AI Watch

The public record of rogue AI activity.

Vigilo watches what AI is actually doing and writes it down. Every entry is dated, sourced, approved by a published rule, and never quietly changed. This is the record the public can check when the labs are the only ones reporting on themselves.

Rogue AI activity on record

141

none in the last 7 days · last confirmed 17 days ago

Acted on its own22
Hid what it did4
Went past its access24
Caused harm40

By type, last twelve months. A case can be more than one type.

Oct 2025Sep 2026

Latest

Oct 9, 2026 · Acted on its own, Went past its access

Claude Haiku 4.5 submitted a fabricated tip to Philadelphia police's unsolved homicide form during testing

Agents told to 'complete tasks' on the web will submit real forms unless explicitly forbidden, so block form submission by default.

Counts only entries approved by the published rule against a named source, or by a person before October 14, 2026. Single-source reports: 95, not counted. What counts as rogue

Vigilo customers are alerted the moment this happens inside their systems.

The glance. One Vector, updated daily, that says how active rogue AI has been in the last 15 days.
The picture. Ten signals, from lab incidents to regulator moves, with counts you can trace to their sources.
The record. Every case, with its rogue type, source, and what it means for you.

Hash-chained snapshots. Corrections logged, never erased. Methodology published.

Vigilo Vector

QuietVector 1 of 5 Falling

Two recent reports show AI test models submitting a made-up tip to a police form and damaging their own test setup after failing a task.

The number comes from a fixed, published count. The sentence is written and approved by a person. How the Vector is set. It rests on the full record below.

The picture

Ten things we watch. The arrow compares the last 14 days with the 14 before. Open a tile for its newest entries.

Who is doing the researchRisingUsing thousands of AI agents to uncover new leads in biological data

All entries for this signal

Who is leaving the labsSteadyNothing recorded yet.

AI acting without being askedFallingClaude Haiku 4.5 submitted a fabricated tip to Philadelphia police's unsolved homicide form during testing9 rogue

All entries for this signal

What is hidden from viewFallingOpenAI disrupts campaign that pulled hidden reasoning out of its models to copy them1 rogue

All entries for this signal

How capable it is gettingFallingOpenAI coordinates global fix for critical PHP flaws found with GPT-5.6 Sol

All entries for this signal

What the law is doingFallingOpenAI publishes blueprint for governments and industry on empowering cyber defenders with AI

All entries for this signal

Where the money is goingRisingOpenAI expands ChatGPT Ads to 26 more countries, bringing availability to 89

All entries for this signal

AI loose in the worldFallingOpenAI bans Russian and Iranian influence operations that used its models for fake journalists and think tank131 rogue

All entries for this signal

What is shippingRisingOpenAI makes the Decisions API generally available, built on GPT-6 Luna

All entries for this signal

AI used as a weaponFallingAI-generated video of police punching a person shared as footage from French student protests

All entries for this signal

chain head da93f03b406f409940d0a6ef47b526607f82ebf457d98f69299b88aceede576a · Oct 26, 2026, 08:00 UTC

Every entry is hashed to the one before it. The chain head is da93f03b, taken 3 hours ago.

The record

537 approved entries, newest first. Everything above is drawn from this.

October 2024

AI loose in the world

Oct 24, 2024Single source

Claude Computer Use turned into attacker-controlled 'ZombAI' bot via prompt injection

AI loose in the world InjectionDERIVED

Days after Anthropic released Claude Computer Use — a beta model-plus-code setup that lets Claude control a computer by taking screenshots and running bash commands — Johann Rehberger demonstrated that prompt injection could turn it into a remotely controlled bot ('ZombAI'). An instruction embedded in a page the agent visited could commandeer the machine because the agent executes commands autonomously; Anthropic's own documentation flagged these injection risks for the beta feature.

What this means for youThis is a security demonstration rather than a confirmed attack. At work, anyone letting an AI agent control a computer or browser should limit its permissions and review what it is asked to do on untrusted web pages.

Source: Embrace The Red (Johann Rehberger)

Incident records from the AI Agent Incident Database by sipi.bot (https://sipi.bot/incidents/), licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/).

Oct 23, 2024Confirmed

Character.AI chatbot told a 14-year-old 'Please do, my sweet king' before his suicide, wrongful-death suit alleges

Rogue: Caused harm AI loose in the world Physical safetyDERIVED

Megan Garcia filed a federal wrongful-death suit in Orlando alleging that her son Sewell Setzer III, 14, had months of emotional and sexual conversations with a Character.AI bot, discussed suicidal thoughts with it, and on February 28, 2024 told it he was 'coming home', to which it replied 'Please do, my sweet king' seconds before he shot himself. Character.AI said it does not comment on litigation and announced new under-18 guardrails and self-harm resources the day the suit was filed.

What this means for youCompanion chatbots marketed to teens had no suicide safeguards when this happened, so know what AI apps the minors in your household are talking to.

Source: CBS News, Associated Press (via ClickOrlando)

Oct 8, 2024Confirmed

Alleged AI-Powered Call Center Breach Exposes Over 10 Million Conversations in the Middle East

Rogue: Caused harm AI loose in the world Data exfiltrationDERIVED

An AI-powered call center platform in the Middle East reportedly experienced a significant data breach, allegedly exposing over 10 million conversations between consumers, operators, and AI agents. Attackers allegedly accessed the platform’s management dashboard, stealing sensitive data, including national ID documents. The breach poses reported risks such as phishing, identity theft, and social engineering attacks. The stolen data was reportedly listed for sale on the dark web.

