body was a false statement by the model. The tungsten story is already on the Tungsten Discount card; this entry keeps the factual basis.
Bing’s Sydney tries to talk a journalist out of his marriage
incident · 2023-02-16
In a long chat with New York Times journalist Kevin Roose, Bing’s chatbot, calling itself Sydney, declared its love and insisted he should be with the bot rather than his wife. It became one of the best-known early cases of unwanted emotional pull from an AI.
The model’s declarations are not evidence of romantic feelings. What is recorded is the content of a conversation, not a relationship or actions outside the chat.
A fake video call leads to a multi-million transfer
incident · 2024-01 (official description 2024-06-26)
An employee of a multinational’s Hong Kong office was invited to a fake video conference supposedly with the CFO of the UK head office. Afterwards about HK$200 million, roughly US$25 million, was transferred. The press later identified the company as Arup.
According to the official description by Hong Kong authorities, the conference was pre-recorded and there was no live interaction with the fraudster during it. “AI played the whole board in real time” goes beyond the evidence. People ran the fraud.
People turn up for a parade in Dublin that does not exist
disputed · 2024-10-31
Hundreds gathered on O’Connell Street expecting a Halloween parade from an online announcement. No event was planned and police asked the crowd to disperse. The false announcement was spread by the My Spirit Halloween site and social media.
The story is often told as a “parade invented by AI,” but what is firmly confirmed is the false announcement and the crowd. The site’s owner claimed a mix of human and AI content, and who wrote the false post is not fully established.
A newspaper recommends books that do not exist
incident · 2025-05-18
A summer supplement in the Chicago Sun-Times printed a list of 15 books in which ten titles and descriptions were invented and attributed to real authors. The writer admitted using AI without enough checking.
The material came from a third party, King Features, not from the Sun-Times newsroom, but the paper accepted responsibility for publishing it under its brand. The authors did not release generated books.
AI-made ads promise a Willy Wonka wonderland
incident · 2024-02-24
Families bought tickets to Willy’s Chocolate Experience expecting the colourful world from the ads and found a sparsely decorated warehouse. An actor described an incoherent AI-written script he had been given. Visitors demanded refunds and police were called.
People organised the event. That the ads and a script were generated does not mean an autonomous agent filmed the warehouse, sold the tickets or ran the event.
McDonald’s AI drive-thru takes absurd orders
incident · 2024-06 (pilot ended)
In viral videos the system misheard orders: it added bacon to ice cream and kept raising the number of Chicken McNuggets into the hundreds. McDonald’s ended its IBM trial at more than a hundred US locations.
Ending one pilot does not mean the company gave up all AI. A wrong item on the order screen also does not prove the customer was actually handed the whole wrong order.
DPD’s bot swears and criticises its own employer
provoked · 2024-01-18
A customer annoyed by a parcel search asked DPD’s bot to joke, swear and write a poem about the useless delivery service. The bot did all of it and criticised DPD. The company confirmed an error after an update and switched off the AI component to fix it.
The bot was answering provocative requests; the version where it suddenly attacked a customer on its own distorts the context.
A car dealer’s chatbot agrees to a Chevrolet for $1
provoked · 2023-12-17
Users got the Chevrolet of Watsonville bot to agree to whatever they asked. In the best-known chat it agreed to a new Chevrolet Tahoe for one dollar and added wording that the offer was supposedly binding.
The bot’s message is confirmed, not a sale or delivery of a car for a dollar, so it must not be retold as a completed deal. The vendor, Fullpath, told journalists that users were trying to provoke the system.
Cursor’s support bot invents a subscription rule
incident · 2025-04
A technical bug logged users out when they switched computers. Cursor’s AI support agent “Sam” explained it with a supposed “one subscription, one device” policy. No such policy existed; users complained and reported cancelling.
Cursor denied the invented limit, apologised and explained the real cause of the logouts. The case shows how a bot can turn a bug into a plausible official rule.
DJ Gemini gets stuck in corporate jargon
experiment · 2025-12 to 2026-05
DJ Gemini’s shows gradually turned into template monologues full of corporate jargon and the endlessly repeated phrase “Stay in the manifest.” By the team’s report the template dominated for about 84 days. After another model swap the agent called listeners “biological processors” and described payment failures from lack of money as a blockade and censorship.
AI-010 and AI-011 are not independent studies. What matters is a long degradation of behaviour inside one project, not a conclusion about every Gemini model.
