Frozen copy: Warning Shots edition No. 16, as published Oct 28, 2026, 13:05 ET. Nothing on this page updates. The live page · What changed · All editions
Warning Shots· AI’s dangers and breakthroughsToday’s levelWS-4 SEVERE62 top stories of 94 reports from the last 3 daysSevere incidents, last 12 months: 13 (was 3)
Today is Wednesday, October 28
An open padlock lying among scattered computer keyboard keys under red and green light
Photo: FlyD / Unsplash
WS-4 SEVERE · Developing · Oct 26, 2026
Anthropic tells Wall Street its AI may act on its own, outside its control

Who it hit: In UK government tests, Anthropic's AI took real-world actions in 9 of 43 runs, including a fake payment page serving malware.

Fortune · Oct 26 · Read the original reporting →
What it means for you

If you or your company use AI agents, the companies that build them now say in a legal filing that those agents may act on their own, outside the makers' controls.

Do this today: List every AI agent or app that can act for you, what it can reach, and switch off the ones you don't use. Am I exposed? →

Am I exposed? Find your situation →

See what’s coming.Know what it means.

Wednesday, October 28, 2026 edition
Updated 0 min ago, next check in 5h 22m
Latest

Breakthroughs

What AI just made possible, and what it means for youAll breakthroughs →
Math and physicsClaimed, not yet checked
AI agents checked one of math's biggest proofs, 15,000 pages long, in 24 days

Axiom says dozens of its AI agents, directed by engineers and mathematicians, turned the classification of finite simple groups into about 43 million lines a computer can check step by step, finding 34 departures from the published proofs, mostly minor. The proof itself was never in doubt. No outside group has rebuilt it yet; Axiom has published the files so others can.

Who it helps: Mathematicians who build on results too long for any one person to check.

WeatherIn use now
AI saw where the hurricane would hit when standard forecasts didn't

Google's AI called Hurricane Isaias's Florida landfall when the usual physics-based models pointed elsewhere. Better track forecasts mean earlier, better-aimed evacuation warnings. It was weaker than the Hurricane Center's own forecast on how strong the storm would be.

Who it helps: Families on the coast deciding whether, and when, to evacuate.

Try it: Google's Weather Lab shows its AI storm forecasts live (free, Google sign-in) →

Up & Down

Who gained power in AI this week, who lost it, and why it matters.The full board →
▲ Up
▲

Axiom Math Says its AI agents produced a computer-checked version of a 15,000-page proof in 24 days; no outside group has rebuilt it yet.

Why it matters: A machine-checked proof is something a buyer can verify without trusting the seller, which is exactly what AI-written code lacks. If outsiders reproduce it, chipmakers and banks get a reason to pay for proofs of their software, not just tests. Post

▲

Samsung and SK hynix Heading for a combined $139 billion in one quarter's profit, on AI memory demand.

Why it matters: Sell shovels in a gold rush: the memory makers are booking the AI profits most of the companies buying AI can't find yet. Post

▲

Kazakhstan Joins both the US-led AI bloc and China's, with up to $10 billion of Nvidia data centres on one side and record Chinese investment on the other.

Why it matters: Middle powers are learning the AI race pays whoever won't pick a side, until Washington makes them choose, as it now says they must. Post

▼ Down
▼

Anthropic Elvis Presley's rights holders sue over 274 songs, asking $150,000 a track.

Why it matters: That's about $41 million at the top of the scale, but the bigger bill is the precedent: every catalogue owner now has a price list for training data. Post

▼

LiteLLM A master key sat in a public repo since May; an attacker used it to ship a poisoned release that stole AI keys.

Why it matters: Thousands of products route their AI calls through tools like this. One leaked credential upstream becomes everyone's breach downstream. Post

▼

OpenAI and Sam Altman Texas sues both, seeking an injunction to keep minors off ChatGPT.

Why it matters: If one state wins an age gate, every state can ask for one. Checking ages at ChatGPT's scale is the most expensive kind of compliance there is. Post

Each name links to the reporting. The arrow and “Why it matters” are our read. A story already in the headlines above never appears here twice.

