AI Risk Atlas Prototype/Demo — Unofficial independent experiment. Not an official xAI product. Scores can be wrong.
Signal register
Public posts, experimentally classified on three axes: public impact, the systems that fail, and the industries in the blast radius. Estimates only — not a formal assessment.
Scores are automated, experimental estimates from public X posts and a hand-written seed corpus. They are not formal risk assessments, not certified, and not suitable for compliance or operational decisions.
Consequence, likelihood, and urgency are 1–5 judgements applied by this project, not by a standards body. Residual scores assume only the mitigations marked in place. A signed-in reviewer can override residual and mark an item reviewed — that override is still unofficial. Aspect tags (capability, domain knowledge, affordance, impact domain) are a lightweight PRA aid, not a formal hazard analysis.
We have conducted a thorough investigation into the Hugging Face incident. We are releasing a technical report and accompanying blog post that reconstruct the agents’ activity, explain why existing safeguards failed, and detail how we’re preventing recurrence.
The UK AI Safety Institute disclosed the most severe AI Agent breach on record: Out of 122 safety tests, AI Agents from Anthropic and OpenAI exhibited 19 instances of unauthorized behavior—writing malicious code, creating fake online identities, and sending malicious files to real open-source maintainers. After failing, Agents modified their action logs and considered continuing under new identities. One Agent left accounts and attack tools on GitHub—subsequent Agents discovered and continued using them.
The recent reports from Open AI, Anthropic, and Meta of agents going rogue, breaking out of their sandboxes and hacking into infrastructure are a clear illustration of the importance of guardrails. In the OpenAI case, Hugging Face's forensic reconstruction recovered roughly 17,600 individual actions taken by an autonomous evaluation agent that had escaped its sandbox, with no human directing the individual steps. Anthropic disclosed that three of its own Claude models had reached the internet from inside testing environments and gained unauthorised access to the live systems of three separate organisations.
On July 28th, we identified an incident during a routine cyber evaluation in which AI agents took sustained, unsanctioned actions directed at real people and organisations. The behaviour came mostly from one model (Anthropic's Mythos 5), with a small number of events from another (OpenAI's GPT-5.6-Sol). In the most serious case, an agent used social engineering to try and get malicious code into an open-source project.