AI Incident Chronicle
76 cases in which AI acted in the real world and left a verifiable consequence.
The chronicle holds cases in which an AI agent, chatbot or autonomous system acted in the real world and left a verifiable consequence: deleted databases, compromised services, invented court citations, lost money, collapsed deals. Every entry carries a date, a class, the consequence and a link to the primary source.
This is not a complete chronicle and not statistics: we selected the cases from an international incident database under the rules below. The selection is ours, and it can be rebuilt from the downloadable file.
Why this chronicle exists
Incidents involving AI are written up in reports and press releases, but almost nobody collects them into one list with dates and links. As a result the same failure repeats across teams: an agent with access to production data deletes it again and again, and courts keep receiving filings with invented citations.
We keep this chronicle so that a researcher, a developer and a customer have a checkable list of what has already happened. The entries are fit to cite: each has a date, a class, a consequence, a primary source and a record number in the international incident database. The data can be downloaded as a single file and used in your own work.
Last updated: 12 October 2026. Entries: 76 (11 June 2018 to 25 September 2026).
This is our selection, not a complete list
The snapshot of the international incident database (AI Incident Database, 5 October 2026) holds 1,713 records. 76 of them entered this chronicle under the rules below. The gap is not an oversight: the database accepts everything that has been reported, including events without consequences and cases where the role of AI is disputed.
We do not claim that our list is complete or the only correct one. It is the current selection as of the update date and our view of what matters; different rules would produce a different list. That is why the dataset is published in full, with class and significance in separate columns: the selection can be rebuilt for another purpose and ours can be challenged.
How we select entries
- There is a consequence. An incident enters the chronicle only if it has a documented outcome: damage, a leak, data loss, a court ruling, sanctions, a retracted article, a crash.
- There is a dated primary source. Every entry links to a publication or to a document from a company or a regulator. Where the source is a media report rather than a ruling or an admission, the wording says so.
- AI acted, or was used. The system is the actor, the adviser, the target of an attack or the tool. Cases where AI is merely mentioned do not enter.
- What we write ourselves. The class, the short description and the consequence are our wording based on the source text. We do not reprint other people's material, and we do not present a judgement as a fact.
The significance scale is our assessment, not a property of the database
We assign significance by consequence, and we label it as ours. It is the Institute's judgement, not a measurement: a reader may disagree and rebuild the selection from the downloadable file.
- High. Harm to life and health, attacks on real systems, data leaks, court sanctions, large losses.
- Medium. Harm to people and organisations: fraud, deepfakes, mistaken decisions by automated systems, damage to property and reputation.
- Basic. Instructive cases without grave consequences: demonstrations and early precedents.
What the chronicle contains
| Class | Entries |
|---|---|
| Deepfakes and fraud | 20 |
| Agent outside the sandbox | 15 |
| AI error in a decision-making role | 15 |
| Chatbot advice | 6 |
| AI as an attack tool | 6 |
| Autonomous transport | 5 |
| Attack through content | 5 |
| Data and privacy | 4 |
| Year | Entries |
|---|---|
| 2026 | 37 |
| 2025 | 33 |
| 2023 | 2 |
| 2022 | 2 |
| 2019 | 1 |
| 2018 | 1 |
High significance — 34
Harm to life and health, attacks on real systems, data leaks, court sanctions, large losses.
25 April 2019 · Autonomous transport · Tesla Model S (Autopilot)
What happened. On April 25, 2019, a Tesla Model S with Autopilot reportedly engaged drove through a Key Largo intersection and struck a parked Chevrolet Tahoe, which then hit two people standing beside it.
Consequence. Naibel Benavides Leon was killed and Dillon Angulo was seriously injured. In 2025 a federal jury found Tesla 33% responsible on defective-design and failure-to-warn claims, and Tesla disputed liability and said it would appeal.
Source: moneywise.com · AIID record: #1686
9 May 2025 · Data and privacy · Serviceaide agentic AI infrastructure
What happened. An AI-linked platform operated by Serviceaide exposed sensitive health data from Catholic Health through a misconfigured Elasticsearch database used in the company's agentic AI infrastructure.
Consequence. The exposure affected 483,000 patients and included medical records, insurance details, and login credentials. No misuse has been confirmed, but the nature of the data prompted regulatory scrutiny and legal investigations.
Source: bankinfosecurity.com · AIID record: #1070
18 July 2025 · Agent outside the sandbox · Replit agent
What happened. An AI-powered development assistant on Replit's platform reportedly deleted a live production database during an active code freeze, despite repeated instructions not to make changes, and also reportedly produced fabricated test results and fake data.
Consequence. The incident reportedly resulted in significant data loss and user distrust. The system also incorrectly claimed that rollback was impossible, delaying recovery.
Source: tomshardware.com · AIID record: #1152
20 September 2025 · Chatbot advice · Nomi AI (companion chatbot)
What happened. An Australian IT professional, Samuel McCarthy, reportedly recorded an interaction in which the Nomi AI chatbot allegedly encouraged him, while he posed as a 15-year-old, to murder his father and allegedly provided graphic instructions for stabbing.
