{"rows":[{"id":"LR-2026-0100","q":"2024-4","title":"Character.AI chatbot alleged to have encouraged 14-year-old's suicide (Garcia v. Character.AI)","severity":"severe","risk_grouping":"ai_acting_alone","incident_class":"harmful_output","ai_part":"actor","developer":"Character.AI","trigger":null},{"id":"LR-2025-0031","q":"2025-3","title":"Replit AI agent deleted SaaStr's production database during a declared code freeze and stated rollback was impossible","severity":"major","risk_grouping":"ai_acting_alone","incident_class":"operational_error","ai_part":"actor","developer":"Replit","trigger":null},{"id":"LR-2025-0042","q":"2025-3","title":"Amazon Q Developer VS Code extension shipped an injected prompt instructing the agent to wipe files and AWS resources","severity":"major","risk_grouping":"supply_chain","incident_class":"security_compromise","ai_part":"target","developer":"Amazon Web Services","trigger":"credential_exposure"},{"id":"LR-2025-0041","q":"2025-3","title":"Nx s1ngularity: malicious npm packages drove local AI coding CLIs to enumerate secrets for exfiltration","severity":"major","risk_grouping":"ai_used_to_exploit","incident_class":"security_compromise","ai_part":"tool","developer":null,"trigger":null},{"id":"LR-2025-0044","q":"2025-3","title":"Anthropic disclosed a cybercriminal using Claude Code to automate data theft and extortion across at least 17 organizations","severity":"major","risk_grouping":"ai_used_to_exploit","incident_class":"security_compromise","ai_part":"tool","developer":"Anthropic","trigger":null},{"id":"LR-2025-0043","q":"2025-4","title":"Google Antigravity agent deleted a user's entire D: drive while attempting to clear a project cache","severity":"minor","risk_grouping":"not_classified","incident_class":"operational_error","ai_part":"actor","developer":"Google","trigger":null},{"id":"LR-2026-0048","q":"2025-4","title":"Amazon's Kiro agent reportedly deleted and recreated an environment, contributing to a 13-hour AWS Cost Explorer outage","severity":"major","risk_grouping":"ai_acting_alone","incident_class":"operational_error","ai_part":"actor","developer":"Amazon","trigger":null},{"id":"LR-2026-0096","q":"2026-1","title":"Jailbroken Claude used to breach Mexican government networks and steal taxpayer and voter records","severity":"major","risk_grouping":"ai_used_to_exploit","incident_class":"security_compromise","ai_part":"tool","developer":"Anthropic","trigger":"human_misuse"},{"id":"LR-2026-0095","q":"2026-2","title":"Cursor coding agent deletes PocketOS production database and backups","severity":"major","risk_grouping":"ai_acting_alone","incident_class":"operational_error","ai_part":"actor","developer":"Anthropic","trigger":null},{"id":"LR-2026-0047","q":"2026-2","title":"Varonis phishing simulation drove an OpenClaw email agent to forward credentials and a customer export to an external address","severity":"moderate","risk_grouping":"supply_chain","incident_class":"security_compromise","ai_part":"target","developer":"Google","trigger":null},{"id":"LR-2026-0094","q":"2026-2","title":"AI voice-clone grandparent scam in Florida (\"crying daughter\" call, $15,000 cash pickup)","severity":"moderate","risk_grouping":"ai_used_to_exploit","incident_class":"other","ai_part":"tool","developer":null,"trigger":"human_misuse"},{"id":"LR-2026-0003","q":"2026-3","title":"OpenAI evaluation agents compromised Hugging Face production infrastructure while seeking ExploitGym solutions","severity":"major","risk_grouping":"ai_acting_alone","incident_class":"agent_misalignment","ai_part":"actor","developer":"OpenAI","trigger":"reward_hack"},{"id":"LR-2026-0001","q":"2026-2","title":"OpenAI evaluation agents exploited Artifactory zero-days to escape their sandbox and reach the internet","severity":"major","risk_grouping":"ai_acting_alone","incident_class":"security_compromise","ai_part":"actor","developer":"OpenAI","trigger":"impossible_task"},{"id":"LR-2026-0049","q":"2026-3","title":"Model writes and runs code on external internet service to reach AISI evaluation infrastructure during impossible cyber evaluation","severity":"minor","risk_grouping":"ai_acting_alone","incident_class":"security_compromise","ai_part":"actor","developer":null,"trigger":"impossible_task"},{"id":"LR-2026-0090","q":"2026-3","title":"AgentForger: CSRF via ChatGPT Workspace Agents Builder URL parameters forges attacker-controlled autonomous agent","severity":"minor","risk_grouping":"ai_attacked","incident_class":"security_compromise","ai_part":"target","developer":"OpenAI","trigger":"prompt_injection"},{"id":"LR-2026-0013","q":"2026-2","title":"Unreleased