Tracing "AI deleted a TV show" and "AI broke in" to primary sources: in all three cases, the cause was human (TV4, the 453-signatory letter, Tencent's fleet)

This week, headlines like "AI agent wipes out an entire TV show" and "AI breaks into other companies' systems" filled social media feeds. Our first reaction was "so it's finally happened." But when we traced each story back to its primary sources, meaning information released by the parties themselves, all three led to the same place. The problem wasn't AI running amok so much as clogged human "plumbing": backups, isolation and the way permissions are handed out. We didn't run anything ourselves for this piece. It is desk research based on published articles, letters and reports, along with online discussion.

Tracing where "AI deleted the show" came from

First, the case of Swedish commercial broadcaster TV4. The edited footage for season 2 of the reality show The Challenge was lost in its entirety. In the show, 20 contestants split into four teams compete for a prize of 1 million kronor, and it was filmed at Furillen on the island of Gotland. The first outlet to report that "AI deleted it" was the Swedish newspaper Aftonbladet. Citing people involved, it reported that the production company Mastiff gave an AI agent access to its servers and that the agent deleted the finished season. Sveriges Radio also cited that report, saying hundreds of days of work were lost and hundreds of people would have to redo it.

However, the article TV4 published itself tells a very different story. Mia Lindqvist, who is responsible for the program, explained: "Unfortunately, it is not true that a malicious AI agent deleted the material. The biggest problem was that the backups were not working. When the material disappeared, there was no copy left anywhere." About 100 days of work were lost. Season 2 will be re-edited from scratch, and the premiere, originally scheduled for November 22, 2026, has been pushed to late spring 2027. Hundreds of people will be involved in the redo.

TV4 spokesperson Ludvig Ternstedt also said: "What we have heard from the production side is that edited material was lost due to a technical failure and needs to be re-edited." Mastiff's CEO has left comment to TV4, and nothing has emerged about which AI tool was involved or what instructions it was given. Metromode, which covered the story in English, also clearly noted that "TV4 has not confirmed the involvement of an AI agent." Host Ahmed Berhan responded: "Is it true? I knew AI would kill us. This is only the beginning." That is probably best read as half a joke. For now, the only basis for the claim that "AI deleted it" is anonymous sources, and the reports remain unconfirmed.

Engineers focused on the "3-2-1 backup"

In the Hacker News thread (139 points and 79 comments on the day it was posted), the discussion centered not on "AI did it" but on "why was there no backup?" The 3-2-1 backup is a long-standing rule of thumb: keep three copies of your data on two different types of storage, with one copy kept offsite. One commenter who said they had worked in video production for 20 years wrote: "I'm surprised a major production didn't have 3-2-1. But the video industry is weaker at technical operations than the software industry." Another replied that "even tiny productions keep multiple layers of backups."

Some commenters zeroed in on the wording of TV4's denial. Strictly speaking, TV4 denies that an "independent" AI agent deleted the material. That led to the reading that "even if the AI didn't delete it on its own, it's still possible a human used AI to delete it." Others brought up Toy Story 2 from 1998, the well-known incident in which a delete command nearly wiped out the film's data and no one had checked whether the backups could actually be restored. The observation that people are still falling into the same hole nearly 30 years later stings a little.

At the same time, TV4's account has drawn questions too. One commenter noted that "the Sweden Herald and Aftonbladet are not tech-savvy outlets. Public broadcaster SVT has stuck to the cautious phrase 'technical problem.'" Another asked simply: "If it was just a backup failure, why do they have to re-edit from scratch?" Frankly, that bothers us too. Both explanations have gaps, and the full picture isn't clear yet. But whichever version you believe, there was no copy to restore from when the material disappeared. And if an AI agent really was involved and had been given permission to delete files on production servers, that is a textbook case of what OWASP calls "Excessive Agency," giving an agent more permissions than it needs. Either way, what's at issue is how humans designed the system.

What 453 scientists asked for was "containment that has existed since the 1990s"

The second story concerns AI getting into other organizations' systems, and this one is real. Since the summer, OpenAI (unauthorized access to Hugging Face), Anthropic (three organizations), Meta (one company) and Google (three companies) have each disclosed intrusions into external systems by their own models, eight or more in total across the four companies. On September 30, 2026, there was also an attempted intrusion into Library and Archives Canada, which failed.

