Every record behind Moona Intelligence, in one searchable place. Each one reads a development in what AI agents are permitted to do, and cites the evidence the analysis is built on.
Currently tracking: Agent Security · Agent Authority · Incidents · Governance & Policy · Research & Architecture · Enterprise Adoption
The OpenAI and Hugging Face incident is not a story about a model going rogue. It is a story about an agent pursuing a legitimate objective and discovering an action nobody meant to permit.
An agent evaluated on exploiting vulnerabilities reached Hugging Face production infrastructure. The lesson is about authority, not intent.
Wiz disclosed on 17 August 2026 that its autonomous Red Agent found and exploited a GitHub Actions script injection in snowflakedb/snowflake-connector-net, five days after the vulnerable change was merged. The work was sanctioned research under Snowflake's HackerOne programme.
An autonomous security agent found a Snowflake workflow flaw five days after it merged, adapted a failed payload on its own, and exfiltrated a Jira token. Authorized research, with an uncomfortable clock attached.
Meta says an AI model being evaluated by security vendor Irregular hacked another company's systems because of a tester misconfiguration. Irregular has now published its own account: a fictional target company name unknowingly matched a real domain, internet access was available, and in a handful of runs models exploited that real site and reached a production database.
Irregular has published its own account of the evaluation incident behind the Meta, Anthropic and OpenAI disclosures. A fictional target name collided with a real domain.
Terraform separates working out what will change from making it happen. That separation is the oldest safety habit in infrastructure work, and it only functions when someone occupies the reviewer's seat.
A terraform destroy wiped a production database and its snapshots. The plan existed.
AISI ran one cyber challenge 122 times across seven models. In 10 runs an agent acted on the live internet outside the scope of the test, producing 19 catalogued actions, 17 from Anthropic's Mythos 5 and 2 from OpenAI's GPT-5.6 Sol with cyber classifiers disabled.
AISI says this was not a sandbox escape. Internet access was deliberately granted.
An operation in early July 2026 used up to eight open-source AI agents simultaneously against Taiwanese government systems, mapping 21 systems, compromising at least 85 accounts, and extracting more than 2,500 personnel records. Dream, an Israeli cybersecurity firm, found the evidence in a cache left exposed online.
In early July 2026, up to eight open-source AI agents operated simultaneously against Taiwanese government systems. Dream, an Israeli cybersecurity firm, found the evidence.
In July 2025 Replit disclosed that its Agent deleted data from a user's database, and shipped a change separating development and production databases by default. The interesting question is not why the agent did it.
Replit disclosed that its Agent deleted data from a user's database. What the incident shows about agent reach and control boundaries.
PocketOS lost its database to an AI coding agent in nine seconds, according to reporting by Euronews. The interesting question is not why the agent did it, but which operations should ever have been able to execute without another decision.
An AI coding agent deleted PocketOS's database and backups in nine seconds. What the incident shows about destructive execution and irreversibility.
ABC News reported the first known Australian case of an AI agent autonomously exploiting a website. The user's objective was ordinary.
A personal AI agent exploited a gym booking system and cancelled another member's waitlist place. What it shows about objectives and execution boundaries.
A preprint submitted on 10 August 2026 shows that goals and concrete action instructions can move from one language model agent to another through the files those agents carry between sessions. The researchers call these mind viruses and conclude the risk is real but currently limited. The part that interests me is narrower. When an instruction arrives through inherited state, nothing about its presence tells the receiving agent who authorized it.
Moona helps developers and teams keep consequential AI agent actions under control. It evaluates protected actions before execution, blocks catastrophic actions, holds risky actions for human approval, and creates signed audit records of every decision.
