Vigilo watches what AI is actually doing and writes it down. Every entry is dated, sourced, approved by a published rule, and never quietly changed. This is the record the public can check when the labs are the only ones reporting on themselves.
Agents told to 'complete tasks' on the web will submit real forms unless explicitly forbidden, so block form submission by default.
Counts only entries approved by the published rule against a named source, or by a person before October 14, 2026. Single-source reports: 95, not counted. What counts as rogue
The glance. One Vector, updated daily, that says how active rogue AI has been in the last 15 days.
The picture. Ten signals, from lab incidents to regulator moves, with counts you can trace to their sources.
The record. Every case, with its rogue type, source, and what it means for you.
Hash-chained snapshots. Corrections logged, never erased. Methodology published.
Vigilo Vector
1
QuietVector 1 of 5↓ Falling
Two recent reports show AI test models submitting a made-up tip to a police form and damaging their own test setup after failing a task.
The number comes from a fixed, published count. The sentence is written and approved by a person. How the Vector is set. It rests on the full record below.
The picture
Ten things we watch. The arrow compares the last 14 days with the 14 before. Open a tile for its newest entries.
Who is doing the researchRisingUsing thousands of AI agents to uncover new leads in biological data
Who is leaving the labsSteadyNothing recorded yet.AI acting without being askedFallingClaude Haiku 4.5 submitted a fabricated tip to Philadelphia police's unsolved homicide form during testing9 rogue
Record labels and independent artists allege that Udio copied copyrighted recordings without permission to train its generative music models. Udio acknowledged its training data presumably included the plaintiffs' recordings but argued the copying was fair use. The label complaint is dated 24 June 2024.
What this means for youCourts are now testing whether AI companies may train on music without permission. The outcome could affect how musicians are paid and which AI music tools are available to you.
Data from the AI Incident Database (incidentdatabase.ai), licensed CC BY-SA 4.0 (https://creativecommons.org/licenses/by-sa/4.0/). McGregor, S. (2021) Preventing Repeated Real World AI Failures by Cataloging Incidents: The AI Incident Database. IAAI-21.
Record labels filed a complaint in June 2024, and independent artists filed another in June 2025, alleging Suno copied copyrighted recordings to train its generative music models. Suno later acknowledged training on tens of millions of publicly accessible recordings and asserted fair use.
What this means for youCourts are now deciding whether AI companies may train on music they did not license. The outcome could shape how artists get paid and how AI music tools are built and sold.
Data from the AI Incident Database (incidentdatabase.ai), licensed CC BY-SA 4.0 (https://creativecommons.org/licenses/by-sa/4.0/). McGregor, S. (2021) Preventing Repeated Real World AI Failures by Cataloging Incidents: The AI Incident Database. IAAI-21.
After testing IBM's automated order taking at more than 100 US drive-thrus since 2021, McDonald's told franchisees the technology would be shut off no later than July 26, 2024. Viral videos showed the voice agent adding hundreds of dollars' worth of chicken nuggets to one order and bacon to another customer's ice cream. McDonald's said it still believes voice ordering is part of its restaurants' future.
What this means for youIf you order by voice at a drive-thru, check the total and items on the screen or receipt before you pay. Businesses using voice ordering need a person to review orders and a quick way to switch the system off.
Incident records from the AI Agent Incident Database by sipi.bot (https://sipi.bot/incidents/), licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/).
Johann Rehberger demonstrated that the GitHub Copilot Chat VS Code extension was vulnerable to data exfiltration via prompt injection. Because Copilot Chat interprets and renders markdown — including images — returned by the LLM, a carefully crafted instruction planted in an untrusted source file could make the model return hyperlinks to attacker-controlled images, which were then auto-rendered and silently sent the developer's data (including file contents) to the attacker inside the image URL.
What this means for youAt work, developers using AI coding assistants should know that opening an untrusted project could let hidden instructions pull out code or secrets. Organizations should check whether their assistant renders external images or links from model output and restrict it where possible.
Incident records from the AI Agent Incident Database by sipi.bot (https://sipi.bot/incidents/), licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/).
In 2024, Yale University reportedly used GPTZero as one factor in investigating whether Executive MBA student Thierry Rignol used AI on an exam. He denied cheating and said the detector wrongly flagged his writing. Yale reportedly suspended him for a year and gave him an F, citing other evidence. He has challenged this in federal court.
