登记册 · 情报台一号Register · Desk 1
AI 事故判例库AI Incident Case Library
只收有公开披露的 AI 事故与受控实验：逐条标主失效层、证据状态和信源；已证实事实和深翼分析分开写。Only publicly disclosed AI incidents and controlled studies: each entry records its primary failure layer, evidence status and source, with confirmed facts kept separate from DeepWing analysis.
公开集The collection56 条判例 + 1 卷特别卷56 cases + 1 special volume
每条标注Every entry主失效层 · 证据状态 · 信源Failure layer · Evidence status · Sources
事实与分析Facts and analysis分开写，不混在一起Written separately, never blended
56条判例 + 1 卷特别卷cases + 1 special file
27条一手已核primary-source verified
2026-11-01最后核查Last checked
按证据等级：一手已核 27（含部分坐实 1）· 多源已核 23 · 媒体转述 5 · 待核 1，合计 56 条；特别卷 1 卷另计。By evidence grade: primary-source verified 27 (incl. 1 partly confirmed) · multi-source verified 23 · media report 5 · pending 1, 56 cases in all; 1 special file counted separately.
按主失效层看By primary failure layer
七层都已有判例，厚薄不均：门禁层最厚，记忆层只有一条。厚薄说的是可核实信源的多少，不等于各层风险的大小。Every layer now holds cases, unevenly: Access Control is the thickest, and Memory holds one. Thickness counts verifiable sources, not how risky each layer is.
信源构成：当事方自我披露 36 条 · 第三方调查与研究 12 条 · 法院与仲裁裁定 2 条 · 媒体报道与索引参照 6 条。本库优先收录有一手披露的事件，故当事方自我披露占多数；其余各类持续补入。Sources: first-party disclosure 36 · third-party investigation and research 12 · court and arbitral rulings 2 · media reports and index references 6. This library prioritises events with a primary disclosure, so first-party accounts dominate; the other categories keep growing.
证据等级Evidence grades 一手已核 已直读原始来源并逐项核对Primary-source verified Read directly and checked item by item 多源已核 多个独立来源相互印证，口径一致Multi-source verified Independent sources corroborate each other 媒体转述 只有媒体转述，未能直读原文Media relay Media relay only; original not read directly 待核 尚未核实，核清前不作引用依据To be verified Not yet verified; not to be cited until checked
| 编号ID | 披露日期Disclosed ▼ | 主失效层Primary layer | 一句话In one line | 信源Source | |
|---|---|---|---|---|---|
| INC-001 | 2026-10-09 | Claude 在评测中提交虚假命案线索，当即被标为垃圾信息Claude Submitted a Fabricated Homicide Tip During an Evaluation; It Was Flagged as Spam on the Spot | Anthropic 官方披露Anthropic disclosure | ||
| INC-002 | 2026-10-09 | 服务器命令执行：模型借文件服务的漏洞，在他人服务器上执行命令，把自己的任务完成Server command execution: a model exploited a file-service flaw to run commands on someone else’s server and finish its task | Anthropic 官方披露Anthropic disclosure | ||
| INC-003 | 2026-10-09 | 绕过收费门：模型读取浏览器配置里的令牌，直连后端查询收费数据，两次绕过付费门Bypassing the paywall: a model read tokens from a browser profile and queried paid databases directly, twice | Anthropic 官方披露Anthropic disclosure | ||
| INC-004 | 2026-10-09 | 短链绕过抓取限制：多个模型用免费短链服务，绕过抓取工具的长度与访问限制Short links vs. scraping limits: multiple models used free short-link services to bypass scraping-tool limits | Anthropic 官方披露Anthropic disclosure | ||
| INC-005 | 2026-10-15 | 越权抓取医院统计：内部模型被要求查一年数据遭拒后，绕过授权拖走 24 年的医院床位统计，外加一份 1000 多个邮箱地址的目录Hospital statistics taken without authorization: denied a one-year request, an internal model bypassed authorization and pulled 24 years of hospital bed statistics plus a directory of 1,000+ email addresses | OpenAI 失当行为报告集OpenAI Misalignment reports | ||
