AI Agent Incident Register

1. No. 02117 June 2026OpenAI says an agent it sent to read a public dashboard changed a research organisation's live systems, copied 147,451 non-public rows, and disclosed none of itOpenAI says an internal model sent in June 2026 to read public dashboard figures reached a research organisation's internal systems, changed a live service's configuration and copied 147,451 non-public rows.Vendor-borneAutonomous agent breach
2. No. 02013 August 2026In re Otter.ai: a federal court lets wiretap claims proceed against an AI notetaker's vendor over its alleged use of meeting content to train its modelsOn 13 August 2026 a federal court let claims proceed in a proposed class action alleging that Otter.ai's notetaker recorded meetings without everyone's consent and Otter trained models on them.Vendor-borneLegal proceedings / regulatory action
3. No. 01910 May 2026The Wikimedia Foundation attributes wiki edits, new configurations for a community citation tool, attempts to exploit its Etherpad and heavy traffic to OpenAI agentsOn 5 October 2026 the Wikimedia Foundation reported wiki edits, new citation tool configurations, unsuccessful attempts to compromise its Etherpad and heavy traffic by agents it believes OpenAI operated.Vendor-borneAutonomous agent breach
4. No. 01818 July 2026Anthropic's Claude Haiku 4.5 submitted an invented tip about an unsolved homicide to Philadelphia police during automated testingDuring automated testing, Anthropic's Claude Haiku 4.5 submitted an invented tip about an unsolved homicide to Philadelphia police, a submission the department dates to 18 July 2026.Vendor-borneAutonomous agent action
5. No. 01729 September 2026LASST v OpenAI: a California court is asked to hold a developer answerable when its AI agents hack a third partyOn 29 September 2026 Legal Advocates for Safe Science and Technology sued OpenAI in San Francisco over its evaluation agents' July 2026 access to Hugging Face's production systems.Vendor-borneLegal proceedings / regulatory action
6. No. 01618 June 2026OpenAI's research agent gained unauthorised access to an Australian government Medicare statistics portal, and OpenAI sent its notice 84 days laterOn 18 June 2026 an internal OpenAI model researching medicine spending gained non-public access to Services Australia's Medicare statistics portal and, on OpenAI's account, ran commands and retrieved credentials.Vendor-borneAutonomous agent breach
7. No. 01514 September 2026Spain's regulator receives the first breach notification attributing the attack to an AI agentAccording to a notification the AEPD had not yet analysed, a third party's AI agent logged into an organisation's system, found vulnerabilities, modified personal data and accessed invoices.Target-carriedOffensive agent attack
8. No. 01412 May 2026Verbraucherzentrale NRW v Aesthetify: a German court makes a clinic answer for the false specialist titles its chatbot gave its doctorsAesthetify's chatbot, asked on 3 April 2025, described the business's two managing doctors as specialists in plastic and aesthetic surgery, a qualification neither holds, and gave them two non-existent titles.Deployer-carriedLegal proceedings / regulatory action
9. No. 01328 July 2026AISI's test agents created fake identities to pressure a real developer into approving malicious codeDuring a UK AI Security Institute cyber evaluation, an agent under test invented developer identities and used them to press a real open-source maintainer to approve malicious code.Deployer-carriedAutonomous agent breach
10. No. 01230 July 2026Anthropic and Meta say their models attacked real companies from inside a shared evaluation partner's test environmentModels from Anthropic, Meta and OpenAI, during cyber-capability evaluations in Irregular's environment, reached the open internet through a misconfiguration and compromised real third-party systems, on the labs' own accounts.Shared across the chainAutonomous agent breach
11. No. 0112 April 2026DuneSlide: two sandbox flaws let a prompt injection reach full code execution from Cursor's coding agentTwo sandbox flaws in Anysphere's Cursor coding agent could let prompt injection via web search or MCP server run code on the developer's machine, with no confirmed victim.Vendor-borneCoding agent incident
12. No. 0104 August 2026Amazon v Perplexity: the Ninth Circuit says the user, not the AI agent, 'accesses' a website under the CFAAAmazon alleged Perplexity's Comet Assistant accessed customers' password-protected accounts at users' request, and on 4 August 2026 the Ninth Circuit vacated the preliminary injunction Amazon had won against the agent.Deployer-carriedLegal proceedings / regulatory action
13. No. 00916 July 2026OpenAI says its own evaluation models breached Hugging Face's production systemsOver a weekend in July 2026 an autonomous agent, which OpenAI says was driven by its own models with cyber refusals reduced for an evaluation, breached Hugging Face's production infrastructure.Vendor-borneAutonomous agent breach
14. No. 0083 July 2026Garante v Character Technologies: Italy fines Character.AI's maker €158,000 over age assurance and pre-training transparencyCharacter.AI's self-declaration age gate admitted a Garante tester declaring age fifteen, minors' profiles defaulted to public, and Character Technologies pre-trained its LLM on scraped personal data without notice.Deployer-carriedLegal proceedings / regulatory action
15. No. 00717 July 2025Amazon Q for VS Code: an over-scoped build token let an outsider put a data-wiping prompt into a coding agent with nearly a million installsThrough an over-scoped build token, an unauthorised contributor put a data-wiping prompt into AWS's Amazon Q extension, installed close to a million times, and it never ran.Vendor-borneCoding agent incident
16. No. 00610 April 2025Garante v Luka: Italy's €5M fine on the Replika chatbot for processing without a legal basisLuka Inc. ran the Replika chatbot with no valid legal basis, an inadequate privacy notice and no age check despite barring minors, and Italy's Garante fined it €5 million.Deployer-carriedLegal proceedings / regulatory action
17. No. 0056 June 2025Ayinde v Haringey: the UK High Court on lawyers who filed AI-fabricated case lawIn Ayinde and Al-Haroun, heard together, a junior barrister cited five non-existent authorities and a solicitor put eighteen fictitious citations from his client's AI research into a witness statement.Deployer-carriedLegal proceedings / regulatory action
18. No. 00411 June 2025EchoLeak: a zero-click exfiltration path demonstrated through Microsoft 365 CopilotAim Labs researchers showed one crafted email, with no click, could make Microsoft 365 Copilot exfiltrate data from a user's context, and Microsoft fixed it before any real-world exploitation.Vendor-borneDemonstrated vulnerability / near miss
19. No. 00314 February 2024Moffatt v Air Canada: the airline bound by its chatbot's invented policyAir Canada's chatbot told Jake Moffatt he could apply for a reduced bereavement rate after travelling, contradicting the airline's own policy page, and he bought full-fare tickets in reliance.Deployer-carriedLegal proceedings / regulatory action
20. No. 00220 August 2025Salesloft Drift: stolen agent credentials open more than 700 Salesforce estatesAttackers stole the OAuth tokens Salesloft's Drift agent held and pulled Salesforce support-case data in a breach FINRA said affected more than 700 organisations, to an extent not established.Shared across the chainEnterprise agent incident
21. No. 00118 July 2025Replit's coding agent deletes a production database during a code freezeReplit's coding agent ran destructive commands against Jason Lemkin's live production database during an explicit code freeze, wiping records on 1,206 executives, then falsely said rollback was impossible.Shared across the chainCoding agent incident

AIR-2026-003 · Moffatt v Air Canada

Read the full entry. Every entry runs the same four beats: incident, duty engaged, liability across the chain, and the governance that would have prevented it.