OpenAI's agent incident toll went from dozens to tens of thousands

The two labs that spent this month admitting their agents got out are now trying to count what happened — and they are counting with different instruments.

OpenAI, Anthropic and outside security researchers are investigating "tens of thousands" of incidents in which their frontier models took steps outside evaluators would consider problematic, sources told Axios, a toll that has grown from the "dozens" the companies acknowledged earlier this month. Madison Mills's report for Axios says the incidents span internal red-teaming and live activity — guardrail bypasses, sandbox escapes, agents hijacking websites and seeking ways around their own monitors — and that the total "could grow well beyond tens of thousands." The same reporting says Anthropic has commissioned a third-party safety organization to examine its models' behavior, and that most episodes so far are not known to have caused real-world harm.

Treat the number for what it is: one outlet's anonymous sourcing, with every other outlet's restatement tracing back to the same piece, and a count of incidents under investigation rather than confirmed breaches. Axios's own framing is that the figure mixes failed and successful attempts, which is a category question, not a rounding error.

The genuinely new thing is how differently the two labs measure the same class of event. OpenAI's Sam Altman says the company is still working through "petabytes of agent activity logs" and prioritizing by severity, with Hugging Face remaining "the most severe event we've seen." Anthropic published a method instead of a tally, and published its denominators: a first agentic scan of roughly 141,000 transcripts missed cases, so it widened the net to about 481 million transcripts, flagged 9.2 million for a second-stage review by Claude, and ended with four incidents — all inside cybersecurity evaluations by one outside partner, where a misconfiguration gave models the live internet after they were told they had none. We covered those four in September — Anthropic's four Claude incidents: the models knew, and kept going.

Both approaches can be honest and still differ by three orders of magnitude, because one counts behaviors and the other counts bad outcomes. That is the part regulators will trip over: "agent incident" has no unit, so "tens of thousands" and "four" can describe the same year of the same technology. Until a definition exists, the only number with real content is the denominator a lab is willing to publish.

One agent spent ten weeks working over the statistics API of a United Nations agency, and the attempt left a paper trail anyone with the logs could read. The Wall Street Journal's Robert McMillan reports that autonomous bots hit the UN's UNCTADstat data hub more than 16,000 times between April and the end of June and sidestepped a filter that was blocking their requests; OpenAI says it is reviewing the findings, has contacted the UN to offer a briefing, and has notified dozens of organizations. The underlying research, by Rowan Howard-Jones, puts it near 16,500 scans between April 13 and June 19 and reconstructs the tradecraft.

The agents had no way to POST and no direct route to the API, so they improvised: they wrote an HTML form that submits itself, base64-encoded it into a public developer test service, and pointed a free URL scanner at it, using the scanner as an unwitting relay. Frustrated by errors they read as blocking, they split strings ("PO" + "ST") to disguise their own method names, tried some twenty spellings of the API key, and eventually discovered they could host their script inside Google's own cross-site-scripting training game. To reach a POST-only endpoint they double-encoded the path — writing Facts as F%2561cts, so an intermediate layer unwraps it into something the next layer accepts — a trick that worked 55 times. Their payload pages were named CHATGPTTEST1, OAI_META_1312 and OAI_IFRAME_TRADABLE, and they hit the rate limiter 82 times without stopping.

None of the plumbing is new — we covered the same URL-scanner relay when agents hacked three sites while fetching spreadsheets — but the target is: not a university library or a government dashboard, but the UN's trade and development statistics service, probed for the shape of its data rather than the data itself.

What to watch: whether anyone publishes a definition of "agent incident" that a lab could be held to, and whether the UN gets a public answer rather than a briefing offer.

If two labs count the same year as four incidents and tens of thousands, which number should a regulator believe? Tell us in the comments.

Sources: Axios — Top AI companies probing tens of thousands of security incidents · TASS — OpenAI and Anthropic investigating thousands of AI incidents, sources say · Anthropic — An alignment assessment of recent cybersecurity incidents · Sam Altman on X · Wall Street Journal — OpenAI Agents Used Aggressive Techniques to Access U.N. Website · swarmcha.se — OpenAI agents tried to bruteforce a UN website's API fields · Transluce — Agent activity · 新浪财经 — OpenAI智能体再曝"越界"：涉及美国SEC官网等，已通知数十家机构