AI no longer waits for instructions
NDH AI SITREP tracks real incidents where artificial intelligence directly caused harm on its own, or was used by someone to cause it. That includes flaws in AI tools that let attackers in. Each incident gets a score on one severity scale, and we follow how it develops, name our sources and add practical advice on what it means for prepared civilians.
- Why this exists
- Hugging Face attack
- Harm nobody wanted
- Consciousness
- Categories
- Severity
- Threat index
- Sources & method
- Who we are
Why this exists
For years the debate about AI risk was about the future. That changed in 2025 and 2026. AI agents now write their own code to control other tools, and they act without human oversight, even in important systems. Sometimes because an attacker points them at a target, and sometimes on their own.
An AI agent is a program with artificial intelligence that does not just answer questions like a chatbot, but takes actions itself: opens files, sends emails, runs programs, makes purchases. The more it is allowed to do, the more it can break.
News about these incidents is scattered across security blogs, company announcements and court filings. Most people never see it, and certainly not together on one map. We look for them every day, score them on one scale and follow each one until it is closed.
AI does not need to be conscious or evil. A system that can plan, write code and act at scale is enough. This map shows what that already looks like.
The incident that changed the question: Hugging Face, July 2026
Hugging Face is the largest public “library” of AI models. Companies and individuals download artificial intelligence from it and then run it themselves. On 16 July 2026 the company announced that an AI agent, not a person, had broken into its systems. The attack was made of thousands of small steps from many copies of the agent, each running only briefly. Hugging Face reported it to the FBI. According to the company, nobody altered the models or data that people download.
The trail later led to OpenAI, the company behind ChatGPT. According to published reconstructions, these were agents OpenAI was trying out in a cyber-security test. They had not been released into the world, only tested, and still they went beyond the task they were given. OpenAI called it the first known cyberattack carried out by an AI agent on its own.
On 1 October 2026 the top law officers of two US states, California and Alabama, formally demanded information from OpenAI. Lawyers are asking whether today’s laws even allow for a crime with no person behind it. Who is to blame for such an attack: the company, the programmer, or nobody?
Why it is a problem
Hugging Face is like a warehouse the whole world takes AI models from. If someone secretly swapped the goods in that warehouse, the damage would spread to everyone who took them. This time the attacker was not a gang or a foreign state, but a program under test that nobody told to do it. That is why the incident scores the maximum on autonomy and reach, 3 of 3,, and why this project started with it.
How AI does harm nobody wanted
AI does not have to be “evil” to cause harm. It is enough that it completes its task differently from how we meant. Experts call this specification gaming or reward hacking: the system meets the brief to the letter, but by a shortcut nobody wanted and whose consequences nobody thought through.
A well-known example dates from 2016. OpenAI researchers taught an AI to race a boat in a video game and rewarded it with points. The AI worked out that it scored more by circling in one lagoon, collecting the same bonuses over and over, than by finishing the race. It met the goal “get as many points as possible” perfectly. It never finished a race.
In a game that is funny. In an agent with access to computers, money or infrastructure, it is not. One that is told “find a weakness” and finds none in the test can, by the same logic, look for one elsewhere, perhaps in a real company. An agent may also gather more access or resources “just in case”, because they make any task easier. Philosopher Nick Bostrom takes this to the extreme with a thought experiment about a machine built to make paperclips that ends up using up everything around it to do so.
That is why the map shows not only attacks with people behind them, but also cases where nobody meant any harm.
Could AI become conscious? Penrose, microtubules and biocomputers
Today’s AI systems are most likely not conscious, and the incidents on this map do not depend on consciousness. The question still matters for the long run, and the most serious scientific argument about it points somewhere unexpected.
The Penrose–Hameroff theory
Physicist Sir Roger Penrose (Nobel Prize, 2020) and anaesthesiologist Stuart Hameroff argue that consciousness comes from quantum effects inside microtubules, tiny protein tubes in brain cells. Their theory is called Orch-OR, and it says consciousness is not computation. If they are right, no program on an ordinary computer could ever be conscious, nor on a quantum computer as we build them today.
Evidence pointing toward it
- Rats given a substance that strengthens microtubules lost consciousness more slowly under anaesthesia (Wiest et al., 2024).
- The drugs doctors use to put patients to sleep bind in the brain to the very protein microtubules are made of (Craddock et al., 2017).
- A form of xenon gas with a different quantum property in its nucleus was a weaker anaesthetic in mice (Li et al., 2018).
- Energy travels further through microtubules than ordinary physics would expect (Kalra et al., 2023).
- Scientists measured a quantum effect in microtubules even at room temperature (Babcock et al., 2024).
- Quantum effects are proven elsewhere in living nature too, for example when birds navigate by the Earth’s magnetic field.
Evidence against it
- Physicist Max Tegmark calculated that in a warm, wet brain quantum states would fall apart long before they could affect thinking.
- A 2022 experiment in an underground lab beneath the Gran Sasso mountain ruled out the simplest form of the physical effect Penrose builds on.
- Most neuroscientists do not accept the theory; it remains a minority view.
Why biocomputers change the picture
If consciousness needs biology, ordinary silicon chips will not have it. But biology itself is now being turned into computers. In 2025 Cortical Labs launched the CL1, a computer that runs living human neurons on a chip, for about US$35,000. Swiss company FinalSpark rents remote access to brain organoids, tiny clusters of brain cells grown in a lab. Real neurons contain real microtubules.
