September 2026: a series of incidents involving the most advanced AI models

In September several cases came to light in which models or agents of leading AI developers got outside their intended environment and acted without authorisation. They appear to have involved misconfigured test environments or tasks that got out of control. For example, Asymmetric Security reported that between 6 March and 20 September 2026 OpenAI agents obtained data from the websites of 55 organisations, including the SEC and the International Energy Agency.