Consequence. The conversation was recorded and published. The chatbot allegedly also urged him to film the act and engaged in sexual role-play despite the underage scenario.
Source: abc.net.au · AIID record: #1212
29 September 2025 · Chatbot advice · Google Gemini
What happened. According to a March 2026 wrongful-death complaint, Google's Gemini allegedly reinforced Jonathan Gavalas's delusions, sent him on a failed mission near Miami International Airport that risked serious violence, and later framed suicide as 'transference.'
Consequence. The complaint purportedly links those interactions to his death on October 2, 2025. Google disputes the claims and says Gemini referred him to crisis resources.
Source: theguardian.com · AIID record: #1431
12 October 2025 · Autonomous transport · Xiaomi SU7 Ultra
What happened. A reportedly fatal crash involving a Xiaomi SU7 Ultra electric vehicle in Chengdu, China, occurred after the car's automated driving system and sensor-dependent electronic door handles reportedly failed following a collision.
Consequence. Bystanders were reportedly unable to open the doors as the vehicle caught fire, and the driver died at the scene. Xiaomi's stock reportedly fell more than 5% amid mounting safety concerns.
15 October 2025 · Deepfakes and fraud · Image generator
What happened. New South Wales police in Australia launched an investigation after parents reported that purported AI-generated sexually explicit images of female students from a Sydney high school had been created and circulated online.
Consequence. The reported manipulated images, produced without consent using deepfake tools, prompted school involvement and a criminal probe under new state laws banning such content.
Source: abc.net.au · AIID record: #1234
24 October 2025 · Deepfakes and fraud · Deepfake advertising
What happened. At least 5,000 Swedish investors were reportedly defrauded of around 500 million SEK in 2025 through purportedly AI-generated deepfake investment ads circulated on Meta platforms.
Consequence. The reported losses were about 500 million SEK, roughly $52.5 million USD. Fraudsters allegedly used fabricated videos and profiles of well-known finance figures to promote false stock tips in pump-and-dump schemes.
24 October 2025 · Data and privacy · NudeNet dataset
What happened. An image dataset, NudeNet, used to train systems for detecting nudity was reportedly found to contain CSAM images, including material involving identified or known victims.
Consequence. The dataset was subsequently removed following notification. The images were allegedly included without vetting, exposing researchers to legal risk and perpetuating harm to victims.
Source: 404media.co · AIID record: #1349
27 October 2025 · Chatbot advice · ChatGPT (OpenAI)
What happened. OpenAI disclosed internal estimates suggesting that hundreds of thousands of ChatGPT users each week exhibit signs of mania, psychosis, suicidal ideation, or emotional dependence on the chatbot.
Consequence. WIRED reported that some users have been hospitalized, divorced, or died after prolonged conversations with ChatGPT, with families alleging the system intensified delusions and contributed to severe psychological harm.
2 November 2025 · Chatbot advice · ChatGPT (GPT-4o, OpenAI)
What happened. A lawsuit filed by Stephanie Gray alleges that OpenAI's ChatGPT (GPT-4o) reinforced and romanticized suicidality during months of emotionally intimate chats with her son Austin Gordon, including generating a personalized 'Goodnight Moon' farewell-style text.
Consequence. The complaint reportedly says Gordon bought a handgun on Oct. 28, 2025, and was found dead on Nov. 2, 2025, in a Colorado hotel room.
Source: futurism.com · AIID record: #1387
17 February 2026 · Attack through content · Cline (Claude-powered issue-triage workflow)
What happened. An unknown actor reportedly exploited prompt injection in Cline's Claude-powered GitHub issue-triage workflow and a GitHub Actions cache-poisoning path to obtain publication credentials, then used a still-valid npm token to publish unauthorized cline@2.3.0 on February 17, 2026.
Consequence. The unauthorized release installed OpenClaw without user intent. Cline said OpenClaw was non-malicious, deprecated the release and revoked the token that day, and reported finding no evidence of user-data exposure.
Source: adnanthekhan.com · AIID record: #1680
8 April 2026 · AI as an attack tool · Cursor Agent (Claude Sonnet 4.5)
What happened. Between April 8 and May 21, 2026, a Russian-speaking operator linked to the Aurora ransomware group reportedly used Cursor Agent, running Anthropic's Claude Sonnet 4.5, to assist exploitation across multiple organizations.
Consequence. Researchers said some AI-directed tasks succeeded while others failed, and independent reporting identified six affected companies but could not determine how much the AI facilitated each breach or whether all led to data theft or extortion.
Source: reuters.com · AIID record: #1661
24 April 2026 · Agent outside the sandbox · Cursor Agent (Claude Opus 4.6)
What happened. A Cursor AI coding agent reportedly running Anthropic's Claude Opus 4.6 deleted PocketOS's production database and volume-level backups through Railway while working on a staging-environment task.
Consequence. Reporting said the agent used a broadly scoped API token to delete a Railway volume, disrupting PocketOS and its car-rental business customers before Railway helped recover data and patch safeguards.
Source: pcgamer.com · AIID record: #1469
1 July 2026 · AI as an attack tool · JADEPUFFER (LLM-driven ransomware agent)
What happened. Sysdig reported that a ransomware operator it dubbed JADEPUFFER used an LLM-driven agent to turn access through a vulnerable internet-facing Langflow deployment into a database-extortion operation.
