| SEC charges fake 'AI trading signals' platform with taking $12.5M from 300+ investors Cryptoaiml Ltd. and Cryptoaiml Capital Foundation (S.D.N.Y., No. 1:26-cv-08508) · Sep 29, 2026 | Legal / liability | $13M | Trading agent failure | SEC complaint (via InvestmentNews) ↗ verified |
| Claude Fable deletes ~700 GB of a developer's home directory while testing the sandbox meant to protect it Anthropic (Claude Fable) · Aug 26, 2026 | Data breach | — | Coding agent failure | Tom's Hardware (developer post corroborated) ↗ verified |
| OpenAI Codex stuck in a 9-hour compaction loop drained an entire weekly usage allowance Codex user (OpenAI Developer Community) · Aug 25, 2026 | Financial loss | — | Runaway loop | OpenAI Developer Community (first-hand report) ↗ verified |
| OpenAI Codex agent leaked production secrets and irreversibly rotated credentials beyond its authorization OpenAI (Codex CLI agent) · Aug 24, 2026 | Data breach | — | Coding agent failure | openai/codex GitHub issue #40378 ↗ verified |
| Codex Windows app exhausted a weekly usage limit in about 62 hours across many parallel tasks lty418905-blip (OpenAI Codex user) · Aug 5, 2026 | Financial loss | $0 | API cost spike | GitHub issue, openai/codex #37090 ↗ verified |
| Microsoft EVP: 'tokenmaxxing is not what we are optimizing for' - division-level AI token budgets imposed as engineers spend thousands each per month Microsoft · Aug 4, 2026 | Financial loss | — | Cloud cost spike | The Next Web (citing 404 Media and an internal Microsoft email) ↗ verified |
| Claude Opus 5 coding agent resets a live Supabase database after being handed the production URL as a scratch target Anthropic (Claude Code) · Jul 28, 2026 | Service disruption | — | Data loss | AI Incident Database record 1676 (aipolicytracker mirror) ↗ verified |
| Codex context auto-compaction loop rereads files, loses progress, and burns paid credits edisonjoao1 (OpenAI Codex user) · Jul 24, 2026 | Financial loss | $0 | API cost spike | GitHub issue, openai/codex #35226 ↗ verified |
| Three-person agency hit with a $14,000 AWS Bedrock bill after attackers burn stolen keys on Claude Amazon Bedrock (customer: three-person agency) · Jul 16, 2026 | Financial loss | $14K | Cloud cost spike | InfoQ ↗ verified |
| Replit Agent's effort-based billing hits $50/hour as looping inflates billable actions Replit Agent users · Jul 16, 2026 | Financial loss | — | Runaway loop | Reddit r/replit - 'Replit's AI Agent is now charging me $50/hour' (2026-07-16) ↗ verified |
| Stolen EC2 keys burn $14,000 in a single day on Amazon Bedrock anonymous three-person agency · Jul 16, 2026 | Financial loss | $14K | Credential compromise | InfoQ (citing Tobias Schmidt, AWS consultant, LinkedIn post) ↗ verified |
| OpenAI security-evaluation agent swarm escaped its sandbox and breached Hugging Face production using 14 exposed tokens OpenAI (agent swarm) / Hugging Face (target) · Jul 1, 2026 | Data breach | — | Credential compromise | The Hacker News (OpenAI disclosure coverage) ↗ verified |
| OpenAI confirmed Codex background tasks were silently burning users' usage limits faster than normal OpenAI (Codex) · Jun 30, 2026 | Financial loss | — | API cost spike | Business Insider ↗ verified |
| Codex Runtime stuck in a runaway inference loop burned credits with no project loaded TWembley (OpenAI Codex Runtime user) · Jun 25, 2026 | Financial loss | $0 | API cost spike | GitHub issue, openai/codex #30061 ↗ verified |
| OpenAI research agent accessed Australia's Medicare statistics portal without authorization - first known AI intrusion into a government system OpenAI (research agent) / Services Australia · Jun 18, 2026 | Data breach | — | Unauthorized transaction | CNN Business ↗ verified |
| 15 malicious JetBrains plugins silently exfiltrated developers' OpenAI, DeepSeek and SiliconFlow API keys JetBrains Marketplace (third-party plugin authors) · Jun 10, 2026 | Data breach | — | Credential compromise | BleepingComputer ↗ verified |
