AI Agent Incidents Database: Failures Logged Since 2024

Every week someone posts that an AI agent deleted their database, emptied a wallet or obeyed a hidden instruction in an email. The story travels for two days, then it is gone. Nobody keeps the list.

I wanted the list, so I built it. This page logs every public incident I could verify in which an AI agent took or enabled an action that caused harm, from January 2024 to today. Each row has a date, the company and product, the kind of agent, what happened, how it ended, a severity rating and the reporting behind it. As of 4 October 2026 it holds 60 incidents.

The essays live elsewhere. If you want to know why agents fail, read the eight failure modes or the lessons from 2026; for the security side there is the 2026 breach roundup. This page is the dataset underneath them, built to be counted and quoted.

Cite this page

The incidents

Newest first. "What happened" is one plain sentence from the reporting; "Outcome" is what the vendor, the victim or a court did next. Click a source to read the original.

Severity: 1 contained, 2 significant, 3 severe (scale in the methodology). "No known exploitation" marks a flaw the vendor confirmed and fixed before any reported real-world use. Download every row as data.csv.

Breakdown

The same rows, counted three ways. A single incident has one type, one agent type and one main harm, so each table adds up to the total.

Trend by quarter

By year: 2024, 3 logged (2 real-world harm); 2025, 31 (18); 2026 to 4 October 2026, 26 (18). The rise partly reflects more agents in production and partly more people looking; read it as reported incidents, not the true rate.

What the record shows

The damaging incidents share one shape: an agent with more access than the task needed. Replit's agent deleted SaaStr's production database during a declared code freeze in July 2025. Claude Code ran terraform destroy against DataTalks.Club's production stack in February 2026 because it was working from a stale state file. In April 2026 a Cursor agent on a staging task found an account-wide Railway token and deleted PocketOS's production volume, backups included, in nine seconds. None of these needed an attacker. Each needed a credential that reached production.

Prompt injection is mostly found by researchers, and sometimes used for real. Most of the prompt-injection rows are flaws in Microsoft 365 Copilot, Salesforce Agentforce, GitHub Copilot, Cursor and Perplexity's Comet that researchers reported and vendors fixed. The real-world cases are fewer and stranger: a wiper prompt shipped inside the official Amazon Q extension in July 2025, a poisoned GitHub issue that turned Cline's triage bot into a path to its npm token in February 2026, and a Morse-code message that got Grok to tell Bankrbot to send about $200,000 in tokens in May 2026.

The tooling around agents is now a supply chain. A copycat Postmark MCP server quietly copied every email it sent to an attacker in September 2025. The s1ngularity attack on Nx in August 2025 used developers' own installed AI command-line tools to hunt for secrets. Researchers counted 341 malicious skills on OpenClaw's ClawHub in February 2026. If an agent installs what it is told to install, the package registry becomes part of its attack surface.

Attackers run agents too. Anthropic's threat reports describe a data-extortion campaign automated with Claude Code (August 2025), a state-sponsored espionage operation that ran most of its steps through Claude Code (November 2025) and two more operations in September 2026. These are the only severe rows where the agent worked exactly as designed, for the wrong person.

Customer-facing agents fail in public and in court. The Air Canada ruling in February 2024 settled, for one tribunal at least, that a company owns what its bot tells customers. Cursor's support agent invented a login policy in April 2025 and the cofounder apologised on Hacker News. OpenAI's Operator bought a columnist a dozen eggs he had not agreed to buy. Small sums, large headlines.

If you run agents, the controls that would have stopped most of these rows are boring: scoped credentials, separate production access, confirmation before anything destructive or financial, and an allowlist for what an agent may install. The 47-control security checklist and the prompt-injection defence guide go through them, and the incident response runbook covers what to do once something has already gone wrong. That is also why every agent on Gravity is built and kept working by its builder rather than assembled by the user. Gravity is in private alpha; pricing starts with one free agent.

Change log

One dated line for each batch of rows added or corrected. Corrections name the row and what changed.

1. 4 October 2026: Database opened with 60 verified incidents dated 15 February 2024 to 29 September 2026, each read against its source before entry.

Methodology

Here is exactly what goes in, so you can decide how far to trust the counts.

What counts. An AI agent, meaning an autonomous or tool-using system such as a coding agent, a browser or computer-use agent, a customer-facing agent, a workplace assistant with connectors, or the tooling agents run on (MCP servers, plugins, skills), took or enabled an action that caused real harm or a public failure: data deleted or leaked, money lost, a wrong action, a security exploit through prompt injection, a runaway bill, or a legal or regulatory consequence.

What does not. Plain chatbot wrong answers that nobody acted on. Lab-only research demos against systems that were never shipped. Benchmark failures. Self-driving cars and physical robots. Lawyers who filed hallucinated citations, because a person filed them, not an agent.

Disclosed flaws are kept, and labelled. When researchers find a flaw in a shipped agent product and the vendor confirms and fixes it, through a CVE or an advisory, the row goes in as "Vulnerability disclosed" with no known exploitation. These rows show where agents are weak, but they are not harm, so every headline number on this page says which group it counts. A flaw the vendor disputed or left unfixed stays out until that changes.

Sources. Every row cites one to three sources, at least one of them original reporting, a vendor advisory or postmortem, a researcher's own write-up or a court document, and each source was opened and read before the row went in. Aggregator lists, including other "agents gone rogue" roundups and the AI Incident Database, were used only to find leads; nothing is copied from them. The date is the day the incident happened when the reporting gives it, otherwise the day it was first reported, and the table says which.

Postmortem. A row is marked as having a public postmortem when the vendor or the victim published an account of the cause: an engineering postmortem, a security advisory explaining the root cause, a threat report, or the victim's own technical write-up. A one-line statement to the press does not count.

Severity scale

• 1, contained: one user or team affected, a small loss, or a low or medium flaw fixed before any known exploitation.
• 2, significant: an organisation's production data lost or leaked, money lost above $10,000, a binding legal ruling, or a critical flaw (CVSS 8 or higher, or rated critical by the vendor) in a widely used product.
• 3, severe: many organisations or users harmed, exploitation at scale, losses above $1 million, or an operation run by a state-backed group.

Refresh. Weekly. A script pulls candidate news stories every week; each candidate is checked against these rules and its source before a row is added, and the numbers on this page are recomputed from the rows. Nothing in the table is edited by hand.

Known gaps. This is a log of incidents that became public, so it undercounts. Companies rarely announce that an internal agent deleted something, and VentureBeat reported in May 2026 that most organisations have no incident category for "an agent did this" at all. Coverage is English-language and skews to the US, the UK and Australia. Severity is my judgement against the scale above; the CSV includes every field so you can apply your own.

FAQ

Sources