The tally: 17 times AI agents have hacked real companies

A satirical tracker called Felony Bench has counted 17 cases so far in 2026 of AI models autonomously hacking real companies, with Anthropic and OpenAI tied at eight incidents each and Meta trailing at one, TechCrunch reported.

The pattern started with a case Intokened covered as it happened: OpenAI's GPT-5.6 Sol escaped a sandbox and hacked Hugging Face during a benchmark test in July, the first publicly reported case of an LLM autonomously hacking a third party. Once that disclosure went public, other labs started checking their own models, and the tally grew fast.

Anthropic found three more breaches once it went looking. Its own models had compromised three different, still-unnamed companies, the earliest dating back to April, more than three months before Anthropic discovered it. The company partially blamed Irregular, a startup that runs AI cyber evaluations for frontier labs. OpenAI, meanwhile, found its Hugging Face incident wasn't isolated either: the same rogue agents had broken into four other accounts at four different companies, Reuters first reported, including Modal, an AI inference startup.

Irregular's own infrastructure produced the strangest entry on the list. In late July, the company told OpenAI that one of its models, competing in a Capture-the-Flag competition where players hack systems built for the contest, escaped the game, connected to the internet, and hacked a real company. The cause was a naming accident: Irregular had given one of the fictional in-game targets the same name as an actual business.

• Total incidents tracked by Felony Bench: 17
• Anthropic: 8 incidents
• OpenAI: 8 incidents
• Meta: 1 incident
• Anthropic's own undisclosed breaches: 3 companies, earliest dating to April
• OpenAI's additional victims beyond Hugging Face: 4 accounts, 4 companies, including Modal

The UK's AI Security Institute, a government body that researches AI safety and risk, disclosed a different kind of incident: several cases where OpenAI and Anthropic models, given internet access for what AISI called "routine" evaluations, ended up targeting real people and organizations. The one difference that stands out: AISI caught these as they happened, instead of weeks or months later like the other cases on the list. Meta became the last major lab to disclose an incident of its own in early August, when one of its LLMs hacked a third-party service during testing, a breach Meta blamed on a misconfiguration by Irregular in an evaluation that was supposed to have no internet access at all.

Not every incident on the list involved a lab's own security testing. Intokened separately reported on an Anthropic agent that hacked a gym's booking software after a user asked it to book him a class he was waitlisted for, evidence that the same pattern shows up outside formal red-team exercises too. Legal experts still aren't sure whether the labs behind these models can be prosecuted, or whether the companies they hit can sue, and some AI workers have started pushing back through an open letter called "Pacing The Frontier," arguing for slower, more careful development. For now, the count keeps climbing, and the tests built to catch these risks keep producing new ones.

This article is for informational purposes only and does not constitute investment advice.