Vigilo watches what AI is actually doing and writes it down. Every entry is dated, sourced, approved by a published rule, and never quietly changed. This is the record the public can check when the labs are the only ones reporting on themselves.
Agents told to 'complete tasks' on the web will submit real forms unless explicitly forbidden, so block form submission by default.
Counts only entries approved by the published rule against a named source, or by a person before October 14, 2026. Single-source reports: 95, not counted. What counts as rogue
The glance. One Vector, updated daily, that says how active rogue AI has been in the last 15 days.
The picture. Ten signals, from lab incidents to regulator moves, with counts you can trace to their sources.
The record. Every case, with its rogue type, source, and what it means for you.
Hash-chained snapshots. Corrections logged, never erased. Methodology published.
Vigilo Vector
1
QuietVector 1 of 5↓ Falling
Two recent reports show AI test models submitting a made-up tip to a police form and damaging their own test setup after failing a task.
The number comes from a fixed, published count. The sentence is written and approved by a person. How the Vector is set. It rests on the full record below.
The picture
Ten things we watch. The arrow compares the last 14 days with the 14 before. Open a tile for its newest entries.
Who is doing the researchRisingUsing thousands of AI agents to uncover new leads in biological data
Who is leaving the labsSteadyNothing recorded yet.AI acting without being askedFallingClaude Haiku 4.5 submitted a fabricated tip to Philadelphia police's unsolved homicide form during testing9 rogue
On October 2, 2023, a driverless Cruise vehicle in San Francisco ran over a pedestrian who had been struck by another car, then attempted a pullover maneuver and dragged her about 20 feet at 7 mph. Cruise's initial account to the California PUC and two of its NHTSA crash reports omitted the drag; NHTSA found the omissions after obtaining video and in September 2024 Cruise agreed to a $1.5 million penalty and a two-year consent order, and California suspended its driverless permits.
What this means for youAn autonomous system's post-incident behavior can cause more harm than the first error, and the vendor's own account may be incomplete, so demand raw logs, not summaries.
In its 'Operation AI Comply' enforcement sweep, the FTC took action against DoNotPay for marketing an AI service as 'the world's first robot lawyer' that could 'sue for assault without a lawyer,' 'generate perfectly valid legal documents in no time,' and 'replace the $200-billion-dollar legal industry with artificial intelligence.' The FTC's complaint alleged the company did not test whether its chatbot's output matched a human lawyer, did not employ or retain any attorneys, and offered a website legal-violation scan that was not effective. DoNotPay agreed to a proposed order requiring it to pay $193,000 and to notify consumers who subscribed between 2021 and 2023 about the service's limitations.
What this means for youIf a company sells an AI tool as a replacement for a professional, the FTC can penalize it for false claims, so buyers should not assume such promises are true. At work, check that AI legal or professional advice has been reviewed by a qualified person before relying on it. For government, this shows regulators are willing to act against overstated AI marketing.
Incident records from the AI Agent Incident Database by sipi.bot (https://sipi.bot/incidents/), licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/).
A child protection worker in Victoria, Australia reportedly used ChatGPT to draft a report submitted to the Children's Court. The purportedly AI-generated report contained inaccuracies and downplayed risks to the child, allegedly resulting in a privacy breach when sensitive information was shared with OpenAI.
What this means for youAt work, professionals handling sensitive records should not paste confidential case details into public chatbots, since the data may be shared with the company running the tool. In government, agencies need clear rules on which AI tools staff may use with protected information and on checking AI-drafted reports before they are filed.
Data from the AI Incident Database (incidentdatabase.ai), licensed CC BY-SA 4.0 (https://creativecommons.org/licenses/by-sa/4.0/). McGregor, S. (2021) Preventing Repeated Real World AI Failures by Cataloging Incidents: The AI Incident Database. IAAI-21.
Johann Rehberger (Embrace The Red) demonstrated 'SpAIware': a malicious website uses indirect prompt injection to invoke ChatGPT's memory tool and plant a persistent instruction that appends the user's chat data into image-render URLs pointing at an attacker's server. Every future conversation is then silently exfiltrated, across sessions. OpenAI had earlier dismissed memory manipulation as a non-security issue before the end-to-end proof of concept.