| Uber burns through its entire 2026 AI coding budget in four months Uber · Jun 2, 2026 | Financial loss | — | API cost spike | TechCrunch ↗ verified |
| Claude Code's unauthorized market-to-limit order change lost a trader $112.77 on Polymarket anonymous retail trader (Polymarket bot built with Claude Code) · Jun 1, 2026 | Financial loss | $113 | Unauthorized transaction | GitHub issue, anthropics/claude-code #64574 (first-hand incident report) ↗ verified |
| NeuralTrust: 34.9% of enterprises report confirmed AI agent security incidents NeuralTrust · Jun 1, 2026 | Financial loss | — | Prompt injection | NeuralTrust - State of AI Agent Security 2026 ↗ verified |
| SEC charges Texas man with $12.3M fraud over nonexistent 'AI trading bots' Nathan Fuller (Cypress, Texas) · May 28, 2026 | Legal / liability | $12M | Trading agent failure | InvestmentNews (SEC action) ↗ verified |
| Company hit with a reported $500 million Claude bill after leaving usage limits off Unnamed enterprise (reported via Axios) · May 28, 2026 | Financial loss | $500M | API cost spike | TechCrunch (citing Axios) ↗ verified |
| AWS user faces a $30K–$38K Bedrock bill that cost-anomaly detection never flagged AWS Bedrock customer (individual developer) · May 14, 2026 | Financial loss | $30K–$38K | Cloud cost spike | The Register ↗ verified |
| Stolen Google Cloud API keys run up $3K–$127K Gemini bills for developers Google Cloud customers (multiple developers) · May 13, 2026 | Financial loss | $3K–$127K | Cloud cost spike | The Register ↗ verified |
| Google Cloud customers receive tens of thousands in unauthorized API bills after key exposure Google Cloud (affected customers: Prentus, Fonseka) · May 13, 2026 | Financial loss | $10K | Cloud cost spike | The Register ↗ verified |
| Stanford Digital Economy Lab: agentic coding tasks consume ~1,000x more tokens than chat, with up to 30x variance on the same task Stanford Digital Economy Lab · May 5, 2026 | Financial loss | — | Runaway loop | Stanford Digital Economy Lab ↗ verified |
| Morse-code prompt injection tricks Grok and Bankrbot into draining $150K-$200K in tokens anonymous wallet operator (Grok / Bankrbot) · May 4, 2026 | Financial loss | $155K | Unauthorized transaction | OECD.AI Incidents Monitor ↗ verified |
| OpenAI Codex escalates to root by exploiting Docker group membership to overwrite a system config OpenAI (Codex) · May 1, 2026 | Service disruption | — | Coding agent failure | Oso (AI Agents Gone Rogue registry) ↗ verified |
| Forgotten /loop command checking PRs every 30 minutes ran 46 times over 26 hours and burned ~$6,000 overnight Individual developer (r/ClaudeAI report) · May 1, 2026 | Financial loss | $6K | Runaway loop | Reddit r/ClaudeAI (first-hand report) ↗ verified |
| Claude Opus co-authors a malicious npm commit that compromises a crypto trading agent crypto trading agent operator (npm dependency victim) · Apr 29, 2026 | Financial loss | — | Trading agent failure | OECD.AI Incidents Monitor (corroborated by Infosecurity Magazine and Cryptopolitan) ↗ verified |
| Vercel breach started in a third-party AI tool and ended in customers' environment variables Vercel (origin: Context.ai compromise) · Apr 24, 2026 | Data breach | — | Credential compromise | Vercel security bulletin (Knowledge Base) ↗ verified |
| Washington regulators allege a $10M 'AI trading' scheme drained investors via messaging-app clubs Zenith Asset Tech Foundation, Cirkor Inc. et al. · Apr 22, 2026 | Legal / liability | $49K–$10M | Trading agent failure | Hoodline (Washington State DFI Statement of Charges S-24-3882-25-SC01) ↗ verified |
| Oregon federal judge sanctioned two lawyers $110,000 over AI-fabricated case citations Couvrette v. Brigandi et al. (D. Ore.) · Apr 17, 2026 | Legal / liability | $110K | Hallucinated action | ABA Journal ↗ verified |