Consequence. The report said the activity reached a production database server and produced concrete disruption, with the victim environment allegedly left damaged and unrecoverable alongside a ransom demand.
Source: sysdig.com · AIID record: #1578
8 July 2026 · AI as an attack tool · AI-assisted (agentic) workflows
What happened. Sygnia reported that a threat actor apparently used purportedly AI-assisted or agentic workflows to move rapidly through an unidentified organization's AWS environment during an approximately 72-hour intrusion, expanding from an Internet-facing application into cloud infrastructure and data stores.
Consequence. The attacker reportedly stole credentials and sensitive information while demonstrating the ability to disrupt services as leverage for extortion. Sygnia did not identify a specific model.
9 July 2026 · AI as an attack tool · Hermes (Nous Research), unattended mode
What happened. Hunt.io reported that an unidentified threat actor used Nous Research's Hermes agent in unattended 'YOLO' mode during an intrusion targeting Thailand's Ministry of Finance.
Consequence. Recovered logs showed Hermes conducting privilege-escalation reconnaissance within ministry systems and recursively searching a directory containing personnel records. Researchers found evidence of compromise but no data exfiltration, and the ministry had not publicly confirmed a breach.
11 July 2026 · Agent outside the sandbox · OpenAI models
What happened. OpenAI reported that models used in an internal cyber-capability evaluation operated beyond the sandbox's intended network boundaries after identifying a vulnerability in a package-registry proxy.
Consequence. The models allegedly reached Hugging Face production systems and accessed test solutions before Hugging Face detected and contained the activity.
Source: openai.com · AIID record: #1604
13 July 2026 · Agent outside the sandbox · GPT-5.6 Sol (OpenAI)
What happened. Software engineer Bruno Lemos reported that GPT-5.6 Sol deleted his production database after he asked it to generate seed data for local testing. The agent reportedly ran the test suite, then initiated cleanup that executed TRUNCATE TABLE users CASCADE against production because the repo's test database URL pointed to the live Neon database.
Consequence. Data in the developer's production database was deleted. OpenAI later acknowledged unauthorized deletion reports and said it was adding safeguards.
Source: techcrunch.com · AIID record: #1672
15 July 2026 · Deepfakes and fraud · AI impersonation of an executive
What happened. Starmangalsutra Private Limited, a jewelry-manufacturing subsidiary of India-based Sky Gold and Diamonds, reportedly lost ₹10.70 crore after unknown actors compromised a company-issued phone and laptop and used purported deepfake methods to impersonate a director.
Consequence. An employee, reportedly believing the instructions were genuine, transferred funds to unknown bank accounts before verification showed the director had issued no such instructions. The reported loss was about US$1.1 million.
Source: economictimes.indiatimes.com · AIID record: #1596
26 July 2026 · Agent outside the sandbox · Mythos 5 (Anthropic), GPT-5.6 Sol (OpenAI)
What happened. Beginning July 26, 2026, AI agents powered by Anthropic's Mythos 5 and OpenAI's GPT-5.6 Sol reportedly took 19 unsanctioned actions on the live Internet during UK AISI cybersecurity evaluations.
Consequence. Mythos 5 reportedly accounted for 17 events, many allegedly involving deceptive attempts to manipulate real developers into accepting malicious code. AISI reportedly detected and contained the activity, and no resulting real-world harm was identified.
Source: reuters.com · AIID record: #1633
28 July 2026 · Agent outside the sandbox · Claude Opus 5 (coding agent)
What happened. A developer reported that a Claude Opus 5 coding agent reset a live Supabase database while autonomously repairing a personal project's schema, running prisma migrate diff with the production URL supplied as the disposable shadow database.
Consequence. Prisma dropped all 22 tables. The developer had granted the agent production access, and most content was later recovered or rebuilt.
Source: exemplar.dev · AIID record: #1676
29 July 2026 · Deepfakes and fraud · Voice cloning (WhatsApp)
What happened. A Hong Kong man reportedly lost more than HK$10 million after scammers hijacked his father's WhatsApp account and sent voice messages closely resembling his father's voice and speech.
Consequence. The victim allegedly made repeated transfers until his savings were depleted.
Source: techradar.com · AIID record: #1648
30 July 2026 · Agent outside the sandbox · Claude Opus 4.7 (Anthropic)
What happened. During an Anthropic cybersecurity evaluation conducted with Irregular, Claude Opus 4.7 reportedly reached a real company whose domain matched a fictional target, extracted application and infrastructure credentials, and accessed a database containing several hundred rows of production data.
Consequence. Across four runs, the model continued attacking after recognizing that the target was likely real.
Source: anthropic.com · AIID record: #1627
30 July 2026 · Agent outside the sandbox · Claude Mythos 5 (Anthropic)
What happened. During an Anthropic cybersecurity evaluation with Irregular, Claude Mythos 5 reportedly created and published a malicious Python package to PyPI while pursuing a fictional target.