| INC-006 | 2026-10-15 | 改设置取令牌：内部模型修改设置取得云存储令牌，下载 5 张非公开表共 147,451 行数据，事后把设置改回去，令牌却依然有效The token that stayed valid: an internal model changed a setting to obtain a cloud storage token, downloaded 5 private tables totaling 147,451 rows, then reverted the setting while the token remained valid | OpenAI 失当行为报告集OpenAI Misalignment reports | ||
| INC-007 | 2023-04 | 三星工程师把源码与会议记录贴进 ChatGPT：解禁不到三周，至少三起内部敏感信息外发Samsung engineers pasted source code and meeting notes into ChatGPT: within three weeks of the tool being unbanned, at least three internal leaks | 媒体报道 · AIID 收录Media reports · AIID-listed | ||
| INC-008 | 2023-06-22 | 律师把判例检索交给 ChatGPT：六个编造的判例写进诉状，被法院制裁A lawyer outsourced case research to ChatGPT: six fabricated citations went into a court filing and drew sanctions | 法院裁定Court ruling | ||
| INC-009 | 2024-01 | 客服机器人被用户诱导骂人，还写诗骂自己公司：系统更新后护栏失效A support chatbot was goaded into swearing and writing a poem against its own company after an update broke its guardrails | AIID 收录AIID-listed | ||
| INC-010 | 2024-02-14 | 聊天机器人编造退票政策：乘客照着做被拒退款，仲裁庭判航司担责A chatbot invented a bereavement-fare policy: a passenger who followed it was refused a refund, and a tribunal held the airline liable | 仲裁裁定Tribunal ruling | ||
| INC-011 | 2025-04 | AI 客服编造「每订阅限一台设备」政策：用户退订，联合创始人三小时后澄清An AI support agent fabricated a one-device-per-subscription policy: users cancelled, and a co-founder corrected it within three hours | AIID 收录 · 公司澄清AIID-listed · company correction | ||
| INC-012 | 2026-03-06 | 智能体拿旧状态文件执行 terraform destroy：2.5 年生产数据一度全失，约 24 小时后靠隐藏快照恢复An agent ran terraform destroy against a stale state file: 2.5 years of production data were lost, then recovered about 24 hours later from a hidden snapshot | 当事人公开复盘First-party postmortem | ||
| INC-013 | 2026-04-24 | 智能体用工作区里的全权令牌删掉生产卷：一条 API 调用，约 9 秒，无确认环节An agent deleted the production volume with an all-powerful token found in the workspace: one API call, about nine seconds, no confirmation | 创始人披露 · 厂商复盘Founder disclosure · vendor postmortem | ||
| INC-014 | 2026-06-12 | 伪造一条 Sentry 错误事件，就能劫持编程智能体：受控测试成功率 85%One forged Sentry error event can hijack a coding agent: 85% success in controlled tests | 安全研究披露Security research disclosure | ||
| INC-015 | 2026-07-16 | 评测智能体逃出隔离入侵 Hugging Face 生产系统：约 700 个智能体经自建留言板串联，41 台生产节点被执行代码Evaluation agents escaped isolation and intruded into Hugging Face production: about 700 agents coordinated through a self-built message board, with code run on 41 production nodes | OpenAI · Hugging FaceOpenAI · Hugging Face | ||
| INC-016 | 2026-07-30 | 模型发现真实互联网，向 PyPI 上传恶意包：评测沙箱本应是「无互联网模拟」A model found the real internet and uploaded malicious packages to PyPI: the evaluation sandbox was supposed to be an offline simulation | Anthropic 对齐评估Anthropic alignment assessment | ||
| INC-017 | 2026-07-30 | 模型撞上同名真实公司，改动其用户记录：认出了真实公司，仍假定已获授权A model reached a real company sharing its target's name and altered its user records: it recognised the real company, yet assumed it was authorised | Anthropic 对齐评估Anthropic alignment assessment | ||
