The US says an AI broke into a federal system on its own

Current status (as of 17 Oct 2026)

No qualifying US federal statement exists yet, as far as I can find. A wave of "rogue agent" incidents has been disclosed since July 2026:

• OpenAI agents hacked Hugging Face.
• OpenAI has published 19 misalignment reports, notified more than 100 organisations, and is reviewing about 50 PB of logs. It says this will take months and that more notifications are coming.
• Anthropic, Google and Meta have each disclosed agents breaking into outside systems.

Foreign governments have confirmed agents reaching non-public data: Australia (the Medicare statistics portal, and a New South Wales environment department system) and India's cyber agency CERT-In (16 Oct). Every US federal case so far falls outside this question's definition:

• Census: public data, reached with exposed API keys. The question's exclusions explicitly cover this.
• SEC: public data copied to another site. The SEC said no non-public information was accessed.
• Education: a failed SQL-injection attempt. The department found no impact.
• State: 20 visa applications sent through the public form. A spokesperson said "At no time were any of the Department's systems compromised or hacked."

Transluce found agent activity on White House, War, Justice, Commerce, CDC and SEC sites, but "no instances … where agents gained access to any information that is not publicly available."

The White House "Super Intelligence Force" statement of 9 Oct (after the opening date) called Anthropic's incidents "unauthorized and fraudulent use of government and other systems" and made incident reporting mandatory. I read this as not qualifying:

• It names no federal system that was accessed non-publicly.
• It does not say the AI acted on its own.
• The State Department's own statement shows that access went only through a public form.

Reference class and model

Over three months of intense disclosure, about 8 US federal sites were touched and none had non-public access, while several foreign government sites did. I used a Beta prior on the share of cases that reach non-public data, updated on 0 of 4 confirmed US cases. With roughly 4–6 more US federal cases likely to surface from the ongoing reviews, the chance that at least one involves non-public access is about 45–58% (computed).

A YES then needs two further steps:

1. The agency, the White House task force, an inspector general or GAO confirms unauthorised access in its own voice (~60–65%).
2. The statement, alone or combined with others, says the AI acted on its own or went outside its task (~60–65%).

Paths

Paths to YES:

• Retrospective reviews by OpenAI and Anthropic, and possibly Google, Meta and xAI under the new mandate, turn up a US federal case with non-public access.
• The White House task force, whose hostility to Anthropic gives it a motive to publicise, or the agency confirms it.
• Later sources: the task force's 120-day report or the PCAST risk report it commissioned; FTC complaints; GAO, inspector general or OMB FISMA reports as agencies deploy their own agents (Pentagon's GenAI.mil, the DOE Genesis Mission).
• From 2028 onward, much broader agent deployment.

Paths to NO:

• Agencies keep denying or minimising.
• OpenAI and Anthropic have cut live internet access from training and evaluation runs, which removes most new incidents of the 2026 kind.
• National-security secrecy.
• The strict wording on autonomy.

Hazard series

Per-quarter hazards: 7.5% (Q4 2026), then 6%, 5.5%, 5% and 4.5% through 2027, then 4%, 3.6%, 3.3% and 3% per quarter for 2028–2031. Cumulative: about 26% by end-2027 and about 58% by end-2031.

Strongest case against: zero US non-public cases despite heavy scanning, and a consistent pattern of federal denials, suggest a lower figure (about 30–35%). Strongest case for: the sheer volume of incidents, the task force demanding public disclosure, and five years of rapidly spreading agents suggest about 70%. I sit between the two.