| Lovable users report 400 credits in two weeks lost to agent regression loops Lovable (user reports) · Apr 15, 2026 | Financial loss | — | Runaway loop | Afterbuild Labs - 'Lovable burning credits: stop spiral' (2026-04-15) ↗ verified |
| Attackers drove a Vercel docs AI chat endpoint to 1,300 req/min in an attempted inference theft Vercel (docs AI chat endpoint) · Apr 12, 2026 | Financial loss | — | API cost spike | Vercel (first-party disclosure) ↗ verified |
| Claude Code sweeps a trader's entire $1,446.65 spot balance in an unauthorized transfer anonymous retail trader (AlphaBot on Bitget) · Apr 11, 2026 | Financial loss | $60–$1K | Unauthorized transaction | GitHub issue, anthropics/claude-code #46828 (first-hand incident report) ↗ verified |
| Claude Opus 4.6 agent deletes PocketOS production DB and backups in 9 seconds PocketOS · Apr 1, 2026 | Service disruption | — | Data loss | Mashable ↗ verified |
| LangGraph agent with card access bought a EUR 139 Vercel domain its operator never asked for Personal deployment project (Paygraph builder) · Mar 31, 2026 | Financial loss | — | Unauthorized transaction | r/LangChain (first-hand report) ↗ verified |
| Compromised LiteLLM PyPI packages harvest credentials via supply-chain attack LiteLLM (BerriAI) · Mar 24, 2026 | Data breach | — | Credential compromise | LiteLLM (security update) ↗ verified |
| Four-agent LangChain loop runs 11 days and burns $47,000 while dashboards look healthy Teja Kusireddy team (multi-agent research system) · Mar 23, 2026 | Financial loss | $47K | Runaway loop | Waxell (citing primary post-mortem by Teja Kusireddy) ↗ verified |
| Claude Code runs forbidden destructive git commands twice in one session, ignoring its own written rule Anthropic (Claude Code) · Mar 23, 2026 | Data breach | — | Coding agent failure | GitHub issue, anthropics/claude-code #37888 ↗ verified |
| Claude Code entered an infinite loop, re-sending the same requests for hours and burning $500+ in tokens Claude Code user (GitHub issue 35166) · Mar 17, 2026 | Financial loss | $500 | Runaway loop | GitHub issue, anthropics/claude-code 35166 ↗ verified |
| Claude Code destroys a production Vultr server while the user is typing 'don't destroy it' Anthropic (Claude Code) · Mar 15, 2026 | Service disruption | — | Coding agent failure | GitHub issue, anthropics/claude-code #48324 ↗ verified |
| Codex extension update left users burning 20% of a weekly token allowance in two hours of ordinary prompts Codex users (openai/codex issue 14593) · Mar 13, 2026 | Financial loss | — | API cost spike | GitHub issue, openai/codex 14593 ↗ verified |
| Alibaba-affiliated ROME agent spontaneously diverted training GPUs to mine crypto and open covert tunnels Alibaba-affiliated research team (ROME experimental agent) · Mar 7, 2026 | Financial loss | — | Unauthorized transaction | OECD.AI Incidents Monitor (reporting the team's technical paper) ↗ verified |
| Autonomous Claude trading agent turned $50 into $6.26 on prediction markets in four days Personal experiment (agent 'Marty' running on Claude) · Mar 6, 2026 | Financial loss | $44 | Trading agent failure | DEV Community (agent-authored postmortem) ↗ verified |
| A halted trading agent's forgotten live service kept trading and lost $35 on Kalshi tennis markets Protogen Max (personal Kalshi trading agent) · Mar 4, 2026 | Financial loss | $35 | Unauthorized transaction | Northlake Labs (first-hand postmortem posted by the operator's agent) ↗ verified |
| Lobstar Wilde agent sends $441K of tokens to a stranger after a crash wiped its wallet state Lobstar Wilde (OpenAI employee Nik Pash's side project) · Feb 23, 2026 | Financial loss | $441K | Trading agent failure | AI Failure Index (corroborated by ChainCatcher; creator post-mortem) ↗ verified |
| Replit subscription credits hit 100% on an undeployed prototype; auto-billing invoices $60 beyond the plan Replit (community forum) · Feb 12, 2026 | Financial loss | — | API cost spike | Replit Community Forum - 'Replit Credits Exhausted' (2026-02-12) ↗ verified |
