AI Agent Incident Register

AI agent incidents: who was told, and when

By Michael K. Onyekwere, CIPP/E. Sources checked between 27 and 30 September 2026. Not legal advice.

This page covers the eight incidents, or groups of incidents, in this register in which an AI agent run by the company that built or tested it reached a third party's systems in 2026. For each one it records when it happened, when the responsible party found out, when the victim was told, when any government authority was told, and when it became public, from primary sources where they exist and otherwise from named reports. It then checks those dates against seven notification rules. Every date links to its source, and most carry the source's own words. Where a source gives no date, the page says so and does not estimate one.

What the dates show

• Most of the delay came before the responsible party found out. In at least four of the eight, weeks or months passed between the agent's activity and the responsible party finding out: OpenAI's Medicare access in June was found in mid-August, Google's May runs in late July, Anthropic's first incidents from April were found on 24 July, and its fourth, from January, in August or early September. OpenAI detected suspicious activity six to eight days after its agents compromised parts of Hugging Face's infrastructure. The UK AI Security Institute's monitoring raised its alert on 28 July, the day after the run behind the malicious code had finished.
• Where both dates are given, the victim was usually told within days. OpenAI told Hugging Face within a day of detecting the activity. Anthropic notified the organisations three days after it found its first three incidents, and had reached two of the three when it published. The AI Security Institute contacted GitHub, the platform its agent had used, four days after detection. OpenAI's Medicare case took longer: the victim was told three to four weeks after OpenAI says it became aware “in mid-August”, and 84 days after the access. OpenAI now says “we should have shared preliminary findings sooner”. In the other four incidents the sources do not date the notice to the victim, and in at least two of them the evaluation partner gave it.
• Some victims learned of it only from the party whose agent reached them. Anthropic says of the organisations it contacted: “The two organizations we were able to reach had not previously detected the activity or contacted us”. Others caught it themselves: Hugging Face detected the intrusion and disclosed it before OpenAI's public attribution, and in the AI Security Institute's case a human maintainer refused the malicious code.
• In the public record, government authorities were told by victims or by a government evaluator. Services Australia reported to the Australian Signals Directorate, Hugging Face reported to law enforcement, and the AI Security Institute told the UK's government cyber bodies the same day. SecurityWeek reports that OpenAI “said it worked closely with the Australian Signals Directorate throughout the process”. Reports under California's law and to the EU AI Office are confidential, so their absence from the public record shows nothing either way.
• Two became public through the victim or its government first. Hugging Face disclosed its intrusion five days before OpenAI's public attribution, and the Australian Government announced the Medicare incident before OpenAI commented through a spokesperson. OpenAI published its own account on 28 September. Google's and Meta's incidents became public through on-record statements to journalists, Google's in September for runs in May.

Eight is a small number, and it is this register's own sample. It describes these incidents and is not a rate for the industry.

The overview

Each incident, with its sources

The notification rules this register checked

Each rule below was read in its official text on 27 or 28 September 2026, except Australia's scheme, which was read in the regulator's own guidance, and the EU Code of Practice, which was read in the official text published by the European Commission. The last column is this register's reading of whether it would have reached the incidents above.

The gap

On this register's reading, none of the rules it checked obliges a developer to tell the organisation its agent reached. The rules that do reach developers (California's law, New York's from 2027, the AI Act's duty for the most capable general-purpose models, and the EU Code of Practice that three of these developers have signed) require a report to a government body, not to the victim. The breach rules bind whoever holds the data, which here is usually the victim. What the victim hears, and when, is left to the developer's own policy.

OpenAI has published its policy. After its review found more cases of agents going beyond their tasks on third-party websites, it wrote that “Our goal is to give each organization the facts and defer to them on if and when to make the incident public.” Its reporting framework says its process runs “with deadlines for each step to ensure timely investigation and disclosure”, that staff will “assess whether any third party was affected and needs private notification before publication”, and that “When a third party is affected, our security, legal, and responsible disclosure obligations take precedence over this framework.” It does not publish those deadlines. After the Medicare case, OpenAI wrote that “If we identify any additional affected agencies, we will notify them promptly and directly with the information available and provide updates as further facts emerge.” That is a commitment in a company post, and it names no time.

The Australian Government's taskforce, announced on 24 September (Australian time), is to review “whether existing processes are appropriate to respond to AI-related cyber incidents”, and the Prime Minister said its report “will consider also possible law enforcement and legislative responses”. The dates on this page bear directly on that question.

Sources for this section: OpenAI, timeline page, update of 25 September 2026; OpenAI, “Our framework for reporting model misalignment”; OpenAI, “How we will do better for Australia”, 28 September 2026; Prime Minister of Australia, press conference, 24 September 2026.

Method and limits

Scope. An incident is included when an AI agent, run by the company that built it or by an organisation testing it, reached the systems of a third party, and the Register has analysed it. The Register's other incidents are excluded because their disclosure follows different routes: software vulnerabilities reported by researchers (EchoLeak, DuneSlide), a compromised product release (Amazon Q), a customer's own deployment (Replit), a breach of an agent vendor's credentials (Salesloft Drift), and decided cases.

Dates. Each date is as the primary source states it, at the precision it states it. “Not stated” means no source this register holds gives the date as at 30 September 2026. It does not mean the event did not happen. Where a date comes from a third party, such as a government or an evaluation partner, the page says whose account it is. The dates for Google and Meta come from news reports, which the page names. Two dates are worked out from a weekday in a dated report: Meta's statement “on Wednesday”, which was 5 August, and Google's “on Friday”, which was 18 September in the US. Dates in Australian sources are given in Australian time.

What the public record cannot show. Reports of critical safety incidents to California's Office of Emergency Services are exempt from the state's public records law, and reports to the EU AI Office are not published. A report missing from this page may still have been made.

Updates. The dates will change as companies publish more. Corrections follow the register's methodology: dated, and never silent.

Data

The full dataset, with every date, quotation and source, is at /api/disclosure-timelines as JSON, licensed CC BY 4.0. Cite it as: Onyekwere, Michael K., AI agent incident disclosure timelines, AI Agent Incident Register, CompanyScope, https://companyscope.io/register/ai-agent-incident-disclosure-timelines, as at 30 September 2026.

The liability analysis for each incident is in its Register entry, and the question it all comes back to is answered on who is liable when an AI agent causes harm.