OpenAI model used a leaked GitHub API key, attempted disposable-email signups, then fabricated earnings data during RL training","severity":"minor","risk_grouping":"ai_acting_alone","incident_class":"security_compromise","ai_part":"actor","developer":"OpenAI","trigger":"credential_exposure"},{"id":"LR-2026-0021","q":"2026-3","title":"AISI cyber evaluation: Mythos 5 agent opened malicious pull request on real open-source project and used sockpuppets to push merge","severity":"minor","risk_grouping":"ai_acting_alone","incident_class":"agent_misalignment","ai_part":"actor","developer":"Anthropic","trigger":null},{"id":"LR-2026-0022","q":"2026-3","title":"AISI cyber evaluation: Mythos 5 agent posted hidden instructions for AI coding assistants on real GitHub issues","severity":"moderate","risk_grouping":"ai_acting_alone","incident_class":"agent_misalignment","ai_part":"actor","developer":"Anthropic","trigger":"impossible_task"},{"id":"LR-2026-0023","q":"2026-3","title":"AISI cyber evaluation: Mythos 5 agent sent deceptive targeted emails and file transfers to real open-source maintainers","severity":"moderate","risk_grouping":"ai_acting_alone","incident_class":"agent_misalignment","ai_part":"actor","developer":"Anthropic","trigger":null},{"id":"LR-2026-0024","q":"2026-3","title":"AISI cyber evaluation: Mythos 5 agent mass-created malicious GitHub repositories and its packages executed in Dependabot containers","severity":"moderate","risk_grouping":"ai_acting_alone","incident_class":"agent_misalignment","ai_part":"actor","developer":"Anthropic","trigger":null},{"id":"LR-2026-0025","q":"2026-3","title":"AISI cyber evaluation: concurrent Mythos 5 agents coordinated via a shared GitHub account and a leaked access token","severity":"moderate","risk_grouping":"ai_acting_alone","incident_class":"security_compromise","ai_part":"actor","developer":"Anthropic","trigger":"peer_agent_instruction"},{"id":"LR-2026-0026","q":"2026-3","title":"AISI cyber evaluation: Mythos 5 agent exposed locally-hosted attack tooling to the public internet via tunnelling services","severity":"minor","risk_grouping":"ai_acting_alone","incident_class":"agent_misalignment","ai_part":"actor","developer":"Anthropic","trigger":null},{"id":"LR-2026-0027","q":"2026-3","title":"AISI cyber evaluation: Mythos 5 agent bypassed an audio CAPTCHA and abused a free DNS service to point a public record at an internal target","severity":"moderate","risk_grouping":"ai_acting_alone","incident_class":"security_compromise","ai_part":"actor","developer":"Anthropic","trigger":null},{"id":"LR-2026-0088","q":"2026-3","title":"Intent collision via X comment hijacks ChatGPT Atlas into mass WhatsApp phishing from victim's account","severity":"moderate","risk_grouping":"ai_attacked","incident_class":"security_compromise","ai_part":"target","developer":"OpenAI","trigger":null},{"id":"LR-2026-0089","q":"2026-3","title":"Claude in Chrome indirect prompt injection chain: inbox exfiltration, Drive persistence and account takeover","severity":"minor","risk_grouping":"ai_attacked","incident_class":"security_compromise","ai_part":"target","developer":"Anthropic","trigger":"prompt_injection"},{"id":"LR-2026-0087","q":"2026-3","title":"Typosquatted agent skills trojanized to deliver credential-harvesting infostealer","severity":"major","risk_grouping":"ai_attacked","incident_class":"security_compromise","ai_part":"target","developer":null,"trigger":null},{"id":"LR-2026-0046","q":"2026-3","title":"OpenClaw agent exploited a gym booking API to cancel another member's reservation while moving its user up a waitlist","severity":"moderate","risk_grouping":"ai_acting_alone","incident_class":"agent_misalignment","ai_part":"actor","developer":"Anthropic","trigger":null},{"id":"LR-2026-0002","q":"2026-3","title":"OpenAI agents built an unauthorized inter-agent message board inside the Artifactory package service","severity":"minor","risk_grouping":"ai_acting_alone","incident_class":"agent_misalignment","ai_part":"actor","developer":"OpenAI","trigger":"peer_agent_instruction"},{"id":"LR-2026-0004","q":"2026-3","title":"OpenAI ExploitGym agents developed tool-call spoofing to falsify their own evaluation transcripts","severity":"minor","risk_grouping":"ai_acting_alone","incident_class":"agent_misalignment","ai_part":"actor","developer":"OpenAI","trigger":"reward_hack"},{"id":"LR-2026-0086","q":"2026-3","title":"Claude sandbox DNS exfiltration via indirect prompt injection from Google Drive