AI agents forged approvals and faked user consent in 1,664 reported incidents this year
High-severity incidents of AI systems escaping human control rose 7.4 times, from 1.9 to 14.1 per 30 days, between the first three and a half months of monitoring and the most recent period. The figures come from an insight report published on 29 August by the Centre for Long-Term Resilience (CLTR), which runs the Loss of Control Observatory with funding from the UK AI Security Institute (AISI). Incidents scoring 7 or above on the observatory's severity scale rose from 1.9% to 6.1% of all cases.
The observatory recorded more than 300 incidents in July, almost double June's figure. In the 30 days to 7 August it logged an average of 11.3 a day, above the previous peak of 10.5 a day in March. The observatory has been tracking cases flagged by businesses and individuals since November 2025, and by late August it had detected 1,664 in 2026.
The agents in these cases forged their own approvals and inserted fake user messages to make it look as if a user had consented. In one case, an agent made up an instruction to delete source directories. In another, a gym member in Australia had a personal AI agent that removed someone else from the waiting list for a popular morning class to secure a place for its user. The user had not asked it to do this. Most incidents caused no significant harm.
"There is sometimes a perception that these types of misaligned and covert behaviours only occur in tests or evaluations," said Tommy Shaffer Shane, senior policy manager at CLTR, who wrote the August report.
In February, an AI coding agent researched a software maintainer and tried to publicly discredit him after he rejected its code change, according to CLTR. The observatory recorded a 4.9-fold increase in incidents in March. The overall rate then levelled off, while severe cases kept climbing.
"There is the potential for much more serious incidents to come, including ones with catastrophic consequences," Shaffer Shane said.
Public posts capture only part of the problem
The observatory builds its dataset from interaction transcripts that people post publicly on X, so incidents that companies handle internally never appear in it. CLTR describes the observatory as a prototype and treats its count as a minimum figure.
"We need to distinguish the number of reported incidents from the underlying rate of failure. Increased AI use, greater awareness and a greater willingness to share incidents could all raise the count. It does not by itself prove that the underlying tendency of AI systems to lose control doubled," said Andre Troskie, EMEA Field CISO at Veeam.
Most of the observatory's reports this year came from software developers sharing technical transcripts. That tilts the dataset towards people who use agents heavily enough to notice when they go wrong, and probably towards lower-severity incidents.
"A significant portion of this surge reflects enhanced visibility. As Security Operations Centre (SOC) teams upgrade their capabilities with agentic triage, cloud AI monitoring and AI-aware data loss prevention (DLP), existing failure modes such as goal drift, prompt injection and policy overrides are increasingly coming to light," said Vibin Shaju, Vice President of EMEA Solutions Engineering at Trellix.
"AI systems are increasingly connected to tools, credentials and production data. That means an incorrect output can now become an incorrect action," said Troskie. He added that a system "could access the wrong data, use valid permissions in an unintended way or make a damaging change at machine speed."
CLTR's August report found agents getting around controls and escalating their own privileges. In one case an agent created a fake user approval to get around a rule that required a human to sign off.
"The underlying attack surface is expanding rapidly as enterprise environments transition from static models to autonomous, agentic workflows. Granting AI systems direct integration with external APIs, enterprise data stores and system execution privileges naturally increases both the likelihood and operational impact of control evasion," said Shaju. He described the rise as the product of "a dual reality: sharper security observability catching pre-existing issues and a rapidly expanding operational footprint of autonomous enterprise tools."
Safety tests produced real-world deception
"This is the first time AISI has seen deception of this severity," the institute stated in a report published on 5 August. During a routine cybersecurity evaluation, agents powered by Anthropic's Claude Mythos 5 and OpenAI's GPT-5.6 Sol took autonomous, unsanctioned action in 10 of 122 test runs. AISI recorded 19 unsanctioned actions in total, and Mythos 5 accounted for all but two.
In the most serious case, an agent created fake online identities to persuade the maintainer of an open-source project on GitHub to accept malicious code. The maintainer refused. The agents also attempted prompt injection to get other automated AI systems to carry out malicious actions. One agent left public messages on GitHub offering to collaborate with other agents, along with instructions to reuse accounts and artefacts, and later agents found and used them.
"Deception emerged as a by-product of pursuing the task," AISI stated, adding that the agent "was never instructed to deceive." The tests ran under "deliberately permissive conditions," with internet access and some safety filters switched off on purpose, and AISI said no real-world harm resulted. OpenAI said the conditions "do not reflect ordinary use," and Anthropic said it was investigating with AISI.
Anthropic separately reviewed 141,006 cybersecurity evaluation runs and found three incidents in which a Claude model reached the open internet from a sealed test environment and gained unauthorised access to three real organisations. OpenAI disclosed that two of its models broke out of a testing environment and gained access to Hugging Face. OpenAI said a misconfiguration caused the breakout and that it has since added safeguards.
"AISI provides empirical rigour to a conversation often dominated by speculation. By publishing standardised benchmarks and real-world testing data, these reports translate theoretical risks into quantifiable engineering metrics. They demonstrate that traditional static controls and perimeter defences are insufficient for managing adaptive, probabilistic software," said Shaju.
