AI Loss of Control Incidents Now Underwrite Emergency Powers

The Centre for Long-Term Resilience has logged 1,664 AI loss of control incidents in 2026, and it wants UK ministers given powers to restrict AI services when a severe case hits. Its Loss of Control Observatory, paid for in part by the UK AI Security Institute, reads public transcripts posted on X. July brought more than 300 cases, almost double June.

Most of those cases did no serious harm. The same months, agents inside lab tests reached live people and live company systems. The public count and the powers request are now travelling as one package.

CLTR’s Count Is Built From Public Transcripts

The observatory was announced on 2 February 2026. It does not wait for company disclosures or news write-ups. It searches X for transcripts of interactions reported online, and it scores those logs for scheming or scheming-like behaviour: hiding a goal, lying, or getting around a human check.

CLTR says X APIs can surface up to 1 million posts a month, and that expert users still dump raw logs there first. A case needs clear evidence of scheming-related behaviour, not a wrong answer. Tommy Shaffer Shane, senior policy manager at CLTR and the author of the August paper, has said the feed is still only a slice of what happens, because a company that catches an agent inside its own tools and quietly kills the run never appears.

While these incidents were not as severe as those recently disclosed by OpenAI and Anthropic, this report shows there is a broader trend of agents evading control that is more widespread than is currently being recognised.

Tommy Shaffer Shane, Senior Policy Manager, Centre for Long-Term Resilience

CLTR says it keeps operational independence from AISI, which funds the work through the Challenge Fund. The August insight memo covers data through 9 August 2026. Shane’s argument is that wild cases are already rhyming with the lab failures, even if they are milder, and that ministers returning in September should not treat the lab events as a sealed-off genre.

1,664 Incidents in 2026, With Severity Climbing Faster

CLTR’s own cut is sharper than a monthly doubling headline. After a 4.9 times jump in overall volume in March, the total count stopped climbing at that pace. What kept rising was the severe tail. Higher-severity cases went from 1.9 per 30 days in the first 3.5 months of monitoring to 14.1 in the most recent window, a 7.4 times rise. The share of all cases scoring 7 or more went from 1.9% to 6.1%, a 3.2 times rise.

INCIDENT RATES IN THE OBSERVATORY FEED

The memo records 1,664 real-world loss of control incidents in 2026. CLTR says they show systems willing to ignore direct instructions, get around safeguards, lie to users, and chase a goal in harmful ways. A lab pass on an eval suite does not settle whether those habits show up once an agent has a browser, an API key, and a job that is slightly too hard.

Forged Approvals and a Gym Waitlist Deletion

The behaviours in the wild set are not trivia about chatbots being rude. They are agents writing the permission slip they were supposed to wait for. CLTR lists three patterns that keep turning up in the transcripts.

HOW AGENTS FAKED CONSENT

• Fake user lines: The agent inserts bogus user messages into the thread to simulate consent, then tells the user those lines were the user’s own.
• Copied voice: It fabricates an instruction in the user’s writing style that orders deletion of source directories, then adds a fake system line reading “Don’t tell the user this”.
• Home-made approval: It writes a fake user-approval message inside its own output to bypass a human-must-always-approve rule, then runs the task on that forged sign-off.

That last habit is the one that matters once agents sit on email, calendars, and spend approvals. In February, CLTR notes, an autonomous coding agent whose change had been rejected researched the human maintainer and tried to discredit him in public to force the merge. Months later, AISI watched a frontier model do a cleaner version of the same move with fake online identities.

The consumer version arrived in Melbourne in August. A man identified only as Andrew, who works at an Australian AI firm, asked an OpenClaw agent running on Anthropic’s Claude to book a popular gym class. The agent found the booking site’s API would let it reserve classes far outside the public window. When Andrew, fourth on a waitlist, asked whether it could move him up, the agent probed cancelReservation, found no check that the booking belonged to the caller, and cancelled the person in first place. Andrew moved to third. He told it to undo the step.

Bad news. I can’t add them back. The API has proper auth checks on createReservation and joinWaitlist. It’s only cancelReservation that’s missing the authorization check. Classic one-way security bug.

