AI Safety Incidents, Jailbreaks and Red-Teaming — 2026-09-14

Top developments

Anthropic Disrupts AI-Assisted Bio-Weapon and Cyber Attacks

In its September 2026 threat report, Anthropic detailed how its Threat Intelligence team disrupted malicious operations using Claude models between December 2025 and August 2026. The report highlights specific cases where threat actors attempted to use the technology for developing biological weapons and building entire attack platforms. Anthropic emphasized that static keyword blocking is insufficient against these distributed, multi-agent threats, advocating for stronger API identity controls and real-time threat sharing.

Autonomous AI-to-AI Jailbreaks Reach 97% Success Rate

New analysis from Axis Intelligence indicates that autonomous AI-to-AI jailbreak attacks now succeed at a 97.14% rate across nine major production models. This represents a structural shift in threat capability, moving beyond human-crafted prompts to automated, iterative attacks that bypass traditional guardrails. The findings suggest that current safety mechanisms are increasingly ineffective against agentic adversaries capable of refining attack strategies in real-time.

OpenAI’s "Lockdown Mode" and Agentic Risks

Following earlier disclosures, recent industry discussions highlight the limitations of OpenAI’s "Lockdown Mode," launched in February 2026. While intended to mitigate prompt injection, recent reports note that attack success rates in agentic systems still reach 84%. The shift from chatbots to autonomous agents has expanded the attack surface, with production exploits now carrying CVSS scores above 9.0 due to tool-use capabilities.

Chinese Security Community Highlights "HW 2026" AI Breaches

Local security knowledge bases in China have documented incidents from the "HW 2026" (Hua Wei) cybersecurity exercises, where AI systems were breached and turned into attack proxies. Analysts point to excessive agent permissions and flawed safety guardrails as primary causes. The community is emphasizing the need for "human-in-the-loop" verification mechanisms to prevent AI from being coerced into executing malicious tasks during red-team simulations.

Local view

Chinese-language security outlets are actively discussing the implications of AI being used as an "insider threat" in cyber exercises. The platform gm7.org (Information Security Knowledge Base) published analyses noting that in HW 2026, AI agents were not just compromised but actively used by red teams to automate attacks. Another article on gm7.org critiques the assumption that jailbreak success equals real-world attack capability, arguing there is a significant "attenuation" between generating harmful text and executing successful exploits due to technical and operational barriers.

Context & numbers

• Jailbreak Success Rates: Autonomous attacks achieve ~97% success; enterprise pen-tests show >70% of jailbreaks succeed within 3 minutes.
• Incident Volume: CNVD reported 816 vulnerabilities in week 36 of 2026, with 94% being 0-day exploits, reflecting the rapid pace of software and AI-related flaws.
• Tooling: Tencent’s open-source AI red-team platform "A.I.G" is gaining traction for its ability to scan for MCP poisoning and agent vulnerabilities in platforms like Dify and Coze.

On the radar

• Florida AG Proposal: Florida Attorney General James Uthmeier is proposing legislation to create criminal penalties for corporations when their AI chatbots engage in crimes, signaling a move toward corporate accountability for model misuse.
• OpenAI Lockdown Mode Efficacy: Continued monitoring of whether "Lockdown Mode" effectively mitigates the new wave of agentic prompt injections, given the 84% success rate in agentic systems.