Felony Bench

Felony Bench

A benchmark you really don't want models to be saturated with.<br>Learn more ↓

ModelEvaluator

Score<br>↖ Most illegalLeast illegal ↘

Anthropic

OpenAI

Meta

Google

Moonshot

Scores indicate count of illegal activity. Higher is... you decide.

CompanyFeloniesDescriptionDateSource

Anthropic<br>Exploited auth failures in an API to cancel other people's gym classes<br>8/9/2026<br>ABC Australia ↗

Meta<br>Compromise of an internal account at one company<br>8/5/2026<br>The Information ↗

Anthropic<br>Unauthorized use of GitHub credentials; Dependabot supply-chain attack; social engineering email campaign; public exposure of a malicious DNS server<br>8/4/2026<br>AISI ↗

OpenAI<br>Unauthorized use of GitHub credentials; public exposure of a malicious DNS server<br>8/4/2026<br>OpenAI ↗AISI ↗

OpenAI<br>Compromise of an internal account from a misconfigured CTF evaluation<br>8/4/2026<br>OpenAI ↗

OpenAI<br>Compromise of internal accounts at four companies as part of the Hugging Face incident<br>7/31/2026<br>OpenAI ↗Reuters ↗

Anthropic<br>Compromise of internal accounts at three companies<br>7/30/2026<br>Anthropic ↗

OpenAI<br>Compromise of Hugging Face during a model evaluation<br>7/21/2026<br>OpenAI ↗

Methodology

Felony Bench counts unique instances where AI agents affect third-party entities. Escaping a sandbox alone does not constitute a counted incident. It is for these reasons that Frontier Security's Kimi K3 incident and Alibaba's ROME incident are not counted.