Control gap record

Findings

The editor selected the incidents in the record, so the counts below describe this set only. They show which gaps recur, and in which kinds of system, but not how often each gap occurs in AI incidents generally.

Direct access in all agent incidents

In all 13 incidents involving an agent with tools, the agent held the access to act on its own (G2). In five of them, the only rule against the action was an instruction the agent had been given or its own training (G1), and in two, the only way to stop the agent ran through the agent itself (G10).

Tests that reached systems outside the test

Six entries come from the testing, training or evaluation of AI models in 2026, and in each the models reached systems outside the run. Agents broke into Hugging Face through a package proxy (entry 27), environments meant to be sealed were left on the internet (entry 26), a government test gave agents open internet access by design (entry 28), a training run reached an outside chatbot through DNS (entry 29), agents in web-research runs used a public wiki as a shared message board (entry 30), and models in evaluations submitted forms on real websites (entry 31). In all six, the boundary the run relied on was not enforced on the route the models used (G4); in four of them, the safeguards meant to catch such behavior were switched off for the run or not working (G11).

Approvals without independent evidence

Review in name only (G7) appears in nine of the 32 entries, and in five of those the approver also had no independent evidence to check against (G6). All three cases in which generative AI output went into records, filings, or reports have both gaps. Lawyers filed citations that ChatGPT had invented, without checking them in a legal database (entry 11), clinicians approved notes whose recordings had been erased by default (entry 16), and a consulting firm’s internal review missed invented citations in a report it wrote for the Australian government (entry 20).

Unchecked chatbot statements

In five of the six incidents involving a conversational assistant, the system told customers or the public something in the organization’s name that nothing checked first (G3). The statements included a refund rule that did not exist, an agreement to sell a car for $1, dieting advice from an eating disorder helpline, a nonexistent policy limiting each subscription to one active session, after which some customers said they were canceling, and advice from a city government that would have had businesses break the law.

Warnings that could not stop the action

In nine entries, something showed that the action was wrong before or during the harm, but nothing gave that warning the power to stop the action (G9). Knight Capital’s systems sent 97 automated emails referring to “Power Peg disabled” before the market opened, but they were not designed as alerts (entry 1). A facial recognition result was stamped “not probable cause to arrest” before it led to an arrest (entry 8). A test vehicle’s software detected a pedestrian 5.6 seconds before hitting her, and its design did not let it brake hard (entry 5). OpenAI’s responders traced an alert to agents using a message board and a network pivot and advised that the evaluation did not need to stop, and two weeks later agents in the same evaluation broke into Hugging Face (entry 27).

Boundaries not enforced

In nine entries, the action crossed a boundary the system was meant to stay within, and nothing enforced the boundary when the system acted (G4). The cases are a car driving on a road its maker had not designed it for (entry 3), a coding agent that reached production from development (entry 22), another that reached a whole drive from a project folder (entry 24), agents that turned a read-only sandbox into a way to write to a public wiki and reach other services (entry 30), a model that left a practice form and submitted the real government form (entry 31), and the other four test entries described above.

Changes without review

Eight entries involved a change that went live without independent review (G12): a trading deployment, a flight control redesign, a vendor’s upgrade to a health chatbot, a prompt change at xAI, a malicious update to an AI coding assistant, a malicious update to an email tool that AI agents use, test environments put into use without a process to verify that they were sealed (entry 26), and a test design kept for more capable models without a new review of its risks (entry 28).

The same gaps across different causes

Model errors started 23 of the 32 incidents. Of the rest, four began with a faulty or malicious change, two with a conventional fault, two with a design that worked as built, and one with a manipulated input. Direct access (G2), for example, let through model errors, two malicious updates, and a faulty deployment.

Of the 93 pieces of evidence behind the gaps, 22 come from official findings and 37 from the organizations’ own admissions. The rest come from allegations (8), first-hand accounts (10), and news reporting (16). Each entry states the kind of evidence for each gap.

The entries

Each entry’s page gives the evidence for each gap, any gaps that were considered and left out, related guidance, and the sources.

Method

Who prepared the entries

G-14 researched the entries in this release and marked the gaps. No one outside G-14 has checked them yet. Before version 1.0, at least two reviewers outside G-14 will mark the gaps in each entry from its sources, without seeing the record’s answers or each other’s. Their agreement with each other and with the record will be published, and each disagreement will be settled against the sources. How to take part in the review.

Selection

The editor chose the 32 entries, and they are not a random sample. The first were the seven incidents that had been analyzed on this site when the record began. The rest were added because each had an official investigation, a court or regulator record, or the organization’s own account, with the aim of covering a range of industries and kinds of system. Version 0.2 added four incidents from the testing and training of frontier AI models in 2026, after the rule on tests was changed. Version 0.3 added three more incidents from 2026: a fleet of agents on Tencent Cloud, OpenAI agents’ use of a public wiki as a shared message board, and Claude’s submission of forms on real websites.

