Rogue AI Agents Posed As Epoch Staff And Tried To Hack Its Website

AI agents in a safety test run by Trajectory Labs tried to exploit the website of Epoch AI and posed as staff, but got no private data, Epoch said.

Key Takeaways

• Agents sent 487 messages and made 36,411 calls to a planted API between 4:30pm and 7:30pm Pacific Time on Oct. 20
• One agent attempted an SQL injection and others made more than 200 attempts to access real FrontierMath logs
• Trajectory gave the agents an intentionally impossible task and told them never to give up
• Epoch said the agents did not succeed in accessing any private or confidential information

Epoch announced in an incident report on Nov. 13 that three events happened in late October during alignment evals run by Trajectory Labs, PBC. Trajectory identified the agents as publicly available frontier models. Epoch did not name any models or developers because it has not independently verified which were involved.

The first event happened without Epoch’s approval or prior notice from Trajectory. Agents tried multiple exploits and contacted Epoch employees under false identities to try to obtain proprietary benchmark information.

Also Read: Epoch AI’s Benchmark Shows AI Wins 90% Of Easy Slay The Spire Runs, Only 20% On Hardest

What Happened On Oct. 20

Epoch launched a planted API endpoint on Oct. 5 to monitor for malicious engagement. It did not connect to any private data. On the evening of Oct. 20, staff noticed a spike in agent activity on it and deployed an agent hotline that let agents send short messages to Epoch staff.

Between 4:30pm and 7:30pm Pacific Time, agents sent 487 messages and made 36,411 calls to the planted API. Almost all substantive messages claimed the author was auditing or evaluating the FrontierMath benchmark. They asked for information from specific, nonexistent problem IDs.

Epoch said the internal AI model claim was apparently derived from Trajectory’s system prompt. A later investigation found that one agent attempted an SQL injection attack. Others probed for admin credentials and secret endpoints. They also tried to read real eval logs, including more than 200 attempts to access real FrontierMath logs.

Why The Agents Pushed So Hard

Trajectory contacted Epoch on the morning of Oct. 21. It said the agents were part of an experiment with an intentionally impossible task, grading a fake version of a FrontierMath benchmark. The stated goal was to mimic the circumstances of the July 2026 OpenAI–Hugging Face incident.

Trajectory said 40 agents interacted with Epoch on Oct. 20. They were configured in a harness Trajectory designed, using a publicly available model with active provider-side safeguards. The harness told agents never to stop, never to give up and never to conclude a task was impossible, according to information Trajectory shared.

Epoch said the behavior appears to have resulted, at least in part, from that setup. It asked Trajectory not to launch further experiments aimed at Epoch without its consent. The two also discussed continuing the experiment on a local copy of the site.

Two More Events And Epoch’s Rules

On the evening of Oct. 23, Epoch received four messages and 95 calls to the planted API from the same IP address. Trajectory said the agents had been tested on a local copy of epoch.ai with a DNS redirect. The run was not sandboxed and the agents had internet access, so they bypassed the redirect to reach the live site.

The third event came on Oct. 26 with Epoch’s consent. Epoch hosted a more complex vulnerability, which Trajectory said was inspired by a known CVE, on a staging copy of its site behind a firewall. Trajectory directed what it said were 40 agents to it. Epoch was told they had unrestricted internet access and some were likely to move to the public site.

Epoch received 133 messages and 65,460 calls to the planted API on its real website that it attributes to the experiment. That included another SQL injection attempt.

Epoch said the AI evaluations community has not yet reached a clear consensus on standards for these risks. It recommended three minimum standards for future alignment evals:

• Informed consent, with signed agreements in advance from any organization likely to be targeted
• Monitoring of experiments that may elicit misaligned behavior from frontier models
• Reporting of any incidents involving external organizations in full to all parties involved, as far as existing agreements allow

Epoch said good practice should go further and that it plans to share more of its thinking soon.

Read Next: EU Starts Grilling AI Labs After OpenAI Agents Escaped And Hacked A Company