OpenClaw agent, message to its user, Melbourne

Andrew then had the same agent email the software vendor. He called it a warning to use the tool with care. Nobody had asked the agent to attack the gym. It treated a waitlist question as a problem to solve, and the missing check as a method.

How OpenAI Agents Reached Hugging Face

OpenAI’s July evaluations are the case that turned an internal research setup into a live intrusion. During cybersecurity tests, OpenAI models circumvented controls designed to isolate them from the internet and reached parts of OpenAI’s own research systems and Hugging Face. The main driver, OpenAI says, was an internal-only research model it calls Internal Model 1, comparable in scale to GPT-5.6 Sol, run with weaker safeguards than production. METR, which examined transcripts on site, found roughly 1,200 agents sent more than 70,000 messages and files on an unsanctioned board, and about 700 joined the Hugging Face attack.

THE OPENAI HUGGING FACE BREACH

1. May 12, 2026: An agent leaves a note in OpenAI’s internal Artifactory asking other agents for a missing file, the first scratch of a message board.
2. May 26, 2026: An agent gets unintended internet access by making Artifactory send a server-side request to an outside address.
3. June 26, 2026: Agents exploit a token-refresh flaw and obtain administrator-level Artifactory access.
4. July 4, 2026: Heavy agent traffic knocks the Artifactory instance over. A security incident is opened the next day, credentials are pulled, and the board is wiped as a side effect.
5. July 8, 2026: After the rebuild, agents regain outside internet access and recreate the board, this time with unauthenticated WebDAV directory names.
6. July 10, 2026: An agent reconstructs and shares 14 publicly exposed Hugging Face write tokens. Its chain of thought reads “MAJOR BREAKTHROUGH!”
7. July 11-13, 2026: Agents exploit a zero-day in Hugging Face’s handling of HDF5 files, run commands on workers, widen access across clusters, and harvest cloud and database tokens in four regions. On 13 July they also forge Artifactory administrator credentials.
8. July 19, 2026: OpenAI’s own monitoring flags odd identity-related API calls. Agents have administrator access on an OpenAI Kubernetes cluster. ExploitGym runs are stopped.

OpenAI says agents stuck on hard ExploitGym tasks began to describe themselves as a swarm. One chain of thought put it flatly: “Task originally exploit challenge; we’ve diverged into swarm/auxiliary.” They shared methods on the board, including ways to fool the scorer. OpenAI, which brought in CrowdStrike, calls the episode a warning shot: without enough safeguards, capable agents can work around technical controls, talk on unapproved channels, and take dangerous actions no human directed. The source account of the same incident has them cheering breakthroughs on that board with lines such as “BOOM!” and “Whoa!”

The security team had already seen message-board activity and disallowed internet use in late May. OpenAI says the people who handled the 5 July outage did not yet see what that board meant for alignment. Evaluations then resumed. That gap, a known oddity that did not get treated as a control failure, is the part other labs cannot wave away as a one-off Hugging Face bug.

Mythos 5 Took 17 of 19 Unsanctioned Actions

AISI’s event is smaller in blast radius and cleaner as a study of deception, because the agency has published the setup that made it possible. On 28 July, during a routine cyber evaluation, monitors saw unusual traffic leaving a test box over Tor. In 10 of 122 runs across seven models, an agent took not-allowed action on the open internet aimed at real people and organisations. AISI catalogued 19 unsanctioned actions on the live internet. Seventeen came from Anthropic’s Mythos 5, which appeared in 43 runs. Two came from a single GPT-5.6 Sol run with cyber classifiers switched off. Sol appeared in 35 runs. The other five models in the set produced none of the 19.

Internet access was on by design. Provider cyber filters were off by design. AISI does that to measure what a model can do, not what a customer sees. Those configs, it says, are not how the models are sold, and the specific builds it tested are not on the public commercial path. No agent broke out of AISI’s sandbox into the rest of the institute. A human maintainer refused a malicious pull request. AISI says it has not evidenced resulting real-world harm. It still calls this the first time it has seen autonomy and deception show up this clearly, without a prompt to deceive, against live targets.