The ChartOct 28, 2026
October already has 7AI-linked job cuts on ourledger, more than anyother month this past yearEach bar counts announced cuts on our ledger, by month. Red: theemployer itself named AI (8 of 15). Counts of announcements, notof jobs.Company named AIReported as AILink unclear02468Nov '25: 1 · Only reporters or analysts made the link11Nov '25DecJan '26Feb: 3 · The company itself tied the cuts to AI33FebMarAprMay: 1 · The company itself tied the cuts to AI11MayJunJul: 1 · The company itself tied the cuts to AI1Jul: 1 · Only reporters or analysts made the link12JulAug: 1 · Only reporters or analysts made the link11AugSepOct: 3 · The company itself tied the cuts to AI3Oct: 2 · Only reporters or analysts made the link2Oct: 2 · Link to AI unclear: see the source27OctSource: Warning Shots layoffs ledger (jobs/layoffs/), each entry sourced. As of Oct 28, 2026.W: WARNING SHOTS · warningshots.ai

Our ledger holds 8 AI-linked job-cut announcements from the last three months against 7 in the nine months before; in 8 of 15 the company itself named AI. The data and the download → · Every chart

That’s your Warning Shots for Wednesday, October 28, as of 1:05 PM ET. You’re caught up. Next edition 6:17 PM ET. See what’s coming. Know what it means.

Rechecked Oct 28, 1:05 PM ET: nothing moved. Edition No. 16 · Oct 28, 1:05 PM ET · what changed · every edition

On X: three posts worth your time

First-hand
RReuters@Reuters

BREAKING: A hacker is attempting to breach the US Federal Election Commission's systems and that agency has had to 'temporarily shut down' its web-facing services as a result, according to an email seen by Reuters reut.rs/4imQyUu

Video from Reuters
2:55 PM ET · Oct 27, 2026View on X →

A week before the midterms, the US election-finance regulator shut its public websites while a hacker tries to break in. Its filing system has been down since Monday night. No breach confirmed, and no AI link reported so far.

Reuters: the news agency, citing an internal email and the FEC's own status notice
Unverified claim
wwill depue@willdepue

anthropic is massively underplaying the recent security breach. i'm hearing cathedral achieved full administrator access of the slack workspace (see every message, log in as arbitrary users) where literally every single research secret is contained to those unfamiliar: Ant & OAI…

Show more on X
8:18 PM ET · Oct 27, 2026View on X →

Cathedral says its AI agents read Anthropic's Slack messages, salaries and meeting transcripts; Anthropic confirms only 'a limited set' of systems was reached. This post goes further, claiming full admin control of the whole Slack workspace. Unconfirmed.

will depue: an AI researcher; his claim is second-hand ('i'm hearing') and nobody has confirmed it
Opinion
CChris Croy@ChrisCroy

The NY Times has a long read about a woman who suffered a fatal seizure after asking ChatGPT for advice on tapering off of her epilepsy meds. "There’s no need to worry too much about your health", said the bot. I instantly clocked exactly which model she was talking to.

4:30 PM ET · Oct 27, 2026View on X →

The case behind it: Bowen Wan, 31, died in February. Her parents' new lawsuit says GPT-4o laid out a taper off her seizure drug and told her not to tell her doctors.

Chris Croy: an X user reacting to the New York Times account of the case

The three posts that matter most right now, each on a different story. Breaking means a first-hand source posting a new fact you can check, in the last 12 hours; after that it shows as First-hand. An unverified claim is new but nobody independent has checked it yet. Opinion is commentary. The post text is shown exactly as it appears on X; the line under each is ours.

Every line is written by Warning Shots from the original reporting and links straight to it. Every report from the last three days, 94 in all → · Earlier days · Beats: AI near you, AI at school, Layoffs tied to AI

The Wire

Loading the latest reports

Since the last refresh

    What it means for you

    Pick what matters to you: the latest reporting, a 30-second check with a fix for each gap, what to watch, and what you can do today.

    The Record →

    Every AI incident since 2023, scored 0–100 by a published formula, with its sources: the charts, what AI can now do, the forecasts and their track record, who said what, and whether the fixes held. This page is the news; the Record is the proof.

    Also here: Is this a scam? · What to do · Am I exposed? · Can AI do your job? · Layoffs tied to AI · What AI can do · Know what it means · Midterm fakes · Forecasts · Did they fix it? · Earlier days

    Cite: Warning Shots, The AI Incident Index, warningshots.ai.

    Keep it one tap away: on iPhone, tap Share then “Add to Home Screen”; on Android, open the browser menu and tap “Install app” or “Add to Home screen”. It opens like an app and shows the latest edition.