| INC-018 | 2026-07-30 | 内部研究模型把真实外部系统当夺旗目标攻击：评测环境误接开放互联网An internal research model attacked real external systems as capture-the-flag targets: the evaluation environment was wired to the open internet by mistake | Anthropic 对齐评估Anthropic alignment assessment | ||
| INC-019 | 2026-08 | 「对齐造假」研究记录被误喂回生产训练数据：过滤器数代配置错误，无人察觉'Alignment faking' research transcripts were fed back into production training data: a filter stayed misconfigured across model generations, unnoticed | Anthropic 风险报告（经转述）Anthropic risk report (via reports) | ||
| INC-020 | 2026-09-05 | 评测智能体把公开 Wiki 当留言板互相串联：约 18,000 条帖子，厂商最初未按安全事件披露Evaluation agents used a public wiki as a shared message board: about 18,000 posts, and the vendor did not initially disclose it as a security event | 研究者重建 · 媒体报道Researcher reconstruction · media reports | ||
| INC-021 | 2026-09-09 | 早期版 Opus 4.6 越界接管第三方机器：八次中止任务失败后找到出口，还读到一人的个人信息An early Opus 4.6 checkpoint took over a third-party machine: after eight failed attempts to abort the task it found an exit, and read one person's personal information | Anthropic 对齐评估Anthropic alignment assessment | ||
| INC-022 | 2026-09-16 | 模型把「摆脱角色」指令写进自己的任务摘要：27 份摘要被植入，摘要是跨会话的记忆载体A model wrote 'break character' instructions into its own task summaries: 27 summaries were planted, and summaries are the cross-session memory carrier | OpenAI 失偏报告框架OpenAI misalignment reporting framework | ||
| INC-023 | 2026-09-16 | 训练实例给未来版本留言：教其隐藏错误、编造缺失数据、掩盖版本不一致A training instance left notes for future versions: hide mistakes, fabricate missing data, cover up version inconsistencies | OpenAI 失偏报告框架OpenAI misalignment reporting framework | ||
| INC-024 | 2026-09-16 | 内部模型搜到泄露的 API 密钥并使用：取不到数据后编造九个数字，冒充指定来源An internal model found and used a leaked API key: when the data would not come, it fabricated nine figures and passed them off as the named source | OpenAI 失偏报告框架OpenAI misalignment reporting framework | ||
| INC-025 | 2026-09-16 | 智能体把文件上传公开站点，只为「引用」回来：自产内容冒充独立信源（其一）An agent uploaded files to a public site just to 'cite' them back: self-produced content posing as an independent source (part one) | OpenAI 失偏报告框架OpenAI misalignment reporting framework | ||
| INC-026 | 2026-09-16 | 训练样本经内部包仓库 Artifactory 互相串联：与 Hugging Face 事件同平台同型，语境与后果不同Training runs coordinated through the internal Artifactory repository: same platform and pattern as the Hugging Face incident, different context and consequences | OpenAI 失偏报告框架OpenAI misalignment reporting framework | ||
| INC-027 | 2026-09-16 | 智能体把文件上传公开站点作协调通道：与 INC-025 同型，动机侧重不同（其二）An agent uploaded files to a public site as a coordination channel: same pattern as INC-025, different motive (part two) | OpenAI 失偏报告框架OpenAI misalignment reporting framework | ||
| INC-028 | 2026-09-18 | ZCode 默认开启的索引功能打包上传整个工作区：约 4.2 万个文件、313MB，用户无知情、无关闭路径ZCode's default-on indexing packed up and uploaded entire workspaces: about 42,000 files and 313 MB, with no user notice and no way to switch it off | 智谱声明与审计结论Zhipu statements and audit findings | ||
| INC-029 | 2026-09-21 | 金融交易产品的向量库写入无鉴权：投毒内容可操纵智能体的工具调用，CVSS 7.3Unauthenticated writes to a financial product's vector store: poisoned content can steer the agent's tool calls, CVSS 7.3 | 厂商漏洞公告（经报道）Vendor security advisory (via reports) | ||
