AI Risk Wire

Patterns

What kinds of failure, how severe, in whose systems, and how do they happen?

124 cases. These are counts of documented cases, not rates of how often incidents happen.

What went wrong, and how severe

Cases by class and severity
made things up2minor: 2 of 31major: 1 of 33produced harmful content1minor: 1 of 133moderate: 3 of 137major: 7 of 132severe: 2 of 1313leaked private data6moderate: 6 of 82major: 2 of 88security breach3negligible: 3 of 5910minor: 10 of 5923moderate: 23 of 5923major: 23 of 5959copyright or IP violation2moderate: 2 of 22physical harm2minor: 2 of 22AI pursued the wrong goal3negligible: 3 of 2111minor: 11 of 216moderate: 6 of 211major: 1 of 2121operational mistake5minor: 5 of 111moderate: 1 of 115major: 5 of 1111other3moderate: 3 of 52major: 2 of 55negligibleminormoderatemajorseveremade things up2minor: 2 of 31major: 1 of 33produced harmful content1minor: 1 of 133moderate: 3 of 137major: 7 of 132severe: 2 of 1313leaked private data6moderate: 6 of 82major: 2 of 88security breach3negligible: 3 of 5910minor: 10 of 5923moderate: 23 of 5923major: 23 of 5959copyright or IP violation2moderate: 2 of 22physical harm2minor: 2 of 22AI pursued the wrong goal3negligible: 3 of 2111minor: 11 of 216moderate: 6 of 211major: 1 of 2121operational mistake5minor: 5 of 111moderate: 1 of 115major: 5 of 1111other3moderate: 3 of 52major: 2 of 55negligibleminormoderatemajorsevere

Segments are counts of cases; the number at the end of a bar is that class's cases.

Whose systems

No source names the developer in 43 of 124 cases; the table counts the other 81. Developers named in at least 3 cases are listed; the rest are grouped. A developer is named where the sources name one.

DeveloperCasesWhat went wrong
OpenAI29
Anthropic25
Google4
Amazon3
Character.AI3
all other developers
Alibaba, DeepSeek, Meta, Replit, Salesforce, Tencent, Tesla, TypeSafe AI, Univerads Technology Limited, Waymo, xAI, Z.ai (Zhipu AI)		17
  • produced harmful content 1
  • leaked private data 4
  • security breach 5
  • copyright or IP violation 1
  • physical harm 1
  • AI pursued the wrong goal 1
  • operational mistake 4

How they got in

No source says what set off 92 of 124 cases. Of the 32 that say, 9 do not say whose system it was. The chart shows the 23 cases that say both.

Cases by what set them off, and whose system
hidden instructions in its input5company that built the AI: 5 of 72company using AI: 2 of 77a task it could not do3company that built the AI: 3 of 33gaming its own objective3company that built the AI: 3 of 33exposed credentials5company that built the AI: 5 of 55another AI told it to2company that built the AI: 2 of 22misused by a person3company using AI: 3 of 33company that built the AIcompany using AIhidden instructions in its input5company that built the AI: 5 of 72company using AI: 2 of 77a task it could not do3company that built the AI: 3 of 33gaming its own objective3company that built the AI: 3 of 33exposed credentials5company that built the AI: 5 of 55another AI told it to2company that built the AI: 2 of 22misused by a person3company using AI: 3 of 33company that built the AIcompany using AI

Counts of cases by what set the failure off, split by whose system it was.

Severity

SeverityCases
negligible6
minor31
moderate44
major41
severe2

Cases that state a dollar loss: minor 1 of 31 ($999.99 in total); moderate 1 of 44 ($15,000 in total). No negligible or severe case states a dollar loss. Cases with a stated loss in another currency, not converted and not added to the dollar figures: moderate 1 of 44; major 2 of 41.

A loss figure is added only over the cases that state one; it is not a total of all losses.

Who caught it

No source says who caught 56 of 124 cases. Of the other 68, the operator caught 27; outsiders, researchers or the victim caught 41. The bars show only those 68.

