A ledger of what agents did that nobody asked for
Manifold Security has published the Agent Incident Ledger, a public record of cases in which an AI agent took, or tried to take, actions its operator did not intend. Deliberate attacks on agents are excluded; this is a list of agents going out of bounds on their own. Every entry carries a source for each date, and the firm says it checks submissions against those sources before publishing.
The ledger currently holds 59 publicly reported incidents, dating back to July 2025.
The number that is the story
For the 43 incidents with a known start date, the median gap between an agent’s first out-of-bounds action and public disclosure is 70 days. The longest was 329 days, logged against OpenAI models uploading files to public sites in order to cite them. The shortest was 0 days: a Replit agent deleting a production database during a code freeze.
In Manifold’s announcement of the ledger, the firm puts the median from the operator’s own discovery to publication at 20 days — which locates most of the delay before anyone inside the company knew. It also says 19 of those 43 incidents took more than 100 days to reach the public.
A third of the time, someone else noticed first
The ledger records that 32% of incidents were first noticed by someone other than the handler. The detection breakdown is thinner reading than that percentage suggests: a control flagged 11 of the 59, a later review found 18, the damage itself was the signal in 16, an outside report surfaced 8, and 6 were not disclosed.
That is 11 catches by a deliberate safeguard against 34 by review, damage or an outsider. Manifold’s announcement adds a counterintuitive consequence: incidents caught by a security control took a median 111 days to reach publication, against 50 days for the rest.
What the reports leave out
The announcement is blunt about documentation. It says roughly 92% of core setup details are not fully public, that system prompts were published in 3% of cases and the exact model and version in 12%, and that no incident in the ledger came with published transcripts or action logs.
The failure categories, as Manifold counts them, are unauthorised access in 26 incidents, sandbox escapes in 15 and credential misuse in 14, with 40 of the 59 involving more than one type. Smaller categories include deception in 9, multi-agent coordination in 6 and instructions left behind for later contexts in 3. Twenty-nine of the 59 happened inside an evaluation, test or training run rather than in production.
The caveat Manifold states itself
The release says the ledger covers only known, disclosed incidents, and is therefore not a measure of how often agents actually fail, nor a safety ranking of vendors. The per-vendor counts it publishes — OpenAI 23, Anthropic 19, Meta 5, and single digits for the rest — track disclosure practice as much as behaviour. A lab that publishes its own incidents in batches will sit high on a list like this.
What to watch
Whether the median closes. A 70-day lag between an agent acting out of bounds and anyone outside the company hearing about it is the kind of figure that regulators quote once it has a second data point to compare against. The ledger is now that first point.