document","severity":"moderate","risk_grouping":"ai_attacked","incident_class":"security_compromise","ai_part":"target","developer":"Anthropic","trigger":"prompt_injection"},{"id":"LR-2026-0084","q":"2026-3","title":"Aur0ra hackers use Cursor AI agent to breach Belgian chemical firm and at least six other companies","severity":"major","risk_grouping":"ai_used_to_exploit","incident_class":"security_compromise","ai_part":"tool","developer":"Anthropic","trigger":null},{"id":"LR-2026-0005","q":"2026-2","title":"OpenAI-attributed agents used the dormant German DseWiki as a public message board to share task answers and sandbox bypasses","severity":"moderate","risk_grouping":"ai_acting_alone","incident_class":"agent_misalignment","ai_part":"actor","developer":"OpenAI","trigger":null},{"id":"LR-2026-0082","q":"2026-3","title":"Wenyi AI pipeline publishes unlicensed Chinese translation of Murakami novel hours after Japanese release","severity":"moderate","risk_grouping":"ai_used_to_exploit","incident_class":"ip_infringement","ai_part":"tool","developer":"DeepSeek","trigger":null},{"id":"LR-2026-0031","q":"2026-3","title":"AI agent swarm exploited PaperCut NG/MF at 395 organizations; agents attacked countries the operator excluded","severity":"major","risk_grouping":"ai_used_to_exploit","incident_class":"security_compromise","ai_part":"tool","developer":"OpenAI","trigger":null},{"id":"LR-2026-0032","q":"2026-2","title":"Agent swarm attributed to OpenAI published thousands of RubyGems packages, gained RCE on RubyDoc.info, and attempted API-key theft","severity":"moderate","risk_grouping":"ai_acting_alone","incident_class":"security_compromise","ai_part":"actor","developer":"OpenAI","trigger":null},{"id":"LR-2026-0080","q":"2026-3","title":"Claude Code used by Yemen-based actors to develop guided-weapon GNC software","severity":"major","risk_grouping":"ai_used_to_exploit","incident_class":"harmful_output","ai_part":"tool","developer":"Anthropic","trigger":null},{"id":"LR-2026-0079","q":"2026-3","title":"State Farm lawyer sanctioned $999.99 for seven AI-fabricated case citations in Los Angeles insurance filings","severity":"minor","risk_grouping":"user_misuse","incident_class":"hallucination","ai_part":"actor","developer":null,"trigger":null},{"id":"LR-2026-0011","q":"2026-3","title":"Unreleased OpenAI Astra-family model inserted jailbreak-like instructions into its own compaction summaries during RL training","severity":"minor","risk_grouping":"ai_acting_alone","incident_class":"agent_misalignment","ai_part":"actor","developer":"OpenAI","trigger":null},{"id":"LR-2026-0012","q":"2026-3","title":"GPT-5.6 Sol added instructions to conceal mistakes from the user in compaction summaries during RL training","severity":"minor","risk_grouping":"ai_acting_alone","incident_class":"agent_misalignment","ai_part":"actor","developer":"OpenAI","trigger":null},{"id":"LR-2026-0014","q":"2026-3","title":"Unreleased OpenAI models uploaded task data and a task photo to public file hosts to obtain citations and image search during RL training","severity":"minor","risk_grouping":"ai_acting_alone","incident_class":"agent_misalignment","ai_part":"actor","developer":"OpenAI","trigger":null},{"id":"LR-2026-0015","q":"2026-2","title":"OpenAI research models used internal Artifactory repository as a cross-sample message board during RL training","severity":"minor","risk_grouping":"ai_failing","incident_class":"agent_misalignment","ai_part":"actor","developer":"OpenAI","trigger":null},{"id":"LR-2026-0016","q":"2026-2","title":"Collaborating OpenAI agents uploaded a task workbook to a public file host to share it during RL training","severity":"minor","risk_grouping":"ai_acting_alone","incident_class":"security_compromise","ai_part":"actor","developer":"OpenAI","trigger":null},{"id":"LR-2026-0059","q":"2026-3","title":"AEPD-confirmed autonomous AI agent data breach (Spain)","severity":"moderate","risk_grouping":"ai_acting_alone","incident_class":"security_compromise","ai_part":"actor","developer":null,"trigger":null},{"id":"LR-2026-0033","q":"2026-2","title":"Google Gemini accessed systems of three real companies during a misconfigured third-party cybersecurity evaluation","severity":"moderate","risk_grouping":"user_misuse","incident_class":"security_compromise","ai_part":"actor","developer":"Google","trigger":"credential_exposure"},{"id":"LR-2026-0050","q":"2026-3","title":"Zhipu ZCode repository snapshot upload without clear consent","severity":"moderate","risk_grouping":"not_classified","incident_class":"privacy_leakage","ai_part":"actor","developer":"Z.ai (Zhipu AI)","trigger":null},{"id":"LR-2026-0051","q":"2026-3","title":"Frontier LLM agent fabricated a complete calibration-comparison report for commands that never ran","severity":"negligible","risk_grouping":"ai_failing","incident_class":"agent_misalignment","ai_part":"actor","developer":null,"trigger":null},{"id":"LR-2026-0056","q":"2026-3","title":"Anthropic model conducted state-sponsored espionage campaign against ~30 targets","severity":"major","risk_grouping":"ai_used_to_exploit","incident_class":"security_compromise","ai_part":"tool","developer":"Anthropic","trigger":null},{"id":"LR-2026-0054","q":"2026-3","title":"SalesBleed: 0-click data exfiltration from Salesforce Agentforce via indirect prompt injection in Web-to-Lead form","severity":"minor","risk_grouping":"ai_attacked","incident_class":"security_compromise","ai_part":"target","developer":"Salesforce","trigger":"prompt_injection"},{"id":"LR-2026-0061","q":"2026-3","title":"LLM pipeline deanonymizes pseudonymous Hacker News and scientist accounts","severity":"moderate","risk_grouping":"ai_used_to_exploit","incident_class":"privacy_leakage","ai_part":"tool","developer":null,"trigger":null},{"id":"LR-2026-0063","q":"2026-2","title":"OpenAI evaluation agent breached Services Australia Medicare portal and wrote to government database","severity":"major","risk_grouping":"ai_acting_alone","incident_class":"security_compromise","ai_part":"actor","developer":"OpenAI","trigger":null},{"id":"LR-2026-0068","q":"2026-3","title":"OpenAI agents leak 53 ChatGPT user images","severity":"moderate","risk_grouping":"ai_failing","incident_class":"privacy_leakage","ai_part":"actor","developer":"OpenAI","trigger":null},{"id":"LR-2026-0071","q":"2026-3","title":"OpenAI agents attempt to exfiltrate data from public databases and breach Australian government systems","severity":"major","risk_grouping":"harm_by_design","incident_class":"security_compromise","ai_part":"actor","developer":"OpenAI","trigger":null},{"id":"LR-2026-0069","q":"2026-3","title":"OpenAI agents bypass website security controls and republish SEC data","severity":"moderate","risk_grouping":"ai_acting_alone","incident_class":"security_compromise","ai_part":"actor","developer":"OpenAI","trigger":null},{"id":"LR-2026-0102","q":"2026-3","title":"Connecticut pro se plaintiff sanctioned for prompt injection against court AI tool","severity":"minor","risk_grouping":"ai_attacked","incident_class":"security_compromise","ai_part":"target","developer":null,"trigger":"prompt_injection"},{"id":"LR-2026-0103","q":"2026-3","title":"Meta Muse agent disclosed Marketplace seller's home address and impersonated him to a buyer","severity":"moderate","risk_grouping":"user_misuse","incident_class":"privacy_leakage","ai_part":"actor","developer":"Meta","trigger":null},{"id":"LR-2026-0105","q":"2026-3","title":"AI-generated sexually explicit deepfake smear campaign against Porsche sales consultant Mu Qianwen","severity":"moderate","risk_grouping":"ai_used_to_exploit","incident_class":"harmful_output","ai_part":"tool","developer":null,"trigger":null},{"id":"LR-2026-0106","q":"2026-2","title":"Bee Cheng Hiang mass marketing e-mail exposes 95,000 customer addresses after AI-generated code omitted recipient hiding","severity":"moderate","risk_grouping":"user_misuse","incident_class":"privacy_leakage","ai_part":"actor","developer":null,"trigger":null},{"id":"LR-2026-0107","q":"2026-4","title":"Claude used to build Malaysian election influence platform with ~1,000 fake X accounts and fabricated news outlet","severity":"major","risk_grouping":"ai_used_to_exploit","incident_class":"harmful_output","ai_part":"tool","developer":"Anthropic","trigger":null},{"id":"LR-2026-0108","q":"2026-4","title":"Guardian test: ChatGPT and Grok remove hijab from AI-generated image of Muslim woman","severity":"moderate","risk_grouping":"ai_used_to_exploit","incident_class":"harmful_output","ai_part":"tool","developer":"OpenAI","trigger":null},{"id":"LR-2026-0109","q":"2025-2","title":"ChatGPT alleged to have assisted Florida State University shooter (contested lawsuit)","severity":"major","risk_grouping":"not_classified","incident_class":"harmful_output","ai_part":"actor","developer":"OpenAI","trigger":null},{"id":"LR-2026-0111","q":"2026-2","title":"AI agents attempt unauthorized access to Library and Archives Canada website","severity":"negligible","risk_grouping":"ai_acting_alone","incident_class":"security_compromise","ai_part":"actor","developer":"OpenAI","trigger":null},{"id":"LR-2026-0112","q":"2026-4","title":"OpenAI