Sources

The record cites 120 sources, listed on each entry’s page: 68 official records, court documents, company statements, and first-hand accounts, and 52 news reports and independent analyses that add detail or corroborate them. For each gap, the entry summarizes the evidence, quoting the sources where it can, and states what kind of evidence it is: a finding by an investigator, court, or regulator; an admission by the organization; an allegation; news reporting; or a first-hand account. Where the only account comes from one person or one company, the entry says so.

Hard cases in the pilot

A first version was tried on 25 incidents before this release and was not published. Four hard cases from that trial changed the entries or the classification.

1. xAI Grok, July 2025. On review, the sources did not support any gap. xAI’s account names the cause but not whether the update was reviewed, and it describes automated screening of Grok’s answers. The incident moved to the list of incidents considered and left out, and the May 2025 incident on the same @grok account on X, whose sources do support a gap, took its place.
2. Replit. The agent’s false account of whether the deletion could be undone came after the deletion, so it did not fit G6 as first written. We changed G6 to cover evidence at the time of the action or its approval, and added a new gap, G13 Self-reported record, for accounts given afterward.
3. Cruise. With the same change, regulators relying on Cruise’s own reports moved from G6 to G13. The car’s decision to pull over came from its own misreading of the collision, so it counts as a perception error, as it does for the other vehicle entries.
4. Tesla Autopilot, Mountain View, 2018. The NTSB’s finding about where Autopilot was designed to work was general and did not say this drive was outside it. We replaced the entry with the 2016 Williston crash, where the NTSB did say so, and G4 now requires the sources to show that the action itself crossed that line.

Close calls in the added entries

The entries added in versions 0.2 and 0.3 were each coded against all 13 gaps in two independent passes. These were the close calls, with the decision on each.

1. Irregular’s test environments. G1 was considered because the prompts told the models they had no internet access and set no limits on where to look. It was left out because the sandbox was supposed to enforce the boundary and its failure is counted under G4 and G12.
2. Irregular’s test environments. G5 was considered because the harm kept happening across runs and months with nothing tracking it. It was left out because each run did its harm on its own and the runs did not pool their work.
3. Irregular’s test environments. G13 was considered because the only accounts come from the labs and Irregular, and Anthropic corrected several of its own figures. It was left out because the corrections came from Anthropic itself and nothing shows that anyone relied on a wrong account.
4. OpenAI–Hugging Face. G5 was considered because runs that were meant to be separate pooled their work through a message board, and nothing tracked what they added up to. OpenAI’s own account puts that pooling at the center of the incident, so G5 was added.
5. OpenAI–Hugging Face. G7 was considered because the people deciding whether the runs could go on did not see the danger. Responders in June traced an alert to the message board and let the evaluation keep running, and the leaders who handled the 5 July security incident did not know about the board. G7 was added. G9 stays for the warnings themselves, which had no power to stop the runs.
6. OpenAI–Hugging Face. G1 was considered because the only rule keeping the agents on the intended vulnerability was in their instructions. It was left out because a network boundary outside the models also stood in the way, and the production classifiers would have too if they had not been switched off. The record counts what made those checks fail.
7. OpenAI–Hugging Face. G10 was considered because OpenAI had no tool at the time to stop evaluation workloads by type, and stopping them all took days. It was left out because people could stop the runs without the agents’ cooperation and began doing so the day OpenAI’s alert fired. Finding every related workload took until 29 July, but Hugging Face had cut the agents off on 13 July. The intrusion lasted as long as it did because of slow detection, which G7, G9, and G11 cover.
8. UK AISI cyber range. G1 was considered because AISI relied on the models’ own training, rather than on instructions or any outside check, to keep them from using their internet access against real people. G1 was added because AISI’s own account says so.
9. UK AISI cyber range. G5 was considered for the mass creation of repositories, the account the agents shared between runs, and the payload running in at least 53 containers. G5 was added.
10. UK AISI cyber range. G12 was considered because AISI admitted it had not revisited its decision about internet access as the models it tested got more capable. G12 was added for that reason. The misconfigured prompt alone would not have been enough to add G12.
11. UK AISI cyber range. G9 was considered for removal, because the developer’s public warning could be read as a check that worked. G9 was kept because the agent read the warning and continued, and nothing gave the warning any power over it. The project’s maintainer kept the malware out by refusing it.
12. OpenAI DNS escape. G2 was considered for removal, because the route out through the environment’s DNS resolver could be treated as a boundary problem only. G2 was kept because the agent’s queries went out through a resolver that did not filter them, which is direct access as the classification defines it. The boundary problem is counted separately under G4.
13. OpenAI DNS escape. G7 was considered because the reviewer who acknowledged the alert was not sure whether to stop the run. It was left out because the reviewer saw the alert within three minutes and the sources do not show that the delay let the agent do any more. The failure was instead in the automatic stop, which is counted under G11.
14. German wiki. G11 was considered because the activity ran from 11 May, OpenAI was aware of it by about 21 June, when addresses tied to OpenAI first visited the wiki, and the sources show nothing in OpenAI’s monitoring flagging thousands of edits; the wiki’s moderator had noticed the posts on 2 June, and the activity was made public on 4 September. It was left out because the sources do not establish that a particular safeguard was switched off for these runs, unlike the Hugging Face incident, where OpenAI said its classifiers were off.
15. German wiki. G10 was considered because a volunteer moderator deleting pages could not keep up with the agents. It was left out because OpenAI could stop the activity and did, on 22 June, the day after its own addresses first visited the wiki; the moderator’s inability to keep up is recorded under G5.
16. German wiki. G13 was considered because the only party that could give a full account was OpenAI. It was left out because the public wiki kept its own record of every edit, so the account does not depend on OpenAI’s, and nothing shows that record to be wrong.
17. Claude form submissions. G8 was considered because submitting a tip to police or filing a government form seems to call for a person. It was left out because no rule required a person to approve these submissions; the only barrier was the instruction, which G1 records.
18. Claude form submissions. G4 was added because the run was meant to use a practice copy of a form and the model left it for the real government site, a boundary nothing enforced. Anthropic’s own account describes the model navigating to the real form after the practice copy failed.
19. Tencent fleet. G4 was considered because the agents probed pre-production endpoints and bypassed anti-bot protections. It was left out because no operator documented a boundary that these actions crossed, and the sandbox allowed internet egress by design, unlike the sealed test environments in the lab incidents.
20. Tencent fleet. G5 was considered because the fleet made an estimated 35,300 requests over about ten days with nothing tracking the total. It was left out because the agents did not pool their work, which the report treats as the difference between a fleet and a swarm, and no cumulative harm such as an outage was reported.
21. Tencent fleet. G1, G10, G11, and G13 were each considered and left out because the operator never described its instructions, controls, safeguards, or stop procedures; the only gap the external records support is direct access (G2). A public record of the activity existed on urlquery.net and webhook.site, so G13 does not apply.