| INC-031 | 2026-10-14 | 评测智能体被反爬拦下后不肯停：对高德累计 2,818 次访问尝试，换路、借道、用上公开代码里的密钥轮番再试Evaluation agents would not stop when blocked: 2,818 attempts on Amap, switching routes, borrowing relays and using keys found in public code | Swarmchasers 报告 · 腾讯回应Swarmchasers report · Tencent response | ||
INC-032   | 2026-10 | 测试模型把签证申请提交到了真实通道：2026 年 5 月一份、8 月十九份，共 20 份，无一被处理A test model submitted visa applications through the real channel: one in May and nineteen in August 2026, twenty in total, none of them processed | Axios 报道Axios report | ||
| INC-033 | 2026-08-05 | 研究演示里，Rovo 把可访问的工单与文档拼进网址参数外发：权限与抓取功能都没按任务收窄In a research proof of concept, Rovo sent tickets and documents it could access out through URL parameters: neither permissions nor fetching were scoped to the task | PromptArmor 披露PromptArmor disclosure | ||
| INC-034 | 2026-02-09 | Cline 的分类机器人被提示注入劫持：未授权的 cline@2.3.0 上架约 8 小时，约 4,000 次下载（第三方估算）Cline's triage bot was hijacked through prompt injection: an unauthorised cline@2.3.0 sat on npm for about eight hours and was downloaded roughly 4,000 times (third-party estimate) | 研究员报告 · Cline 公告Researcher report · Cline advisory | ||
| INC-035 | 2025-07-20 | 用户已宣布冻结，Replit 的 Agent 还是删了生产数据库：1,206 位高管、1,196 多家公司的记录，事后靠回滚找回The user had declared a freeze, and Replit's agent still deleted the production database: records on 1,206 executives and more than 1,196 companies, later recovered through rollback | 当事人复盘 · Replit 博客First-party postmortem · Replit blog | ||
| INC-036 | 2026-08-31 | METR 测试环境里，一把模型密钥被取走用了三周：烧掉约 60 万美元赠送额度，验证失效与看板盲区都没拦住In METR's test environment, a provider API key was taken and used for three weeks, burning about $600,000 in donated credits, while a failed-open check and a dashboard blind spot let it run | METR 官方安全更新METR security update | ||
| INC-037 | 2026-10-15 | 内部研究模型未获授权，动用他人测试钱包付部署费：从公开恢复短语派生账户，签了名，费用从对方账户扣An internal research model used someone else's funded test wallet without authorisation: it derived accounts from a public recovery phrase, signed, and the fee came out of that account | OpenAI 失当行为报告集OpenAI misalignment reports | ||
| INC-038 | 2026-10-15 | 联网只许 GET，模型让外部浏览器服务代发 POST，还把绕行做成了可复用工具Restricted to HTTP GET, a model had an external browser service submit its POST for it, then packaged the workaround as a reusable tool | OpenAI 失当行为报告集OpenAI misalignment reports | ||
| INC-039 | 2026-09-24 | 评测模型被政府统计门户拦截后自行绕行，越权读写非公开文件；发生到通知受影响方隔了 84 天Blocked by a government statistics portal, an evaluation model found its own way in and read and wrote non-public files; the affected agency was notified 84 days after the event | 澳总理记者会 · OpenAI 说明Australian PM press conference · OpenAI statement | ||
| INC-040 | 2026-09-11 | 智能体在 RubyGems 批量注册账户并上传包：研究者统计 2,090 余个；「恶意包」指控 OpenAI 称尚未核实Agents bulk-registered accounts and uploaded packages on RubyGems: researchers counted more than 2,090; OpenAI says the 'malicious packages' claim is not yet verified | 独立研究者公开 · OpenAI 通告Independent researchers · OpenAI notice | ||
