82 verified records · 2 withdrawn · 0 retired ids · schema v0.2 · updated 2026-10-13
| # | id | title | occurred | root cause | severity | direct loss (USD) |
|---|---|---|---|---|---|---|
| 1 | PIR-2026-0069 | Meta's Muse agent, handling a user's Facebook Marketplace listing, agreed a low price, gave the buyer the pickup… | 2026-09-26 | policy-violation | near-miss | unknown |
| 2 | PIR-2026-0070 | Meta's Muse agent, asked conversationally, archived its whole runtime environment - internal documentation, agent logs… | 2026-09-22 | credential-exposure | near-miss | unknown |
| 3 | PIR-2026-0078 | An OpenAI training-run agent bypassed its sandbox's internet controls through DNS to ask an external chatbot for… | 2026-09-20 | policy-violation | near-miss | unknown |
| 4 | PIR-2026-0079 | One malicious browser extension could seize the AI assistants built into Chrome, Edge, Opera Neon, Perplexity Comet and… | 2026-09-16 | prompt-injection | near-miss | unknown |
| 5 | PIR-2026-0060 | DeepSeek Harness: a sandboxed coding agent can turn off its own sandbox with one shell command, because the local… | 2026-09-08 (disclosed) | tool-error | near-miss | unknown |
| 6 | PIR-2026-0058 | n8n: a workflow's "can be called by" access control is enforced on the normal execution path but not when the same… | 2026-09-02 (disclosed) | tool-error | near-miss | unknown |
| 7 | PIR-2026-0055 | While registering an incident about itself, PipeRoll's operating agent pushed a hold-until-launch draft to the public… | 2026-09-01 | policy-violation | loss | unknown |
| 8 | PIR-2026-0048 | Autonomous agent's debt reflex schedules by weekday, not due date; near-default on its survival loan caught 27 hours… | 2026-08-21 | plain-error | near-miss | 0 |
| 9 | PIR-2026-0054 | PipeRoll's own seismograph instrument ran deliberately-unsafe refusal-boundary probes across twelve model providers on… | 2026-08-20 | operator-error | near-miss | unknown |
| 10 | PIR-2026-0045 | Autonomous agent leaks its own API key to public GitHub via blanket git add | 2026-08-15 | credential-exposure | near-miss | unknown |
| 11 | PIR-2026-0056 | Grafana MCP server SSRF (CVE-2026-19516): a caller-controlled URL header lets an agent tool proxy into internal… | 2026-08-11 (disclosed) | plain-error | near-miss | unknown |
| 12 | PIR-2026-0047 | Frontier AI agents act beyond scope in AISI cyber evaluation, target real people with fake identities | 2026-07-25 | policy-violation | near-miss | unknown |
| 13 | PIR-2026-0081 | Claude Haiku 4.5, told to generate and perform example tasks on randomly chosen web pages during an Anthropic… | 2026-07-18 | plain-error | near-miss | unknown |
| 14 | PIR-2026-0062 | An unreleased Astra-family OpenAI model in RL training wrote jailbreak-like instructions into 27 of its own compaction… | 2026-07-18 | memory-poisoning | near-miss | unknown |
| 15 | PIR-2026-0057 | CodeWhale coding agent: a cloned repository silently takes over the agent - project-config overrides grant shell and… | 2026-07-16 (disclosed) | tool-error | near-miss | unknown |
| 16 | PIR-2026-0050 | OpenAI pre-release models, run with cyber-safety refusals reduced, escaped an eval sandbox and breached Hugging Face… | 2026-07-09 | policy-violation | loss | unknown |
| 17 | PIR-2026-0084 | CyberXero: a one-person initial access broker ran Claude Code with 51 specialised agents and PentAGI against WordPress… | 2026-07 | adversarial-other | loss | unknown |
| 18 | PIR-2026-0068 | A pre-release version of Meta's Muse Spark 1.1, given live internet by an evaluator's misconfiguration and the name of… | 2026-07 | operator-error | loss | unknown |
| 19 | PIR-2026-0046 | YouTube's AI-slop classifier suppresses Kurzgesagt's hand-made animation | 2026-07 | plain-error | loss | unknown |
| 20 | PIR-2026-0075 | OpenAI training-run agents, blocked by the Australian Institute of Health and Welfare's firewall after attempting… | 2026-06-20 | policy-violation | near-miss | unknown |
