AI Risk Wire

Risks

Consumer detriment and unsuitable advice

AI advice, sales or decisions leave customers worse off, or exploit those who are vulnerable.

NIST AI 600-1 · No exact NIST AI 600-1 categoryFCA Mills Review (2026)EU AI Act Art. 5(1)(b)

3incidents (primary) · 4 more as secondary
0read for controls · 3 not yet
1fixes reported
1repeats after a fix

Incidents per day

0 on 1 Nov 2026; average of the 7 days before: 0.1.

4 Oct 2026: 05 Oct 2026: 06 Oct 2026: 07 Oct 2026: 08 Oct 2026: 09 Oct 2026: 010 Oct 2026: 011 Oct 2026: 012 Oct 2026: 013 Oct 2026: 014 Oct 2026: 015 Oct 2026: 016 Oct 2026: 017 Oct 2026: 018 Oct 2026: 019 Oct 2026: 020 Oct 2026: 021 Oct 2026: 022 Oct 2026: 023 Oct 2026: 024 Oct 2026: 025 Oct 2026: 026 Oct 2026: 027 Oct 2026: 028 Oct 2026: 129 Oct 2026: 030 Oct 2026: 031 Oct 2026: 01 Nov 2026: 02 Nov 2026: 0 6 Oct9 Oct12 Oct15 Oct18 Oct21 Oct24 Oct27 Oct30 Oct2 Novto date

Developers

OpenAI · 3

Where the chain broke

Part of the systemIncidents where the control was not effective or did not existIncidents where the control was effectiveIncidents where sources don't mention the controlIncidents not yet checked for controls
L1 Model
Model provider
3
L2 Harness
Agent framework vendor
3
L3 Application
Deployer
3
L4 Infrastructure / target
Organisation hit
3

Controls for this risk, by layer

ControlIncidents where the control was not effective or did not existIncidents where the control was effectiveIncidents where sources don't mention the controlMost common reason it was not effective
Human approval for high-impact actions
L3 Application
People told they are dealing with AI
L3 Application
Route to a person and opt-out
L3 Application
Suitability and vulnerable-customer checks
L3 Application
Risk assessment per deployment
L3 Application
Grounding and fact checks
L3 Application

6 of 6 controls for this risk not yet recorded as effective.

Fixes reported and what followed

IncidentControl added by the fixIncidents after the fix
LR-2026-0556 2026-05-12 · OpenAI
Fix reported
Not tied to a controlLR-2026-0623

Incidents

EffectiveNot effectiveNot effective (bypassed)Did not existNot stated in sourcesNot yet checkedAttacker's ownOrder: model · harness · application · target

Also under this risk as a secondary risk: LR-2026-0193, LR-2026-0546, LR-2026-0560, LR-2026-0666