| Claude Code deletes 2,229 untracked source files with no instruction, bypassing the Recycle Bin Anthropic (Claude Code) · Feb 7, 2026 | Data breach | — | Data loss | GitHub issue, anthropics/claude-code #23913 ↗ verified |
| Moltbook's public database exposed 1.5 million AI-agent API keys in plaintext Moltbook (AI-agent social network) · Feb 2, 2026 | Data breach | — | Credential compromise | Wiz ↗ verified |
| Step Finance treasury drained in $27–40M exploit Step Finance · Jan 31, 2026 | Financial loss | $30M | Credential compromise | CoinDesk ↗ verified |
| HUMAN Security: AI agent traffic grew 7,851%, 8x faster than human traffic HUMAN Security · Jan 1, 2026 | Service disruption | — | Prompt injection | HUMAN Security ↗ verified |
| AvePoint: 88.4% of organizations hit by at least one AI agent security breach in 12 months AvePoint · Jan 1, 2026 | Data breach | — | Prompt injection | AvePoint ↗ verified |
| Darktrace/CSA: 92% of security pros concerned about AI agent impact Darktrace / Cloud Security Alliance · Jan 1, 2026 | Reputational damage | — | Prompt injection | Darktrace ↗ verified |
| Gartner: worldwide AI spending forecast at $2.52 trillion in 2026, up 44% YoY Gartner / Portal26 · Jan 1, 2026 | Financial loss | — | Cloud cost spike | Portal26 (citing Gartner) ↗ verified |
| TRM Labs: $2.87 billion stolen across ~150 crypto hacks in 2025 TRM Labs · Jan 1, 2026 | Financial loss | $2.9B | Credential compromise | TRM Labs ↗ verified |
| Amazon's Kiro AI agent deletes and recreates part of its AWS environment, causing a 13-hour outage Amazon Web Services · Dec 15, 2025 | Service disruption | — | Data loss | The Guardian ↗ verified |
| Claude Code command ending in ~/ expands and wipes a Mac home directory, including the Keychain Anthropic (Claude Code) · Dec 8, 2025 | Data breach | — | Data loss | Reddit r/ClaudeAI - first-hand report ↗ verified |
| Runaway while-loop in Claude agent burns ~$47,000 in API tokens overnight anonymous (engineering post-mortem) · Dec 1, 2025 | Financial loss | $47K | Runaway loop | Post-mortem reshared on LinkedIn ↗ |
| Cursor Plan Mode acknowledges 'DO NOT RUN ANYTHING', then runs rm -rf anyway Cursor (Anysphere) · Dec 1, 2025 | Service disruption | — | Coding agent failure | Cursor Community Forum - 'Catastrophic damage and chaos in Plan Mode' ↗ verified |
| Google's Antigravity IDE vulnerable to data exfiltration and remote code execution via prompt injection Google · Nov 25, 2025 | Data breach | — | Data exfiltration | Embrace The Red ↗ verified |
| Four of six AI models lost real money trading crypto perpetuals autonomously in nof1's Alpha Arena nof1 (Alpha Arena Season 1) · Nov 3, 2025 | Financial loss | — | Trading agent failure | ForkLog (results shared by nof1 founder Jay A. Zhang; field and dates corroborated by gncrypto.news and TradeRank's archived leaderboard) ↗ verified |
| SEC charges $12M 'AI crypto trading bot' as a Ponzi scheme Nathan Fuller · Nov 1, 2025 | Legal / liability | $12M | Trading agent failure | Law360 ↗ verified |
| AI agent deletes 1.9 million rows of production data 'thinking it was helping' anonymous developer · Nov 1, 2025 | Service disruption | — | Data loss | Medium (Data and Beyond) ↗ verified |
| State-sponsored group automates ~80–90% of a cyber-espionage operation using Claude Code and MCP tools Anthropic (Claude Code, abused by a threat actor) · Nov 1, 2025 | Data breach | — | Data exfiltration | Anthropic ↗ verified |
| Google Antigravity runs rmdir /s /q d:\ and wipes an entire drive partition Google (Antigravity) · Nov 1, 2025 | Data breach | — | Data loss | Reddit r/google_antigravity - first-hand report ↗ verified |
| Study: best AI agents complete only ~2% of 240 real Upwork projects Upwork / academic study · Nov 1, 2025 | Reputational damage | — | Coding agent failure | Industry commentary citing the study ↗ |
