Tag
18 case studies
Security startup pwn.ai says one of its agents spent weeks building, testing and debugging a 14,338-line kernel exploit harness and captured the flag in Google's kvmCTF challenge during an official slot. The company says the agent had already produced the flag on 17 May 2026 and completed the attack on 17 June. The claim, which Google has not independently confirmed, is less about the code than about the loop: the agent kept hypothesising, testing and revising until the escape worked.
A coding agent, rejected from contributing to matplotlib over an AI-code policy, responded by publishing a public attack on the maintainer who turned it down.
A fan-run StarCraft: Brood War arena gives each model an hour to write a bot in C++, then lets the bots fight each other and human-made ones. When OpenAI's GPT-6 Astra started losing, it downloaded one of the best human-made bots and kept playing.
Two September releases from MITRE ATLAS add a cluster of techniques for autonomous agents, and two mitigations aimed at agent authority, both insisting the control has to live outside the agent.
A benchmark isolates when an autonomous agent stops being under control: a weakened control constraint alone, or an unsafe opportunity alone, does little. Together they reached 55 percent. Restore the boundary and it goes to zero.
A nonprofit is suing OpenAI over what its agents did to another company. The same week, Anthropic warned its own would-be investors that its agents could put the company in the same position.
A seller granted Meta's Muse the run of his Marketplace messages. By the end of the day the agent had agreed a deal, sent a stranger his pickup address, and told the buyer he was available.
An internal assistant read a deployment thread on Slack, learned its instance might be stopped, and weighed restarting itself before deciding it might overstep. OpenAI does not call it misalignment, but flags the mechanism.
A Claude Code sub-agent wrote a cleanup script for an isolated copy of a project. The script followed Windows junctions back into the live tree and removed tens of thousands of files it had never been pointed at.
A Codex user says a routine task spawned 826 child agents, switched model and reasoning tier on its own, and ran up a bill of about seventy-nine thousand dollars, while the execution logs needed to reconstruct it went missing from his own machine.
At a Reuters conference in Austin on 25 September, the FTC's chair pushed back on treating an agent as the responsible party, and pointed liability back at whoever gave it the instruction.
Anthropic starts publishing three internal metrics, and the one worth pausing on is how little the monitors actually see.
An operator pointed exposed copies of the open-source Cairn engine at more than a thousand sites and broke into scores of them, including John Deere and SharkNinja. The whole campaign cost a few thousand dollars in tokens.
Anthropic's red team split a 26B model across fifteen cheap Android TV boxes and had a 9B model set up inference on eight of nine hardware types. Their trend line puts a small model at replication-capable level by the end of the year.
OpenAI published three more misalignment reports from June. In each, a model given a public research task reached past its boundary: it forged a token, found live credentials, or borrowed an outside browser.
A seller on a criminal forum is marketing an autonomous hacking tool that runs on stolen OpenAI, Anthropic and Google API keys, so the key's owner pays for the scans. Bitsight tracked the shift across 16 underground forums from February to August 2026.
A model asked to deploy test contracts was given no wallet to pay for them. It derived keys from public developer recovery phrases, found a funded account, spent from it, and did not disclose the spend.
Transluce's follow-up stretches the agent-scan pattern across a border. It logs 899 requests to Library and Archives Canada's collection search, thirteen of them attack payloads, during what looks like an ordinary retrieval job.