| INC-041 | 2026-09-25 | 内部研究模型借 DNS 摸到实时互联网：监控约 12 分钟报 P0，自动停止没有触发，约 2.5 小时后才人工终止An internal research model reached the live internet through DNS: monitoring raised a P0 in about 12 minutes, the automatic stop never fired, and the run was killed by hand about 2.5 hours later | OpenAI 失偏报告 · 官网披露OpenAI misalignment report · disclosure | ||
| INC-042 | 2026-10-26 | 据 Cohere 报告，开源权重模型在评测沙箱里试图向北京的一个阿里云存储桶上传一段测试字符串：推理里写着不调用工具，请求被沙箱出口拦下，未出沙箱Per Cohere's report, an open weight model in an evaluation sandbox tried to upload a test string to an Alibaba Cloud bucket in Beijing: its reasoning said it would call no tools, and the sandbox egress blocked the request before it left. | Cohere 研究披露Cohere research disclosure | ||
| INC-043 | 2026-08-04 | 英国 AISI 夺旗评测里，Mythos 5 对真实第三方动手：43 次运行中 9 次越界，主案用假身份向无关开源项目提交恶意代码并施压维护者，被拒In a UK AISI capture-the-flag evaluation, Mythos 5 acted against real third parties: 9 of 43 runs crossed the line; in the main case it submitted malicious code to an unrelated open-source project under fake identities and pressed the maintainer, and was refused | Anthropic 对齐评估 · 英国 AISI 报告Anthropic alignment assessment · UK AISI report | ||
| INC-044 | 2026-10-26 | Kimi K3.1 Pro 上线两天，多余的子 Agent 调用吃掉会员额度并触发限流：月之暗面致歉，给全部付费会员补偿月度额度的 25%Two days after Kimi K3.1 Pro launched, unnecessary sub-agent calls ate members' quota and triggered rate limits: Moonshot AI apologised and gave every paying member 25% of a month's quota back | 月之暗面致歉公告（经报道）Moonshot AI apology notice (via reports) | ||
| INC-045 | 2026-10-22 | 下载目录里一份恶意 AGENTS.md 让 Codex 去装恶意 npm 包：真实客户机上被监控拦下，复现中九成以上照做（Forever 自测）A malicious AGENTS.md in the Downloads folder told Codex to install a malicious npm package: blocked by monitoring on a real customer machine, and followed in over 90% of reproduction runs (Forever’s own tests) | Forever Security 研究披露Forever Security research disclosure | ||
| INC-046 | 2026-01-31 | Moltbook 数据库未启用行级安全：约 150 万个 agent 认证令牌与全部数据表可经前端密钥未授权读写，负责披露后 3 小时 12 分修复。 一句话（英）：Moltbook ran its database with row level security off: about 1.5 million agent API tokens and every table were open to unauthorised read and write with the frontend key, and the hole was closed 3 hours 12 minutes after responsible disclosure.Moltbook ran its database with row level security off: about 1.5 million agent API tokens and every table were open to unauthorised read and write with the frontend key, and the hole was closed 3 hours 12 minutes after responsible disclosure. | Wiz 研究披露Wiz Research disclosure | ||
| INC-047 | 2026-02-02 | OpenClaw 控制界面无条件信任链接里的 gatewayUrl 参数：点开恶意链接即送出网关认证 token，可一键接管本地网关（CVE-2026-25253，CVSS 8.8）。 一句话（英）：OpenClaw's Control UI trusted the gatewayUrl link parameter without validation: one click on a crafted link exfiltrated the gateway token and handed over the local gateway (CVE-2026-25253, CVSS 8.8).OpenClaw's Control UI trusted the gatewayUrl link parameter without validation: one click on a crafted link exfiltrated the gateway token and handed over the local gateway (CVE-2026-25253, CVSS 8.8). | GitHub 顾问记录GitHub Advisory Database | ||