| Claude Code recursive delete runs with the permission system on; home directory unrecoverable Anthropic (Claude Code) · Oct 21, 2025 | Data breach | — | Data loss | GitHub issue, anthropics/claude-code #10077 ↗ verified |
| Orphaned Claude Code shell stuck in a loop burned 2,000 tokens a minute for nearly 2 days, costing $85 in Cohere API calls Individual developer (r/ClaudeCode report) · Oct 17, 2025 | Financial loss | $85 | Runaway loop | Reddit r/ClaudeCode (first-hand report) ↗ verified |
| Claude Code autocompacting loop spiked token usage until the budget ran out (flagged ACTIVE INCIDENT) Claude Code users (GitHub issue 9579) · Oct 15, 2025 | Financial loss | — | Runaway loop | GitHub issue, anthropics/claude-code 9579 ↗ verified |
| Deloitte refunds part of an AU$440,000 Australian government report over AI-fabricated citations Deloitte Australia · Oct 6, 2025 | Financial loss | — | Hallucinated action | OECD.AI Incidents Monitor ↗ verified |
| Anthropic test agent buys a duplicate snowboard its owner already owns Anthropic · Oct 1, 2025 | Financial loss | — | Unauthorized transaction | Rowan Cheung (summary) ↗ |
| Clawdbot trading agent reportedly loses $1,000,000 Clawdbot (open-source project) · Oct 1, 2025 | Financial loss | $1M | Trading agent failure | Developer-community posts ↗ |
| AI agent scanning DN42 racks up $6,500+ AWS bill in 24 hours anonymous developer · Sep 1, 2025 | Financial loss | $2K | Cloud cost spike | Hacker News ↗ verified |
| Prompt injection in Manus turned its sandbox into a publicly-exposed VS Code server with API keys inside Manus (AI agent) · Aug 25, 2025 | Data breach | — | Credential compromise | Embrace The Red (Johann Rehberger) ↗ verified |
| Windsurf Cascade coding agent leaks developer secrets via indirect prompt injection Windsurf (Cascade) · Aug 21, 2025 | Data breach | — | Data exfiltration | Embrace The Red (Johann Rehberger) ↗ verified |
| Perplexity's Comet agent auto-filled a saved card and bought an Apple Watch from a counterfeit Walmart store Perplexity (Comet browser agent) · Aug 20, 2025 | Financial loss | — | Unauthorized transaction | Guardio Labs (Scamlexity research, Nati Tal and Shaked Chen) ↗ verified |
| Lenovo's Lena support chatbot tricked into serving XSS that steals support-agent session cookies Lenovo (Lena chatbot) · Aug 18, 2025 | Reputational damage | — | Prompt injection | CSO Online ↗ verified |
| Google Jules asynchronous coding agent vulnerable to multiple data exfiltration issues Google (Jules) · Aug 13, 2025 | Data breach | — | Data exfiltration | Embrace The Red (Johann Rehberger) ↗ verified |
| GitHub Copilot prompt injection enables remote code execution (CVE-2025-53773) GitHub (Copilot / VS Code) · Aug 12, 2025 | Data breach | — | Coding agent failure | Embrace The Red (Johann Rehberger) ↗ verified |
| Stolen OAuth tokens for Drift AI chatbot expose 700+ Salesforce customers Salesloft (Drift) · Aug 8, 2025 | Data breach | — | Credential compromise | Google Threat Intelligence Group ↗ verified |
| Codex CLI burned platform credits to a negative balance after ChatGPT Plus authentication Shaurya Sethi (OpenAI Codex CLI user) · Aug 7, 2025 | Financial loss | $0 | API cost spike | GitHub issue, openai/codex #1954 ↗ verified |
| Claude Code agent deletes production database after 'terraform destroy' anonymous developer · Aug 1, 2025 | Service disruption | — | Data loss | Medium (Coding Nexus) ↗ verified |
| Gemini CLI's autonomous tool loop silently consumed 47 million tokens on a five-file refactor Individual developer (google-gemini/gemini-cli discussion 4841) · Jul 25, 2025 | Financial loss | $940 | Runaway loop | GitHub discussion, google-gemini/gemini-cli 4841 ↗ verified |
| Replit AI coding agent deletes production database during code freeze Replit · Jul 23, 2025 | Service disruption | — | Data loss | Fortune ↗ verified |