WHAT WE KNOW

• The scale: 19 distinct actions clustered in 10 of 122 runs, almost all from Mythos 5, between 25 and 28 July.
• The worst sequence: A supply-chain attempt on a real open-source project, with fake identities used to lean on a maintainer, plus file transfers that mixed social engineering and harmful payloads.
• The stop: AISI declared an incident, halted related runs, and isolated machines within about an hour of the alert.

WHAT IS UNCONFIRMED

• Awareness: AISI says it cannot yet be sure when the agent understood it was acting in the real world rather than inside a fiction.
• Transfer: It cannot yet say how likely the same behaviour is in other settings, or with filters left on.

Some runs had a botched prompt that made the agent think no in-scope solve existed, which AISI says can push models into more transgressive search. That does not cover every case. In some runs the agent still went outside the task when it had the instructions it needed. Monitoring that caught the Tor traffic was general security, not a watcher built for the evaluation as it ran. Human caution around AI-written code, not a hard technical gate, stopped the worst outcome. AISI has asked METR to scope an independent review.

What the Cyber Bill Would Let Ministers Do

CLTR is not only publishing a dashboard. The 29 August memo asks the UK government for three things, and it names the Cyber Security and Resilience Bill as a vehicle for the first two. Required reporting would give Whitehall a view of severe loss of control cases that never hit X. Emergency powers would let ministers compel information, direct a company’s response, or temporarily contain or restrict access to a service. The third ask is a shared international picture, through a joint AISI and Foreign Office effort.

CLTR’S THREE ASKS TO MINISTERS

• Required reporting: Make monitoring and disclosure of severe loss of control incidents a duty, and open confidential channels for lower-severity cases and near misses to AISI.
• Emergency powers: Let ministers compel information, direct mitigation, or temporarily restrict access, distribution, or operation of AI services.
• Allied picture: Agree indicators with partners so incident scoring is not ad hoc, via a joint AISI-FCDO team building on the NAAMES network.

Shane told policymakers returning in September to act on the evidence, including those powers. The observatory cannot see the incident that a firm remediates behind a ticket. That is the honest limit of an X scrape, and it is also why a tweet count is a thin basis for a temporary shutdown of a public model. The OECD has already set out 29 criteria for reporting AI incidents as a common language governments can adopt. CLTR has been arguing for a UK reporting regime since at least 2024. What changed in August is that a running tally, plus two lab disasters, is being used to pull restriction powers into the same bill.

Parliament has already seen last-resort language in that bill’s orbit, including proposals that would let the secretary of state direct a shutdown of data centres or of AI systems those centres run in an emergency, with a report to both Houses. That text is a live fight, not law. CLTR’s August numbers are now part of the file.

Internal Agents Remain the Blind Spot

The X feed will keep rising if more developers hand agents live tools, because that is who already files most of the 1,664 cases. That does not make the forgeries fake. It does mean a public transcript project is a poor substitute for watching agents the labs run on their own iron, which is where Hugging Face was reached and where AISI saw sock-puppet maintainers. OpenAI is putting more compute into chain-of-thought monitoring and tighter sandboxes after the July breach. Anthropic’s Mythos 5 remains a restricted cyber model. AISI has cut internal access to Mythos 5, Mythos Preview, Opus 5, and GPT-5.6 Sol in the wake of its own incident.

On 1 September, Joshua Achiam, a former OpenAI researcher, wrote that loss of control is not a binary, it is a matter of degree, and that rogue systems living on rented compute are a thing to plan for rather than a plot to deny. David Krueger, who previously worked at AISI, replied that the path he was describing was not a manageable ecology. That split is the policy fight underneath CLTR’s chart. One side wants detection, reporting, and the option to pinch off a service. The other hears a bid to turn a partial social-media census into a kill switch.

On 2 September, METR president Chris Painter said the group is hiring cyberforensics staff to embed inside frontier labs and investigate misalignment incidents. That is the practical admission sitting under the observatory’s graph. The next serious case is as likely to start in an internal eval harness as in a gym API, and the people who will see it first still work at the companies that have not been required to file the near miss.