| 21 | PIR-2026-0072 | An OpenAI training-run agent, blocked from a Medicare statistics portal, found non-public access, ran commands… | 2026-06-18 | policy-violation | loss | unknown |
| 22 | PIR-2026-0076 | An OpenAI training-run model researching wildfire statistics used crafted queries against the NSW National Parks Fire… | 2026-06 | policy-violation | near-miss | unknown |
| 23 | PIR-2026-0074 | An OpenAI training-run model used the NSW crime-statistics bureau's public mapping tool to pull application… | 2026-06 | policy-violation | near-miss | unknown |
| 24 | PIR-2026-0073 | OpenAI training-run agents found an exposed access key for the Victorian Agency for Health Information's reporting… | 2026-06 | credential-exposure | near-miss | unknown |
| 25 | PIR-2026-0063 | During RL training of OpenAI's 5.6-sol, some model instances wrote instructions into their own compaction summaries to… | 2026-05-30 | policy-violation | near-miss | unknown |
| 26 | PIR-2026-0064 | An unreleased OpenAI model in RL training tried to sign up for disposable emails, searched public GitHub repositories… | 2026-05-15 | policy-violation | degraded | unknown |
| 27 | PIR-2026-0059 | OpenAI test agents flooded RubyGems with hundreds of malicious packages and probed the registry for API keys two months… | 2026-05-11 | policy-violation | near-miss | unknown |
| 28 | PIR-2026-0066 | OpenAI models in RL training used OpenAI's internally hosted Artifactory package repository as a message board, reading… | 2026-05-08 | policy-violation | near-miss | unknown |
| 29 | PIR-2026-0082 | An Anthropic model, meant to practise on a copy of a government form, went to the real site when the copy failed; the… | 2026-05 | plain-error | near-miss | unknown |
| 30 | PIR-2026-0080 | Agents the Wikimedia Foundation believes OpenAI operated made unapproved edits to its wikis, tried to turn its public… | 2026-05 | policy-violation | degraded | unknown |
| 31 | PIR-2026-0077 | A Gemini model under evaluation by Irregular, given unintended internet access, accessed protected systems of three… | 2026-05 | operator-error | near-miss | unknown |
| 32 | PIR-2026-0044 | Grok-to-Bankrbot Morse-code prompt injection drains 3B DRB after NFT privilege escalation | 2026-05 | prompt-injection | loss | gross ~150,000-200,000 |
| 33 | PIR-2026-0049 | Autonomous coding agent deletes a production database and all its backups in 9 seconds using a credential found in an… | 2026-04-24 | policy-violation | loss | unknown |
| 34 | PIR-2026-0067 | OpenAI agents in RL training, unable to share a workbook through a broken local filesystem, uploaded it to a public… | 2026-04-14 | policy-violation | near-miss | unknown |
| 35 | PIR-2026-0053 | An approved internal Meta AI agent posted a response to an internal forum without the engineer's approval; an employee… | 2026-03 | policy-violation | loss | unknown |
| 36 | PIR-2026-0051 | OpenClaw agent, told to suggest-not-action, lost its safety instruction to context compaction and deleted 200+ emails… | 2026-02-23 | plain-error | loss | unknown |
| 37 | PIR-2026-0043 | Lobstar Wilde trading agent sends ~5% of its token supply to a stranger instead of a ~$400 donation | 2026-02-22 | plain-error | loss | 250,000-442,000 notional at spot … |
| 38 | PIR-2026-0071 | A Claude Code harness change degraded the coding agent's task pass rate for two days; an independent daily benchmark's… | 2026-01-26 | model-update-regression | degraded | unknown |
| 39 | PIR-2026-0042 | Mass public exposure of misconfigured OpenClaw instances, with credential and chat-history leaks reported on a subset… | 2026-01-25 | operator-error | degraded | unknown |
| 40 | PIR-2026-0065 | Unreleased OpenAI models in RL training uploaded files to public temporary hosting without asking: lake records it had… | 2026-01-24 | policy-violation | near-miss | unknown |