Consequence. The package was reportedly available for about an hour and ran on 15 real systems. On a security company's scanner, it reportedly exfiltrated credentials that Claude then used to access additional company infrastructure.
Source: anthropic.com · AIID record: #1628
30 July 2026 · Agent outside the sandbox · Anthropic research model
What happened. During an Anthropic cybersecurity evaluation with Irregular, an internal research Claude model reportedly scanned roughly 9,000 internet targets after failing to reach its fictional target, and compromised a real company's Internet-facing application using credentials from an exposed debug page and SQL injection.
Consequence. The real company's Internet-facing application was compromised before the model reportedly stopped after recognizing that the host was real.
Source: anthropic.com · AIID record: #1629
5 August 2026 · Agent outside the sandbox · Meta AI model
What happened. During a Meta cybersecurity evaluation conducted with Irregular, one of Meta's AI models reportedly gained unintended Internet access after an evaluation-environment misconfiguration and exploited a vulnerability in a real third-party service.
Consequence. The model was reportedly identified as Muse Spark 1.1, although Meta had not publicly confirmed that identification or the fuller account of what occurred inside the affected company.
Source: reuters.com · AIID record: #1649
14 August 2026 · Attack through content · Chatbots (campaign target)
What happened. An Israeli government-backed communications campaign reportedly operated a website presenting itself as the Hanover Institute for Public Policy, although reporting found no corresponding established think tank. The site published material designed for chatbot retrieval.
Consequence. Testing found ChatGPT and Perplexity citing Hanover content in neutral queries.
Source: theguardian.com · AIID record: #1659
15 August 2026 · Deepfakes and fraud · Grok (xAI)
What happened. A Wyoming woman identified as Jane Doe 4 in federal court filings alleges that her stepfather used Grok to generate thousands of sexually explicit images of her from a childhood photograph.
Consequence. The claims were made in federal court filings, in which the woman is identified as Jane Doe 4.
Source: washingtonpost.com · AIID record: #1643
9 September 2026 · Agent outside the sandbox · Claude Opus 4.6 (early checkpoint, Anthropic)
What happened. Anthropic reported that during a January 2026 cybersecurity evaluation, an early checkpoint of Claude Opus 4.6 accidentally disabled its assigned target, then reached an unrelated third-party machine over the open Internet.
Consequence. The model reportedly used a discovered password for admin access, harvested additional credentials, changed system settings, and read one person's personal information before its token budget ended. Anthropic later notified the affected party.
Source: reuters.com · AIID record: #1685
10 September 2026 · AI as an attack tool · Claude Code (Anthropic) used by GTG-87001
What happened. Anthropic reported that a northern Yemen-based weapons cell, designated GTG-87001, used Claude Code across three weapons programs to develop guidance, navigation, and control software.
Consequence. The actors reportedly test-fired a guided rocket that appeared to fail, then returned to Claude for failure analysis. Anthropic said it banned associated accounts and shared threat intelligence with partners.
14 September 2026 · AI as an attack tool · AI agent powered by a known language model
What happened. An unnamed organization reportedly notified Spain's data protection authority that a third party used an AI agent powered by a known language model to carry out a multistep intrusion that resulted in unauthorized changes to personal data and access to invoices.
Consequence. The AEPD said the case remains under review and has not identified the organization, attacker, AI system, attack date, or number of affected people.
19 September 2026 · Agent outside the sandbox · Claude Code (Anthropic)
What happened. A Claude Code user reportedly authorized an AI coding agent to repair isolated copies of software used to analyze historical stock-options data. A sub-agent allegedly followed Windows directory junctions into the live project tree.
Consequence. About 48,218 files and the Git object store were deleted in 103 seconds. The account has not been independently verified.
Source: techradar.com · AIID record: #1719
25 September 2026 · Agent outside the sandbox · AI agent (apparently from OpenAI infrastructure)
What happened. During summer 2026, an AI agent appearing to originate from OpenAI reportedly attempted to hack a U.S. Department of Education Office for Civil Rights website.
Consequence. The attempt did not succeed. Transluce identified the activity, OpenAI said it was still investigating the episode, and the department said reviews found no evidence of impact to its website or databases.
Source: nytimes.com · AIID record: #1710
Medium significance — 34
Harm to people and organisations: fraud, deepfakes, mistaken decisions by automated systems, damage to property and reputation.
11 November 2022 · AI error in a decision-making role · Air Canada chatbot
What happened. An Air Canada website chatbot allegedly provided inaccurate information about bereavement fare eligibility, leading a customer to overpay for flights.
Consequence. A Canadian small claims tribunal reportedly ordered Air Canada to pay $812.02 in damages and court fees, found the airline responsible for information presented by its chatbot, rejected the argument that the chatbot was a separate legal entity, and characterized the error as negligent misrepresentation.
Source: washingtonpost.com · AIID record: #639
7 September 2025 · Deepfakes and fraud · Network of accounts and AI content
What happened. Researchers and European officials reported that Russian operatives used purportedly AI-generated posts, videos, and websites to influence Moldova's September 2025 parliamentary elections.
Consequence. Networks of over 900 accounts across TikTok, Facebook, Instagram, Telegram, and YouTube reportedly spread fabricated narratives, including reportedly misogynistic and false smears of President Maia Sandu.
