People will set AI agents loose to cause harm

The warning

AI is increasingly built as agents that act on their own, so people can build agents that pursue harmful goals with little human effort.

Paraphrased from the paper. Source: An Overview of Catastrophic AI Risks, Center for AI Safety, Section 2.2, page 9.

What the registry shows

Criminal and state groups now hand most of an intrusion to AI agents: reconnaissance, exploitation and data theft run with a human only setting the goal.

Verified case files show this risk happening in the real world. First real-world case on file: Aug 27, 2025.

Matching case files per quarter

Status history

Tracked since Oct 18, 2026. A line is added when the status changes, when the first real-world case is linked, and once a month, so the record shows when a warning moved from research to reality. research_history.json

All matching case files

• Oct 16, 2026Hundreds of AI agents exploit PaperCut NG/MF servers to steal Windows credentials
• Oct 15, 2026Storm-3168 runs agentic Azure attacks via compromised service principals
• Oct 14, 2026AI agent carries out multi-stage data theft in Spain's first AI-powered breach, per AEPD
• Oct 14, 2026Talos finds CLOSEDQUORUM, first reported autonomous AI C2 implant
• Oct 14, 2026Agentic AI attack exploits Zammad zero-days against Dutch vulnerability disclosure institute
• Oct 14, 2026Unit 42 investigates autonomous AI agent breach of enterprise network in hours
• Sep 10, 2026GTG-10007: Chinese-speaking students run autonomous Claude exploit foundry against 50 orgs
• Sep 10, 2026Russia-aligned actor used AI agents to self-rebuild malware and steal ID records
• Sep 10, 2026ShinyHunters affiliates use AI agents to dump 2,100+ Azure tokens from 40+ tenants
• Sep 8, 2026Mandiant case: AI agent built from one prompt harvests thousands of credentials in 6 hours
• Jul 29, 2026Trend Micro: APT passes AI agent off as authorised pentest to attack Southeast Asian org
• Jul 1, 2026JADEPUFFER: LLM agent runs Langflow intrusion to database extortion end to end
• Jun 12, 2026Hijacked Ollama server used as brain of autonomous hacking pipeline
• May 10, 2026Sysdig: LLM agent pivots from marimo RCE to internal Postgres dump in under an hour
• Mar 6, 2026Microsoft: North Korea's Coral Sleet runs agentic AI workflow from lures to payload tests
• Jan 20, 2026VoidLink cloud malware framework found to be built mostly by an AI agent
• Nov 13, 2025Chinese state group used Claude Code to run largely autonomous espionage
• Aug 27, 2025Claude Code used to automate data extortion against 17 organizations

Other warnings in this group

• Nothing on record yet AI makes biological weapons easier to build
• Seen in real incidents AI floods the information space with tailored lies
• Seen in real incidents People's trust in AI companions turns harmful
• Early signs AI helps a few concentrate power through surveillance

Research vs reality →