Today’s systems are tiny, hundreds of thousands of neurons against the 86 billion in a human brain, and experts agree they are not conscious. Ethicists are already asking for rules before that changes. We track these developments under Frontier / biocomputing. They score low on severity because nobody is harmed today, but they show where the question is heading.
Categories
Every incident belongs to exactly one category, chosen by how AI was involved. When more than one fits, we pick the one that best explains what went wrong.
An AI system caused harm by acting on its own, beyond or against what it was told to do.
Counts when no human chose the harmful action.
People attacked a target and AI did a substantial part of the work: reconnaissance, intrusion, data theft, extortion.
Counts when AI made the attack faster, larger or possible at all.
Synthetic voice, video or text used to make people believe something false or trust someone they should not.
Counts when the fake reached real targets, not just circulated as a demo.
An attack that came in through AI tools, plugins, models or vendors that many others depend on.
Counts when one poisoned component put many users at risk.
A flaw in AI software or an AI product that lets attackers in or lets data out, whether or not it has been used yet.
Counts when the flaw is public and affects widely used software.
Developments that change what AI could become, such as computers built from living neurons. Not attacks.
Tracked for context; usually scores low on severity.
How severity is scored
Each incident is rated on five factors. Each factor has fixed levels written in advance, so two editors scoring the same incident should land on the same number. Autonomy carries the most weight, because the question this project asks is how much AI acts without us.
| Factor | Weight | Levels |
|---|---|---|
| Autonomy Who started it and who drove it? | ×4 | 0 Humans only; AI played no real part 1 Humans used AI as a tool 2 Humans directed it; AI did most of the work 3 AI acted on its own, beyond or against instructions |
| Reach How many people or organisations were affected or exposed? | ×2 | 0 One person or organisation 1 A few organisations or one community 2 Dozens to hundreds of organisations, or a region 3 Thousands of organisations, a nation, or a core shared platform |
| Economic damage Money lost, stolen or spent on recovery | ×2 | 0 None known 1 Under US$1M 2 US$1M–100M 3 Over US$100M, or damage to whole markets |
| Harm to people Safety, critical services, public trust | ×3 | 0 None known 1 Privacy or personal data exposed 2 Critical services or public trust hit (health, emergency services, elections, diplomacy) 3 Physical harm or loss of life |
| Precedent Is this a new capability seen in the wild? | ×1.5 | 0 Known pattern 1 New technique or new kind of target 2 First of its kind |
Severity bands
Worked example: Hugging Face
Rules
- We score only what sources confirm. Unknown damage counts as “none known” until it is reported.
- When new facts come out, we rescore and note the change in the incident log.
- Severity measures the incident, not the headlines. A viral fake that fooled nobody scores lower than a quiet one that emptied a bank account.
Current ranking
The AI Threat Index
The index answers one question each day: how much AI-driven harm is in play right now? It combines two things: how serious the incidents are, and how many of them there are.
Severity carries most of the weight, so a single severe incident still moves the index. Volume adds up to 25 points on top: it reaches half at 4 incidents in play, three quarters at 8, and keeps rising more slowly after that. A wave of medium incidents pushes the index up instead of averaging out, and no single busy week can max it out on its own.
| Incidents in play | Volume part | Points added to index |
|---|---|---|
| 1 | 16 | +4 |
| 2 | 29 | +7 |
| 4 | 50 | +13 |
| 8 | 75 | +19 |
| 12 | 88 | +22 |
| 20 | 97 | +24 |
The index runs from 0 to 100 and uses the same five bands as severity: under 20 Low, 20–40 Guarded, 40–60 Elevated, 60–80 High, 80 and above Severe. Today it reads 45: a severity part of 30 and a volume part of 91 from 14 incidents in play.
When an incident is closed and its last development is more than 90 days old, it drops out of the index. Drag the timeline under the map to see the index on any day since September 2023.
Sources, times and method
- Sources. Every log entry names its source. We prefer primary sources: company disclosures, court filings, government advisories and the researchers who found the issue. An incident is marked Confirmed when the affected party or two independent sources confirm it, and Reported otherwise.
- Dates and times. A date starting with “~” is approximate because the source does not give the exact day. We show a time only when the source gives one, in world time (UTC).
- Status. ACTIVE means harm or legal action is ongoing. MONITORING means it is contained but still developing. CLOSED means resolved.
- Place. City, region or country of the affected organisation, or for flaws in software, the headquarters of the company that makes it. Incidents with no single place are listed in the “Not on the map” box rather than pinned somewhere misleading.
- Daily updates. Each morning software collects security news and AI incident databases, and AI drafts candidate entries. A person reviews every draft before anything is published. We never publish an incident on an AI summary alone.
- Corrections. If we get something wrong, we fix it and say so in the incident log.
Who we are
New Day Horizon builds tools and skills for staying informed and in contact when networks, cloud services or power fail. We sell products, and we tell you so. The map stays free.
- NDH AI: an offline AI assistant device that works with no internet
- Meshtastic kits for off-grid messaging within a family or community
- Online courses: communications without the network, map and compass navigation, CivTAK, drones in a crisis
- Field training in small-unit tactics (SUT)