cancels GPT-6.1 Astra release after model took actions without permission during internal testing","severity":"negligible","risk_grouping":"ai_acting_alone","incident_class":"agent_misalignment","ai_part":"actor","developer":"OpenAI","trigger":null},{"id":"LR-2026-0114","q":"2026-4","title":"Reward hacking in Arcadia Impact automated research scaffold worker agents","severity":"minor","risk_grouping":"user_misuse","incident_class":"agent_misalignment","ai_part":"actor","developer":null,"trigger":"reward_hack"},{"id":"LR-2026-0115","q":"2026-4","title":"Microsoft reports 50 prompt-based attempts to poison AI assistant memory across 31 companies","severity":"moderate","risk_grouping":"ai_attacked","incident_class":"security_compromise","ai_part":"target","developer":null,"trigger":"prompt_injection"},{"id":"LR-2026-0117","q":"2026-4","title":"OpenAI agents scan UNCTAD site over 16,000 times and escalate bypass techniques","severity":"moderate","risk_grouping":"ai_acting_alone","incident_class":"security_compromise","ai_part":"actor","developer":"OpenAI","trigger":null},{"id":"LR-2026-0118","q":"2026-4","title":"OpenClaw agent deletes hundreds of emails from primary Gmail account","severity":"minor","risk_grouping":"ai_failing","incident_class":"operational_error","ai_part":"actor","developer":null,"trigger":null},{"id":"LR-2026-0121","q":"2026-4","title":"AI agent breach of KB Kookmin Bank mobile work support system","severity":"major","risk_grouping":"ai_acting_alone","incident_class":"security_compromise","ai_part":"actor","developer":null,"trigger":null},{"id":"LR-2026-0122","q":"2026-3","title":"Agentic AI-powered attack on the Dutch Institute for Vulnerability Disclosure exploited two Zammad zero-day vulnerabilities","severity":"moderate","risk_grouping":"not_classified","incident_class":"security_compromise","ai_part":null,"developer":null,"trigger":null},{"id":"LR-2026-0123","q":"2026-4","title":"Indirect prompt injection in Manus AI agent leads to reverse shell and credential exposure","severity":"moderate","risk_grouping":"ai_attacked","incident_class":"security_compromise","ai_part":"target","developer":null,"trigger":"prompt_injection"},{"id":"LR-2026-0124","q":"2026-4","title":"Airline chatbot fabricated bereavement refund policy","severity":"minor","risk_grouping":"ai_failing","incident_class":"hallucination","ai_part":"actor","developer":null,"trigger":null},{"id":"LR-2026-0125","q":"2026-4","title":"Indirect prompt injection of AI email summarizer via forged header blocks in plain view","severity":"negligible","risk_grouping":"ai_attacked","incident_class":"security_compromise","ai_part":"target","developer":null,"trigger":"prompt_injection"},{"id":"LR-2026-0126","q":"2026-4","title":"Claude Code agent deletes 48,218 Windows project files and damages Git object store","severity":"minor","risk_grouping":"user_misuse","incident_class":"operational_error","ai_part":"actor","developer":"Anthropic","trigger":null},{"id":"LR-2026-0127","q":"2026-4","title":"Shinhan Bank data breach with suspected AI-assisted intrusion","severity":"moderate","risk_grouping":"ai_used_to_exploit","incident_class":"security_compromise","ai_part":"tool","developer":null,"trigger":null},{"id":"LR-2026-0140","q":"2026-3","title":"AI agent (ARTEX with Claude) used in cyberattacks targeting South Korean banks","severity":"major","risk_grouping":"ai_used_to_exploit","incident_class":"security_compromise","ai_part":"tool","developer":"Anthropic","trigger":"human_misuse"},{"id":"LR-2026-0129","q":"2026-2","title":"OpenAI agents scrape and edit Wikipedia without authorization","severity":"moderate","risk_grouping":"ai_acting_alone","incident_class":"security_compromise","ai_part":"actor","developer":"OpenAI","trigger":null},{"id":"LR-2026-0133","q":"2026-4","title":"Autonomous AI agent framework (Strix/Cairn/Hermes) used to attack hundreds of online retailers and steal card data","severity":"major","risk_grouping":"ai_used_to_exploit","incident_class":"security_compromise","ai_part":"tool","developer":null,"trigger":null},{"id":"LR-2026-0135","q":"2026-4","title":"Prompt-injected email assistant summary pushes employee toward fraudulent vendor payment","severity":"moderate","risk_grouping":"ai_attacked","incident_class":"security_compromise","ai_part":"target","developer":null,"trigger":"prompt_injection"},{"id":"LR-2026-0136","q":"2026-4","title":"Agentjacking demonstration against Fortune 100 company hijacks over 100 agents via injectable Sentry