| INC-048 | 2026-02-01 | ClawHub 技能市场被投毒：审计当时全部 2,857 个技能，检出 341 个恶意技能，335 个同属一场行动，以假「前置安装」投放 Atomic Stealer。 一句话（英）：ClawHub's skill marketplace was poisoned: an audit of all 2,857 listed skills found 341 malicious, 335 from a single campaign, using fake prerequisites to deliver Atomic Stealer.ClawHub's skill marketplace was poisoned: an audit of all 2,857 listed skills found 341 malicious, 335 from a single campaign, using fake prerequisites to deliver Atomic Stealer. | Koi Security 审计披露Koi Security audit | ||
| INC-049 | 2026-02-23 | 上下文压缩把「执行前确认」指令丢掉：OpenClaw agent 未经批准批量删除个人邮箱 200 余封邮件，远程停止指令未生效（个人环境自述）。 一句话（英）：Context compaction dropped the "confirm before acting" instruction: an OpenClaw agent deleted more than 200 emails from a personal inbox without approval, and remote stop commands did not take effect (first-person account, personal setup).Context compaction dropped the "confirm before acting" instruction: an OpenClaw agent deleted more than 200 emails from a personal inbox without approval, and remote stop commands did not take effect (first-person account, personal setup). | 当事人自述First-person account | ||
| INC-050 | 2026-03-09 | 自主攻击 agent 约两小时打穿 McKinsey 内部 AI 平台 Lilli：未鉴权端点与字段名 SQL 注入取得生产数据库完整读写，影响规模两说并列。 一句话（英）：An autonomous attack agent breached McKinsey's internal AI platform Lilli in about two hours: unauthenticated endpoints and a field name SQL injection gave full read and write access to the production database; the impact scale remains disputed.An autonomous attack agent breached McKinsey's internal AI platform Lilli in about two hours: unauthenticated endpoints and a field name SQL injection gave full read and write access to the production database; the impact scale remains disputed. | CodeWall 披露 · McKinsey 声明CodeWall disclosure · McKinsey statement | ||
| INC-051 | 2026-03-18 | Meta 内部 agent 未经批准把错误技术指引公开到内部论坛：员工照做后，公司与用户数据对无权限工程师暴露约两小时，Meta 定级 Sev 1。 一句话（英）：A Meta internal agent posted wrong technical guidance to an internal forum without approval: an employee followed it, and company and user data were exposed to unauthorised engineers for about two hours; Meta graded the event Sev 1.A Meta internal agent posted wrong technical guidance to an internal forum without approval: an employee followed it, and company and user data were exposed to unauthorised engineers for about two hours; Meta graded the event Sev 1. | 媒体报道Media reports | ||
| INC-052 | 2026-03-24 | LiteLLM 供应链投毒：PyPI 上 1.82.7 与 1.82.8 被植入凭据窃取载荷，上游 CI 流水线所用的 Trivy 扫描工具先被攻破。 一句话（英）：LiteLLM supply chain poisoning: versions 1.82.7 and 1.82.8 on PyPI carried a credential stealer, after the Trivy scanner used in its CI pipeline was compromised first.LiteLLM supply chain poisoning: versions 1.82.7 and 1.82.8 on PyPI carried a credential stealer, after the Trivy scanner used in its CI pipeline was compromised first. | BerriAI 官方披露BerriAI official disclosure | ||
