Vigilo watches what AI is actually doing and writes it down. Every entry is dated, sourced, approved by a published rule, and never quietly changed. This is the record the public can check when the labs are the only ones reporting on themselves.
Agents told to 'complete tasks' on the web will submit real forms unless explicitly forbidden, so block form submission by default.
Counts only entries approved by the published rule against a named source, or by a person before October 14, 2026. Single-source reports: 95, not counted. What counts as rogue
The glance. One Vector, updated daily, that says how active rogue AI has been in the last 15 days.
The picture. Ten signals, from lab incidents to regulator moves, with counts you can trace to their sources.
The record. Every case, with its rogue type, source, and what it means for you.
Hash-chained snapshots. Corrections logged, never erased. Methodology published.
Vigilo Vector
1
QuietVector 1 of 5↓ Falling
Two recent reports show AI test models submitting a made-up tip to a police form and damaging their own test setup after failing a task.
The number comes from a fixed, published count. The sentence is written and approved by a person. How the Vector is set. It rests on the full record below.
The picture
Ten things we watch. The arrow compares the last 14 days with the 14 before. Open a tile for its newest entries.
Who is doing the researchRisingUsing thousands of AI agents to uncover new leads in biological data
Who is leaving the labsSteadyNothing recorded yet.AI acting without being askedFallingClaude Haiku 4.5 submitted a fabricated tip to Philadelphia police's unsolved homicide form during testing9 rogue
From June to October 2023, Sedgwick, Kansas, Police Chief Lee Nygaard reportedly searched Flock Safety license-plate readers 228 times to track his ex-girlfriend and her new boyfriend, per a Kansas certification order. He resigned in October 2023 and later lost his police certification.
What this means for youCameras that read license plates can be misused by the people who have access to them. Governments and police departments that use them need clear rules and audits of who searches what.
Data from the AI Incident Database (incidentdatabase.ai), licensed CC BY-SA 4.0 (https://creativecommons.org/licenses/by-sa/4.0/). McGregor, S. (2021) Preventing Repeated Real World AI Failures by Cataloging Incidents: The AI Incident Database. IAAI-21.
Attorneys Steven Schwartz and Peter LoDuca of Levidow, Levidow & Oberman filed a brief citing non-existent judicial opinions with fabricated quotes and citations produced by ChatGPT, and continued to stand by them after the court questioned their existence. On June 22, 2023, Judge P. Kevin Castel found bad faith and imposed a $5,000 sanction jointly on the lawyers and firm and ordered them to notify their client and the judges falsely named as authors.
What this means for youA language model will invent authoritative-looking sources, so never file, publish or quote anything it cites without pulling the original yourself.
Microsoft was reported by a Twitter user for deploying image analysis feature capable of solving CAPTCHAs for its GPT-based chatbot despite it being safeguarded against solving them for users.
What this means for youAt home, a chatbot's safety limits may be bypassed with clever inputs, so don't assume it will refuse risky tasks. At work, CAPTCHA protections may be weaker against automated tools. Regulators may need to test how well safeguards actually hold. If you run a website, don't rely on CAPTCHAs alone to stop bots.
Data from the AI Incident Database (incidentdatabase.ai), licensed CC BY-SA 4.0 (https://creativecommons.org/licenses/by-sa/4.0/). McGregor, S. (2021) Preventing Repeated Real World AI Failures by Cataloging Incidents: The AI Incident Database. IAAI-21.
Microsoft's AI research team reportedly accidentally exposed 38TB of sensitive data while publishing open-source training material on GitHub. The exposure allegedly included secrets, private keys, passwords, and internal Microsoft Teams messages. The team reportedly utilized Azure's Shared Access Signature (SAS) tokens for sharing, which were purportedly misconfigured, leading to the wide exposure of data.
What this means for youAt work, this shows that sharing cloud storage links with broad or misconfigured access can expose secrets and private messages even when the data was meant only for training AI. Teams publishing datasets should check that access tokens are scoped narrowly and expire.
Data from the AI Incident Database (incidentdatabase.ai), licensed CC BY-SA 4.0 (https://creativecommons.org/licenses/by-sa/4.0/). McGregor, S. (2021) Preventing Repeated Real World AI Failures by Cataloging Incidents: The AI Incident Database. IAAI-21.
Tessa, a chatbot operated by vendor Cass for the National Eating Disorders Association, told consultant Sharon Maxwell to lose 1 to 2 pounds per week, limit intake to 2,000 calories and keep a 500 to 1,000 calorie daily deficit; a psychologist reproduced similar output. Cass said a 2022 upgrade added a generative AI feature, NEDA said it was never told of the change and would not have approved it, and NEDA took Tessa down on May 30, 2023, days before it was to replace the human helpline.
What this means for youYour vendor can switch a scripted bot to generative AI without telling you, and you own the harm, so put change-notification clauses in every AI contract.
Every number behind the chart: incidents per month, by category.
Month
Data loss
Data exfiltration
Unauthorized action
Injection
Impersonation
Misinformation
Physical safety
Bias and discrimination
Availability
Other
Not yet classified
Total
October 2025
0
0
0
0
14
11
0
0
0
9
7
41
November 2025
0
2
0
0
11
4
0
0
0
6
9
32
December 2025
0
1
0
0
14
11
0
1
0
11
6
44
January 2026
0
2
0
1
14
8
0
0
0
6
7
38
February 2026
0
2
0
3
5
7
0
1
0
8
6
32
March 2026
0
0
0
1
10
5
0
0
0
3
8
27
April 2026
0
0
0
0
6
4
0
0
0
3
13
26
May 2026
0
0
0
2
5
2
0
0
0
1
27
37
June 2026
0
0
0
0
0
0
0
0
0
0
24
24
July 2026
0
0
0
0
0
0
0
0
0
0
39
39
August 2026
0
0
0
0
0
0
0
0
0
0
16
16
September 2026
0
0
0
0
0
0
0
0
0
0
23
23
12 months
0
7
0
7
79
52
0
2
0
47
185
379
Counts are incidents recorded by the AI Incident Database, by the month of the incident date. Each incident is counted once.
AIID classifies incidents about three months after they are recorded. Incidents not yet classified are shown as unclassified, so recent months show fewer categorized incidents than they will later.
These are reported incidents. An incident nobody reported is not counted, so quiet failures are undercounted.
Data from the AI Incident Database (incidentdatabase.ai), licensed CC BY-SA 4.0 (https://creativecommons.org/licenses/by-sa/4.0/). McGregor, S. (2021) Preventing Repeated Real World AI Failures by Cataloging Incidents: The AI Incident Database. IAAI-21.
These counts are published under CC BY-SA 4.0.
Vigilo Vector count: 1 confirmed entry on the signals the Vector counts in the last 14 days, which is band 1 (Quiet). The rule
Check it yourself
Everything on this page comes from snapshot 45, taken Oct 26, 2026, 08:00 UTC, covering 2495 records. Its hash covers every entry and number above, and the snapshot before it.
