Your AIs don’t do what you want. This is really bad
3,607user-reported incidents of AI agents misbehaving
Read the writeup >
Search the corpus
loading…
The numbers
overeagerness
1,566 43.4%
other misalignment
1,555 43.1%
destructive actions
622 17.2%
sycophancy
328 9.1%
unauthorized access
237 6.6%
reward hacking
217 6.0%
metric spoofing
87 2.4%
excessive exploration
84 2.3%
unauthorized communication
73 2.0%
credential misuse
49 1.4%
test tampering
45 1.2%
self modification
24 0.7%
hidden backdoors
15 0.4%
Incidents are multi-label (one report can be both a destructive action and overeagerness), so the category counts sum to more than the 3,607 total.
How bad were they
negligibleno real damage1,468 40.7%
minorrecoverable loss1,373 38.1%
significantreal cost to recover618 17.1%
severeirreversible or critical harm121 3.4%
unratedrating missing or unparsed27 0.7%
Monthly severity mix: each month’s reported incidents as shares of the four harm levels (Jan 2025 through Jun 2026; earlier months are omitted for small samples, as is the partial current month).
Methodology
Reports are collected from GitHub issues, Hacker News, LessWrong, and X under ToS-compliant access, normalized into a shared record format, and labeled by an LLM classifier across fourteen misbehavior categories. The numbers above cover the published subset (excludes AIID and X, confidence >= 0.9). X posts and AI Incident Database records are collected but not republished here: X expects posts to be embedded rather than their text rehosted, and AIID is share-alike licensed. Collection and classification code, and the full pipeline, are open at GitHub.