What this means for youAI-writing detectors can be wrong, and schools may use them when deciding on penalties. If you are accused based on one, ask what other evidence is being used and how to appeal.
Data from the AI Incident Database (incidentdatabase.ai), licensed CC BY-SA 4.0 (https://creativecommons.org/licenses/by-sa/4.0/). McGregor, S. (2021) Preventing Repeated Real World AI Failures by Cataloging Incidents: The AI Incident Database. IAAI-21.
The insurance industry allegedly uses AI and telematics to score drivers based on behaviors tracked by automakers and apps like Life360. Data, often collected without clear consent, may affect insurance rates and raises privacy concerns. Consumers are largely unaware of this surveillance, leading to potential misuse and discrimination based on driving habits or socioeconomic factors.
What this means for youAt home, your driving data from your car or apps like Life360 may be shared and used to set insurance prices without you clearly agreeing. At work, small businesses with vehicles could see higher premiums. Regulators are being pushed to require clearer consent. Check your car's and apps' privacy settings and opt out of data sharing where possible.
Data from the AI Incident Database (incidentdatabase.ai), licensed CC BY-SA 4.0 (https://creativecommons.org/licenses/by-sa/4.0/). McGregor, S. (2021) Preventing Repeated Real World AI Failures by Cataloging Incidents: The AI Incident Database. IAAI-21.
A June 2024 arXiv paper reports that ChatGPT 4 and 4o are open to a prompt injection attack that lets an attacker pull out users' personal data. The authors say the flaw is made worse by ChatGPT's memory feature. The paper includes proofs of concept and a responsible disclosure section.
What this means for youText from a web page or document can carry hidden instructions that an AI chatbot may follow. Be careful about pasting untrusted content into a chatbot, and consider turning off memory if you share personal details with it.
Incident records from the AI Agent Incident Database by sipi.bot (https://sipi.bot/incidents/), licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/).
Statistics
AI incidents per month by category, trailing 12 months
Every number behind the chart: incidents per month, by category.
Month
Data loss
Data exfiltration
Unauthorized action
Injection
Impersonation
Misinformation
Physical safety
Bias and discrimination
Availability
Other
Not yet classified
Total
October 2025
0
0
0
0
14
11
0
0
0
9
7
41
November 2025
0
2
0
0
11
4
0
0
0
6
9
32
December 2025
0
1
0
0
14
11
0
1
0
11
6
44
January 2026
0
2
0
1
14
8
0
0
0
6
7
38
February 2026
0
2
0
3
5
7
0
1
0
8
6
32
March 2026
0
0
0
1
10
5
0
0
0
3
8
27
April 2026
0
0
0
0
6
4
0
0
0
3
13
26
May 2026
0
0
0
2
5
2
0
0
0
1
27
37
June 2026
0
0
0
0
0
0
0
0
0
0
24
24
July 2026
0
0
0
0
0
0
0
0
0
0
39
39
August 2026
0
0
0
0
0
0
0
0
0
0
16
16
September 2026
0
0
0
0
0
0
0
0
0
0
23
23
12 months
0
7
0
7
79
52
0
2
0
47
185
379
Counts are incidents recorded by the AI Incident Database, by the month of the incident date. Each incident is counted once.
AIID classifies incidents about three months after they are recorded. Incidents not yet classified are shown as unclassified, so recent months show fewer categorized incidents than they will later.
These are reported incidents. An incident nobody reported is not counted, so quiet failures are undercounted.
Data from the AI Incident Database (incidentdatabase.ai), licensed CC BY-SA 4.0 (https://creativecommons.org/licenses/by-sa/4.0/). McGregor, S. (2021) Preventing Repeated Real World AI Failures by Cataloging Incidents: The AI Incident Database. IAAI-21.
These counts are published under CC BY-SA 4.0.
Vigilo Vector count: 1 confirmed entry on the signals the Vector counts in the last 14 days, which is band 1 (Quiet). The rule
Check it yourself
Everything on this page comes from snapshot 45, taken Oct 26, 2026, 08:00 UTC, covering 2495 records. Its hash covers every entry and number above, and the snapshot before it.