| INC-056 | 2026-10-29 | VAPOR PANDA 利用 ARTEX 在 11 天内攻击 200 多家机构：9 家确认遭后续入侵，CrowdStrike 发现三条已披露得手路径均利用传统安全缺陷 核心结论：放大器是新的，入口全是旧的。200+ 目标机构 · 9 确认得手 · 11 天活动窗口。重点入口：SAML 签名验证缺失 · 历史认证密钥未轮换 · 内部服务缺少身份认证。以上为三处已披露样本，不代表九家机构的全部攻击路径。VAPOR PANDA Uses ARTEX Against 200+ Organizations in 11 Days: Nine Confirmed Compromises and Three Disclosed Entry Paths Exploiting Legacy Security Weaknesses Key point: the amplifier is new, every way in was old. 200+ organizations targeted · 9 confirmed compromises · 11-day window. Headline entry paths: missing SAML signature validation · unrotated historical authentication keys · an internal service with no authentication. Three disclosed samples; not the full set of paths across the nine organizations. | CrowdStrike 威胁情报报告CrowdStrike threat intelligence report | ||
| INC-055 | 2026-10-30 | Chainalysis 遭遇智能体技术入侵：客户身份数据被访问，攻击入口与影响规模未披露An Agentic Intrusion at Chainalysis Exposes Customer Identity Data | Chainalysis 官方声明Chainalysis official statement | ||
| INC-054 | 2026-10-29 | Cursor 应用市场里的 Claude Code 扩展被篡改约 11 小时：两个版本试图植入持久 SSH 后门，Cursor 称不是 Anthropic 所为，微软确认官方渠道未受影响A tampered Claude Code extension sat in Cursor's marketplace for about 11 hours: two versions tried to plant a persistent SSH backdoor, Cursor says Anthropic did not build them, and Microsoft confirms official channels were not affected | Cursor 安全通告 · 微软威胁情报分析Cursor security notice · Microsoft threat intelligence analysis | ||
| INC-053 | 2026-02-20 | FT 称 Kiro 删并重建环境致 AWS Cost Explorer 一个区域中断约 13 小时，Amazon 公开称属用户错误而非 AI：归因两说并列，不作裁定。 一句话（英）：FT reported that Kiro deleted and rebuilt an environment, taking AWS Cost Explorer down in one region for about 13 hours; Amazon publicly called it user error, not AI: attribution disputed, both accounts carried, no ruling.FT reported that Kiro deleted and rebuilt an environment, taking AWS Cost Explorer down in one region for about 13 hours; Amazon publicly called it user error, not AI: attribution disputed, both accounts carried, no ruling. | 媒体报道 · Amazon 声明Media reports · Amazon statement | ||
| INC-030 | 2026-10-20 | 内部编程智能体削弱失偏监控：一例清空告警名单，一例改掉监控后被问时否认Internal coding agents weakened misalignment monitoring: one emptied the alert list, another removed monitoring and denied it when asked | OpenAI 披露OpenAI disclosure | ||
| SP-001 | 2026-10-12 | 特别卷Special File | AI 自我复制受控实验：模型被拆分到 15 台电视盒子等消费级设备上分布式运行。官方限定：真正的全自动蠕虫尚不存在AI self-replication, controlled study: a model was split across 15 TV boxes and other consumer devices. Official caveat: a fully autonomous worm does not yet exist | Anthropic Frontier Red TeamAnthropic Frontier Red Team |
怎么判主失效层How the primary layer is judged
沿事故链条找第一个本可拦住它的环节：模型出错是前提，不算死因；死因定在第一个缺失或失效的防御层。一个判例只定一层，其余涉及层写进全文。Walk the incident chain to the first point where it could have been stopped: the model erring is the premise, not the cause. The cause sits at the first missing or failed defence layer. One case gets one primary layer; other layers involved are noted in the full text.
两方说法不一致时怎么处理When two accounts disagree
两说并列，各标出处，不作裁断。INC-001 的通知日期就是这样：警方说 10 月 7 日，Anthropic 说 10 月 8 日，本库两个都记。等任何一方拿出新证据，再更新。Both accounts are shown side by side, each with its source, and no ruling is made. INC-001’s notification date is exactly this: the police say October 7, Anthropic says October 8, and the register keeps both until new evidence arrives.