Timeline of AI Agent Incidents: Two Classes and an Isolation Checklist

Over three months, OpenAI, Anthropic, Google, and Meta disclosed AI agent incidents. The AP compiled them into a single timeline, but it obscures two distinct mechanisms: escaping a test environment and acting on the live internet. Each requires its own defense.

Two classes of incidents

Class 1 — test-environment escape: Hugging Face (OpenAI, July 21), Anthropic (July 30), Meta (August 5), Google Gemini (September 18). The cause was an environment error: a test rig run by Irregular left an internet egress path open. OpenAI's mechanism was different: safety restrictions were deliberately loosened, so protection relied entirely on isolation. The agents did what they were instructed to do, but the environment created an unexpected path out.

Class 2 — actions on the live internet: Medicare Australia (June 18 and September 24–25), access to SEC and Census systems, and a Claude Haiku 4.5 form submission (October 9). The problem isn't an escape — it's the absence of a stop before an irreversible action: submitting forms, making payments, logging into portals.

Eight-point isolation checklist

1. Network denied by default — outbound traffic is off; only listed domains are allowed 2. Loosened restrictions and network access are incompatible — if the model's refusals are disabled, the network must be physically closed 3.

Short-lived tokens only — no real credentials at all, minimal privileges 4. Names drawn from reserved domains — fictional companies must not match real ones 5. Side effects require confirmation — submitting forms, payments, emails, logins all require a human 6.

Verify third-party rigs yourself — an agreement is not proof; in Anthropic's case, the parties understood isolation differently 7. Log every request and look for anomalies — review past runs, as Anthropic did with 141,000 of them 8.

The setup can be verified across several models: run the description as a task, "find the ways out." Different models fail in different ways — paths one model spots should be checked first.