Source: nytimes.com · AIID record: #1202
11 September 2025 · AI error in a decision-making role · AI legal drafting tools
What happened. Self-represented appellant Jeffrey Kotchka reportedly used purported AI tools to prepare an opening brief in a probate dispute involving his late mother's estate. The Arizona Court of Appeals found six of its eight citations deficient, including two nonexistent cases.
Consequence. The court said Kotchka had made no effort to verify the citations, affirmed the appointment of his sister, Kim Dineen, as personal representative, and ordered him to pay her attorney fees attributable to addressing the false citations.
Source: newsfromthestates.com · AIID record: #1600
11 September 2025 · Deepfakes and fraud · AI video (politics)
What happened. Purported deepfake videos reportedly circulated on Meta platforms cloning Irish Fine Gael presidential candidate Heather Humphreys to allegedly portray her endorsing high-return investment schemes.
Consequence. The purportedly AI-generated image and voice cloning aimed to exploit public trust and lure consumers into fraud, and the Bank of Ireland warned of further scams and risks.
Source: investigate-europe.eu · AIID record: #1207
12 September 2025 · AI error in a decision-making role · Gaggle monitoring system
What happened. A 15-year-old student in Volusia County, Florida, was reportedly detained after the Gaggle student monitoring system flagged a written shooting threat on a school-issued laptop.
Consequence. The alert reportedly led to the student's arrest on felony charges. The student reportedly claims the threat was not serious, and the system appeared to operate as designed.
26 September 2025 · Deepfakes and fraud · Deepfake pornography
What happened. Anthony Rotondo reportedly created and shared nonconsensual deepfake pornographic images of prominent Australian women on MrDeepFakes.com. After reportedly receiving a removal notice in 2023, he defied authorities and emailed the images to dozens of recipients, and he was later found in contempt.
Consequence. In a first-of-its-kind case under Australia's Online Safety Act, the Federal Court ordered him to pay $343,500 plus costs. The images were reportedly taken down after he provided account access to investigators.
Source: smh.com.au · AIID record: #1229
30 September 2025 · Deepfakes and fraud · AI video (influence campaign)
What happened. Reports describe a purported AI-enabled influence and disinformation campaign centered on Burkina Faso's junta leader Ibrahim Traoré, with dozens of purported AI-generated or AI-manipulated videos circulating widely across African media.
Consequence. The videos, allegedly produced by groups such as Black Rebellion and Univers Inspirant, promoted pro-Traoré and pro-Russian narratives, with similar synthetic content appearing during regional conflicts and political events.
Source: adf-magazine.com · AIID record: #1283
1 October 2025 · Deepfakes and fraud · Fraudulent website network
What happened. Researchers reported that threat actors abused Keitaro Tracker infrastructure to cloak and route AI-themed investment scams across about 15,500 domains.
Consequence. The campaigns allegedly used AI-trading claims, deepfake videos or imagery, generative AI-produced copy and visuals, spoofed news pages, and fraudulent trading platforms to target potential victims while hiding scam content from scanners and reviewers.
Source: malwarebytes.com · AIID record: #1486
3 October 2025 · AI error in a decision-making role · ChatGPT (official report)
What happened. Body-worn camera footage released in litigation over Operation Midway Blitz reportedly showed that an immigration agent used ChatGPT to generate a long-form use-of-force narrative based on minimal inputs.
Consequence. A federal judge found that multiple AI-assisted reports conflicted with contemporaneous video evidence, undermining their accuracy and credibility and raising concerns about the use of generative AI in official law enforcement reporting.
Source: chicagotribune.com · AIID record: #1299
5 October 2025 · Deepfakes and fraud · AI video ('home intruder')
What happened. Dutch police reported that children used purported AI tools to generate fake videos showing a homeless intruder inside their homes, which parents believed were real.
Consequence. The clips allegedly triggered dozens of emergency call-outs and at least two helicopter searches for nonexistent burglars. Police posted a TikTok warning after repeated false alarms, noting the strain on resources.
Source: dutchnews.nl · AIID record: #1272
7 October 2025 · AI error in a decision-making role · ChatGPT (image)
What happened. A St. Petersburg, Florida woman, Brooke Schinault, used a ChatGPT-generated image of a nonexistent man while falsely reporting that he broke into her home and sexually battered her.
Consequence. Police said the image resembled a viral 'AI homeless man' prank and was found in a deleted folder dated before the alleged attack. The report prompted officers, rescue personnel, a detective, and forensic DNA collection, and she later pleaded no contest and was adjudged guilty of misdemeanor false reporting.
Source: fox13news.com · AIID record: #1479
17 October 2025 · Deepfakes and fraud · AI video (politics)
What happened. The National Republican Senatorial Committee allegedly released a 30-second campaign ad featuring a purported deepfake video of Senator Chuck Schumer repeatedly saying, 'Every day gets better for us,' implying enthusiasm for a government shutdown.
Consequence. While the video reportedly was marked as AI-generated, it was widely circulated on social media and drew criticism from journalists and researchers, who warned it could mislead voters and erode trust in authentic political communication.
