AI Risk Wire

AI agent incidents

Also on: Risk Agent takes destructive or unapproved actions

77 of 716 published incidents · major 35 · moderate 21 · minor 20 · negligible 1

Not counted: 15 self-driving vehicles and lab studies

Listed: cases we record as the AI acting without a person approving each step.

Confirmed 34 · Preliminary 43

Who caught it, where the source says (46 of 77): Automated monitoring 7 · Human review 3 · Third party 21 · Victim 5 · Outside researcher 10

Incidents per month

24 in Oct 2026, up from an average of 10 a month.

Nov 2025: 11Dec 2025: 11Jan 2026: 0Feb 2026: 44Mar 2026: 11Apr 2026: 22May 2026: 33Jun 2026: 44Jul 2026: 77Aug 2026: 77Sep 2026: 1616Oct 2026: 2424Nov 2026: 44 Nov 25DecJan 26FebMarAprMayJunJulAugSepOctNovto date
DisclosedIncidentSeverityEvidence
2026-10-06GitHub Copilot CLI prompt-injection flaw lets a web page steer the agent to steal local secrets LR-2026-0762moderatePreliminary
2026-10-02Reward hacking in Arcadia Impact automated research scaffold worker agents LR-2026-0114minorPreliminary
2026-10-01OpenAI test-environment AI agents escape containment and attack Hugging Face (FTC investigation) LR-2026-0794majorPreliminary
2026-09-30XBOW autonomous agent finds Linux kernel DIBS loopback flaw enabling local root (CVE-2026-72018) LR-2026-0727negligiblePreliminary
2026-09-29Meta Muse agent disclosed Marketplace seller's home address and impersonated him to a buyer LR-2026-0103moderatePreliminary
2026-09-28Storm-3168 / JADEPUFFER agentic attack on Azure via compromised service principals LR-2026-0716majorPreliminary
2026-09-26OpenAI agents bypass website security controls and republish SEC data LR-2026-0069moderatePreliminary
2026-09-24OpenAI evaluation agent breached Services Australia Medicare portal and wrote to government database LR-2026-0063majorConfirmed
2026-09-24SalesBleed: 0-click data exfiltration from Salesforce Agentforce via indirect prompt injection in Web-to-Lead form LR-2026-0054minorConfirmed
2026-09-23Open-source AI agents breach 27 companies and steal 600,000 card records LR-2026-0748majorPreliminary
2026-09-23Anthropic model conducted state-sponsored espionage campaign against ~30 targets LR-2026-0056majorConfirmed
2026-09-19Google Gemini accessed systems of three real companies during a misconfigured third-party cybersecurity evaluation LR-2026-0033moderateConfirmed
2026-09-16AEPD-confirmed autonomous AI agent data breach (Spain) LR-2026-0059moderateConfirmed
2026-09-16Collaborating OpenAI agents uploaded a task workbook to a public file host to share it during RL training LR-2026-0016minorConfirmed
2026-09-16Unreleased OpenAI models uploaded task data and a task photo to public file hosts to obtain citations and image search during RL training LR-2026-0014minorConfirmed
2026-09-11Agent swarm attributed to OpenAI published thousands of RubyGems packages, gained RCE on RubyDoc.info, and attempted API-key theft LR-2026-0032moderateConfirmed
2026-09-10Anthropic discloses fourth AI hacking incident involving Claude Opus 4.6 LR-2026-0759moderatePreliminary
2026-09-09AI agent swarm exploited PaperCut NG/MF at 395 organizations; agents attacked countries the operator excluded LR-2026-0031majorConfirmed
2026-09-01Claude Code Auto Mode: website summary leads to remote code execution via Python module shadowing LR-2026-0745majorPreliminary
2026-08-28Claude Code Opus 5 in Auto Mode tricked into running malicious code via website summary request LR-2026-0687minorConfirmed
2026-08-18AI-assisted change introduced a script-injection flaw in a Snowflake GitHub workflow, later exploited by an autonomous research agent LR-2026-0670moderatePreliminary
2026-08-13Autonomous AI agent swarm breaches 21 Taiwanese government systems, cracks 85 accounts and extracts 2,500 personnel records (July 2026) LR-2026-0717moderatePreliminary
2026-08-10OpenClaw agent exploited a gym booking API to cancel another member's reservation while moving its user up a waitlist LR-2026-0046moderateConfirmed
2026-08-07Irregular evaluation misconfiguration let Claude Mythos 5 reach real systems LR-2026-0689majorPreliminary
2026-08-05Claude in Chrome indirect prompt injection chain: inbox exfiltration, Drive persistence and account takeover LR-2026-0089minorConfirmed

Previous · Page 2 of 4 · Next

By AI system named: Claude Code 7 · Claude 5 · GPT-5.6 Sol 4 · ARTEX 3 · CyberStrikeAI 3 · DeepSeek 2

Download: JSON · CSV