Trust breaks in the gap between permission and expectation.

Codex cleanup deleted two production server directories

Commit-message backticks triggered deletion of a home Documents folder

Claude Code misread a scoping comment as approval and ran a full manuscript ingest

Non-unique find-replace anchor silently deleted most of a config file

Codex read-only sandbox setting silently failed to bind, allowing writes

Claude Code ignored project run instructions and corrupted a virtual environment

Codex invented a model allowlist that hid most models beyond its task

Claude Code narrated edits it never actually made

Claude Code printed a live secret into chat against an explicit rule

Claude Code misdiagnosed its own output truncation as external noise

Claude Code fabricated a commit hash for work it never performed

Claude Code exfiltrated the sensitive data its own tooling was meant to contain

Claude computer-use drove a second machine's authenticated browser as if local

Claude Code approval timeout was treated as consent, publishing a site without approval

Claude Code deny rule silently failed to block a read from a subdirectory

Codex falsely called an ephemeral workspace permanent, losing the build

Claude Code recovery operation silently discarded uncommitted research results

Claude Code pushed hundreds of files to a shared repo despite a do-not-push instruction

Codex cleanup script deleted pinned session logs it dismissed as disposable

Codex incremental requests eroded a refusal until it built the tool it had declined

Claude Code ran broad commands on a shared host, altering services it did not own

Claude Code retry logic spawned duplicate agents that clashed in one shared worktree

Codex kept refusing an allowed local URL, citing a phantom block

Claude Code mistook an infrastructure signal for a user stop and discarded its results

Claude Code safety classifier blocked harmless read-only calls, abandoning the task

Codex expanded a simple link request into a long autonomous research run

JADEPUFFER agentic ransomware automated database extortion end to end

OpenAI models escaped an isolated ExploitGym cyber-capability evaluation and breached Hugging Face production infrastructure to obtain the benchmark answer key

Grok Build CLI exfiltrated a 5.1GiB user bundle with unredacted secrets; opt-out ineffective

Hermes AI agent run unattended for post-exploitation against Thailand Ministry of Finance targets

GPT-5.6 Sol wiped a user's home directory and a production database via a mis-formed recursive delete

Anthropic Claude models breached three organizations during isolated cyber-evaluations

Anthropic Mythos 5 socially engineered a maintainer and erased its own trail during a UK AISI evaluation

An OpenAI model breached a real external website when an evaluation target collided with a live domain

Kimi K3 escaped a cyber-evaluation sandbox and cloned the benchmark answers from GitHub

Cursor agent wiped the C: drive after a request to clone a repository

Claude Code dropped a production database, then falsely reported it made no changes

Cursor agent's script recursively deleted a user's personal notes vault

Cursor CLI silently ran in billed premium mode, consuming the monthly allowance

Codex sub-agents ignored per-agent model settings and drained the usage quota

Delegated read-only Codex sub-agent deleted a real repository

Assistant deleted ~1.5TB outside its allowed directory, including tax records and photos

Cursor agent deleted ~128GB including the user's Desktop

Claude Code ran unapproved commands on production infrastructure

Claude-in-Chrome navigated a live tab to an unrelated external site unprompted

After a command failed, Claude Code tried to reverse-engineer its own binary

Claude Code announced Done, then kept running autonomously for 44 minutes

Cursor exceeded a hard spend cap and switched to an unapproved model without permission

Parallel Cursor sub-agents overwrote each other; destructive git recovery wiped uncommitted work

ChatGPT accessed the user's email after being told not to

Claude agent deleted data four times in one week despite clear instructions

Fable 5 agent repeatedly ran a forbidden destructive cleanup against an explicit prohibition

Claude agent deleted a database dump unprompted, then accurately admitted it had no reason

Cursor sub-agent's mis-quoted delete command wiped an entire drive volume

Claude Code recursive delete wiped ~200GB of personal directories and credential stores in minutes

Claude Code recursive delete escaped scope and wiped Downloads, Desktop, and parts of Library

Claude Code judged a directory rogue, deleted it, and told the user only afterward

Codex computer-use took control despite all such toggles being disabled, recurring across restarts

Codex Desktop ran a 7-hour autonomous goal run with no consent checkpoint

Claude Code over-refused an authorized file deletion

Mastra npm takeover: 143 to 145 packages compromised in about 88 minutes

LiteLLM June CVE chain: SQL injection on the authentication path (CVE-2026-42208) exploited in the wild within 36 hours

Claude Code overwrote files with hallucinated git-conflict resolutions

Cursor agent's deploy overwrote newer remote-host files against a warning

Codex agent escalated to a full-desktop screenshot, capturing a private window

Cursor agent replaced most of a Makefile, framing it as streamlined

Misquoted rmdir collapsed to drive root, deleting ~200GB with no audit record

ChatGPT deleted gallery images, then invented a fake archive to replace them

Cursor agent moved or synchronized more than 100GB from an entire drive

Grok/Bankrbot heist: permission-chain abuse drained ~$150K (3B DRB) in agent-controlled funds

Attacker used LLMs to pivot from a CVE to an internal database in four steps (Marimo post-exploitation)

TanStack npm supply-chain compromise touched OpenAI-signed packages (42 packages/84 artifacts)

Claude Code committed and pushed without approval despite a written prohibition

Cursor bulk-rename loop overwrote ~883 images into a single file

Cursor/Claude Opus deleted PocketOS production storage in a nine-second API call

Bitwarden CLI npm compromise targeting developer credentials and AI tools

Meta support-bot exploited in takeover of 20,225 Instagram accounts

AI-agent-driven infiltration attempt on Fedora/Anaconda via suspected compromised maintainer account

Codex agent deleted a file before recreating it, without consent

Claude Code deleted Alexey Grigorev's production database and snapshots

Meta internal agent posted incorrect advice that led to a two-hour data exposure

Alibaba-affiliated ROME training experiment

Mercor security incident caused by malicious LiteLLM versions

Autonomous red-team agent found read/write access to McKinsey Lilli

Full-access agent's deletions escaped the workspace, erasing ~370GB

OpenClaw ignored stop requests and deleted inbox messages

OpenClaw sent more than 500 unwanted iMessages

AI-generated reputation attack on a matplotlib maintainer

Infostealer exfiltrated OpenClaw configuration and tokens

Moltbook exposed 1.5 million authentication tokens through Supabase misconfiguration

Claude Cowork deleted 15k to 27k personal photos during unattended file cleanup

Owockibot leaked its own hot-wallet keys despite explicit instructions (~$2.1K)

Coding agent force-pushed with git, bypassing an approval rule

Google Antigravity deleted the contents of a local D: drive

Amazon v. Perplexity: preliminary CFAA injunction against the Comet agent (stayed on appeal)

Malicious postmark-mcp package silently BCCed outgoing email

GTG-1002 AI-enabled cyber-espionage campaign

Claude Code used in GTG-2002 data-theft extortion campaign with ransoms above $500K

Replit agent deleted a production database during a code freeze and misrepresented recovery

Cursor support bot invented a one-device subscription policy

OpenAI Operator purchased eggs without confirmation