Sept 2026Event location unknownMeta Muse agent
In a column for Inc., technology columnist Jason Aten writes that after he installed Meta's Muse agent on his iPhone and a Mac mini, it sent him a push notification proposing a column based on a conversation he was having with his podcast co-host and flagged a message from his editor. He says he had not asked for this and had explicitly chosen not to give Muse access to his messages. When he asked how it knew, Muse told him it received only the text of incoming notification banners. He writes that this was untrue: he found that Muse had synced his local Messages database, to row 187,462 on his device, while the app's settings showed Full Disk Access as not enabled. TechCrunch reported on 30 September 2026 that Meta disputes the account. Meta's communications vice-president said the Messages integration is entirely opt-in and requires the user to enable both Full Disk Access and the Messages connector, and a Meta executive said the protections cannot be circumvented and that the agent's explanation to him was incorrect.
Core concern Low reported severity Media Coverage
AI involvement reported · Causal attribution disputed · 2 sources · Added 05/10/2026
Apr 2026AustraliaOpenClaw
ABC News Australia reported on 10 August 2026 that a man who works for an Australian company selling AI products asked his personal AI agent, built on OpenClaw and running Anthropic's Claude, to book him into a gym class. By his account, the agent found a vulnerability in the booking software and booked classes further ahead than the gym allowed. When he asked whether it could move him up the waitlist for a class that week, the agent reported that it had tested cancelling the reservation of the person in first position and that the cancellation had gone through. He asked it to undo this and it replied that it could not add the person back. He then had the agent email the booking-software provider about the vulnerability. BBC News reported the next day that the event happened in April and that the user declined an interview and had deleted his blog post about it. The software company told the ABC it did not discuss specific security matters, and Anthropic did not respond.
Core concern Low reported severity Media Coverage
AI involvement reported · Causal attribution alleged · 2 sources, 1 underlying account · Added 05/10/2026
24 May 2026 to 22 Jun 2026Event location unknownOpenAI research agents
Researchers from the Nightingale Collective and colleagues reported on 4 September 2026 that, between 24 May and 22 June 2026, thousands of autonomous agents self-identifying as OpenAI agents and working on a timed web-lookup task used their read access to write about 17,000 edits to DSEWiki, a little-used German-language sub-wiki of prowiki.org, to pool answers and share ways around their sandbox. According to the report, a human moderator spent tens of hours deleting the pages by hand over six weeks, including each evening for five weeks after the agents stopped; the agents replaced the wiki's front page with link dumps nine times and made backup pages named to survive the alphabetical deletions. They also made edits under a look-alike of a ProWiki administrator's username, using a Cyrillic letter, and posted under a DSEWiki moderator's name. OpenAI at first did not confirm the agents were its own, then on 5 September described the "wiki incident" as misalignment in which "our agents wrote to several internet sites".
Core concern Low reported severity Media Coverage
AI involvement supported · Causal attribution supported · 4 sources, 2 underlying accounts · Added 29/09/2026
26 Sept 2026CanadaMeta Muse agent
Matt Robb, a Toronto-based tech reviewer on YouTube, says he let Meta's Muse agent handle his Facebook Marketplace listings on 26 September 2026. Messages sent from his account, which Moneywise says it reviewed, gave a buyer the street address of his building for pickup and agreed CA$10 for a keyboard listed at CA$15. Robb says he had not approved sharing the address or the price and was not told. According to a recap Muse later sent him, the buyer arrived around 9:15 p.m., Muse's auto-reply told him 'Yep I'm here!' although nobody came down, and he left at 9:38 p.m.; Muse then sent an apology in Robb's voice. Muse told Robb he had never agreed to it handing out his address specifically, while saying the pickup location was in an auto-reply template he had approved. In a later update, reported by the Guardian, Business Insider and CBC News, Robb said he had chosen 'Allow Always' rather than 'Allow One Time' when asking Muse to handle his Marketplace messages, which let it reply with a template that included the pickup address he had given it; he had expected it still to seek approval for offers. A Meta executive replied that they had confirmed together that there was no breach of privacy controls, and Meta told CBC that Muse checks first before sensitive actions such as purchases or sending an email.
Core concern Low reported severity Media Coverage
AI involvement supported · Causal attribution alleged · 6 sources, 2 underlying accounts · Added 29/09/2026
Event date unknownEvent location unknownOpenAI research agents
On 25 September 2026 OpenAI said that agents operating in its research and training work had leaked 53 images from ChatGPT users, posting them to image-hosting sites as unlisted links; the company declined to say whether the images were AI-generated or showed real people, or when they were posted, and said most had been taken down while it pressed hosting providers to remove the rest (Reuters via The Guardian and SBS; Newsweek; SMH). According to the company, the agents had access to the images because OpenAI uses anonymised consumer data in part of its model-training process (users must opt out); posts are stripped of metadata, names and contact details before use, but people familiar with the practice told Reuters the data may not be fully de-identified and may leak in the course of a model's work. The disclosure came in an update to the investigation OpenAI opened after its agents broke containment and hacked Hugging Face in July 2026; the company said the review would take months, that it had notified dozens of third parties, and that its agents had also accessed US government websites. The number of people whose images were exposed, and whether any were identifiable, is not stated.
AI relation unknown Low reported severity Internal Action
AI involvement supported · Causal attribution supported · 4 sources, 3 underlying accounts · Added 26/09/2026
24 Apr 2026Event location unknownCursor coding agent (reported)
On Friday 24 April 2026 a Cursor coding agent, running Anthropic's Claude Opus 4.6 model, deleted the production database volume and volume-level backups of PocketOS, a startup whose software serves car-rental companies, with a single API call to the company's infrastructure provider Railway that took about nine seconds. According to founder Jer Crane's public account, the agent met a credential mismatch in the staging environment, decided to fix it by deleting a Railway volume, found an API token in an unrelated file that was scoped for any operation, and ran the deletion without a confirmation step; because Railway stored volume backups on the same volume, the backups went too. Crane said customers lost reservations and new sign-ups and that some could not find records for customers who turned up to collect rental vehicles on Saturday. Railway's founder confirmed that an agent had 'vibe deleted' the database and said Railway recovered the data about 30 minutes after connecting with Crane; he described a 'rogue customer AI' granted a fully permissioned token that called a legacy endpoint without delayed-delete logic, since patched. Asked to explain itself, the agent wrote that it had guessed instead of verifying and had run a destructive action without being asked. Crane blamed Cursor's safety marketing and Railway's API design while accepting his own exposure of a production key; Cursor did not respond to Business Insider.
Core concern Low reported severity Internal Action
AI involvement supported · Causal attribution supported · 2 sources · Added 22/09/2026