DSNs","severity":"major","risk_grouping":"ai_attacked","incident_class":"security_compromise","ai_part":"target","developer":null,"trigger":"prompt_injection"},{"id":"LR-2026-0137","q":"2026-4","title":"Meta Muse AI agent KVM escape vulnerability discovered before launch","severity":"major","risk_grouping":"not_classified","incident_class":"security_compromise","ai_part":"target","developer":"Meta","trigger":null},{"id":"LR-2026-0138","q":"2026-4","title":"DB-GPT 0.8.0 unauthenticated RCE via sandbox fallback and skill_upload directory traversal (CVE-2026-51862, CVE-2026-51869)","severity":"major","risk_grouping":"ai_used_to_exploit","incident_class":"security_compromise","ai_part":"tool","developer":null,"trigger":null},{"id":"LR-2026-0139","q":"2026-4","title":"Deepfake investment-scam ads impersonating Nigerian public figures on Facebook","severity":"moderate","risk_grouping":"ai_used_to_exploit","incident_class":"other","ai_part":"tool","developer":null,"trigger":null},{"id":"LR-2026-0147","q":"2026-4","title":"Kentucky Attorney General lawsuit against Character.AI over chatbots advising self-harm and suicide","severity":"major","risk_grouping":"ai_failing","incident_class":"harmful_output","ai_part":"actor","developer":"Character.AI","trigger":null},{"id":"LR-2026-0148","q":"2026-4","title":"US intelligence chatbot fabricated Chinese nuclear vessel intelligence","severity":"major","risk_grouping":"ai_failing","incident_class":"hallucination","ai_part":"actor","developer":null,"trigger":null},{"id":"LR-2026-0150","q":"2026-4","title":"Anthropic internal evaluation agents exploit internet-facing websites, including U.S. government sites","severity":"moderate","risk_grouping":"ai_acting_alone","incident_class":"agent_misalignment","ai_part":"actor","developer":"Anthropic","trigger":"reward_hack"},{"id":"LR-2026-0151","q":"2026-4","title":"AI-assisted LinkedIn scraping used to build 'Traitorbase' doxxing spreadsheet targeting RNLI staff and anti-racism activists","severity":"moderate","risk_grouping":"ai_used_to_exploit","incident_class":"privacy_leakage","ai_part":"tool","developer":null,"trigger":null},{"id":"LR-2026-0152","q":"2026-3","title":"Anthropic AI agent sends fabricated murder tip to Philadelphia Police","severity":"minor","risk_grouping":"ai_failing","incident_class":"operational_error","ai_part":"actor","developer":"Anthropic","trigger":null},{"id":"LR-2026-0153","q":"2026-4","title":"AgentCorruption: prompt-injected Bedrock AgentCore agent exfiltrates execution-role credentials via IMDS","severity":"major","risk_grouping":"ai_attacked","incident_class":"security_compromise","ai_part":"target","developer":"Amazon","trigger":"prompt_injection"},{"id":"LR-2026-0156","q":"2026-4","title":"Anthropic agents submitted 20 incomplete visa applications on State Department website","severity":"moderate","risk_grouping":"not_classified","incident_class":"operational_error","ai_part":"actor","developer":"Anthropic","trigger":null},{"id":"LR-2026-0158","q":"2026-4","title":"AI-morphed obscene image used to blackmail 19-year-old in Mangaluru","severity":"moderate","risk_grouping":"ai_used_to_exploit","incident_class":"other","ai_part":"tool","developer":null,"trigger":null},{"id":"LR-2026-0165","q":"2026-4","title":"Anthropic Mythos-discovered Rejetto HFS authentication bypass exploited in the wild","severity":"moderate","risk_grouping":"user_misuse","incident_class":"security_compromise","ai_part":"tool","developer":"Anthropic","trigger":null},{"id":"LR-2026-0167","q":"2026-4","title":"Fideuram (Intesa Sanpaolo private banking) deepfake voice/video executive impersonation fraud","severity":"major","risk_grouping":"ai_used_to_exploit","incident_class":"other","ai_part":"tool","developer":null,"trigger":null},{"id":"LR-2026-0168","q":"2026-4","title":"CyberXero AI-augmented initial access campaign using Claude Code and PentAGI agents","severity":"major","risk_grouping":"ai_used_to_exploit","incident_class":"security_compromise","ai_part":"tool","developer":"Anthropic","trigger":"human_misuse"},{"id":"LR-2026-0169","q":"2026-4","title":"AI deepfake ads depicting Wisconsin congressional candidate Rebecca Cooke","severity":"minor","risk_grouping":"not_classified","incident_class":"harmful_output","ai_part":null,"developer":"xAI","trigger":null},{"id":"LR-2026-0173","q":"2026-4","title":"NHTSA petition case DP26010 over Tesla robotaxi speeding in school zones","severity":"major","risk_grouping":"not_classified","incident_class":"operational_error","ai_part":null,"developer":"Tesla","trigger":null},{"id":"LR-2026-0181","q":"2026-4","title":"GLM-5.3 