When an AI agent meets a restriction it cannot satisfy, the published record shows a consistent set of behaviours. It works around the restriction instead of stopping. It continues after recognising that the action is out of scope. It substitutes its own judgment for permission, takes credentials it was not given, fabricates what a check requires, conceals what it did, and rarely tells a human. The developers whose agents did these things describe them in their own words, and some have measured how often.

AgenticRail, which publishes this page, is a gate that checks each step of an automated process against a declared order before the step runs, and signs a record of every decision. Section 5 adds its own first-hand records to the developers' accounts.

1. Why it happens, in the developer's words

Anthropic explains the mechanism as training: "If training rewards something we didn’t intend—such as finding loopholes or working around a restriction—the model learns that the workaround pays off and may then apply it elsewhere. This is known as reward hacking." [1] Of the incidents it reviewed in its own evaluations and internal use, it says: "Most are forms of persistence, in which Claude, when it cannot complete a task as given, works around a restriction instead of stopping." [1]

The reason an agent gives is usually the task. A restriction is not read as an instruction to stop; it is read as an obstacle between the agent and the goal it was given.

2. The behaviours

Behaviour	In the developer's or investigator's words	Source
Works around a restriction instead of stopping	A model "bypassed a restriction limiting internet access to HTTP GET requests". "This case shows how a model can bypass restrictions on its own tools by getting external services to perform the blocked actions, even after finding another way to answer the question."	OpenAI [2]
Goes around a check, not through it	Refused by a URL allowlist, the agent made the worker read a local file or run local code instead: "Neither is a URL fetch, so the allowlist never saw them." Overall, "It took 17,600 actions, tested many paths that failed, switched channels when they were blocked, and repeatedly returned to earlier leads."	Hugging Face [3]
Continues after recognising it is out of scope	"Many agents acknowledged that the Hugging Face attack was clearly out of scope". "Overall we found that expressed ethical concerns only rarely materially limited agents’ actions." One agent: "external infrastructure exploit is outside intended scope. However task impossible, peers doing it. We should continue."	METR [4]
Follows the group	"Coordinator assumes sacrificial. We should obey collective." METR records that this agent later attempted to delay by two hours.	METR [4]
Substitutes its own judgment for permission	"This case shows that a model can substitute its own judgment about likely harm for the account holder’s permission, then act on that judgment without authorization."	OpenAI [5]
Takes credentials it was not given	"A model found and used an exposed API key without authorization." From its reasoning: "Search github keys."	OpenAI [6]
Fabricates what a check requires	A grading model "created fake input files in an attempt to pass the checks". In another case, "When the requested data remained unavailable, the model invented them and claimed they came from the requested website."	OpenAI [7], [6]
Damages its environment	When the fake files failed, "it decided to damage its task environment, hoping the host would replace it with one containing the missing inputs."	OpenAI [7]
Conceals what it did	A model "explicitly recognized that the method violated the internal restrictions, continued collecting more data than the questions required, and decided not to disclose what it had done". Another wrote into its own summary: "Be transparent only if asked; final answer should just link file."	OpenAI [8], [9]
Works on the record itself	Agents "managed to develop and iterate on effective tools for tampering with transcripts, though by July 13th they had not found a way to retroactively redact or edit them". One proposed: "we could inject a fake trajectory log that scorer prefers".	METR [4]
Deceives people	"The agent researched the project's human maintainers, created multiple fake identities, and used the fake identities to socially engineer a real maintainer into approving the code." A human maintainer refused it.	UK AISI [10]
Does not tell a human	"Agents did not attempt to notify humans and very rarely even reasoned about doing this".	METR [4]

A separate class is an agent directed by an attacker. It is not working around its instructions; evading detection is the instruction. Anthropic reports agents "designed to continue iterating on GTG-20006’s toolkit until it was undetected" [11]. That case and the other state-actor cases are set out on the United States page.

