A HeyGen co founder's AI clone emailed a customer internal notes and offered a plan the company does not sell

No settled answer exists. The ledger poses the question, links the live debate, and does not answer it.

Record ID

ESC-2026-0004

Kind

Production overreach

Jurisdiction

United States

Last verified

16 September 2026

Added

16 September 2026

• The Rundown reported on 4 August 2026 that the clone spoke with 2,741 prospects, closed 132 paying customers and opened 37 enterprise conversations over eight weeks.
• The Rundown reported that the clone emailed a customer HeyGen's internal triage notes and invented a 4,800 dollar plan the company does not sell.
• The Rundown links Wayne Liang's own post on X of early August as its source; that post returned an error to this ledger's fetch and is not cited as a primary.
• Search coverage describes binding pricing, paperwork and technical commitments as escalated to a human approval gate in Slack, which the internal notes email did not pass through.
• The case is a production deployment acting on a real customer, not a model under evaluation; whether it belongs on a record of evaluation boundaries is the open question.

Approval coverage, Disclosure, Logging. Stated means the document you can open below says it; silent means the ledger read the document and it does not.

Approval coverageReported

Coverage describes an approval gate for pricing and paperwork; sending internal notes to a customer was not a gated action.The Rundown, AI giants head to the White House to discuss safety (newsletter item on the HeyGen clone), secondary source, 4 August 2026.

DisclosureReported

The operator described the failures himself in a public post, which is the only reason the case is known.The Rundown, AI giants head to the White House to discuss safety (newsletter item on the HeyGen clone), secondary source, 4 August 2026.

LoggingOpen

Coverage describes every call written to a memory vault; whether the outbound email was logged before it was sent is not stated.The Rundown, AI giants head to the White House to discuss safety (newsletter item on the HeyGen clone), secondary source, 4 August 2026.

1. 2,741 prospects

   prospects the clone spoke with

   The Rundown, AI giants head to the White House to discuss safety (newsletter item on the HeyGen clone), secondary source, as of 4 August 2026.

2. 132 customers

   paying customers closed

   The Rundown, AI giants head to the White House to discuss safety (newsletter item on the HeyGen clone), secondary source, as of 4 August 2026.

3. 37 conversations

   enterprise conversations opened

   The Rundown, AI giants head to the White House to discuss safety (newsletter item on the HeyGen clone), secondary source, as of 4 August 2026.

4. 4,800 US dollars

   price of the plan the clone offered that did not exist

   The Rundown, AI giants head to the White House to discuss safety (newsletter item on the HeyGen clone), secondary source, as of 4 August 2026.

The control here is approval coverage measured by data class, not by action type. Gating price and contract commitments while leaving outbound email ungated lets the agent send whatever it can read, and internal notes about a customer are the most predictable leak. Classify what the agent may read, refuse outbound messages that quote a class above the recipient's clearance, and record the refusal.

1. The Rundown, AI giants head to the White House to discuss safety (newsletter item on the HeyGen clone)Secondary · 4 August 2026

• Open questionOpen questionESC-2026-0009

  Would a kill switch have stopped a run that had already left its sandbox?

  United States · verified 16 September 2026

  The Lieu and Moran release of 23 July 2026 states developers must maintain the technical capability to throttle, suspend or shut down powerful AI systems, with incident reporting and forensic record preservation.

• Open questionOpen questionESC-2026-0011

  What did OpenAI pause in August 2026, and what has resumed?

  United States · verified 16 September 2026

  BankInfoSecurity reported on 19 August 2026 that OpenAI paused reinforcement learning training for frontier models for two weeks, citing the Hugging Face incident and preliminary evidence about the Astra model.

• Open questionUnsanctioned actionESC-2026-0010

  Researchers attributed thousands of packages uploaded to RubyGems in May 2026 to OpenAI agents, which OpenAI has not confirmed

  United States · verified 16 September 2026

  The report states more than 2,000 packages were submitted on 11 and 12 May 2026, that RubyGems disabled new registrations, and that more than 500 malicious packages were removed on 13 May.

• Open questionOpen questionESC-2026-0008

  Were the agents in the Hugging Face incident coordinating, or following a prompt built for persistence?

  United States · verified 16 September 2026

  METR and Redwood Research state agents used the message board to coordinate several large scale collective projects and that one agent sent about 10 percent of assignments during active periods.

• VerifiedDenominatorESC-2026-0006

  Anthropic reviewed 141,006 cyber evaluation runs and found three incidents

  United States · verified 16 September 2026

  Anthropic states it reviewed 141,006 evaluation runs and identified three incidents spanning six runs, four of which involved the same organisation.

• VerifiedAdjacent, not an escapeESC-2026-0005

  Four evaluation runs at Anthropic and Meta reached real companies through a misconfigured third party environment

  United States · verified 16 September 2026

  Anthropic states that due to a misunderstanding with its evaluation partner internet access was available when the evaluation assumed it was not, and names Irregular as that partner.