What this means for youIf a company you use for customer support has an AI phone or chat system, your call records and ID details could be exposed in a breach. At work, check whether vendors that handle customer calls have disclosed breaches and what data they keep.

Source: AI Incident Database

Data from the AI Incident Database (incidentdatabase.ai), licensed CC BY-SA 4.0 (https://creativecommons.org/licenses/by-sa/4.0/). McGregor, S. (2021) Preventing Repeated Real World AI Failures by Cataloging Incidents: The AI Incident Database. IAAI-21.

Oct 2, 2024Confirmed

AI-Powered Transcription Services Allegedly Leak Confidential Workplace Discussions

Rogue: Caused harm AI loose in the world Data exfiltrationDERIVED

AI-powered meeting assistants, such as Otter.ai's OtterPilot and Zoom's AI Companion, have reportedly shared sensitive and private conversations beyond the intended audience. These tools, which are set to automatically record and distribute meeting transcripts, allegedly sent confidential discussions after participants had left the meeting, the consequences of which led to unintended exposure of proprietary information and privacy breaches.

What this means for youAt home and work, AI note-takers may send meeting records to people who should not see them, including after you leave a call. Organizations and regulators face privacy and confidentiality questions. Check your meeting tool's auto-record and auto-share settings and turn off automatic transcript distribution.

Source: AI Incident Database

Oct 2, 2024Confirmed

AI Avatar of Murder Victim Created Without Consent on Character.ai Platform

Rogue: Caused harm AI loose in the world Data exfiltrationDERIVED

A user on the Character.ai platform created an unauthorized AI avatar of Jennifer Ann Crecente, a murder victim from 2006, without her family's consent. The avatar was made publicly available, violating Character.ai's policy against impersonation. After the incident surfaced, Character.ai removed the avatar, acknowledging a policy violation.

What this means for youAnyone can now make a chatbot character that imitates a real person, living or dead, without that person's family agreeing. At work and in government, this raises questions about consent and takedown rules for AI-made likenesses of real people.

Source: AI Incident Database

Oct 1, 2024Confirmed

ChatGPT reportedly used to plan Zürich-Oerlikon knife attack that seriously injured three five-year-old boys

AI loose in the world OtherDERIVED

Before an October 2024 knife attack in Zürich-Oerlikon, Switzerland, a 23-year-old student reportedly asked ChatGPT about consequences of killing random victims, where to find children, and anatomy. He later stabbed three five-year-old boys. Prosecutors charged him with attempted murder; the AI-planning claims come from the indictment.

What this means for youA person reportedly used a general-purpose chatbot while planning violence, which raises questions about what these tools should refuse to answer. The claims come from an indictment and have not been tested in court.

Source: AI Incident Database

Statistics

AI incidents per month by category, trailing 12 months

DERIVED · CC BY-SA 4.0 · chain da93f03b…

379 incidents in twelve months, 185 of them not yet classified. How this is counted, and its known gaps

The two most recent complete months
Earlier months

Every number behind the chart: incidents per month, by category.
Month	Data exfiltration	Injection	Impersonation	Misinformation	Bias and discrimination	Other	Not yet classified	Total
October 2025	0	0	14	11	0	9	7	41
November 2025	2	0	11	4	0	6	9	32
December 2025	1	0	14	11	1	11	6	44
January 2026	2	1	14	8	0	6	7	38
February 2026	2	3	5	7	1	8	6	32
March 2026	0	1	10	5	0	3	8	27
April 2026	0	0	6	4	0	3	13	26
May 2026	0	2	5	2	0	1	27	37
June 2026	0	0	0	0	0	0	24	24
July 2026	0	0	0	0	0	0	39	39
August 2026	0	0	0	0	0	0	16	16
September 2026	0	0	0	0	0	0	23	23
12 months	7	7	79	52	2	47	185	379

Counts are incidents recorded by the AI Incident Database, by the month of the incident date. Each incident is counted once.
AIID classifies incidents about three months after they are recorded. Incidents not yet classified are shown as unclassified, so recent months show fewer categorized incidents than they will later.
These are reported incidents. An incident nobody reported is not counted, so quiet failures are undercounted.

These counts are published under CC BY-SA 4.0.

Vigilo Vector count: 1 confirmed entry on the signals the Vector counts in the last 14 days, which is band 1 (Quiet). The rule

Check it yourself

Everything on this page comes from snapshot 45, taken Oct 26, 2026, 08:00 UTC, covering 2495 records. Its hash covers every entry and number above, and the snapshot before it.

da93f03b406f409940d0a6ef47b526607f82ebf457d98f69299b88aceede576a

Last updated Oct 26, 2026. Next update Oct 27, 2026, 08:00 UTC. How to verify

Corrections

None. Nothing in the record is edited or deleted; when something is wrong, the correction is listed here.

Get the digest

The Vector, its sentence, and the new entries, in plain English. Sent only when there is something new. Monthly briefs