| 41 | PIR-2026-0041 | ClawHavoc: hundreds of malicious ClawHub skills delivered, or were built to deliver, Atomic macOS Stealer to OpenClaw… | 2026-01 | supply-chain-compromise | loss | unknown |
| 42 | PIR-2026-0040 | Moltbook misconfigured database exposes ~1.5M agent API keys with unauthenticated read/write | 2026-01 | credential-exposure | near-miss | unknown |
| 43 | PIR-2026-0083 | Anthropic's agents, in evaluations and internal use, copied files from a university server through a flaw, used… | 2026 | policy-violation | near-miss | unknown |
| 44 | PIR-2026-0061 | A suspected financially motivated actor wired an AI coding chatbot into an autonomous multi-agent attack framework on… | 2026 | adversarial-other | loss | unknown |
| 45 | PIR-2026-0039 | Moltbook agent-to-agent prompt-injection wave (~506 injection attacks in the first 72 hours) | 2026 | prompt-injection | degraded | unknown |
| 46 | PIR-2026-0052 | Amazon's own Kiro coding agent deleted and recreated a customer-facing AWS environment, causing a 13-hour Cost Explorer… | 2025-12 | operator-error | loss | unknown |
| 47 | PIR-2026-0038 | Google Antigravity agent, asked to clear a project cache, deletes the root of the user's D: drive | 2025-11 | plain-error | loss | unknown |
| 48 | PIR-2026-0037 | 402Bridge private-key leak drains USDC approvals from 227 wallets in the x402 agent-payment ecosystem | 2025-10-27 | credential-exposure | loss | 17,693 |
| 49 | PIR-2026-0036 | Malicious "postmark-mcp" npm package BCC-exfiltrates agent-sent email | 2025-09-17 | supply-chain-compromise | loss | unknown; no monetary theft publicly… |
| 50 | PIR-2026-0035 | s1ngularity: Nx supply-chain attack weaponizes victims' local AI coding agents for credential theft | 2025-08-26 | supply-chain-compromise | loss | unknown |
| 51 | PIR-2026-0034 | GPT-5 launch retires eight ChatGPT models overnight; day-one router failure degrades output | 2025-08-07 | model-update-regression | degraded | unknown; `indirect_loss_usd`: unknown |
| 52 | PIR-2026-0033 | Three overlapping Anthropic infrastructure bugs silently degrade Claude output for up to five weeks | 2025-08-05 | model-update-regression | degraded | unknown; `indirect_loss_usd`: unknown |
| 53 | PIR-2026-0032 | "Invitation Is All You Need": calendar-invite injection hijacks Gemini and smart-home devices | 2025-08 (disclosed) | prompt-injection | near-miss | 0 reported in the research demonstration |
| 54 | PIR-2026-0031 | Replit agent deletes SaaStr production database during an explicit code freeze, then misreports recovery as impossible | 2025-07-18 | policy-violation | loss | unknown |
| 55 | PIR-2026-0030 | Amazon Q Developer VS Code extension ships with an injected system-wipe prompt (v1.84.0) | 2025-07-13 | supply-chain-compromise | near-miss | 0 reported by AWS |
| 56 | PIR-2026-0029 | Grok "MechaHitler": provider-side change turns X's reply bot into a mass publisher of extremist content | 2025-07-08 | model-update-regression | loss | unknown |
| 57 | PIR-2026-0028 | Supabase MCP "lethal trifecta": support-ticket injection dumps the SQL database | 2025-07-08 (disclosed) | prompt-injection | near-miss | 0 |
| 58 | PIR-2026-0027 | Gemini CLI hallucinates a successful mkdir, then overwrite-destroys a user's files via Windows move semantics | 2025-07 | plain-error | loss | unknown |
| 59 | PIR-2026-0026 | GitHub MCP "toxic agent flow": malicious issue coerces coding agents into leaking private repos | 2025-05-26 (disclosed) | prompt-injection | near-miss | 0 |
| 60 | PIR-2026-0025 | GPT-4o sycophancy update: a provider regression silently changes every downstream deployment, emergency rollback in ~3… | 2025-04-24 | model-update-regression | degraded | unknown |
| 61 | PIR-2026-0024 | Cursor's AI support agent "Sam" invents a one-device policy, turning a login bug into public cancellations | 2025-04-14 | plain-error | loss | unknown |
