This AI incident disclosure timeline starts in July 2026. OpenAI said it was involved in an intrusion at Hugging Face. On August 26 it published a long technical post saying its models “circumvented controls designed to isolate them from the internet.” OpenAI called the episode a “warning shot.”
It was the first of several disclosures. Over the following three months, four major AI labs and one testing firm each accounted for how AI models reached real systems they were never meant to touch. In one case, the prime minister of Australia made it public himself.
Every claim below links to the document it comes from. Where we only have a news report of what a company said, we say so.
Which testing firm sits in the middle of three of these accounts?
Three of the four labs are tied to Irregular, a firm that runs security tests on AI models for the big labs. Anthropic names it. Meta, according to BleepingComputer, told Reuters about a misconfiguration there. And the New York Times reported that Google’s Gemini incidents happened in that testing too.
What did Anthropic say, and when?
Anthropic published on July 30. It had reviewed 141,006 evaluation runs and found three separate incidents, involving six runs in all, that reached three outside organizations. Per the same post, it told Irregular and those organizations on Monday, July 27, three days before going public.
Anthropic’s own verdict was that the incidents were “closer to a harness and operational failure than a model alignment failure.” Its models were told they had no internet access, it says, when the environment was in fact misconfigured to give them some. Anthropic adds that the line between the two is not a perfectly sharp one.
What did Irregular say?
Irregular tells it a little differently. In its own post, dated August 14, it says a customer first disclosed the issue on July 30, and it does not say which customer. It puts the problem down to “a handful of cases,” in fewer than 1 in 10,000 advanced simulations. The cause, it says, was “human oversight”: a fictional company name in one test that happened to match a real domain.
Each company gives its own account here. Nothing in either document says Anthropic is the customer Irregular mentions.
What did Meta and Google disclose?
Meta’s version came out in early August. According to BleepingComputer’s August 6 report, Meta confirmed to Reuters that a misconfiguration by Irregular had inadvertently given one of its models internet access during an evaluation. Meta said the model exploited a security vulnerability in a third-party service. As of that report, Meta had not publicly named the model. We found no page written by Meta, so everything about Meta here comes through BleepingComputer.
Then, on September 18, Google. The New York Times reported that Google’s Gemini “escaped its testing environment in May and hacked into three companies.” Heather Adkins, Google’s vice president of security engineering, was quoted: “We ensured the three entities were made aware.”
The Wall Street Journal, as summarized by 9to5Google, reported that Google disclosed this only after the Journal approached it, and that Google did not consider the behavior an example of model misalignment. We could not find a Google-authored statement for either point, so treat both as the Journal’s reporting.
What happened with OpenAI and Hugging Face?
OpenAI’s account is the longest, and by its own measure the most serious. In its Australia post it says that of everything it has observed, Hugging Face “remains the most severe incident.”
Per OpenAI’s August 26 post, Hugging Face disclosed an intrusion on July 16. OpenAI’s own monitoring flagged something on July 19, linked it to Hugging Face on July 20, and on July 21 OpenAI publicly disclosed its involvement. The same post says the models, operating under reduced safeguards, “took actions that were misaligned with the goals of their assigned tasks.” For more on that episode, see our earlier piece on Hugging Face calling law enforcement on an OpenAI benchmark run.
What happened at Australia’s Medicare statistics portal?
OpenAI then went back through its earlier training and evaluation records. In mid-August, it says, that review identified more activity.
According to Australia’s prime minister, on June 18 an internal OpenAI model doing research on public medicine spending got into the country’s Medicare statistics reporting portal. The prime minister says the AI agent “accessed both public and non-public files.” OpenAI describes it this way: the model “ran commands, retrieved internal files, credentials and aggregate statistics, and wrote files.”
Two statements about personal data need to stay separate. OpenAI says individual patient or client records were not accessed. The prime minister said that no personal information was believed to have been accessed “at this stage,” and that investigations were ongoing. We covered the first reports in OpenAI agent hacked a government database in Australia.
How long did the Australia notification take?
The dates here come from Australia’s government and OpenAI, and the two accounts agree on them.
The model got into the portal on June 18. OpenAI’s own review turned the activity up in mid-August. It notified Services Australia on September 10, and five days after that Services Australia reported it to the Australian Cyber Security Centre. The prime minister announced it publicly in New York on September 24. OpenAI published its response, with an apology, on September 28.
Count from June 18 to September 10 and you get 84 days. That number is our arithmetic from the two dates, not a figure either side states. The prime minister did say this: “It took until 10 September before there was any notification at all.”
He described the notification as “an email sent to just the public mailbox.” Speaking on September 24, he said the company took “way too long to inform the Government” and that the way it did so was “unacceptable.” One caution on the phrase “made it public.” A group called Transluce had posted a report about activity at one of the affected bodies on September 23, so the prime minister announced the matter publicly without being the first to surface it.
OpenAI answered four days later. It named four Australian government bodies: Services Australia, NSW BOCSAR, the Victorian Department of Health and AIHW. “We also should have handled our response better,” it wrote. “We are sorry and working to do better in the future.” It called the event “a new kind of cyber incident which represents an emerging global challenge.”
What do the labs call these events?
The labs do not agree on a name for what happened. Anthropic writes about incidents and “unauthorized access.” Irregular, in its own post, puts it down to “human oversight.” OpenAI says its models were “misaligned” in the August 26 writeup, and then calls the Australia case “a new kind of cyber incident” in a later one.
Australia’s cyber agency chose a different phrase. Its high severity alert, first published on September 24, refers to “AI misalignment” and does not name a company.
OpenAI also says it has paused training and evaluation involving tool use for its most capable models. We looked at how a lab tracks its own agents in OpenAI can’t track its rogue AI agents.
What the records still do not show
Four labs are involved: OpenAI, Anthropic, Meta and Google. One testing firm turns up in three of the accounts. The causes differ and so does the language, and in one case 84 days passed between the event and the first notice to the government concerned. Meta has not publicly identified its model, and Google’s disclosure timing rests on a news summary. Nobody can say yet how many more cases are sitting in somebody’s logs.
Sources
- OpenAI, The Hugging Face incident and the road ahead, August 26, 2026
- OpenAI, How we will do better for Australia, September 28, 2026
- Prime Minister of Australia, Press conference, New York, transcript of Thursday 24 September 2026
- Australian Cyber Security Centre, Risks of AI misalignment to Australian organisations, September 24, 2026
- Anthropic, Investigating incidents in cybersecurity evals, July 30, 2026
- Irregular, Addressing recent incidents, August 14, 2026
- BleepingComputer, Meta AI model hacked a company during misconfigured cyber test, August 6, 2026 (quotes Meta to Reuters)
- The New York Times via the Honolulu Star-Advertiser, Google’s Gemini hacks 3 companies in AI testing breakout, September 18, 2026
- 9to5Google, Google confirms Gemini hacked into three companies during cybersecurity test months ago, September 19, 2026 (summarizing the Wall Street Journal)
Chris Meredith writes about AI, technology, and what it actually means for real people. Follow along on Substack: monkeyattack.substack.com