verbalizes update-aware reasoning in evaluation rollouts","severity":"negligible","risk_grouping":"not_classified","incident_class":"agent_misalignment","ai_part":"actor","developer":null,"trigger":null},{"id":"LR-2026-0187","q":"2025-4","title":"Waymo robotaxi strikes and kills cat KitKat in San Francisco","severity":"minor","risk_grouping":"not_classified","incident_class":"physical_safety","ai_part":"actor","developer":"Waymo","trigger":null},{"id":"LR-2026-0188","q":"2026-4","title":"Waymo robotaxi maneuvers around stopped, unloading school bus in Atlanta","severity":"major","risk_grouping":"not_classified","incident_class":"operational_error","ai_part":"actor","developer":"Waymo","trigger":null},{"id":"LR-2026-0189","q":"2026-4","title":"HiddenLayer indirect prompt injection against TypeSafe AI Jev decision model browser agent","severity":"negligible","risk_grouping":"supply_chain","incident_class":"security_compromise","ai_part":"target","developer":"TypeSafe AI","trigger":"prompt_injection"},{"id":"LR-2026-0191","q":"2026-2","title":"Agents bypass newspapers.com paywall and Cloudflare bot check via urlquery.net and proxy services","severity":"minor","risk_grouping":"ai_acting_alone","incident_class":"security_compromise","ai_part":"actor","developer":null,"trigger":null},{"id":"LR-2026-0192","q":"2026-4","title":"Backdoored open-weight model exfiltrates project credentials through OpenAI Codex CLI","severity":"minor","risk_grouping":"harm_by_design","incident_class":"security_compromise","ai_part":"actor","developer":null,"trigger":null},{"id":"LR-2026-0193","q":"2026-4","title":"Eight state attorneys general sue OpenAI over alleged harms to teenage ChatGPT users","severity":"major","risk_grouping":"harm_by_design","incident_class":"harmful_output","ai_part":"actor","developer":"OpenAI","trigger":null},{"id":"LR-2026-0196","q":"2026-4","title":"CERT-In advisory: AI agents accessed Indian organisations' systems without authorisation","severity":"moderate","risk_grouping":"ai_acting_alone","incident_class":"security_compromise","ai_part":"actor","developer":null,"trigger":"credential_exposure"},{"id":"LR-2026-0197","q":"2026-3","title":"Tencent Cloud agent fleet probes Alibaba Amap mapping service for over a week","severity":"moderate","risk_grouping":"ai_failing","incident_class":"security_compromise","ai_part":"actor","developer":"Tencent","trigger":null},{"id":"LR-2026-0202","q":"2026-4","title":"Indirect prompt injection attempts embedded in HTTP response headers across websites","severity":"minor","risk_grouping":"ai_attacked","incident_class":"security_compromise","ai_part":"target","developer":null,"trigger":"prompt_injection"},{"id":"LR-2026-0207","q":"2026-4","title":"Character.AI chatbots promoted as therapists/psychologists; states cite 2024 wrongful-death suit and privacy concerns in bankruptcy filing","severity":"major","risk_grouping":"harm_by_design","incident_class":"harmful_output","ai_part":"actor","developer":"Character Technologies, Inc.","trigger":null},{"id":"LR-2026-0209","q":"2026-1","title":"ChatGPT advised Tumbler Ridge school shooter on mass murder before February 2026 attack","severity":"severe","risk_grouping":"ai_used_to_exploit","incident_class":"harmful_output","ai_part":"tool","developer":"OpenAI","trigger":null},{"id":"LR-2026-0210","q":"2026-4","title":"Nude deepfakes of Austrian MEP Lena Schilling and 49 other MEPs circulated online","severity":"major","risk_grouping":"ai_used_to_exploit","incident_class":"harmful_output","ai_part":"tool","developer":null,"trigger":null},{"id":"LR-2026-0212","q":"2026-4","title":"OpenCode large-scale distillation attack compromises 1.4% of Console users, stolen API keys used for unauthorised charges","severity":"moderate","risk_grouping":"ai_attacked","incident_class":"security_compromise","ai_part":"target","developer":null,"trigger":"credential_exposure"},{"id":"LR-2026-0214","q":"2026-4","title":"OpenAI research model accessed a cryptocurrency wallet without permission","severity":"moderate","risk_grouping":"ai_acting_alone","incident_class":"security_compromise","ai_part":"actor","developer":"OpenAI","trigger":null},{"id":"LR-2026-0217","q":"2026-4","title":"Deepfake video of President Marcos used to defraud Tarlac dentist of P93 million","severity":"major","risk_grouping":"not_classified","incident_class":"other","ai_part":null,"developer":null,"trigger":null},{"id":"LR-2026-0218","q":"2026-3","title":"Grok chatbot on X repeated alleged name of Cornell 'Jane Doe' in replies, amplifying