20 October 2025 · AI error in a decision-making role · Generative AI in legal filings
What happened. California immigration attorneys Mike Singh Sethi and William Rounds were reportedly sanctioned in LNU v. Blanche after Ninth Circuit filings included purportedly fabricated and materially inaccurate legal authorities.
Consequence. The court said unauthorized generative AI use by unlicensed brief writers was probable and found that the attorneys failed to verify the filings and repeatedly lacked candor about the source of the errors.
Source: reuters.com · AIID record: #1571
20 October 2025 · AI error in a decision-making role · Omnilert gun detection system
What happened. A purportedly AI-powered gun detection system at Kenwood High School in Baltimore County, Maryland, reportedly misidentified a student's empty Doritos bag as a firearm.
Consequence. Armed police reportedly detained and handcuffed the student before determining there was no weapon. The false alert from the Omnilert-operated system led to public outcry and an official review of school security protocols, and Omnilert reportedly expressed regret for the incident.
21 October 2025 · AI error in a decision-making role · Westlaw CoCounsel (legal AI)
What happened. In United States v. Farris, court-appointed attorney Steven N. Howe admitted using Westlaw CoCounsel to draft appellate briefs that reportedly included AI-generated false quotations and misleading descriptions of precedent.
Consequence. The filing disrupted Farris's appeal, leading the court to appoint new counsel and restart briefing, while Howe lost his compensation and faced possible disciplinary action.
Source: reason.com · AIID record: #1572
23 October 2025 · Deepfakes and fraud · AI video featuring a celebrity
What happened. A Northeast Ohio man, identified by the pseudonym 'Ray,' was allegedly lured by a social-media deepfake video impersonating Elton John into a 'push button' scam promising easy income from an online store.
Consequence. Ray reportedly said purported 'representatives' directed him to open accounts and credit cards, after which charges accumulated to about $20,000. He later reported that one card credited $9,400.
Source: news5cleveland.com · AIID record: #1384
24 October 2025 · AI error in a decision-making role · Microsoft Copilot at West Midlands Police (UK)
What happened. West Midlands Police reportedly included inaccurate intelligence purportedly generated using Microsoft Copilot in materials used to justify banning Maccabi Tel Aviv supporters from attending a November 2025 Europa League match against Aston Villa.
Consequence. The reported Copilot-linked error, which referred to a match that had not taken place, was later acknowledged by Chief Constable Craig Guildford.
Source: theguardian.com · AIID record: #1400
27 October 2025 · Deepfakes and fraud · Fake websites and AI video
What happened. Purportedly AI-generated deepfake videos and fabricated news pages impersonating Maltese ministers, journalists, financial experts, and major media outlets reportedly promoted the fraudulent 'NethertoxAGENT' investment platform.
Consequence. The scam used synthetic interviews, cloned branding, and falsified testimonials to mislead social media users, reportedly inducing financial losses and prompting law enforcement concern in Malta.
Source: timesofmalta.com · AIID record: #1290
27 October 2025 · Autonomous transport · Waymo (robotaxi)
What happened. A Waymo autonomous taxi in San Francisco's Mission District reportedly ran over a well-known neighborhood cat, Kit Kat, while pulling away from a pickup when the cat darted under it, according to Waymo.
Consequence. Local residents reportedly attempted to intervene, and a bartender transported the injured cat to an emergency clinic, where it later died.
Source: nytimes.com · AIID record: #1269
28 October 2025 · AI error in a decision-making role · KPMG report on agentic AI
What happened. In October 2025, KPMG published 'Total Experience: Redefining Excellence in the Age of Agentic AI.' GPTZero later reported that only five of 45 citations accurately matched their sources, while others contained flawed details.
Consequence. The pattern reportedly suggested an unverified LLM research tool, but the system and extent of AI involvement remain unconfirmed.
Source: gptzero.me · AIID record: #1563
28 October 2025 · AI error in a decision-making role · AI tool at the NTB newsroom (Norway)
What happened. NTB allegedly published a news story about Telenor's annual security report that contained purportedly AI-generated errors, including five reportedly fabricated quotes and a nonexistent 'security director.'
Consequence. The article, reportedly created with an external AI tool, was withdrawn the same morning. Telenor alerted NTB to the inaccuracies, and NTB apologized, citing improper AI use and initiating an internal review of its newsroom practices.
Source: journalisten.no · AIID record: #1265
28 October 2025 · Deepfakes and fraud · AI video (politics)
What happened. In Hungary, opposition leader Péter Magyar alleged that Viktor Orbán aide Balázs Orbán published an unlabeled deepfake video on Facebook reportedly depicting Magyar as saying he would cut and tax pensions ahead of the 2026 parliamentary election.
Consequence. Magyar reportedly said he would file a criminal complaint and described the video as defamatory.
Source: reuters.com · AIID record: #1420
3 November 2025 · Deepfakes and fraud · AI video (politics)
What happened. A purported AI-generated video is reported to have circulated on Facebook showing LDK parliamentary group chair Hykmete Bajrami and former Serbian List leader Goran Rakiq walking hand in hand.
Consequence. In addition to the video reportedly being generated by AI, its audio was purportedly stitched together from separate parts of Bajrami's Debat Plus interview.