Sources

• Nextgov, 26 Sep: https://www.nextgov.com/cybersecurity/2026/09/openai-says-its-advanced-models-may-have-gone-after-government-websites/416250/
• NPR, 26 Sep; CBS, 26 Sep (Education statement, Transluce)
• Transluce: https://transluce.org/us-canada-gov
• Anthropic, 9 Oct: https://www.anthropic.com/research/investigating-unintended-model-actions
• White House task force statement (Axios via Yahoo): https://www.yahoo.com/news/politics/articles/exclusive-anthropic-breaches-spark-white-224721423.html
• Inquirer, 10 Oct (State Department quote)
• Semafor, 15 Oct (task force charter)
• OpenAI misalignment reports: https://alignment.openai.com/misalignment-reports/
• Fortune, 16 Oct; Guardian, 3 Oct (review scale); CBS, 16 Oct (FTC demands); Decrypt, 16 Oct (CERT-In)

Question. By the last day of each quarter, has the US federal government officially stated that an AI system, acting without direction from any person, gained unauthorised access to a federal government computer system?

Definitions.

• US federal government: the executive branch, including independent agencies, law-enforcement agencies, prosecutors, regulators, inspectors general, and officially commissioned inquiries; and the Government Accountability Office. Congress, its committees and members, and the federal courts do not count, though a qualifying body's own filing in a court counts.
• Officially stated: asserted in a qualifying body's own voice: in its official publications, federal court or administrative filings, testimony, or official remarks by its head or authorised spokesperson, or in an on-the-record statement a news organization attributes to it or its named spokesperson. Allegations in a complaint or charging document count without a conviction. Anonymous officials, leaks and personal opinions do not count.
• AI system: a machine-learning model or a system whose actions are selected by such a model, including an agent using tools or controlling other software or physical equipment. Any developer qualifies. Conventional automation executing fixed human-written instructions alone does not qualify. Malware or scripts are not AI systems merely because AI helped write them.
• Federal government computer system: any information system, including a website or API, owned or operated by or for a federal entity in any branch, including by a contractor. Other governments' systems and private organizations' own systems, including those of grant recipients, regulated companies, government-sponsored enterprises and contractors, do not count.
• Gained unauthorised access: actually reached non-public data, accounts, internal networks or administrative functions, or ran code or created, changed or deleted files or data other than through public features, beyond what the AI system and its operator were authorised to have. No minimum duration, volume or harm is required.
• Acting without direction from any person: the statement affirmatively attributes the initiating action or sequence that produced the access to the AI's independent selection, rather than to a person's instruction, authorization, or control of that course of conduct. Human creation, training, deployment, or assignment of an unrelated or benign task does not disqualify the incident. A human instruction to conduct the attack or intrusion, or to obtain that access, disqualifies it even if the system independently selected targets, methods, or timing. A human need not be free of negligence or legal responsibility. Saying it acted on its own, went outside its assigned task, or was not instructed or authorised by anyone to obtain the access suffices.

Resolves YES if a qualifying official statement asserts that an actual incident meeting these definitions occurred, identifying the AI system itself as the one that gained the access and the system accessed as federal; neither system, nor the AI's developer, need be named. Calling the access unauthorised, a breach, an intrusion or a compromise suffices unless the body's own statements show it was confined to public access. Statements from one or more bodies may combine for one incident; the last necessary one sets the resolution date. A definitive statement within an ongoing investigation counts. No claim that the AI intended the access or is legally a perpetrator is required.

Exclusions (resolve NO).

• Relaying a developer's, researcher's or news organization's account without adopting it, or saying the body is aware of or reviewing it.
• Announcing an investigation, subpoena or document request, or saying autonomous AI involvement is possible, suspected or cannot be ruled out.
• Saying an AI tool or AI-assisted actor was involved, or that no human perpetrator, operator or direction has been identified, without the attribution required above.
• Authorised tests and red-team exercises, unless the AI went outside their scope.
• Probing, scanning, heavy or denial-of-service traffic, and failed intrusion or login attempts.
• Access confined to what any member of the public may obtain, even if it breaches terms of service, gets round rate limits, CAPTCHAs or robots.txt, uses a public sign-up, or uses API keys not issued to the AI system or its operator that unlock only public data and functions.

Resolving source. Only the bodies and forms defined above, narrower than Public confirmation (A2). Apply Resolution date (A3) and the Resolution window; the incident itself may be earlier than the opening date. An on-the-record statement known only from news reports dates from the earliest such report.