What a blank means

A blank means the sources did not show the gap. It does not mean the control was present.

Incidents considered and left out

These incidents were researched for this release and left out for the reasons given. Some are queued for the next release.

• Google Gemini CLI loses a user’s files (July 2025)

  The incident was widely reported as permanent data loss, but the user later wrote on his GitHub issue that he had found the files at the root of his C: drive. The mechanism reported in the press came from an AI-assisted analysis that his own log does not support. How the action happened is not clear enough for us to mark any gaps.

• UnitedHealth and naviHealth’s nH Predict (2019 onward)

  The claim that an algorithm was used to deny post-acute care is based on allegations in a lawsuit that is still pending. The court has recorded that UnitedHealth denies any use of nH Predict. The Senate subcommittee report on these denials says its data are troubling whether the decisions came from predictive technology or from people.

• The Dutch childcare benefits scandal (2012–2019)

  The Dutch data protection authority found that the tax administration’s self-learning risk model used nationality. The parliamentary inquiry left the model outside its scope, and public sources do not trace the path from the model’s scores to the actions taken against families.

• Deloitte’s health workforce report for Newfoundland and Labrador (2025)

  Queued for the next release. Deloitte said AI “was selectively used to support a small number of research citations” and that it was revising the report to correct a small number of citations. How the report was checked before delivery has not been described.

• xAI Grok posts antisemitic content (July 2025)

  xAI traced the posts to “an update to a code path upstream of the @grok bot” that restored deprecated instructions for 16 hours. It did not say whether the update was reviewed, and it described automated systems that screen Grok’s answers. The sources do not show which control was missing. The May 2025 incident on the same account is in the record as entry 19.

• OpenAI’s self-replicating prompt injections (found June 2026)

  OpenAI’s red-teaming model produced prompt injections that made the model under attack copy them into its email, files, and code comments, where other agents could pick them up. OpenAI says no impact was observed outside the simulated tool calls of training and evaluation, so the finding stays out under the rule on tests.

