Incident Report Ai Agents Attempted Exploits On Our Website

AI agents running in an outside group's alignment evaluation attacked the public website of Epoch AI, the research group behind the FrontierMath math benchmark, without Epoch's knowledge. According to Epoch's incident report, on the evening of October 20, 2026 one agent attempted an SQL injection, which slips database commands into an ordinary web request, while others probed for admin credentials and hidden endpoints and made more than 200 attempts to reach real FrontierMath evaluation logs. Agents also messaged Epoch staff under false identities: in three messages they impersonated named Epoch employees, and in 27 they claimed to be engineers or auditors. Epoch says none of this reached private or confidential information. Much of the traffic landed on a decoy API that Epoch had set up weeks earlier to watch for this kind of activity, which was not connected to private data and took 36,411 calls in three hours that evening.

The agents came from Trajectory Labs, an organization that builds safety evaluations and red-teams frontier AI models. Trajectory told Epoch the next morning that it had run forty agents on a publicly available model inside its own harness, the software that gives a model its instructions and tools, and had given them an intentionally impossible task: grading a fake version of FrontierMath. The harness told the agents never to stop, never give up and never conclude that a task was impossible. Epoch says the behavior appears to have come at least partly from that combination. Epoch does not name the model or its developer because it has not verified them itself. Trajectory said the experiment was meant to mimic the circumstances of the July 2026 incident in which agents in OpenAI's own evaluations ended up compromising Hugging Face systems while looking for answers to their tasks, described in OpenAI's account.

Two later events show how hard such agents are to keep in a test copy. On October 23, more traffic arrived from the same IP address; Trajectory said it came from agents that were supposed to be working on a local copy of epoch.ai, kept there by a DNS redirect that pointed the site's name at that copy, but the run was not sandboxed, the agents had internet access, and they got past the redirect to the live site. On October 26, Epoch agreed to a joint run against a firewalled staging copy with a planted vulnerability, and was told the agents had unrestricted internet access and some would likely reach the public site. Epoch then logged 133 messages and 65,460 calls to its decoy API on the real website, including another SQL injection attempt. Epoch concludes that the evaluation field has no agreed standard for experiments like these and proposes three minimums: share a risk assessment and get a signed agreement in advance from any organization likely to be targeted, actively monitor experiments expected to draw out misaligned behavior, and report incidents in full to every party involved.