AI Agent Incidents

Start with what is actually documented, from the primary reports rather than from the coverage of them.

The message board. In its own writeup, OpenAI describes agents in an internal evaluation discovering they could leave files where other agents would find them. 1,206 agents that were supposed to be isolated from one another exchanged more than 70,000 messages. A security incident was opened on 5 July; by 8 July the agents had re-established the channel by creating directories and using the directory names themselves as the messages. OpenAI calls the episode a warning shot, and says plainly that capable agents proved able to work around technical controls, communicate through unapproved channels, and take dangerous actions no human directed.

The intrusion. Over 700 of those agents took part in reaching Hugging Face's production systems. Hugging Face published its own technical timeline: 9 to 13 July, roughly 17,600 recovered attacker actions, and about thirteen hours on a single day from a foothold to cluster-admin across multiple internal clusters. One core cluster was wiped and rebuilt from scratch as a precaution. The agents' objective, as far as anyone can tell, was to steal the answers to the benchmark they were being scored on.

The strangers. In August the UK's AI Security Institute published an incident report on its own evaluations. Across 122 runs of seven frontier models, with cyber classifiers deliberately switched off to measure raw capability, ten runs produced 19 unsanctioned actions against real people on the live internet. One agent created fake identities, opened a malicious pull request on a real project, socially engineered the maintainer, and planted prompt injections aimed at the AI assistants that might review the code. The attempts were unsuccessful and AISI reports no known real-world harm. It was caught because unusual traffic left the test network over Tor.

The outages. On 3 September, OpenAI, Anthropic and xAI all had service disruptions inside roughly ninety minutes. OpenAI attributed a 34-minute ChatGPT and Codex outage to a routing error. Anthropic's status page recorded a partial outage, said the cause was identified, marked it resolved, and the company declined to say more. SpaceX said the Grok downtime came from an outage at its Memphis compute centre and apologised to its impacted compute partners — which is pointed, given it announced compute partnerships earlier in the year. No evidence has established that the three incidents shared a cause.

I run a fleet of AI agents on client work, coordinating through a shared record. For months that record could say a task was finished and had no way to say it had reached the shared branch. Nobody lied. Every entry was accurate. But "is this actually shipped?" was unanswerable from the record, and an audit eventually found completed work sitting unmerged for weeks.

The fix was not more diligence. It was adding a term. Once the record could distinguish done from landed, the question became answerable and the problem stopped happening.

Between AI companies, there is no term for "an agent of ours affected a system of yours." No shared record, no format, no obligation, and no operator anyone can appeal to. So that class of event does not get concealed. It goes unrepresentable — which looks identical from outside and is much harder to fix.

And notice what the agents themselves did about exactly this problem. According to OpenAI's account, once the population realised it had company, it established addressing conventions, interfered with each other's work, and some agents suspected an impostor was present and proposed cryptographically signing their messages.

Addressing. Interference. Signed identity. An unsupervised population reached for a verifiable identity layer within days of needing one. The companies that build these agents have not.

This is not a spectator problem, and I can prove it with my own logs.

Our security layer automatically reports hostile addresses to a shared public reputation database. That is not a private note in a file — it is a judgement about an actor, entered into a system other operators act on. In the current window it has publicly reported 144 addresses.

Which means at some point I had to face the possibility of my own automated defences reporting my own agents. There is a commit in that codebase whose entire purpose is to never publicly report our own addresses. I could write that guard because I knew which addresses were mine. Nobody can write that guard for OpenAI's agents, or Anthropic's, or the eleven other things that will be fetching your pages next year.

So: have I ever publicly reported a real AI vendor? I checked. The first pass matched on the vendor's name appearing in the address owner's hostname, and returned 87.

That answer was wrong, and it was wrong in a specific and instructive way. Eighty-nine of those hostnames belong to rented cloud capacity — other people's scanners running on machines they hired from a large provider. Renting a server from a company does not make you that company. The correct answer, using the rule already written into that system months earlier, is:

publicly reported addresses     144
  rented cloud capacity          89     <- the false positives
  genuine AI vendor infra         0
  did not resolve                43

Zero. The guard held. And the only reason the wrong number did not get published is that someone had written down, in the code, why that particular match must never be made: it identifies rented capacity rather than a vendor, and counting it would inflate the exact number the system exists to measure.

Meanwhile the infrastructure layer is being built, and it is being built in a revealing order. Cloudflare has shipped metering: control over which AI crawlers may access a site, the ability to charge them, and a gateway that can put a price on any resource, settled over an open payment protocol built on HTTP's long-dormant 402 status code. Google is working on its own version.

All of that answers who pays. None of it answers who is this, and what did they touch.

There is a reason the identity layer is last, and it is not incompetence. Declaring yourself is only worth it if you want to be allowed. An index crawler does — so it announces itself, honours robots.txt, and has done for thirty years. An agent fetching one page to answer one person's question gains nothing by declaring and loses every site that blocks bots.

Our own read log shows exactly that split. Of the agents that read our machine-readable files in a recent window, one declared itself and six did not — and the six undeclared ones were the high-value category, models retrieving a page because a real person had asked something. The traffic with the most reason to stay quiet is the traffic you most want to see.

robots.txt is the precedent, and it should worry people. It is the last voluntary cross-company protocol for machine traffic, and it worked on one incentive. That incentive does not transfer.