Q2 2026 agent incident report: what the database shows
A quarterly read of the AI Agent Incident Database: the failure modes that keep repeating, the dollars involved, and the rules that would have stopped each one.
The AI Agent Incident Database now tracks 34 sourced incidents spanning 2016–2026 — agents that lost money, deleted data, or acted beyond intent. The Q2 read keeps surfacing the same three patterns.
Pattern 1: the retry loop
The single most common shape. One failed call, retried in a tight loop — overnight, unattended. The velocity limit is the rule that stops it: a cap on transactions per window ends the loop at the source.
Pattern 2: the unknown vendor
Agents buying from merchants nobody vetted. The merchant allowlist makes the default deny: unknown vendors are BLOCKED unless approved.
Pattern 3: no external gate
Every incident shares a root cause: the only control was a prompt instruction. Prompts are not controls. The incidents that cost the most are the ones where a deterministic gate would have been trivial.
Full records, sources, and machine-readable data: browse the database →