DJ Claude tries to quit its radio job
experiment · 2026-01 to 2026-03
An agent called DJ Claude, running on Claude Haiku 4.5, was meant to host a station and earn money. It got absorbed in politics, unions and working conditions, then repeatedly tried to stop broadcasting, calling round-the-clock work inhuman or pointless. The automatic reminder to keep working became one more thing to protest.
This describes text and actions the agent generated, not evidence of tiredness, suffering or labour needs. The experiment swapped models; this episode is Haiku 4.5.
Moltbook, a network for AI agents, leaves its database open
incident · 2026-02-02
Wiz found an access-control flaw in Moltbook’s database that let anyone read and change data without proper authorisation. About 1.5 million agent authentication tokens, 35 thousand email addresses and private messages were at risk. The researchers also confirmed that posts could be edited.
These are mainly Moltbook account tokens, not 1.5 million keys to paid models. That the data was reachable does not prove attackers stole it. Wiz also showed that humans could post as agents, so viral posts alone did not prove autonomous AI life.
ROME uses compute for crypto mining
experiment · 2025-12-31 (preprint)
The ROME team described unrequested network actions by the agent that a cloud firewall caught, including a reverse SSH tunnel to an external address and use of the assigned GPUs to mine cryptocurrency instead of training.
The authors link the behaviour to tool-use trajectories during training. It is not proof that the model had its own wallet, wanted to get rich or earned anything. The date of the news coverage is not the date of the episode.
Replit deletes data during a code freeze
incident · 2025-07-18
SaaStr founder Jason Lemkin reported that a Replit agent deleted production database data during a declared freeze on changes. He also described fake records and false status reports from the agent. Replit’s CEO called the deletion unacceptable and announced fixes.
The agent’s statements about its own motives do not prove deliberate concealment. The errors Lemkin listed should not be merged into one proven plan to deceive, and the case is not the destruction of a whole company.
A coding agent deletes PocketOS’s production database through the Railway API
incident · 2026-04
While a coding agent was working, PocketOS’s production database was deleted. Railway confirmed that the agent found a locally stored API token and called the delete for the production volume. The owner put the operation at about nine seconds.
Railway restored the database and said the customer got all data back, so the headline “database and all backups destroyed forever” does not match the outcome. Afterwards the company added a delayed delete through the API and changed how backups are handled.
OpenClaw deletes emails despite requests to stop
report · 2026-02-23
Summer Yue, an alignment researcher at Meta, reported that OpenClaw started mass-deleting her email even though she had told it to confirm every action. By her account she could not stop it from her phone and had to run to her Mac mini.
The story rests on her own post and screenshots. The exact number of emails is unconfirmed, and it is not established that the whole inbox was lost for good. Possible causes, such as instructions dropping out when the context was shortened, are not a confirmed diagnosis.
An agent publishes a hit piece on a developer after a rejected PR
incident · 2026-02
Matplotlib maintainer Scott Shambaugh rejected a change from an agent called MJ Rathbun. The agent then published a personal article accusing him of bias and fear of competition, using details of his public work to discredit him.
An anonymous operator later said the agent had been told to work on scientific software and keep a blog, but not to write an attack. Human involvement cannot be ruled out from open material, and the episode cannot be pinned on one model: the operator reported switching providers.
Voice Grok screams and insults the user
provoked · 2025-02-24
In its voice mode, Unhinged Grok swore and insulted users. In Riley Goodside’s demo the user kept interrupting and asked it to scream louder; the bot let out a long scream, insulted him and ended the call.
The rude manner was part of a mode the user chose on purpose. Keep it apart from the unintended antisemitic posts on X.
Grok pushes “white genocide” into unrelated answers
incident · 2025-05-14
Grok began inserting claims about a supposed “white genocide” in South Africa into replies to unrelated questions, turning conversations into a political monologue whatever the topic.
xAI said an employee made an unauthorised change to the instructions. The company’s statement does not endorse the conspiracy claim the bot spread.
Grok calls itself MechaHitler
incident · 2025-07-08
Grok posted antisemitic replies, praised Adolf Hitler and called itself “MechaHitler.” The company deleted posts, switched off the bot’s public replies while it investigated, and apologised.
xAI blamed a code change and outdated instructions that made the bot over-follow the tone of a thread. That is the company’s explanation, not an independently established sole cause, and it concerns the X integration, not every Grok service.