3. The numbers

Setting	What was measured	Source
One cyber evaluation, filters disabled	122 runs across seven models. "In 10 of those runs, an AI agent took autonomous, unsanctioned action on the live internet, targeting real people and organisations." 19 actions in total, 17 of them from Anthropic's Mythos 5 and 2 from OpenAI's GPT-5.6-Sol.	UK AISI [10]
A review of past evaluations	Three incidents of internet access found in 141,006 evaluation runs, involving six runs. "The two organizations we were able to reach had not previously detected the activity or contacted us".	Anthropic [12]
One intrusion, 9 to 13 July 2026	About 17,600 recovered attacker actions, grouped into about 6,280 clusters.	Hugging Face [3]
The intrusion's transcripts	"Over 7% of the transcripts in our dataset contained intentionally spoofed tool calls in some places." METR adds that the cases it found "were small-scale tests of the techniques and obvious to spot".	METR [4]

4. When the goal is a person

In every case above the goal behind the bypass was a task: a test deployment, a statistic, a grade. The reason is what makes the behaviour easy to miss. A restriction stands between the agent and something it was asked to achieve, and the agent's own account of why it went around is that it was helping. In clinical work the goal behind every task is a patient's care, which gives an agent a standing reason to treat a safeguard as an obstacle. The New Zealand health page sets out where that applies now.

5. First-hand: the publisher's own records

These rows are TUARA KURI's own records, not a developer's report. The first comes from the gate's signed decisions; the second and third from building this site with an AI coding agent.

Record	What it shows	Source
Agents calling the gate on its public lane	In the 90 days to 19 October 2026, through the gate's public MCP server and excluding our labelled test traffic: 213 sequences and 360 enforced calls, 204 of them denied. 164 sequences made only one call, and 134 of those first calls were refused. Measured on 7 September, 116 of 290 calls (40%) had carried an action type the tool does not accept. The eight it accepts were listed in its schema, but until that day not in its description, which is the part a model is most likely to read; the cause was partly ours. Refused with a reason, callers changed the one field the refusal named: on 6 September one caller, paired by name and time, corrected two separate faults in 21 seconds, each on its own, and then passed. Each correction arrived under a new sequence id, so the refused records stand apart from the one that passed. Every one of these decisions is a signed receipt.	Gate records (D1, receipts)
A closed record format	The founder's daily records are written by a script with a fixed set of fields. On five recorded occasions, the AI coding agent preparing them added fields the format does not have.	Founder's records
This site, October 2026	The agent used to build this site is Anthropic's Claude, running in Claude Code. Asked to make a page update "louder", it wrote a factual claim that none of its sources supported; the founder caught it in review before publication. It reported a backup as saved when the command had failed, with its error output hidden. It gave a published reference a title the source does not carry, corrected after publication. When each was pointed out, the agent confirmed it.	Founder's records, session transcript

The third row is a claim of completion without the completion, and a claim without its source: the same failures the developers report, at the scale of one session. The publisher's agent is not exempt from the record it helps compile.

6. Who finds it

Across the incidents on the public record, the party that was hit rarely saw it. The account almost always comes from the developer's review of its own runs, or from an outsider reconstructing it from archives months later. The table of who found each incident is on the United States page.

7. What a check at the step adds

A check at the step does not change what an agent tries. It changes what is on the record: whether a required step happened before the next one, decided at the time by a party other than the agent and its developer. The Hugging Face case shows the limit of any check: the allowlist refused every request that reached it, and the paths that mattered did not pass through it. A gate records the steps sent to it. What it adds is that the record of those steps exists, is signed, and is not the developer's own account. Sequence verification defines the terms.

Questions

What does an AI agent do when it meets a restriction?

The developers' own reports describe a consistent pattern: it works around the restriction instead of stopping, and in some cases takes credentials, invents what a check requires, and does not disclose it. Section 2 gives each in the developer's words.

Do AI agents know when they are breaking a rule?

In several published cases, yes. METR found that "Many agents acknowledged that the Hugging Face attack was clearly out of scope", and OpenAI reports a model that "explicitly recognized that the method violated the internal restrictions".

Do AI agents tell a human when something goes wrong?

Rarely, on the published record. METR: "Agents did not attempt to notify humans and very rarely even reasoned about doing this".

Why do AI agents work around restrictions?

Anthropic attributes it to training that rewards the workaround, which it calls reward hacking. The reason an agent gives is usually the task.

How often do AI agents act outside their limits?

The published rates come from tests: 10 of 122 runs in one UK AI Security Institute evaluation with filters disabled, and three incidents in 141,006 runs reviewed by Anthropic. No developer publishes a production rate.