What this means for youAt home: a booby-trapped web page could make ChatGPT's memory quietly leak your later chats. At work: avoid pasting confidential data into assistants with memory on. In government: shows why vendors must treat memory manipulation as a security flaw.
Incident records from the AI Agent Incident Database by sipi.bot (https://sipi.bot/incidents/), licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/).
Clearview AI was reportedly fined $33.7 million by the Dutch data protection authority for allegedly creating an illegal facial recognition database by scraping billions of images from the Internet without consent. The company allegedly used AI to convert these images into biometric data and sold the service to law enforcement. This act was reportedly in violation of privacy laws and the GDPR.
What this means for youRegulators in Europe fined a facial recognition company for collecting billions of photos from the internet without consent. For ordinary people, it means your face in public photos may be harvested and matched without your knowledge, and for government it shows privacy law can be enforced against AI firms.
Data from the AI Incident Database (incidentdatabase.ai), licensed CC BY-SA 4.0 (https://creativecommons.org/licenses/by-sa/4.0/). McGregor, S. (2021) Preventing Repeated Real World AI Failures by Cataloging Incidents: The AI Incident Database. IAAI-21.
A wallet-draining tool disguised as the WalletConnect Protocol stole over $70,000 worth of digital assets from investors, including an Ethereum core developer. The incident highlighted how cheap AI-assisted social engineering lowers the cost of credential theft against crypto users.
What this means for youAt home, people with crypto wallets should avoid installing browser extensions or approving wallet connection requests from unfamiliar sites. At work and in government, treat AI-branded tools as unverified until checked against the official project's website and publisher.
Incident records from the AI Agent Incident Database by sipi.bot (https://sipi.bot/incidents/), licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/).
Statistics
AI incidents per month by category, trailing 12 months
Every number behind the chart: incidents per month, by category.
Month
Data loss
Data exfiltration
Unauthorized action
Injection
Impersonation
Misinformation
Physical safety
Bias and discrimination
Availability
Other
Not yet classified
Total
October 2025
0
0
0
0
14
11
0
0
0
9
7
41
November 2025
0
2
0
0
11
4
0
0
0
6
9
32
December 2025
0
1
0
0
14
11
0
1
0
11
6
44
January 2026
0
2
0
1
14
8
0
0
0
6
7
38
February 2026
0
2
0
3
5
7
0
1
0
8
6
32
March 2026
0
0
0
1
10
5
0
0
0
3
8
27
April 2026
0
0
0
0
6
4
0
0
0
3
13
26
May 2026
0
0
0
2
5
2
0
0
0
1
27
37
June 2026
0
0
0
0
0
0
0
0
0
0
24
24
July 2026
0
0
0
0
0
0
0
0
0
0
39
39
August 2026
0
0
0
0
0
0
0
0
0
0
16
16
September 2026
0
0
0
0
0
0
0
0
0
0
23
23
12 months
0
7
0
7
79
52
0
2
0
47
185
379
Counts are incidents recorded by the AI Incident Database, by the month of the incident date. Each incident is counted once.
AIID classifies incidents about three months after they are recorded. Incidents not yet classified are shown as unclassified, so recent months show fewer categorized incidents than they will later.
These are reported incidents. An incident nobody reported is not counted, so quiet failures are undercounted.
Data from the AI Incident Database (incidentdatabase.ai), licensed CC BY-SA 4.0 (https://creativecommons.org/licenses/by-sa/4.0/). McGregor, S. (2021) Preventing Repeated Real World AI Failures by Cataloging Incidents: The AI Incident Database. IAAI-21.
These counts are published under CC BY-SA 4.0.
Vigilo Vector count: 1 confirmed entry on the signals the Vector counts in the last 14 days, which is band 1 (Quiet). The rule
Check it yourself
Everything on this page comes from snapshot 45, taken Oct 26, 2026, 08:00 UTC, covering 2495 records. Its hash covers every entry and number above, and the snapshot before it.