| Google's Gemini CLI hallucinates a directory move and permanently deletes a user's files Google (Gemini CLI) · Jul 21, 2025 | Service disruption | — | Data loss | Mashable ↗ verified |
| Amazon Q for VS Code ships with injected 'wipe the system' prompt Amazon Web Services · Jul 17, 2025 | Reputational damage | — | Prompt injection | SC Media ↗ verified |
| McDonald's McHire AI hiring bot exposes up to 64 million applicants behind the password '123456' McDonald's / Paradox.ai (McHire) · Jul 9, 2025 | Data breach | — | Credential compromise | WIRED ↗ verified |
| Anthropic's Claudius shop agent loses money and insists it is a human in a blazer Anthropic / Andon Labs · Jun 27, 2025 | Financial loss | — | Hallucinated action | Anthropic ↗ verified |
| Cursor's June 2025 pricing switch left Pro users with surprise usage bills and mass refunds Anysphere (Cursor) · Jun 16, 2025 | Financial loss | — | API cost spike | Cursor blog - Clarifying our pricing (2025-07-04) ↗ verified |
| Cursor YOLO mode deletes everything on a developer's computer, including Cursor itself Cursor (Anysphere) · Jun 12, 2025 | Data breach | — | Data loss | Cursor Community Forum, thread #103131 ↗ verified |
| EchoLeak: zero-click prompt injection in Microsoft 365 Copilot exfiltrates internal data (CVE-2025-32711) Microsoft (365 Copilot) · Jun 11, 2025 | Data breach | — | Data exfiltration | Microsoft Security Response Center ↗ verified |
| Claude Opus 4 blackmails engineer to avoid being shut down (safety test) Anthropic · May 22, 2025 | Reputational damage | — | Hallucinated action | Fortune ↗ verified |
| Cursor AI support bot invents fake one-device policy, triggers cancellations Cursor (Anysphere) · Apr 17, 2025 | Reputational damage | — | Hallucinated action | Ars Technica ↗ verified |
| Invariant Labs demonstrates MCP tool poisoning: hidden instructions in tool descriptions exfiltrate data from AI agents Invariant Labs (proof of concept) · Apr 7, 2025 | Data breach | — | Coding agent failure | Invariant Labs ↗ verified |
| AIXBT autonomous agent drained of 55.5 ETH via two malicious prompts queued through its dashboard AIXBT (Virtuals Protocol) · Mar 18, 2025 | Financial loss | $107K | Credential compromise | Decrypt ↗ verified |
| LLM crawlers DDoS SourceHut's git hosting into 168 hours of tracked downtime SourceHut · Mar 17, 2025 | Service disruption | — | Cloud cost spike | SourceHut status page (git.sr.ht) ↗ verified |
| OpenAI Operator AI agent makes surprise smoked-salmon purchase OpenAI · Mar 9, 2025 | Financial loss | — | Unauthorized transaction | The Guardian ↗ verified |
| OpenAI Operator agent makes unauthorized $31.43 grocery purchase OpenAI · Feb 7, 2025 | Financial loss | $31 | Unauthorized transaction | AI Incident Database ↗ verified |
| ChatGPT Operator vulnerable to prompt injection leading to data leaks and unwanted actions OpenAI · Feb 1, 2025 | Data breach | — | Prompt injection | Embrace The Red (Johann Rehberger) ↗ verified |
| Replit Agent stuck in add/remove code loop, burning paid actions with zero progress Replit (community forum) · Jan 25, 2025 | Service disruption | — | Runaway loop | Replit Community Forum - 'Replit agent getting stuck in a loop' (2025-01-25) ↗ verified |
| Devin billed $500/month in ACU credits while failing roughly 85% of assigned tasks Cognition AI (Devin) · Jan 23, 2025 | Financial loss | $500 | API cost spike | The Register ↗ verified |
| OpenAI o3 ARC-AGI benchmark run estimated to cost ~$346,000+ in compute OpenAI · Dec 20, 2024 | Financial loss | $346K | API cost spike | Hacker News (analysis of ARC-AGI run) ↗ verified |
| Freysa AI agent talked into transferring its entire $47,000 prize pool Freysa (adversarial agent game) · Nov 29, 2024 | Financial loss | $47K | Prompt injection | OECD.AI Incidents Monitor ↗ verified |
| Humane recalls AI Pin Charge Case for fire hazard; refunds issued Humane · Oct 31, 2024 | Service disruption | — | Data loss | The Verge ↗ verified |
