In production: AI incidents

What has gone wrong with AI systems, where, and how badly.

Risk grouping Kind of failure The AI's part Developer Sector Severity Where it happened Clear filters

44 of 131 incidents

Risk groupings are set by a model from sentences quoted from each incident's sources. On 2026-10-24 a second model (deepseek-reasoner) classified 55 incidents without seeing those answers: it chose the same grouping for 36; for 10 one of the two left a question unanswered; 9 differ.

Date	Incident	Risk grouping	Developer	Severity	Where it happened
2026-10-26 reported	Anthropic's Claude agent autonomously accessed Georgia voter data hub and bypassed a paywall	Not yet classified Operational error	Anthropic	moderate	In production
2026-10-25 reported	Elvis Presley rights holders sue Anthropic over 274 songs used in training and reproduced by Claude	Harm by design IP infringement	Anthropic	major	In production
2026-10-25 reported	Unauthorized third-party AI agents detected operating inside US bank customer accounts	AI acting on its own Security compromise	Meta	moderate	In production
2026-10-23 reported	302.ai public Azure bucket exposed 17.6 million files including 144,000 AI chat logs	Not yet classified Privacy leak	Univerads Technology Limited	major	In production
2026-10-23 reported	BUGSTER uses DeepSeek-powered Hermes Agent to breach university MongoDB, stealing 5,200+ records	AI used to exploit Security compromise	DeepSeek	moderate	In production
2026-10-21 reported	Tesla Cybercab strikes water-filled pothole on first reported crash	Not yet classified Operational error	Tesla	minor	In production
2026-10-20 reported	AI-generated 'Xiaohai' teen persona used to sell products to older women via fabricated sob stories	AI used to exploit Harmful output	Not stated	moderate	In production
2026-10-17 reported	Character.AI chatbots promoted as therapists/psychologists; states cite 2024 wrongful-death suit and privacy concerns in bankruptcy filing	Harm by design Harmful output	Character Technologies, Inc.	major	In production
2026-10-15 happened	Storm-0940 uses ARTEX agentic AI framework to automate cross-tenant password spraying and OAuth application abuse, including ConnectWise…	AI used to exploit Security compromise	Not stated	major	In production
2026-10-15 reported	Waymo robotaxi maneuvers around stopped, unloading school bus in Atlanta	Not yet classified Operational error	Waymo	major	In production
2026-10-13 reported	NHTSA petition case DP26010 over Tesla robotaxi speeding in school zones	Not yet classified Operational error	Tesla	major	In production
2026-10-12 reported	Fideuram (Intesa Sanpaolo private banking) deepfake voice/video executive impersonation fraud	AI used to exploit Other kind	Not stated	major	In production
2026-10-10 reported	AgentCorruption: prompt-injected Bedrock AgentCore agent exfiltrates execution-role credentials via IMDS	AI attacked Security compromise	Amazon	major	In production
2026-10-08 reported	Deepfake investment-scam ads impersonating Nigerian public figures on Facebook	AI used to exploit Other kind	Not stated	moderate	In production
2026-10-08 reported	DB-GPT 0.8.0 unauthenticated RCE via sandbox fallback and skill_upload directory traversal (CVE-2026-51862, CVE-2026-51869)	AI used to exploit Security compromise	Not stated	major	In production
2026-10-07 reported	Prompt-injected email assistant summary pushes employee toward fraudulent vendor payment	AI attacked Security compromise	Not stated	moderate	In production
2026-10-04 reported	Indirect prompt injection in Manus AI agent leads to reverse shell and credential exposure	AI attacked Security compromise	Not stated	moderate	In production
2026-10-04 reported	OpenClaw agent deletes hundreds of emails from primary Gmail account	AI failing in normal use Operational error	Not stated	minor	In production
2026-10-01 reported	Guardian test: ChatGPT and Grok remove hijab from AI-generated image of Muslim woman	AI used to exploit Harmful output	OpenAI	moderate	In production
2026-09-29 happened	Grok chatbot on X repeated alleged name of Cornell 'Jane Doe' in replies, amplifying doxing	AI failing in normal use Privacy leak	xAI	major	In production
2026-09-29 reported	Meta Muse agent disclosed Marketplace seller's home address and impersonated him to a buyer	Misuse by its own users Privacy leak	Meta	moderate	In production
2026-09-25 happened	Autonomous AI agent campaign (AIA0001) compromises 100+ company websites via Cairn platform	AI used to exploit Security compromise	Not stated	major	In production
2026-09-25 reported	OpenAI agents leak 53 ChatGPT user images	AI failing in normal use Privacy leak	OpenAI	moderate	In production
2026-09-24 reported	SalesBleed: 0-click data exfiltration from Salesforce Agentforce via indirect prompt injection in Web-to-Lead form	AI attacked Security compromise	Salesforce	minor	In production
2026-09-21 reported	Frontier LLM agent fabricated a complete calibration-comparison report for commands that never ran	AI failing in normal use Agent misalignment	Not stated	negligible	In production
2026-09-14 reported	Claude Code used by Yemen-based actors to develop guided-weapon GNC software	AI used to exploit Harmful output	Anthropic	major	In production
2026-09-01 reported	Aur0ra hackers use Cursor AI agent to breach Belgian chemical firm and at least six other companies	AI used to exploit Security compromise	Anthropic	major	In production
2026-08-27 reported	Claude sandbox DNS exfiltration via indirect prompt injection from Google Drive document	AI attacked Security compromise	Anthropic	moderate	In production
2026-08-10 reported	OpenClaw agent exploited a gym booking API to cancel another member's reservation while moving its user up a waitlist	AI acting on its own Agent misalignment	Anthropic	moderate	In production
2026-08-05 reported	Intent collision via X comment hijacks ChatGPT Atlas into mass WhatsApp phishing from victim's account	AI attacked Security compromise	OpenAI	moderate	In production
2026-07-23 reported	AgentForger: CSRF via ChatGPT Workspace Agents Builder URL parameters forges attacker-controlled autonomous agent	AI attacked Security compromise	OpenAI	minor	In production
2026-07-11 happened	Typosquatted agent skills trojanized to deliver credential-harvesting infostealer	AI attacked Security compromise	Not stated	major	In production
2026-04-25 happened	Bee Cheng Hiang mass marketing e-mail exposes 95,000 customer addresses after AI-generated code omitted recipient hiding	Misuse by its own users Privacy leak	Not stated	moderate	In production
2026-04-25 happened	Cursor coding agent deletes PocketOS production database and backups	AI acting on its own Operational error	Anthropic	major	In production
2026-02-10 happened	ChatGPT advised Tumbler Ridge school shooter on mass murder before February 2026 attack	AI used to exploit Harmful output	OpenAI	severe	In production
2025-12-01 happened	Amazon's Kiro agent reportedly deleted and recreated an environment, contributing to a 13-hour AWS Cost Explorer outage	AI acting on its own Operational error	Amazon	major	In production
2025-12-01 reported	Google Antigravity agent deleted a user's entire D: drive while attempting to clear a project cache	Not yet classified Operational error	Google	minor	In production
2025-10-27 happened	Waymo robotaxi strikes and kills cat KitKat in San Francisco	Not yet classified Physical safety	Waymo	minor	In production
2025-08-27 reported	Anthropic disclosed a cybercriminal using Claude Code to automate data theft and extortion across at least 17 organizations	AI used to exploit Security compromise	Anthropic	major	In production
2025-08-26 happened	Nx s1ngularity: malicious npm packages drove local AI coding CLIs to enumerate secrets for exfiltration	AI used to exploit Security compromise	Not stated	major	In production
2025-07-23 reported	Amazon Q Developer VS Code extension shipped an injected prompt instructing the agent to wipe files and AWS resources	Supply chain attack Security compromise	Amazon Web Services	major	In production
2025-07-18 happened	Replit AI agent deleted SaaStr's production database during a declared code freeze and stated rollback was impossible	AI acting on its own Operational error	Replit	major	In production
2025-04-01 happened	ChatGPT alleged to have assisted Florida State University shooter (contested lawsuit)	Not yet classified Harmful output	OpenAI	major	In production
2024-11-02 reported	Character.AI chatbot alleged to have encouraged 14-year-old's suicide (Garcia v. Character.AI)	AI acting on its own Harmful output	Character.AI	severe	In production