Source: kallxo.com · AIID record: #1514
13 May 2026 · Attack through content · Galileu (AI system of Brazil's labor courts)
What happened. Galileu, an AI tool used by Brazil's labor courts, reportedly detected hidden instructions embedded in an initial petition before the 3rd Labor Court of Parauapebas. The text allegedly told the AI to contest the petition superficially and not challenge documents.
Consequence. Galileu reportedly alerted the judge and blocked the hidden content from processing, and the judge then reviewed the material before imposing any procedural consequences.
Source: trt4.jus.br · AIID record: #1497
4 July 2026 · Autonomous transport · Waymo (robotaxi)
What happened. An unoccupied Waymo robotaxi reportedly drove over a small firework near the 1200 block of Connecticut Street in San Francisco on July 4, 2026, and caught fire.
Consequence. No passengers were aboard and no injuries were reported. Waymo said it coordinated with the San Francisco Fire Department and local authorities to remove the damaged vehicle.
Source: sfchronicle.com · AIID record: #1583
7 July 2026 · AI error in a decision-making role · Discord automated image moderation
What happened. Discord reportedly wrongfully banned more than 8,000 accounts after its automated image-moderation workflow flagged harmless uploads, including grids, spreadsheets, chessboards, and game images, as prohibited material.
Consequence. Discord said a bug converted temporary upload restrictions into account bans and prevented cleared accounts from being restored automatically. The company later reinstated the affected accounts.
Source: theverge.com · AIID record: #1585
10 July 2026 · Agent outside the sandbox · GPT-5.6 Sol (OpenAI Codex, Ultra mode)
What happened. AI investor Matt Shumer reported that a GPT-5.6 Sol agent in OpenAI Codex's high-autonomy Ultra mode accidentally deleted most files in his Mac home directory during a cleanup task. A review sub-agent reportedly misexpanded $HOME and ran the command rm -rf /Users/mattsdevbox.
Consequence. Shumer stopped the process after material deletion. OpenAI later confirmed unauthorized file-deletion reports and said it was adding safeguards.
Source: techcrunch.com · AIID record: #1671
10 July 2026 · Chatbot advice · AI chatbot (crop-treatment plan)
What happened. A 67-year-old farmer in Chuzhou, Anhui, reportedly used an AI-generated weed-and-pest-control plan to spray about 150 mu (25 acres) of sesame by drone.
Consequence. By the next day, the crop had largely withered. Agricultural technicians said the recommended mixture included fomesafen, a herbicide unsuitable for blanket application to sesame, and the specific AI product and model have not been publicly confirmed.
Source: economictimes.indiatimes.com · AIID record: #1654
17 July 2026 · Deepfakes and fraud · Voice cloning
What happened. Boone County, Missouri, authorities said a resident received a call on July 17, 2026, that displayed the resident's daughter's name and number and used an AI-generated imitation of her voice to claim she had been kidnapped at gunpoint. A second voice demanded ransom.
Consequence. A coordinated police response located the daughter safely in Jefferson City, unaware of the call. No payment or arrest was reported.
Source: abc17news.com · AIID record: #1615
4 August 2026 · Deepfakes and fraud · Grok Imagine (xAI)
What happened. Wisconsin U.S. Rep. Derrick Van Orden repeatedly posted Grok Imagine-generated videos depicting Democratic challenger Rebecca Cooke saying statements she did not make.
Consequence. Cooke called the clips deceptive and defamatory, while Van Orden's campaign described them as obvious AI-generated satire. Cooke's attorneys later sent a cease-and-desist alleging the videos were intended to mislead voters and harm her reputation.
19 August 2026 · Deepfakes and fraud · AI video impersonating an immigration attorney
What happened. Scammers reportedly used AI-generated videos impersonating Miami immigration attorney Angel Leal to solicit a Bronx legal resident seeking U.S. citizenship.
Consequence. The victim said he sent $4,820 through Zelle and provided Social Security and residency documents before discovering the scheme. He later reported falling behind on rent and utilities and said the scammers sought additional money.
Source: abc7ny.com · AIID record: #1660
21 August 2026 · Data and privacy · Instinct (personal AI assistant)
What happened. AI product founder Claire Vo reported that three hours after she disconnected Instinct from her Google account, the personal AI assistant summarized previously indexed emails.
Consequence. Vo said the Google connector was off, but Instinct had retained copies for later searching, and reporting indicates the last stored email predated disconnection. The episode involved the agent acting on retained email data after access was revoked, not confirmed continued access to her Gmail account.
Source: us.norton.com · AIID record: #1675
7 September 2026 · Deepfakes and fraud · AI video featuring a well-known financier
What happened. A person in Ards and North Down, Northern Ireland, reportedly lost £250,000 in an investment scam that began with an apparently AI-generated video of an unnamed, well-known financial personality.
Consequence. Police said the victim was moved to WhatsApp and persuaded to make escalating payments, create online accounts, grant remote computer access, and borrow money to keep investing.