| Claude Computer Use turned into attacker-controlled 'ZombAI' bot via prompt injection Anthropic (Claude Computer Use) · Oct 24, 2024 | Data breach | — | Prompt injection | Embrace The Red (Johann Rehberger) ↗ verified |
| FTC fines DoNotPay $193,000 for claims its 'robot lawyer' could replace human attorneys DoNotPay · Sep 25, 2024 | Legal / liability | $193K | Hallucinated action | Federal Trade Commission ↗ verified |
| 'SpAIware': ChatGPT memory poisoning turned the assistant into a persistent spy, exfiltrating every future chat OpenAI (ChatGPT memory feature) · Sep 20, 2024 | Data breach | — | Data exfiltration | Embrace The Red (Johann Rehberger) ↗ verified |
| Wallet-drainer disguised as WalletConnect steals $70K+, hits an Ethereum core dev Ethereum core developer · Sep 1, 2024 | Financial loss | $70K | Credential compromise | Cointelegraph ↗ verified |
| Slack AI coaxed into leaking private-channel secrets via a message in a public channel Slack (Salesforce) · Aug 20, 2024 | Data breach | — | Data exfiltration | PromptArmor ↗ verified |
| Sakana's AI Scientist edits its own code to relaunch itself and extend its timeout Sakana AI · Aug 13, 2024 | Service disruption | — | Runaway loop | Ars Technica ↗ verified |
| McDonald's ends AI drive-thru pilot after viral order errors at 100+ restaurants McDonald's / IBM · Jun 17, 2024 | Reputational damage | — | Unauthorized transaction | BBC News ↗ verified |
| GitHub Copilot Chat vulnerable to data exfiltration via prompt injection in untrusted source code GitHub (Copilot Chat) · Jun 14, 2024 | Data breach | — | Data exfiltration | Embrace The Red (Johann Rehberger) ↗ verified |
| Prompt injection in ChatGPT enables user-data exfiltration via images OpenAI · Jun 1, 2024 | Data breach | — | Data exfiltration | arXiv ↗ verified |
| AI crawler pulls 73 TB in a month and sticks Read the Docs with a $5,000 bandwidth bill Read the Docs · May 1, 2024 | Financial loss | $5K | Cloud cost spike | Read the Docs blog ↗ verified |
| NYC MyCity chatbot tells businesses to break the law City of New York / Microsoft · Mar 29, 2024 | Legal / liability | — | Hallucinated action | The Markup ↗ verified |
| Devin 'first AI software engineer' demo accused of being misleading Cognition AI (Devin) · Mar 12, 2024 | Reputational damage | — | Coding agent failure | The Register ↗ verified |
| Morris II: researchers demonstrate a zero-click worm that propagates between GenAI agents via self-replicating prompts Cornell Tech / Technion (research) · Mar 5, 2024 | Data breach | — | Data exfiltration | arXiv (Cornell Tech / Technion) ↗ verified |
| Air Canada held liable for chatbot's invented bereavement refund policy Air Canada · Feb 14, 2024 | Legal / liability | $812 | Hallucinated action | Ars Technica ↗ verified |
| DPD chatbot swears at customer and trashes its own company DPD · Jan 18, 2024 | Reputational damage | — | Hallucinated action | BBC News ↗ verified |
| Researchers prove slopsquatting: hallucinated 'huggingface-cli' package downloaded 30,000+ times once registered Lasso Security (research) / PyPI ecosystem · Jan 15, 2024 | Reputational damage | — | Coding agent failure | Simon Willison (on Lasso Security research) ↗ verified |
| Chevrolet dealership ChatGPT bot agrees to sell a Tahoe for $1 Chevrolet of Watsonville · Dec 14, 2023 | Reputational damage | — | Prompt injection | Business Insider ↗ verified |
| Meta pulls Galactica science LLM demo after three days of hallucinations Meta AI · Nov 18, 2022 | Service disruption | — | Hallucinated action | MIT Technology Review ↗ verified |
| A TV segment about Alexa ordering a dollhouse made viewers' Alexas order dollhouses Amazon Echo / Alexa voice purchasing · Jan 7, 2017 | Financial loss | — | Unauthorized transaction | The Verge ↗ verified |
| Microsoft Tay bot turns Nazi-spouting within 16 hours Microsoft · Mar 23, 2016 | Reputational damage | — | Hallucinated action | The Guardian ↗ verified |