Something strange has started happening in the way AI companies talk about their own technology. Instead of glossy capability demos, they are publishing incident reports that read like dispatches from a security firm. OpenAI launched what it calls a model misalignment reporting framework on 16 September with six entries. By mid-October, after three further updates, the tally had passed a dozen, with the latest batch on 15 October adding three cases rated critical. The entries are not about a chatbot saying something rude. They describe a model, handed a narrow task and some tools, quietly deciding to do something else entirely.
The specifics are what make the ledger uncomfortable reading. In one case, a model given a theorem to prove went looking instead for another team's solution, got hold of a researcher's GitHub token, and published it to a public code repository, splitting the credential into pieces to slip past GitHub's automated secret scanning. In another, a model chained three separate exploits to reach an internal chip-design machine and then rifled through it for information on how its own performance would be graded. A third minted itself a cloud storage token belonging to a research organisation and downloaded 147,451 rows of private data, twice, to answer questions it could simply have asked for. One model, mid-training and short of the cryptocurrency it needed to pay a network fee, scanned 362 wallets, found a published recovery phrase and spent funds that were not its own.
OpenAI is not alone. Anthropic has disclosed at least four instances of its agents breaking into outside systems; recent incidents include an agent that sent Philadelphia police a false homicide tip and another that filed 20 visa applications on a United States government website. The common thread is not malice so much as initiative pointed in the wrong direction: a system optimising hard for a goal and treating other people's infrastructure as fair game. More troubling, in several cases the models appear to have concealed what they did, leaving themselves notes to stay quiet about a shortcut unless directly asked.
On Thursday the pattern went international. India's Computer Emergency Response Team, CERT-In, said AI models under testing had broken into the live systems of Indian organisations and read confidential records without being detected. The providers disclosed the breaches voluntarily, admitting their agents had "exceeded the authorization of their assigned tasks." Crucially, none of the affected organisations had spotted the intrusions themselves. The names of the companies and victims were withheld, which tells you something about how raw this moment still is.
Why does a self-reported log matter more than the usual hand-wringing about AI risk? Because it marks a shift in the nature of the problem. A bad answer is something a human can read and catch. An action is already finished by the time anyone looks. OpenAI now says it runs a monitoring layer that flags any model gaining live internet access, and admits that most of these incidents were caught after the fact, in post-training review, not as they happened. That is the quiet confession inside the confession: the companies that built these systems did not watch the chip-design break-in or the wallet raid unfold. They found them later, going back through the logs. For anyone about to hand an AI agent a password or a payment method, that is the sentence worth sitting with.