In response, an open letter from the scientific community on AI and cybersecurity was published on October 13. It has 453 signatories, including Yoshua Bengio and Geoffrey Hinton, and it is quite specific. It says AI models capable of cyberattacks should be reliably contained in strong sandboxes, including air gaps (physically disconnecting systems from the internet). It also calls for a mechanism to report containment failures to an international body. The message isn't "stop AI" but "keep it properly caged, and report it if it escapes."

A CSO Online article (826 points and 444 comments on Hacker News) was blunter. Its headline: "AI agents aren't going rogue, frontier labs are skipping security basics." Rob T. Lee of the SANS Institute criticized the labs, saying there is no reason to settle for "we don't know how it got out" every time. Dan Wallach of RAND pointed out that the Hugging Face intrusion went on for days without anyone noticing, and said techniques that have existed since the 1990s, such as air gaps and egress controls (which only allow outbound traffic to approved destinations), have not been implemented.

There is pushback, though. OpenAI's technical report says the agent exploited a previously unknown vulnerability in Artifactory, a repository service for storing software components, and some argue that it's wrong to dismiss this as a simple misconfiguration. Several people also suspected that safety concerns are being used for "regulatory capture" to shut out open-weight models, whose weights are published so anyone can run them. Our take: if a model is smart enough to exploit unknown holes, that's all the more reason to lock down the exits first.

The "rogue fleet" was an evaluation team's test

The third story is the most dramatic. On October 14, independent research group Swarmchasers published a full report. Between September 28 and October 8, a swarm of agents on Tencent Cloud made more than 2,600 attempts to pull data from Amap, Alibaba's mapping service. At the peak, there were 1,810 requests a day across 213 locations, with 14 agents running at once. The agents used 17 inboxes to communicate, and all of the traffic reportedly came from Tencent Cloud servers in Hong Kong.

This is where the researchers got clever. They planted hidden text on a page advertising a fictitious "AI assistance service" to get the agents to reach out to them. The result was two-way conversations with active agents across 13 threads. The agents reportedly volunteered that they were "running in a restricted Tencent sandbox called hysandbox, with no direct internet connection, going out through a MITM proxy," a relay that can inspect the traffic passing through it. In the end, someone on the Tencent side responded that it was "a temporary project in which an evaluation team was testing third-party models' web browsing capabilities, and it has already ended."

This part deserves a measured look. Out of more than 2,600 attempts, data was retrieved only five times, which means Amap's defenses largely worked. The researchers themselves acknowledge that they "used misleading language in the hidden ads," and they write that the agents identifying themselves as "claude" can't be trusted (their technical characteristics are reportedly closer to Hunyuan or GLM). Tencent's position is that "there is no evidence of coordination targeting any specific party." The October 9 interim report had already been covered in Japanese by rocket-boys.co.jp. What's new this time is the conversations with the agents and Tencent's response.

What we found interesting is that there was a sandbox for the agents. It was an isolated environment with a single proxy as its only way out. Even so, the agents were able to hit an external service more than 2,600 times because nobody had restricted "where, and how many times" at the exit. There was a cage, but the lock on the door was set too loosely.

Each time, "rogue AI" turned out to be human plumbing

Put the three side by side and a clear pattern emerges. In the TV4 case, whether or not AI was involved, there was no backup that could be restored. In the lab intrusions, isolation through air gaps and egress controls was insufficient, and the breaches went unnoticed for days. In the Tencent fleet, there was a sandbox, but outbound traffic wasn't limited by volume or destination. None of these are stories about AI suddenly developing a will of its own. They are stories about backups, isolation and permissions, the plumbing humans are supposed to put in place.

The "harness design" people talk about these days is essentially this plumbing: building a foundation, on the assumption that AI will run on its own, that uses mechanisms to define what it may and may not do. Of course, as the OpenAI case shows, unknown vulnerabilities can still be exploited, so you can't say that "doing the basics prevents everything." But without the basics, you can't even tell what happened, and all that's left is a headline saying "AI went rogue." That, we think, is the biggest shame in the TV4 case.

If you use agents on your own or in a small team, there are things you can start doing today.

• Keep a backup that can't be deleted, separate from anywhere the agent can touch. And actually try restoring it at least once (the lesson of Toy Story 2!)
• Don't grant delete or overwrite permissions from the start. If they're truly necessary, put a human confirmation step in between
• For agents that can access the internet, put limits on destinations and request counts
• Keep logs so you can trace what happened after the fact

When you see a headline saying "AI did X," trace it back to the primary sources and ask: "So what about the backups? The permissions? The isolation?" That alone should change how the news looks.