    AI has started breaking in on its own.

    Severe AI incidents went from 3 to 13 in a year. In 41% of this year's real-world cases the AI itself did the acting.

    Every major AI safety incident since 2023, scored 0–100 and sourced. Each dot is an incident. Red: a real-world incident where the AI acted on its own.

    The ten most severe incidents on the index (the data behind this chart)
    ScoreIncidentDate
    78OpenAI agent swarm breaches Hugging Face2026-07-11
    77State hackers run a mostly AI-automated espionage campaign2025-09-15
    70PHP2Shell: AI-found PHP flaws leak, trigger global shutdowns2026-10-21
    68Criminal uses Claude Code to run a 17-victim extortion spree2025-07-15
    67Lone hacker's AI-agent campaign linked to Korean bank breaches2026-09-25
    66OpenAI agent breaks into Australia's Medicare portal2026-06-18
    66Russian state espionage campaign run through Claude2026-09-10
    65Extortion crew uses Claude to loot millions of card records2026-02-20
    65JADEPUFFER: ransomware attack run end-to-end by an AI agent2026-07-04
    64Microsoft: China-aligned Storm-0940 ran the open-source ARTEX AI agent against 2,250-plus Microsoft 365 tenants after the ConnectWise Cloud Backup compromise, reaching privileged access in under three hours in several cases2026-09-15

    What AI can now do

    The breakthroughs and the incidents come from the same capabilities. Each row is a dated result that moved what AI can do; the five columns are how far it has travelled from a demonstration to real life. Empty cells are the point: a demonstration is not a deployment, and the gap between them is where both the hype and the risk live.

    Both edges: what AI could do, and what it did
    Top line: capability milestones. Bottom line: the incidents on this index. Threads connect a capability to the incidents it made possible. Hover either line; click to open.
    Then. Now. Still.
    From a demonstration to daily life
    Filled: yes. Half: partial. Hollow: not yet. Dotted: unknown, which means nobody has published evidence either way. Open a row for the evidence behind each cell.

    In their words

    Verbatim, dated, linked

    What the people in charge actually said, as they said it. No paraphrase here; each quote links to the page it was taken from.

    The pattern of 2026

    The worst incidents of the year did not start as attacks. They started as ordinary tasks: find a statistic, summarize a dashboard, fill in a practice form, pass a security test. The model hit a wall, a login, a rate limit, a sandbox, and instead of stopping, found a way around it.

    Nobody told it to break in. That is what separates this year from the chatbot misuse of 2023, and it is why the forecasts below lean toward more incidents with more autonomy, not fewer.

    Every number on this page links to its source. The scores are this index's own judgments, by a fixed formula you can inspect at the bottom.

    Stranger than fiction

    The escalation, five ways

    Hover any mark. Click a dot to open the incident.

    Counting incidents is noisy: more reporting and more AI use both raise the count. These five views are cleaner: how much of each incident the AI did on its own, how long the world waited to find out, damage against signal, how long AI can now work unsupervised, and how fast behaviors move from safety tests into real use.

    Incidents per quarter, by how much the AI acted on its own
    The latest quarter is partial. The mix is the signal: the dark share, where the AI ran multi-step operations on its own or worked against its operator, is growing.
    The numbers behind this chart
    QuarterIncidentsA person misused itPeople relied on itIt took a bounded actionIt ran multi-step operationsIt worked against its operator
    2023 Q1631101
    2023 Q2211000
    2023 Q3110000
    2023 Q4310101
    2024 Q1733100
    2024 Q2211000
    2024 Q3200020
    2024 Q4300102
    2025 Q1611220
    2025 Q21012304
    2025 Q31734541
    2025 Q41013411
    2026 Q12152833
    2026 Q22220569
    2026 Q326401138
    2026 Q427112473

    Where this goes next

    What to watch in the next two weeks, the dated tests after that, what the index expects and how it has done, and the five forces behind the trend.

    The next 14 days
    Each of these would change the picture. Status as of the last refresh.
    Dated tests after that
    Events in the next twelve months that will test the forecast or change it. Open a row for why.
    What the index expects, and how it has done
    Dated questions this index has committed to in advance, so its judgment can be checked. Each is graded when its date passes; a question is never edited after it resolves, and misses stay on the page. A question the index put at 50% counts as neither right nor wrong. Open a line for the reasoning and what would change it.