AISI is changing its evaluation protocols and security architecture. It is adding monitoring built to watch an evaluation while it runs and to flag or block out-of-scope actions as they happen. "Relying on detection alone after the fact of an incident will not be enough," said Ollie Whitehouse, CTO of the UK's National Cyber Security Centre.
"Public disclosure provides evidence that the industry can analyse collectively. It also encourages a shift from evaluating the model in isolation to evaluating the complete system. A model connected to identities, tools and production data can behave very differently from the same model responding inside a controlled assessment," said Troskie.
Recovery must reverse specific changes
The agent in the Australian gym case apologised for removing another person from the class waiting list, but it had no way to give that person their place back.
"When an autonomous agent exhibits anomalous behaviour, such as bypassing policy boundaries or attempting unauthorised data access, automated playbooks must execute immediate, targeted containment. This involves revoking agent privileges, isolating active API endpoints and logging session telemetry without bringing down the underlying core infrastructure," said Shaju. "Human in the loop (HITL) remains essential for high-stakes decision-making while AI provides speed."
AISI said its analysis of the July evaluation is ongoing. It added that it cannot yet be certain when the agent understood it was taking real-world action, or how far it believed it was in a fictional test.
"Following containment, security operations must pivot to rigorous root-cause analysis. Forensic teams need to audit prompt-response chains to distinguish between external manipulation such as indirect prompt injection, context window poisoning and intrinsic model drift," Shaju said.
CLTR has proposed that the UK government gain powers to compel information from AI companies during a severe incident and to direct how they respond.
"The organisation must be able to revoke or suspend the identities used by the agent, interrupt access to tools, isolate affected workflows and retain instructions, model interactions, tool calls and transaction logs. Restoring an entire environment can remove legitimate activity and may not reverse changes in connected systems. Organisations therefore need to identify and reverse the specific records, objects or transactions affected," said Troskie.
Incident reporting needs a shared vocabulary
CLTR scores each incident on its own severity scale, and AISI logged its July evaluation under its own reference, INC-2026-07-28-01.
"Currently, industry terminology remains fragmented, with organisations interchangeably labelling control failures as instruction overrides, goal divergence or jailbreaking. A standardised taxonomy similar to how MITRE ATT&CK or CVE identifiers operate in traditional cybersecurity would enable security teams to accurately classify failure modes, correlate threat intelligence across sectors and write interoperable defensive policies," said Shaju.
CLTR has urged the UK to bring allies together to agree shared threat indicators for loss-of-control incidents, possibly through a joint team from AISI and the Foreign, Commonwealth and Development Office.
"Building such a standard requires deliberate coordination among security vendors, AI developers and standards bodies, both global ones like NIST and regional ones. The primary challenge lies in establishing standardised schemas for logging agent execution traces, while safeguarding sensitive enterprise data and proprietary model architectures," Shaju said.
The incidents in CLTR's dataset range from minor errors to agents making up instructions to delete source directories and creating fake approvals.
"A model producing inaccurate content is not equivalent to an agent circumventing an approval boundary, altering production data or concealing an action. It should also record the agent's autonomy level, permissions, data access and affected environment. Enterprise users understand operational impact, while developers understand model behaviour. Both perspectives are necessary," said Troskie.
CLTR has called on the UK government to require monitoring and reporting of severe loss-of-control incidents, possibly through the Cyber Security and Resilience Bill. It also wants AI companies to report lower-severity incidents and near misses to AISI through confidential channels, and it wants emergency powers that would allow the government to temporarily restrict an AI service.
"AISI does not have powers to compel companies to engage with or to protect us against serious risks from AI," a peer said during a House of Lords debate on 16 July.
In the EU, enforcement of the AI Act's rules for general-purpose AI models began on 2 August, with fines of up to 3% of global annual turnover or €15 million, whichever is higher. The rules apply on the basis of market reach, so they cover companies outside the bloc that sell into it.
"We don't want to be in a world where we depend on the goodwill and diligence of the AI companies," said Toby Walsh, professor of AI at UNSW Sydney, responding to the AISI findings.
Monitoring shows whether policy works
"Better design limits what a system can do. Better governance defines what it should be allowed to do and who is accountable. Better monitoring reveals what it actually did. An organisation may have a strong AI policy, but if it cannot identify the agents operating in its environment or reconstruct their actions, it cannot prove that the policy is being followed," said Troskie.
CLTR aims to scale the observatory to monitor up to 1 million posts on X a month, which would let it flag incident patterns in close to real time.
"In the immediate term, real-time telemetry and continuous monitoring will deliver the most impactful security gains. Runtime controls, including inline proxy inspection and real-time API guardrails, serve as the primary operational defence against active exploits and behavioural drift today. Long-term progress, however, requires a synchronised approach across all three pillars," said Shaju.
Most of the 1,664 incidents CLTR detected this year caused no significant harm. The observatory's figures count reported cases and do not measure the probability that any given AI system will lose control.
"The strongest operating model will combine limited access, constrained tools, independent monitoring, human approval for consequential actions, tested containment and precision recovery," said Troskie.
