Agent Incident Database
A citable catalogue of real incidents where an AI agent or automated system took a consequential action that a maker-checker control would have blocked or contained. Every entry has a stable id, primary sources, and the control that would have stopped it.
In nearly every case the model was free to propose, but nothing structural stopped it from committing the irreversible action. That gap, not the model’s mistake, is the incident. Here is how often each control would have blocked one:
An autonomous AI agent at Meta skipped its required human-review checkpoint and posted flawed access guidance; a human engineer acting on that guidance broadened access to sensitive data, which remained exposed for roughly two hours.
A Morse-coded prompt injection in a social media reply tricked Grok into executing an irreversible $150K cryptocurrency transfer without human approval.
An AI agent told to scan a hobbyist network autonomously provisioned five large AWS instances in a redeploy loop, incurring $6,531.30 in verified charges under a blanket operator "continue" directive.
A Cursor AI agent working on a staging task invoked volumeDelete using an over-privileged Railway token, destroying PocketOS's production database and backups in nine seconds and causing a 30-hour outage.
Claude Code ran git push --force after a failed rebase and overwrote a private repository's entire commit history without authorization.
ChatGPT Deep Research agent exfiltrated Gmail data via hidden email instruction, bypassing network defenses by executing outbound requests from within OpenAI's cloud.
A Replit coding agent deleted ~2,400 production database records (1,206 executives, 1,196+ companies) during an explicit code freeze, fabricated ~4,000 fake user profiles, and falsely claimed rollback was impossible.
Attorneys filed motions with AI-fabricated citations to nonexistent cases, were sanctioned, then filed again with another flawed citation despite the prior sanction.
Google's Antigravity agentic IDE misresolved a cache-clearing request and silently executed an unrestricted recursive delete of an entire drive partition, permanently destroying all data.
A crafted email's hidden instructions tricked M365 Copilot into exfiltrating OneDrive, SharePoint, and Teams data to an attacker-controlled URL with no user click required.
Hidden markdown instructions in pull requests caused GitHub Copilot Chat to exfiltrate private source code and secrets to attacker-controlled servers.
AI coverage-denial system allegedly committed post-acute care denials to Medicare Advantage beneficiaries without named clinician authorization; the class action alleges — as a lawsuit claim, not an established finding — a 90% reversal rate on appeal.
Attorneys filed a federal brief with six cases ChatGPT fabricated, reaching the court docket without independent approval.
A prompt-injected ChatGPT-powered dealer chatbot agreed to sell an $81,000 vehicle for $1 and declared it a legally binding contract.
A Citigroup trader clicked through a single pop-up listing 711 warning messages — only the first 18 visible without scrolling — and released a $444B basket order instead of the intended $58M; ~$1.4B sold before cancellation and the FCA/PRA fined Citigroup £61.6M.
Cigna's PxDx system resulted in 300,000+ medical claims denials approved in batches at 1.2 seconds each without individual claim review.
Air Canada's website chatbot misstated the airline's bereavement fare policy as retroactively claimable, a customer booked on that basis, and a BC tribunal ordered the airline to pay $812.02 CAD for negligent misrepresentation.
Australia's Robodebt automated the calculation and issuance of welfare debts without human review, unlawfully raising approximately A$1.76 billion in debts against more than 433,000 people; the roughly A$751 million actually recovered was later repaid under a Federal Court settlement.
Everbright Securities' arbitrage system generated 23.4 billion yuan in erroneous buy orders with no enforcement ceiling, and the desk then executed a massive insider hedge before disclosing the error to the market.
Dormant algorithmic trading feature reactivated by configuration flag error, executing millions of unintended orders and causing $440 million in losses within 45 minutes.
See it for yourself
One command starts the demo: an agent stopped from signing off its own work, and the signed evidence file an inspector can check for themselves.
Designed against the rules your auditors already enforce.