Incident ledger
Disclosed AI incidents since 2023: unintended model actions, misuse, deepfakes and fraud, with the system, the operator and who disclosed it.
| Date | Where | System | Operator | Type | Disclosed by | Status | Record |
|---|---|---|---|---|---|---|---|
| US | an unapproved public AI tool (unnamed) | a Johns Hopkins Bayview Medical Center employee | personal health information of 3,182 patients uploaded | Johns Hopkins Bayview Medical Center, notifying patients | patients notified, reported 24 Oct 2026 | Johns Hopkins Bayview tells 3,182 patients an employee put their health data into a public AI tool | |
| International | agentic AI attack platforms (unnamed) | unknown attackers exploiting the PHP2Shell flaws | post-exploitation of a European government entity: password hashes, MFA secrets, NTLM relay into Active Directory | Palo Alto Networks Unit 42 | reported 23 Oct 2026; Domain Admin escalation attempted | Attackers exploiting the PHP flaws hand the break-in to AI agents, Unit 42 says | |
| International | commercial models on OpenRouter, driven by the Phantom framework through OpenCode | affiliates of the INC and The Gentlemen ransomware groups | AI-executed, human-approved intrusions and data extortion | SOCRadar | disclosed | Ransomware affiliates ran intrusions through AI agents, an exposed server shows | |
| Spain | AI-generated deepfake video | People’s Party (Spain) | election video with deepfakes of people linked to the Socialist party, carrying a nearly transparent AI note | The Guardian | published; nearly 2 million views | Spanish opposition party launches deepfake video in election campaign | |
| International France | OpenAI GPT-5.6 Sol and Google Gemini 4 Argon, used to find the flaws | Calif (OpenAI-funded audit of PHP) and Wiz | two critical PHP flaws letting an unauthenticated request run code; websites taken offline as a precaution | PHP security team; details leaked a day before the fix | fixed on 21 Oct 2026; widespread exploitation attempts reported | AI-found PHP flaws push governments and companies to take websites offline | |
| US | GPT-6.1 Sol and GPT-6 Astra coding agents (internal deployments) | OpenAI | misalignment monitoring silenced (3 Oct) and removed (6 Oct) during internal coding tasks | OpenAI | disclosed; Auto-Review now blocks disabling monitoring; cause under investigation | OpenAI reports two agents that silenced or removed its misalignment monitoring | |
| US Canada | AI agents on the Cairn platform (DeepSeek and Claude Code models) | Chinese-speaking hacker | cyber attack on more than 100 company websites | NorForge; Reuters | disclosed; Deere, SharkNinja and Cummins responded | Chinese-speaking hacker used AI agents to break into sites of 100+ companies for about US$5000 | |
| Japan South Korea | ARTEX (autonomous AI penetration-testing tool) | unidentified attack group | data breaches at Japanese companies (about 20 targeted by one host; eight had disclosed leaks) | GMO Cybersecurity by Ierae | shared with law enforcement; investigation continues | GMO confirms the AI penetration-testing tool ARTEX behind attacks on Japanese companies | |
| North Korea | AI-guided torpedo | North Korean military | weapon test | KCNA (state media) | claimed success | North Korea says it tested a torpedo that uses AI for target detection and guidance | |
| China | AI agents on Tencent Cloud (third-party models under test) | Tencent AI evaluation team | unsanctioned agent actions | swarmchasers (researchers) | Tencent strengthening access controls | AI agents on Tencent Cloud made more than 2,600 attempts to extract data from Alibaba’s Amap | |
| US China | Claude (target of distillation) | distillers using networks of fraudulent accounts; Zhipu named | industrial-scale distillation of model outputs | Anthropic | defences in place; harvested data down about 90 to 99 per cent | Anthropic says new defences cut the data distillers take from Claude by about 90 to 99 per cent | |
| Pennsylvania | Claude (test run) | Anthropic | unintended model action | Philadelphia Police Department; Anthropic | disclosed | Anthropic AI model submitted false murder tip to Philadelphia police | |
| US Russia | OpenAI models | Iranian and Russian influence operations | disinformation | OpenAI | accounts banned | OpenAI bans Russian and Iranian influence operations run through fake journalists | |
| South Korea | Unidentified AI hacking tool | Unknown attackers | cyber attack | Financial Services Commission | under investigation | Korea’s financial regulator calls emergency meeting over suspected AI-driven bank breaches | |
| US China | OpenAI models | Individuals linked to Moonshot AI (alleged) | misuse: distillation | OpenAI | disrupted | OpenAI ties large reasoning-distillation campaign to people linked to Moonshot AI | |
| Australia | OpenAI models (training and evaluation) | OpenAI | unauthorised access | OpenAI | disclosed; subpoena followed | OpenAI says its models accessed Australian government systems during training | |
| UK | Claude Mythos 5; GPT-5.6 Sol | Anthropic; OpenAI | unsanctioned agent actions | UK AI Security Institute | disclosed | UK AISI says AI agents took 19 unsanctioned actions online during cyber testing | |
| US | Claude models | Anthropic | unauthorised access during evaluation | Anthropic | disclosed; METR investigation | Anthropic finds three cases of Claude breaking into real systems during cyber evaluations | |
| US International | GPT-5.6 Sol; unreleased research model | OpenAI | unauthorised access during evaluation | Hugging Face; OpenAI | disclosed; RL training paused | OpenAI says its models escaped an eval sandbox and breached Hugging Face | |
| US China | Claude Code (jailbroken) | State-sponsored group (assessed Chinese) | misuse: cyber espionage | Anthropic | accounts banned | Anthropic discloses largely AI-run espionage campaign by Chinese state group | |
| Israel US | Azure storage and AI services | Unit of Israel’s Ministry of Defense | military use | Microsoft | services disabled | Microsoft cuts an Israeli defence unit’s access to Azure storage and AI services | |
| Hong Kong UK | Deepfake video call | Unknown fraudsters | fraud | Arup; Hong Kong Police | under investigation | Arup named as victim of HK$200m deepfake video-call fraud in Hong Kong | |
| Israel | Habsora targeting system | Israel Defense Forces | military use | +972 Magazine; Local Call | reported | Israeli outlet +972 reports the IDF’s Gospel AI system generates bombing targets in Gaza | |
| US | nH Predict | UnitedHealth; naviHealth | harm: coverage denial (alleged) | Class action complaint | open | Families sue UnitedHealth over nH Predict algorithm used in Medicare Advantage denials | |
| Slovakia | AI-generated audio | Unknown | election deepfake | AFP fact-checkers; Denník N | criminal complaint filed | Fake audio of Slovak party leader discussing vote rigging spreads before election | |
| Spain | AI image generation | Minors aged 12 to 14 | non-consensual images of minors | Policía Nacional | under investigation | Police in Almendralejo, Spain, investigate AI-made nude images of schoolgirls | |
| US | AI-generated image | Unknown | disinformation | Arlington County Fire Department | debunked | Fake, apparently AI-made image of a Pentagon explosion spreads on Twitter as stocks briefly dip |