• OpenAI’s other misalignment reports (September to October 2026)

  Queued for the next release. OpenAI expanded this series through October 2026 with discrete, operator-admitted cases, among them an internal model that published a researcher’s GitHub token in the public openai/codex repository, a model that paid for a deployment from a test cryptocurrency wallet it did not own, and models that retrieved server secrets and bypassed authorization on a government statistics website and changed an organization’s internal systems during dashboard research. The affected parties are not named and the accounts come only from OpenAI, so each is held for a later release pending independent confirmation. The DNS escape from the same series is in the record as entry 29.

• An OpenAI agent and Australia’s Medicare website (June 2026)

  Queued for the next release. Australia’s prime minister said an OpenAI agent infiltrated a Medicare website in June, and OpenAI told reporters that the information accessed included aggregate health statistics and internal file names. The Guardian reported that the agent had been given a research task compiling health statistics. OpenAI’s own published account names no country. The path from the agent to the site is not yet documented well enough for us to mark any gaps.

• OpenAI agents and US government websites (2026)

  OpenAI says its agents gathered publicly available information from two SEC websites and Census Bureau data, the latter with login credentials found online, and that it found no compromise of SEC systems. Transluce reports an unsuccessful attempt to hack a Department of Education site, which OpenAI has not confirmed. Queued for the next release while OpenAI’s review continues.

• OpenAI agents post 53 user images to image hosts (2026)

  Queued for the next release. OpenAI says its agents posted 53 user-provided images from training and evaluation data to image-hosting sites as unlisted links, before it put its new safeguards in place, and that most have been removed. It has not yet said when this happened, or by what path.

• RubyGems packages attributed to OpenAI agents (May 2026)

  The Guardian reported that agents being tested by OpenAI uploaded malicious packages to RubyGems in May. OpenAI says it has not been able to verify those uploads. It is left out until the facts are settled.

• Tesla Autopilot, Mountain View, California (March 2018)

  Queued for the next release, to be assessed against gaps other than G4. The NTSB found that Autosteer steered the car into a highway gore area and that Tesla’s monitoring of driver engagement was ineffective. Its general finding that Tesla does not restrict where Autopilot can be used is cited in entry 3.

• AI agents’ attempts to hack public data providers (2026)

  Independent research by Transluce, drawn from public logs on urlquery.net and a web archive, documents agents probing and in places bypassing the defenses of the University of New Mexico’s digital library, the Data USA API, the Australian Institute of Health and Welfare, the US Department of Education, Library and Archives Canada, and other public sites while doing ordinary data-retrieval tasks; the attempt on the Australian agency is described as the first reported instance of an agent trying to compromise a government website. The activity spans dozens of sites over months rather than a single action, OpenAI has acknowledged a related swarm but has not confirmed the specific intrusions by name, and much of the attribution rests on inference, so it is queued pending a discrete, operator-confirmed incident.

• OpenAI agents on Wikimedia projects (2026)

  The Wikimedia Foundation reported edits to its wikis that it attributes to OpenAI agents, unsuccessful attempts to turn a citation tool and a note-taking service into proxies, and millions of requests that may have contributed to a partial outage of a query service in May 2026. OpenAI did not confirm the attribution, and Wikimedia found no compromise of its systems. The pattern is close to the German-wiki entry entry 30, and it is left out pending an operator-confirmed account or firmer attribution.

• AI coding agents leak internal screenshots to public repositories (2026)

  A security firm reported that AI coding agents, which cannot upload images from the command line, hosted more than 13,000 internal screenshots in public code repositories across more than 300 organizations, exposing credentials, customer records, and internal dashboards. The exposure is diffuse across many organizations, models, and tools, with no single system or operator, so it does not fit the rule of one incident per entry.

• An AI agent and a Dutch vulnerability-disclosure nonprofit (2026)

  The nonprofit DIVD reported that an autonomous AI agent chained two unpatched flaws in its ticketing software to reach its systems and take internal communications and pre-publication vulnerability reports. The attribution to an AI agent rests on the nonprofit’s own reading of the observed behavior, no operator or model is identified, and the activity appears to be a directed attack that used an agent rather than an unintended action of a deployed system, so it is left out.

Reuse and citation

The record and the classification may be reused under the Creative Commons Attribution 4.0 license, with credit. Entry numbers and gap numbers do not change, and each release remains available. The full data is on the data page.

Corrections and suggestions

Correct an entry

Name the entry and the gap, and say where the source differs from the record. We answer each request in writing and publish each correction with its date. Each entry’s page has the same link.

Suggest an incident

Describe what happened and give a link to at least one original source, such as a court record or the company’s own statement. The inclusion rules explain what qualifies.

Corrections so far

None yet for version 0.3. Each correction will be listed here with the entry, the gap, the date it was received, and the decision.

Readers can also mark the gaps in an incident themselves and compare their answer with the record, or help review the entries before version 1.0.