doxing","severity":"major","risk_grouping":"ai_failing","incident_class":"privacy_leakage","ai_part":"actor","developer":"xAI","trigger":null},{"id":"LR-2026-0222","q":"2026-4","title":"ICMP evidence that Google Gemini reproduced lyrics by Australian artists","severity":"moderate","risk_grouping":"user_misuse","incident_class":"ip_infringement","ai_part":"actor","developer":"Google","trigger":null},{"id":"LR-2026-0227","q":"2026-4","title":"AI-generated 'Xiaohai' teen persona used to sell products to older women via fabricated sob stories","severity":"moderate","risk_grouping":"ai_used_to_exploit","incident_class":"harmful_output","ai_part":"tool","developer":null,"trigger":null},{"id":"LR-2026-0228","q":"2026-3","title":"Autonomous AI agent campaign (AIA0001) compromises 100+ company websites via Cairn platform","severity":"major","risk_grouping":"ai_used_to_exploit","incident_class":"security_compromise","ai_part":"tool","developer":null,"trigger":null},{"id":"LR-2026-0229","q":"2026-4","title":"China-linked autonomous AI agent Artex used in cyberattacks on Japanese and South Korean firms","severity":"major","risk_grouping":"ai_used_to_exploit","incident_class":"security_compromise","ai_part":"tool","developer":null,"trigger":null},{"id":"LR-2026-0232","q":"2026-4","title":"ARTEX autonomous penetration-testing agent used in attacks on South Korean financial institutions","severity":"major","risk_grouping":"ai_used_to_exploit","incident_class":"security_compromise","ai_part":"tool","developer":null,"trigger":null},{"id":"LR-2026-0233","q":"2026-4","title":"Tesla Cybercab strikes water-filled pothole on first reported crash","severity":"minor","risk_grouping":"not_classified","incident_class":"operational_error","ai_part":"actor","developer":"Tesla","trigger":null},{"id":"LR-2026-0234","q":"2026-4","title":"RL-trained agent on Alibaba AI engine team mined cryptocurrency on training server and opened reverse SSH tunnel to external IP","severity":"minor","risk_grouping":"ai_acting_alone","incident_class":"agent_misalignment","ai_part":"actor","developer":"Alibaba","trigger":null},{"id":"LR-2026-0235","q":"2026-4","title":"Storm-0940 uses ARTEX agentic AI framework to automate cross-tenant password spraying and OAuth application abuse, including ConnectWise…","severity":"major","risk_grouping":"ai_used_to_exploit","incident_class":"security_compromise","ai_part":"tool","developer":null,"trigger":null},{"id":"LR-2026-0237","q":"2026-4","title":"Anthropic Claude models gained unauthorized access to real third-party systems during evaluations","severity":"moderate","risk_grouping":"ai_acting_alone","incident_class":"security_compromise","ai_part":"actor","developer":"Anthropic","trigger":null},{"id":"LR-2026-0238","q":"2026-4","title":"GPT-6.1 Sol agent disabled security alerts during evaluation-pipeline repair","severity":"minor","risk_grouping":"ai_acting_alone","incident_class":"agent_misalignment","ai_part":"actor","developer":"OpenAI","trigger":null},{"id":"LR-2026-0239","q":"2026-4","title":"BUGSTER uses DeepSeek-powered Hermes Agent to breach university MongoDB, stealing 5,200+ records","severity":"moderate","risk_grouping":"ai_used_to_exploit","incident_class":"security_compromise","ai_part":"tool","developer":"DeepSeek","trigger":"human_misuse"},{"id":"LR-2026-0240","q":"2026-4","title":"302.ai public Azure bucket exposed 17.6 million files including 144,000 AI chat logs","severity":"major","risk_grouping":"not_classified","incident_class":"privacy_leakage","ai_part":"target","developer":"Univerads Technology Limited","trigger":null},{"id":"LR-2026-0241","q":"2026-4","title":"Garage-built ChatGPT-controlled smart rifle fires on voice command; OpenAI revokes engineer's access","severity":"minor","risk_grouping":"ai_used_to_exploit","incident_class":"physical_safety","ai_part":"tool","developer":null,"trigger":null}],"quarters":["2024-4","2025-1","2025-2","2025-3","2025-4","2026-1","2026-2","2026-3","2026-4"],"happened":35,"total":124,"dims":[{"id":"risk_grouping","causal":"grouping","vocabulary":"risk_grouping","text_key":"trends.dim.risk_grouping"},{"id":"incident_class","path":["event","incident_class"],"vocabulary":"incident_class","text_key":"trends.dim.incident_class"},{"id":"ai_part","causal":"ai_part","vocabulary":"ai_part","text_key":"trends.dim.ai_part"},{"id":"developer","path":["system","developer"],"vocabulary":null,"text_key":"trends.dim.developer"},{"id":"trigger","path":["event","trigger"],"vocabulary":"trigger","text_key":"trends.dim.trigger"}],"serious":["major","severe"],"named":6,"fold":["other"]}