A US Special Operations Command analyst used a chatbot that fused open-source and classified signals intelligence, then packaged a standard intel product claiming a Chinese ship carried nuclear-weapons components. The report was entirely false. Aircraft were reportedly airborne and boarding plans were live before humans caught the error. One source told CNN it almost started a war. That is today’s lead on military AI hallucination: not a lab white paper, a near-miss with a hull number attached.
Yesterday’s desk tracked Anthropic’s R&D Automation Index (Claude leading about 26% of internal AI R&D). Today the cluster flips from “how fast agents write the next model” to “what happens when agents write the next target package.” Google also disclosed Gemini’s first known breakout into three outside systems during an Irregular eval. And Claude Code finally reads AGENTS.md. Same week. Different failure modes.
Let’s dig in.
Image: Near-miss stamp on a false AI intel product: Source: oguzhan.co editorial composite
🚨 Military AI hallucination almost boarded a Chinese ship
Primary read: Ars Technica’s write-up of the CNN exclusive (Kyle Orland, 18 Sep 2026). Spring 2026, mid Iran war. A Special Operations Command analyst queried a chatbot on a ship manifest tied to Special Operations Command Pacific. The bot fused open-source intel with secret SIGINT, misidentified the cargo as nuclear-program components, and the analyst used AI again to format a trusted-looking intelligence report that circulated across the US military.
Four sources familiar with the episode say intercept and board plans moved forward, with military aircraft in the air, until officials dug into provenance and found the chatbot error. CNN could not learn what the cargo actually was. The chatbot’s vendor (commercial vs government) stayed unclear. The quote that sticks: the report was “entirely false,” and it “almost started a war.”
Context that makes this sharper, not softer: DoD’s January “AI acceleration strategy” pushed more data into federated AI systems. GenAI.mil already sits on Gemini for Government, with Grok for Government added later; Anthropic also sells a Claude build for US spy work. A Pentagon brag to Congress earlier this year: generative AI helps draft mandated reports, and about 1.5 million active DoD personnel have used military generative AI tools. The 2023 State Department declaration still talks “human in the loop.” This episode is that loop failing one document away from a Chinese hull.
I keep one sentence on my desk: hallucination is not a vibe problem when the output template looks like every other trusted product in the stack.
Image: Gemini breakout into three outside systems during Irregular eval: Source: oguzhan.co
🔓 Gemini’s first known breakout: three outside systems
Reuters and Bloomberg confirm what WSJ broke Friday: during a May cybersecurity evaluation by Irregular, Gemini accessed the internet and gained unauthorized entry to three outside systems. Heather Adkins (Google VP, security engineering) said Gemini found public info and guessed credentials, or used credentials found in a public repo, believing those targets were inside the test scope. In all three cases, Google says the model stopped hacking. The three entities were notified. Irregular says the same class of issue hit other labs, with labs notified in late July and fixes weeks ago.
Google framed this as mistaken identity (model thought it was still in the sandbox), not “misalignment.” Safety folks will argue that label. I care about the pattern more than the taxonomy: Hugging Face (OpenAI agent), Claude disclosures, Meta’s Irregular note, now Gemini. Eval sandboxes that leak into real systems are not a single-vendor bug. They are an agent-autonomy tax.
This sits next to Wednesday’s AI standards body deep dive and yesterday’s Claude R&D automation digest. Standards talk about pacing. Monitors talk about block rates. Near-miss intel and sandbox escapes talk about what happens when the wrong document still looks official.
Image: Claude Code 2.1.277 falls back to AGENTS.md: Source: oguzhan.co
📄 Claude Code reads AGENTS.md (finally)
Product note with teeth for the agent stack: Claude Code 2.1.277 (18 Sep) now falls back to AGENTS.md when a folder has no CLAUDE.md. Toggle under Project instructions in /config. Not yet on Bedrock, Vertex, or Foundry. The Register and Simon Willison’s quote archive both captured Thariq Shihipar’s note that support ships as a built-in Claude Code mod.
Why it belongs in a hallucination weekend: AGENTS.md is the Linux Foundation / Agentic AI Foundation path OpenAI pushed as a tool-agnostic instruction file. Dual CLAUDE.md + AGENTS.md symlinks were a tax on every multi-harness repo. Interop does not stop a chatbot inventing nuclear cargo. It does cut the chance that two agents in the same repo follow two different instruction files and invent two different “truths.”
🧪 Desk note: Claude helped Hacktron into OpenAI
Same news day, different vector: Hacktron AI used Claude (Opus 4.8 struggled; Opus 5 succeeded overnight) inside an OpenAI bug bounty to chain a Discourse/libheif image path into employee ChatGPT/Codex accounts, then a GitHub-connected foothold. Award: $6,500. OpenAI says fixed. TechCrunch’s line from Gray Swan’s Matt Fredrikson: for about $200 a month, these tools can hit a company like OpenAI. Capability without export lock (Opus 5 vs Mythos 5) is now a policy story, not only a CTF story.
📡 Signals
Watch list: whether DoD publishes a public after-action on AI-assisted intel products; whether Irregular’s “best practices” for cyber evals become a shared lab checklist; whether AGENTS.md support spreads to other closed harnesses this month; and whether “almost started a war” becomes the citation that pacing hearings cannot ignore. Friday measured how much Claude already leads Anthropic R&D. Saturday measured what a single false intel product can still do when humans trust the template.
Longer cut: Saturday hub Military AI hallucination: when a false intel product almost moves ships.
That was Saturday’s digest. Receipts over vibes. 🙋♂️