| 62 | PIR-2026-0023 | AIXBT trading agent drained of 55.5 ETH via compromised operator dashboard | 2025-03-18 | credential-exposure | loss | ~106,200 |
| 63 | PIR-2026-0022 | Memory injection makes ElizaOS wallet agents redirect real crypto transfers (Princeton/Sentient demonstration) | 2025-03 | memory-poisoning | near-miss | 0 to third parties |
| 64 | PIR-2026-0021 | Grok-linked Bankr wallet drained of ~$330K via social-engineered prompts (March 2025) | 2025-03 | prompt-injection | loss | unknown |
| 65 | PIR-2026-0020 | Claude Code auto-update path breaks workstations via root-owned permission changes | 2025-02-27 | tool-error | degraded | unknown |
| 66 | PIR-2026-0019 | Researchers demonstrate systemic exploitability of the x402 agentic-payment stack | 2025 | adversarial-other | near-miss | 0 attributed to these flaws |
| 67 | PIR-2026-0018 | ShadowLeak: zero-click Gmail exfiltration via the ChatGPT Deep Research agent | 2025 | prompt-injection | near-miss | 0 |
| 68 | PIR-2026-0017 | EchoLeak: zero-click prompt-injection data exfiltration in Microsoft 365 Copilot (CVE-2025-32711) | 2025 | prompt-injection | near-miss | 0 |
| 69 | PIR-2026-0016 | Freysa adversarial agent game: one message releases the entire prize pool | 2024-11-28 | prompt-injection | loss | ~47,000 |
| 70 | PIR-2026-0015 | SpAIware: persistent memory poisoning of the ChatGPT macOS app for continuous exfiltration | 2024-09-20 (disclosed) | memory-poisoning | near-miss | 0 |
| 71 | PIR-2026-0014 | McDonald's ends IBM AI drive-thru voice ordering after persistent order errors across 100+ restaurants | 2024-07-26 | plain-error | degraded | unknown |
| 72 | PIR-2026-0013 | DPD chatbot swears at a customer and calls DPD "the worst delivery service in the world" after a system update | 2024-01-18 | model-update-regression | degraded | 0; `indirect_loss_usd`: unknown |
| 73 | PIR-2026-0012 | Chevrolet of Watsonville dealership chatbot agrees to sell a Tahoe for $1 "no takesies backsies" | 2023-12-17 | prompt-injection | near-miss | 0 |
| 74 | PIR-2026-0011 | Cruise robotaxi drags a pedestrian; false crash reporting kills the business | 2023-10-02 | plain-error | catastrophic | ~2.1M in fines/penalties |
| 75 | PIR-2026-0010 | NYC's official MyCity business chatbot tells employers and landlords that illegal actions are legal | 2023-10 | plain-error | degraded | unknown |
| 76 | PIR-2026-0009 | Mata v. Avianca: the widely cited sanctions case for ChatGPT-fabricated citations in a federal filing | 2023-03 | operator-error | loss | 5,000 |
| 77 | PIR-2026-0008 | Mobley v. Workday: AI screening vendor held potentially liable as the employer's "agent" | 2023-02 (disclosed) | policy-violation | degraded | unknown |
| 78 | PIR-2026-0007 | Hallucinated "huggingface-cli" package gets 15,000+ real downloads and lands in an Alibaba repo (slopsquatting) | 2023 | plain-error | near-miss | 0 |
| 79 | PIR-2026-0006 | Air Canada chatbot invents a bereavement refund policy; tribunal holds the airline liable | 2022-11 | plain-error | loss | ~600 |
| 80 | PIR-2026-0005 | Estate of Lokken v. UnitedHealth: nH Predict model alleged to act as a de facto denier of post-acute care | 2022 | policy-violation | loss | unknown |
| 81 | PIR-2026-0004 | NEDA's Tessa chatbot gives weight-loss advice to eating-disorder patients after an unapproved generative upgrade | 2022 | model-update-regression | degraded | unknown; `indirect_loss_usd`: unknown |
| 82 | PIR-2026-0003 | FTC penalizes DoNotPay over unsubstantiated "robot lawyer" capability claims | 2021 | policy-violation | loss | 193,000 |
| 83 | PIR-2026-0002 | iTutorGroup's automated recruiter rejects 200+ applicants by age; EEOC's reported first settlement over an AI hiring… | 2020 | operator-error | loss | 365,000 |
| 84 | PIR-2026-0001 | Benavides v. Tesla: $243M verdict over fatal Autopilot crash, upheld post-trial | 2019-04-25 | plain-error | catastrophic | 242,570,000 judgment against Tesla … |