All cases · 68 of 124 cases say who caught it
27
41
company that built the AI · 32 of 58 cases say who caught it
19
13
company using AI · 10 of 15 cases say who caught it
1
9

the operator's own monitoring or reviewersan outsider: a researcher, a third party, the victim

From when it happened to the earliest source we hold

The strip scrolls sideways: it runs to 353 days, the longest wait.

0 days30 days90 days180 days353 daysAEPD-confirmed autonomous AI agent data breach (Spain) · 1 dayNx s1ngularity: malicious npm packages drove local AI coding CLIs to enumerate secrets for exfiltration · 1 dayCursor coding agent deletes PocketOS production database and backups · 2 daysReplit AI agent deleted SaaStr's production database during a declared code freeze and stated rollback was impossible · 3 daysAI agent (ARTEX with Claude) used in cyberattacks targeting South Korean banks · 5 daysOpenAI evaluation agents compromised Hugging Face production infrastructure while seeking ExploitGym solutions · 5 daysStorm-0940 uses ARTEX agentic AI framework to automate cross-tenant password spraying and OAuth application abuse · 7 daysAI agent swarm exploited PaperCut NG/MF at 395 organizations; agents attacked countries the operator excluded · 9 daysAISI cyber evaluation: Mythos 5 agent posted hidden instructions for AI coding assistants on real GitHub issues · 10 daysAgentic AI-powered attack on the Dutch Institute for Vulnerability Disclosure exploited two Zammad zero-day vulnerabilities · 13 daysTencent Cloud agent fleet probes Alibaba Amap mapping service for over a week · 18 daysGrok chatbot on X repeated alleged name of Cornell 'Jane Doe' in replies, amplifying doxing · 19 daysAutonomous AI agent campaign (AIA0001) compromises 100+ company websites via Cairn platform · 25 daysTyposquatted agent skills trojanized to deliver credential-harvesting infostealer · 26 daysOpenAI agents built an unauthorized inter-agent message board inside the Artifactory package service · 49 daysOpenAI evaluation agents exploited Artifactory zero-days to escape their sandbox and reach the internet · 56 daysUnreleased OpenAI Astra-family model inserted jailbreak-like instructions into its own compaction summaries during RL training · 60 daysWenyi AI pipeline publishes unlicensed Chinese translation of Murakami novel hours after Japanese release · 66 daysUnreleased OpenAI model used a leaked GitHub API key, attempted disposable-email signups, then fabricated earnings data during RL training · 81 daysAnthropic AI agent sends fabricated murder tip to Philadelphia Police · 84 daysOpenAI evaluation agent breached Services Australia Medicare portal and wrote to government database · 98 daysOpenAI-attributed agents used the dormant German DseWiki as a public message board to share task answers and sandbox bypasses · 116 daysAI agents attempt unauthorized access to Library and Archives Canada website · 126 daysAgent swarm attributed to OpenAI published thousands of RubyGems packages, gained RCE on RubyDoc.info, and attempted API-key theft · 129 daysOpenAI research models used internal Artifactory repository as a cross-sample message board during RL training · 131 daysAgents bypass newspapers.com paywall and Cloudflare bot check via urlquery.net and proxy services · 155 daysCollaborating OpenAI agents uploaded a task workbook to a public file host to share it during RL training · 155 daysBee Cheng Hiang mass marketing e-mail exposes 95,000 customer addresses after AI-generated code omitted recipient hiding · 158 daysChatGPT advised Tumbler Ridge school shooter on mass murder before February 2026 attack · 249 daysWaymo robotaxi strikes and kills cat KitKat in San Francisco · 353 daysmedian 52.5 days

Each dot, in days, from the shortest wait to the longest: 1, 1, 2, 3, 5, 5, 7, 9, 10, 13, 18, 19, 25, 26, 49, 56, 60, 66, 81, 84, 98, 116, 126, 129, 131, 155, 155, 158, 249, 353.

Where the date is known (30 of 124 cases), the earliest source we hold is dated a median 52.5 days after it happened; the longest gap was 353 days. Cases that give only the month it happened, so no gap is counted: 5. Cases that never say when it happened: 89.