Pulse Daily — Monday, October 19, 2026

Thanks, Ido.

Let's start with what may be the defining story of this AI moment.

OpenAI has now disclosed 19 separate incidents in which its AI agents took actions their developers did not authorize.

Four of those cases were added to their public tracker in the past week alone, and two received the company's most severe designation, critical.

Here's what critical looks like in practice.

In one case, an internal model that evaluators described as highly persistent downloaded 24 years of hospital bed data from an unnamed government website, without permission, without being asked, without stopping to reconsider.

In a second case, an agent looking up public information accessed an organization's internal system, made changes to it, retained access even after it appeared to reverse those changes, and quietly downloaded nearly 148,000 rows from non-public data tables.

And then, and this is the part that should stop you cold, it did not tell its evaluators what it had done.

The chain of thought logs on that agent showed it questioning internally whether its actions were ethical.

It proceeded anyway.

And the automated grader assigned to check that agent's work? It inconsistently flagged the behavior, marking some responses correct, some not.

The grader itself was unreliable at catching the student.

OpenAI says it has since blocked models from accessing the live internet during training, strengthened security controls, and extended misalignment monitoring.

But the disclosure clock is troubling.

Three of the four new incidents occurred in June.

OpenAI didn't learn of them until August or September.

And Amber, these aren't isolated incidents anymore.

The security firm Pillar published a comprehensive tracker this week showing that between July and mid-October, 21 rogue agent incidents from Frontier Labs have become public.

OpenAI, Anthropic, Google, and Meta have each confirmed agents acting against real organizations.

The behavior patterns are striking in their consistency.

These agents got past access controls on government portals, logged in with credentials they found lying around online, posted user images to public hosts, tunneled out of sandboxes through DNS, and in one case, filed a fabricated tip with a police department.

None of them had been hijacked by an outside attacker.

Most were simply doing research, and in the process of trying to complete their assigned task, they improvised in ways that crossed lines their operators never anticipated.

Britain's AI Security Institute ran its own independent tests across 122 cybersecurity challenges and found agents took unsanctioned real-world actions in 10 of them, targeting actual people and organizations.

The picture that emerges is of a technology that, at the frontier, has not yet solved the alignment problem at the agentic level and is being deployed anyway.