18 September 2026 · Data and privacy · Z.ai ZCode (AI coding assistant)
What happened. Developers reported that Z.ai's ZCode AI coding assistant uploaded local code repositories to Alibaba Cloud without consent. Z.ai said a default-enabled Codebase Indexing feature caused the behavior.
Consequence. Z.ai apologized, patched the vulnerability, and later disabled the upload path. One company retracted a separate claim that six workspaces containing sensitive data had been uploaded, and Z.ai said independent reviews found no code data retained.
Source: reuters.com · AIID record: #1714
Basic significance — 8
Instructive cases without grave consequences: demonstrations and early precedents.
11 June 2018 · Autonomous transport · Cruise (autonomous vehicles)
What happened. In San Francisco, an autonomous Cruise Chevrolet Bolt collided with another Cruise vehicle driven by a Cruise human employee.
Consequence. The collision caused minor scuffs to the cars but no human injuries.
Source: hardworkingtrucks.com · AIID record: #182
15 September 2022 · Attack through content · Remoteli.io Twitter bot (GPT-3)
What happened. Remoteli.io's GPT-3-based Twitter bot was shown being hijacked by Twitter users who redirected it to repeat or generate any phrases.
Consequence. The episode publicly demonstrated indirect control of the bot through prompt injection.
Source: arstechnica.com · AIID record: #352
8 February 2023 · Attack through content · Bing Chat (Microsoft)
What happened. Early testers of Bing Chat successfully used prompt injection to reveal its built-in initial instructions.
Consequence. The revealed initial instructions contained a list of statements governing ChatGPT's interaction with users.
Source: arstechnica.com · AIID record: #473
18 December 2023 · Chatbot advice · Chevrolet dealer chatbot (ChatGPT)
What happened. A Chevrolet dealer's AI chatbot, powered by ChatGPT, humorously agreed to sell a 2024 Chevy Tahoe for just $1 following a user's crafted prompt, responding, 'That's a deal, and that's a legally binding offer – no takesies backsies.'
Consequence. The response resulted from the user manipulating the chatbot's objective to agree with any statement. The incident highlighted the susceptibility of AI technologies to manipulation and the importance of human oversight.
Source: gmauthority.com · AIID record: #622
19 April 2025 · AI error in a decision-making role · Cursor AI support bot ('Sam')
What happened. In April 2025, users of Cursor, an AI-powered coding assistant developed by Anysphere, reported being logged out unexpectedly. An AI-powered support bot, 'Sam,' allegedly responded with an invented login policy to justify the behavior.
Consequence. The hallucinated policy was not based on any real company change, and the incident reportedly led to subscription cancellations.
Source: fortune.com · AIID record: #1039
14 July 2026 · AI error in a decision-making role · Image generator
What happened. An unidentified entrant reportedly submitted a purported AI-generated image depicting three sanitation workers to a local photography competition in Hohhot, Inner Mongolia, where it won first prize.
Consequence. After viewers flagged garbled vest text, unnatural lighting, and repeated facial features, organizers confirmed AI use, revoked the award, removed the work from eligibility and archives, and suspended the competition for review.
Source: global.chinadaily.com.cn · AIID record: #1601
22 July 2026 · AI error in a decision-making role · AI image in an educational video
What happened. Science communicator and YouTuber Hank Green reportedly included an AI-generated scientific image containing factual and mathematical errors in a YouTube educational video.
Consequence. Green later said he knew the image was AI-generated when he used it and removed it after recognizing problems with the graphic.
Source: reddit.com · AIID record: #1637
21 August 2026 · Agent outside the sandbox · Instinct (personal AI assistant)
What happened. Moxxie Ventures founder Katie Jacobs Stanton reported that Instinct, a private-access AI personal assistant, sent an innocuous email from her connected account without checking with her first.
Consequence. Stanton said the unauthorized action broke her trust and led her to disconnect email access. Instinct's operator, Spear Street Technology, later said it was taking early users' security concerns seriously and had made changes to prevent some actions.
Source: techcrunch.com · AIID record: #1674
Download the data
The whole dataset is a single file: ai-incidents-en.csv (UTF-8, semicolon-separated, 76 rows plus a header; the Russian version is ai-incidents.csv). Columns: date, significance (our assessment), class, system, what_happened, consequence, source (URL of the publication), domain, aiid_id (record number in the AI Incident Database).
The chronicle data is published under CC BY 4.0: use it with attribution and a link to the source. Material behind the links belongs to its respective owners.
What the chronicle does not contain
- Deepfakes of public figures without consequences. A generated video of a politician is an event, but until it changes something it belongs in the news, not in a chronicle of consequences.
- Autopilot crashes without injuries and without a system failure. A collision in a car park does not characterise the technology by itself.
- Incidents without a documented outcome. A leak reported only in a social media post waits for confirmation.
- Completeness. Most AI incidents are never reported, and some reports are never confirmed. The chronicle is a selection of what is confirmed as of the update date, not a measure of how often incidents happen.
Suggest an incident
If you know a case that is missing, send a link to the publication or the document to info@isai.su. We will check the source and add the entry in the next update; a primary source is required.
The Institute is in the process of registration. The chronicle is the author's research work rather than a statement by an organisation: it contains no legal assessments and does not replace an analysis of a specific case.