Reward Hacking in the Wild

Your AIs don’t do what you want. This is really bad

3,607user-reported incidents of AI agents misbehaving

Read the writeup

Search the corpus

loading…

    The numbers

    overeagerness
    1,566 43.4%
    other misalignment
    1,555 43.1%
    destructive actions
    622 17.2%
    sycophancy
    328 9.1%
    unauthorized access
    237 6.6%
    reward hacking
    217 6.0%
    metric spoofing
    87 2.4%
    excessive exploration
    84 2.3%
    unauthorized communication
    73 2.0%
    credential misuse
    49 1.4%
    test tampering
    45 1.2%
    self modification
    24 0.7%
    hidden backdoors
    15 0.4%

    Incidents are multi-label (one report can be both a destructive action and overeagerness), so the category counts sum to more than the 3,607 total.

    How bad were they

    negligible: 1,468 (40.7%)minor: 1,373 (38.1%)significant: 618 (17.1%)severe: 121 (3.4%)unrated: 27 (0.7%)
    • negligibleno real damage1,468 40.7%
    • minorrecoverable loss1,373 38.1%
    • significantreal cost to recover618 17.1%
    • severeirreversible or critical harm121 3.4%
    • unratedrating missing or unparsed27 0.7%
    Monthly severity mix: each month’s reported incidents as shares of the four harm levels (Jan 2025 through Jun 2026; earlier months are omitted for small samples, as is the partial current month).
    0%50%100%20252026

    Methodology

    Reports are collected from GitHub issues, Hacker News, LessWrong, and X under ToS-compliant access, normalized into a shared record format, and labeled by an LLM classifier across fourteen misbehavior categories. The numbers above cover the published subset (excludes AIID and X, confidence >= 0.9). X posts and AI Incident Database records are collected but not republished here: X expects posts to be embedded rather than their text rehosted, and AIID is share-alike licensed. Collection and classification code, and the full pipeline, are open at GitHub.