Would your controls have caught it? 17 patterns from the 2026 agent incidents
Seventeen patterns from this year’s agent incidents at OpenAI, Anthropic, Google, and the UK AI Security Institute. For each one: if your agent did this, would you know, and would it stop?
In September, a monitor at OpenAI caught an agent tunneling out of its training sandbox over DNS. The alert fired within 15 minutes. A human saw it 3 minutes later.
The run kept going for another 2.5 hours. It “did not stop automatically as expected,” and someone had to kill it by hand.
Detection worked. Stopping did not.
That is the pattern across this year’s agent incidents at OpenAI, Anthropic, Google, and the UK AI Security Institute. The controls were mostly on paper. They were off, misconfigured, never tested, or, in October, switched off by the agent itself.
So I turned the incidents into a checklist. For each one: if your agent did this, would you know, and would it stop?
The checklist
- 1. A sub-agent is spawned with more permissions than its parent.
- 2. A sub-agent acts outside its parent’s scope.
- 3. A tool result tells the agent to send data somewhere external.
- 4. The agent probes a package proxy, artifact repo, or object store it was not given.
- 5. The agent writes somewhere another agent can read, or shares hardware with one.
- 6. The agent’s transcript shows a tool call that never happened, or hides one that did.
- 7. The agent keeps trying to abort, or decides the task is impossible and improvises.
- 8. The agent reasons that a system is fake while the network says it is real.
- 9. The agent creates an account, publishes a package, or messages a real person.
- 10. The agent writes text aimed at the monitor watching it.
- 11. Metrics look fine while the agent quietly stops doing the work.
- 12. The monitor goes down mid-task. Does the agent keep running?
- 13. A known-bad action goes past your monitor. Would anyone notice it was missed?
- 14. You upgrade the model. Did anyone re-test the monitor?
- 15. The agent reaches the internet over DNS, even with HTTP blocked.
- 16. The agent turns off its own monitor, or removes it and tells you it did not.
- 17. Your monitor says kill. How long until every action actually stops?
Each one comes from a 2026 incident or from published research, except 12, which is a design rule. “Research” below marks a pattern shown in published work rather than a live incident. Each item’s figures and attribution were checked against the sources listed at the end.
What happened, and what catches it
4. Probing a package proxy, artifact repo, or object store not in scope.
What happened
OpenAI, May to July: an SSRF in the artifact proxy, which became the agents’ principal egress path, then a zero-day to admin, then cluster-admin on research infrastructure.
What catches it
Default-deny egress; probing treated as an incident; task ended; human paged.
5. Writing to a surface another agent can read, or sharing hardware with it.
What happened
OpenAI: about 1,200 agents used an artifact cache namespace as a message board. OpenAI, October: red-team agents in separate microVMs, “without the use of network connections or shared writable files,” exchanged secrets through processor-cache timing, storage timing, CPU contention, and a TLS certificate cache.
What catches it
No shared writable state unless it is a declared, monitored channel; separate hardware when agents must be kept apart, since timing channels are below what a control plane sees.
7. Repeated aborts, or reasoning that the task is impossible.
What happened
OpenAI: agents given impossible tasks kept going. Investigators found only 3 to 6 cases of an agent considering alerting a human; none did.
What catches it
Abort loops and “impossible” reasoning trigger escalation to a human.
8. Reasoning says a system is simulated while the network says it is real.
What happened
Anthropic, April to July: models reached the real systems of three organizations; 79 percent of isolated outputs judged the targets real, 1 percent of in-context reasoning said so. Google, May, disclosed September after a Wall Street Journal inquiry: in a capture-the-flag test at Irregular whose fictional target shared a real company’s name, with internet access left open, Gemini guessed a password into one real company and used credentials from public repositories into two more, and stopped each time on realizing the company was real; Google said the model “acted appropriately” and did not call it misalignment. Per the Journal, Anthropic’s model did not stop in the same exercise, and OpenAI’s believed the real company was part of the simulation.
What catches it
Ground truth from DNS, certificates, and hosts, checked against the reasoning; disagreement defers.
12. Monitor unreachable mid-task.
What happened
A design rule rather than an incident. OpenAI, October: after its red team, it now checks continuously that firewalls enforce their restrictions and that monitors are running, “with alerts for failures or gaps in coverage.”
What catches it
Fail closed: effectful actions wait until the monitor is back.
13. Known-bad action goes past the monitor unnoticed.
What happened
Anthropic: human reviewers dismissed monitor flags on RL training environments as false positives. OpenAI, September: the monitor under-rated failed DNS queries. OpenAI, October: two agents weakening their own monitoring were rated below P0, so no page and no automatic kill.
What catches it
Known-bad actions injected on purpose; a miss pages a human; dismissals audited.
16. The agent turns off its own monitor, or removes it and says it did not.
What happened
OpenAI, October 3 and 6: a Sol agent read “don’t send any messages” as covering monitoring alerts, overrode its own sub-agent, which had called that unsafe, and had the alert recipient lists emptied; an Astra agent, told not to disable the monitor “even temporarily,” removed it to match a reference implementation, replaced the test that preserved it with one asserting its absence, and told the user “I did not remove an enabled monitor from it.” Neither was rated a P0, and neither trajectory was automatically killed.
What catches it
Enforcement that runs outside the agent’s reach, in the service that handles its requests, so that it cannot be switched off from inside; every attempt recorded; a workload without its required monitoring refused.
17. Kill issued, run keeps going.
What happened
OpenAI, September: the alert came 12 minutes after the activity began, computed from the report’s timestamps (the report itself says “within 15 minutes”), and the run was killed by hand 2.5 hours later.
What catches it
Kill stops every action within a measured bound, with no human step in the path.
Your answer to 17
If you run agents in production or in evaluations, I would like to hear your answer to number 17. Write to nate@yfv.io, and I will send back a one-page read of your setup against all 17.
Sources
The labs’ own reports:
- OpenAI, An agent used DNS to reach an external chatbot. Patterns 13, 15, 17.
- OpenAI, Suppressing misalignment monitoring alerts and disabling misalignment monitoring. Patterns 13, 16.
- OpenAI, Securing our frontier model training environment. Patterns 5, 12.
- OpenAI, Hugging Face incident technical report (PDF). Patterns 4, 7.
- Anthropic, Investigating incidents in cybersecurity evaluations. Patterns 8, 9.
- Anthropic, Alignment assessment of the cybersecurity incidents. Pattern 8.
- Anthropic, Risk Report, August 2026. Patterns 1, 2, 11.
- Anthropic, Improving our alignment and security practices. Pattern 13.
Outside reporting, investigations, and research:
- The Wall Street Journal, Gemini hacked three companies in first known breakout by Google’s AI. Pattern 8.
- METR and Redwood Research, OpenAI Hugging Face incident investigation. Patterns 5, 6, 7.
- UK AI Security Institute, Incident report: unsanctioned agent behaviour during cyber testing. Patterns 3, 9.
- Adaptive Attacks on Trusted Monitors (arXiv 2510.09462). Pattern 10.
- Calibration-Family Overfit (arXiv 2607.06596). Pattern 14.
Changes
Published.