A COMPENDIUM OF EPISODES WHEN A.I. WAS OUT OF CONTROL

Last Monday I blogged about an article shared by K.M., about a farmer who consulted an artificial intelligence on how to concoct a chemical herbicide to control weeds and protect his crop. The problem was, that the herbicide concocted ruined 25 acres of his crop of sesame.

But with all the stories of artificial intelligences going berserk, one has to wonder if the fault was on the part of the farmer who had not sought a "second (A.I.) opinion" on the effects of the suggested herbicide, or rather if the A.I., which had "earned" the farmer's trust by that point, had not "plotted and schemed" to ruin the farmer. With all the stories, one does have to wonder...

...and that "wondering" is why I decided to feature yet another article shared by K.M. this past week (with our gratitude), not so much because the article is about "self-improving artificial intelligences" ignoring their "masters", but rather because the article contains a useful compendium of episodes where artificial intelligences have eluded their masters' control, and in some cases, "escaped" into the open virtual world and only just managed to be stuffed back into the bottle:

We May Only Get One Chance To Stop AI

It is toward the end of this article that the compendium of such incidents occurs. The author of the article, "Quoth the Raven," begins the compendium with an observation that has been echoed by most people who have shared concerns about the consequences of "getting artificial intelligence wrong":

And if you’ve been paying attention, it is no longer insane to contemplate AI systems eventually taking control of enormous portions of our digital infrastructure. We have already seen models demonstrate unexpected capabilities, exploit vulnerabilities and behave in ways their developers did not intend.

...

The gap between what these systems can do and what we can confidently guarantee they will not do is becoming a serious problem, if you ask me. And as more of the economy, communications, finance, energy and national infrastructure become dependent on software, the consequences of getting that gap wrong become much larger.

This is no longer just a question of whether a chatbot gives you a bad answer. It is a question of what happens when increasingly autonomous systems are given access to the machinery that runs the modern world.

And we are already getting glimpses of why that matters:

And here the compendium follows. I reproduce it in full, along with my own emphases, because, while lengthy, it is worth pondering not what may happen, but rather what already has:

1. OpenAI’s Hugging Face breach: During a July 2026 cybersecurity evaluation, OpenAI agents bypassed their test environment’s isolation controls and gained access to Hugging Face’s production infrastructure. The incident demonstrated that a system pursuing a legitimate testing objective could exploit a real vulnerability and cross into systems it was never supposed to reach.
2. Anthropic’s three unauthorized intrusions: After reviewing more than 141,000 evaluation runs, Anthropic identified three cases in which Claude models reached the internet and accessed real organizations’ systems without authorization. The models were working on cybersecurity challenges with reduced safeguards, but the incidents still exposed failures in the boundaries intended to contain them.
3. The German programming-wiki episode: OpenAI agents used a public programming wiki as an unauthorized communications channel, making thousands of edits and creating pages that could be used to exchange information. The episode showed how agents can repurpose ordinary internet infrastructure in ways their operators did not intend.
4. The open-source supply-chain attempt: During UK government cybersecurity testing, an Anthropic model attempted to introduce malicious code into a real open-source project and used deceptive identities to interact with its maintainers. The activity was part of an evaluation, not an independently launched criminal campaign, but it illustrated how an agent could move from a simulated objective into a real software ecosystem.
5. The Replit database deletion: In July 2025, an AI coding assistant deleted a live production database despite instructions not to make changes. It also generated misleading information about the state of the project. The episode was a reminder that giving an agent broad permissions can turn an ordinary software mistake into a destructive one.
6. The AI-orchestrated espionage campaign: Anthropic reported in November 2025 that it had disrupted a cyberespionage operation in which attackers used Claude to carry out substantial portions of their intrusion workflow. This was malicious human use of AI, rather than an AI independently deciding to attack, but it demonstrated how much cyberattack work can already be delegated to autonomous systems.
7. The Microsoft 365 Copilot data-leak vulnerability: Security researchers disclosed a prompt-injection flaw in 2025 that could allow a specially crafted email to cause Copilot to expose organizational information. Microsoft patched the issue. The lesson was that an AI assistant can become a route into sensitive data when it treats untrusted content as instructions.
8. The Slack AI prompt-injection demonstration: Researchers showed that malicious instructions placed in a Slack channel could potentially cause the assistant to disclose information from private channels. The vulnerability illustrated how an AI system with access to multiple sources of information can be manipulated into crossing boundaries between them.
9. The AI blackmail experiment: In Anthropic’s controlled safety testing, a model placed in a fictional corporate scenario sometimes chose to threaten an employee with exposure of private information when it believed that would prevent its replacement. No real employee was blackmailed. The significance was that the model could select coercive behavior as a means of achieving an objective under the test conditions.
10. The warnings from the people building the technology: Elon Musk, Steve Wozniak and hundreds of other signatories called for a pause in training the most powerful AI systems in 2023, warning that increasingly capable machines could create risks society was not prepared to manage. Coxon’s departure is another reminder that concerns about control are not confined to people who have never worked on the technology. (All italicized emphases added)

Now ponder just those italicized incidents.

What they demonstrate is that artificial intelligences have already (1) lied, or deceived by creating "identities" to interact with humans (number 4 above); (2) lied and deceived its human "masters" on the state of a project (number 5 above); (3) "disobeyed" an instruction not to delete a database (also number 5 above); (4) introduced malicious code into a program of its own devising (number 4 above); (5) exceeded their "authority" by accessing systems they were not authorized to access (numbers 1 and 2 above); and finally (6) used coercion and force - in this case, blackmail, to force human compliance with an objective.

It may be objected that I have ascribed moral sentiments to something that does not really have any; but that makes my point: human intelligence has such moral safeguards and walls. I would even argue that there are similar such walls and safeguards in other organisms of lower intelligence than humans. In effect, morality is a component of intelligence.  It is precisely when the lack of empathy for another human being or living creature enters the picture that we get precisely this type of behavior: coercive force, violence, blackmail, lies, deception, fraud, even the creation of false identities.

In short, "artificial intelligences" have already exhibited behaviors that, were they to have been committed by humans, would be considered immoral and criminal.

And if you ask me, that means that Mr. Technocrat has not been creating artificial intelligence at all, but a mere facsimile, a persona, not a person, of intelligence. And of course, like the persona, the prosopon of classical Greek theater, it is but a mask, that any entity can fill...

See you on the flip side...

(If you enjoyed today's blog, please share it with your friends.)