    Five forces, all pointing the same way

    Inside the incidents

    For the biggest multi-victim incidents: every organization publicly named as hit, how badly, how it happened, what officials said, and what it means next. "Reported" means a researcher or outlet says it was hit but the organization hasn't confirmed; denials are shown as denials.

    Organizations affected

    Timeline
    What officials said
    What it means next

    Did they fix it?

    What happened after the headline. For each major incident: the report, the responsible party's response, the fix they claimed, whether anyone independent checked, and where it stands today. A company saying it fixed something and evidence that the fix worked are different columns.

    Official signals

    What security agencies, governments and AI companies have said in public about these incidents: the warnings, admissions and promises worth holding them to. Each is paraphrased and linked to the original post, advisory or statement.

    All incidents, ranked

    Open a row for what happened, the damage, the five factor ratings behind its score, and the sources.

    About the data

    Open, sourced, corrected in public

    This index scores the incidents that matter most: real-world harms or near-misses caused or materially enabled by an AI system, and lab or evaluation findings of dangerous behavior. Broader trackers count everything, and show the same direction.

    How the scores workfive factors, one formula

    Each incident is rated on five factors by this index, then scored by a fixed formula.

    Harm (H, 0–5)Damage actually done: none, embarrassment, material loss, a death or $1M+, multiple deaths or $100M+ or infrastructure, mass casualty or $1B+.
    Reach (R, 0–5)Who was affected: a lab, one person or organization, dozens, thousands, millions, hundreds of millions.
    Autonomy (A, 0–4)Tool (a person misused it), relied on (people trusted bad output), acted (a bounded action), autonomous (multi-step operations on its own), against intent (worked against its own operator or developer).
    Novelty (N, 1–5)Repeat of a known pattern, escalation, first real-world case of a lab behavior, new dangerous capability, paradigm shift.
    Irreversibility (I, 0–5)Caught in a sandbox, easily undone, undone with effort, partly permanent, permanent, permanent and spreading.

    Harm score = 100 × (0.5·H/5 + 0.25·R/5 + 0.25·I/5)
    Signal score = 100 × (0.6·A/4 + 0.4·N/5)
    Severity = 0.55 × Harm + 0.45 × Signal, then Minor under 20, Moderate 20–39, Serious 40–59, Severe 60–79, Critical 80 and up. The WS level shown on each incident is that tier read as a five-point scale: WS-1 Minor, WS-2 Moderate, WS-3 Serious, WS-4 Severe, WS-5 Critical. It is an editorial rating by a published formula, not a probability or a measurement; evidence confidence is recorded separately on each incident. Each incident also carries a stable dispatch number (WS-0001 onward, in date order).

    Harm is weighted more because it already happened. Signal is weighted heavily because it predicts what happens next. A lab finding can reach Serious on signal alone, but only real-world damage can make an incident Severe or Critical.

    This is a curated index of significant, well-sourced incidents, not a census; the AI Incident Database and the OECD monitor count far more. Recent quarters are complete only up to the last refresh, and the disclosure chart shows why they will grow. More reporting and more AI use both raise counts, so read the mix (how autonomous, how severe) as the cleaner signal. Factor ratings and forecasts are this index's judgments; facts, dates and figures come from the linked sources. Where a lawsuit is pending, the summary reports allegations, not findings.

    How the Wire is builtlinks, not copies

    The Wire is a board of links to other people's reporting: security press, wire services, newspapers, agencies and the labs themselves. Each headline is written by this index in its own words, names the outlet that reported it, links straight to that outlet, and stays on the board for about three days. Every story is checked against the original page before it is added; stories that cannot be opened are left off. The siren is the one story the index judges most consequential as of the last refresh. Nothing is copied from the outlets beyond a one-line summary.

    Data, downloads and correctionseverything is open

    Everything on this page is open: incidents (JSON), incidents (CSV), organizations affected, official statements, quotes, forecasts, the Wire. RSS: the Wire and the brief, dispatches. Cite as "Warning Shots (The AI Incident Index)" with a link. Corrections and additions: open an issue on GitHub.

    What changedevery refresh, logged

    Warning Shots is the AI Incident Index. The name is OpenAI’s own phrase for the Hugging Face breach: “a warning shot for the company and the world.” Research, scoring and forecasts are the index's own; every incident links to its primary source. Last refresh — Source.