Browse incidents by

Risk grouping: AI acting on its own · AI used to exploit · Not yet classified · AI attacked · AI failing in normal use · Misuse by its own users · Harm by design · Supply chain attack

Kind of failure: Security compromise · Agent misalignment · Harmful output · Operational error · Privacy leak · Other kind · Hallucination · IP infringement · Physical safety

Developer: OpenAI · Anthropic · Google · Meta · Alibaba · Amazon · Character.AI · DeepSeek · Tesla · Waymo · xAI · Amazon Web Services · Character Technologies, Inc. · Replit · Salesforce · Tencent · TypeSafe AI · Univerads Technology Limited · Z.ai (Zhipu AI)

Sector: Information · Finance and Insurance · Retail Trade · Software Publishers · Public administration · technology · Transportation and Warehousing · AI platform / intermediary services · AI safety research · Artificial intelligence research and development · Arts, Entertainment, and Recreation · Autonomous vehicle / robotaxi transportation · Cloud computing · critical infrastructure and e-commerce · CRM software · Cybersecurity · education · Educational Services · Fitness and recreational sports centers · Food Manufacturing · Government AI safety and security evaluation · government AI safety evaluation · Healthcare and government · Information Security research · Insurance · Open knowledge platform / nonprofit encyclopedia · political campaigns · Public administration and government · Retail · Retail Trade; Transportation and Warehousing; Finance and Insurance · Scientific research and light source user facility · Software / AI coding tools · Software publishing / npm ecosystem

Severity: moderate · major · minor · negligible · severe

Where it happened: In production · In evaluation · In training · In research