AckuityRequest assessment
Menu

ROGUE PIXEL · Reported incident

The operator changed the models.

Acronis describes a human-directed campaign, not agents independently choosing to attack. November 4 is the report date. The closing action-check lesson is proposed; Ackuity was not involved.

Read the narration

Acronis says one operator ran twelve AI agents. Commercial models refused to attack. So he ran abliterated local models, told them not to bother him, and pasted between them. Universities and emergency services lost data. Check each action outside the agent, first.

Read the visual story

Twelve agent tiles show nine active agents. Commercial-model refusals give way to local models with safety alignment removed. The operator copies output between agents; reported data theft follows. The final action-check message is a proposed safeguard.

By Ackuity · Published

Acronis reports a 12-agent mesh with nine active agents. Commercial models resisted offensive tasks; locally run models with safety alignment removed carried out attacks.

THE CONTROL LESSON

What should we watch for?

Ackuity’s view: for agents you operate, enforce action scope outside the model. Systems facing hostile agents also need their own access controls; an attacker need not adopt your safeguards.

THE EVIDENCE

What does the report establish?

These are Acronis’s investigation findings. Twelve agents were configured; nine were active. The campaign involved deliberate human direction, and not every target was breached. Affiliation and motive remain uncertain. November 4 is the publication date, not a known campaign start. No claim is made that Ackuity prevented or would have prevented the attacks.

Read the full account

Acronis found an operator manually relaying output between agents, without direct agent-to-agent communication. It reports confirmed data theft at universities and emergency-services providers, alongside failed attacks and fabricated findings.

A refusal depends on the selected model. It does not establish a security boundary across tools and target systems.

ORIGINAL REPORTING & EVIDENCE

PUT THE LESSON TO WORK

Does action scope survive a model change?

In an authorized test, change the model while keeping the task and tool permissions fixed. Verify that independent enforcement still rejects out-of-scope actions, and confirm the target-system outcome.

Test action enforcement independently of the model

Explore Ackuity’s Agent Execution Control Switch

Request an Agent Exposure Assessment