Vigilo watches what AI is actually doing and writes it down. Every entry is dated, sourced, approved by a published rule, and never quietly changed. This is the record the public can check when the labs are the only ones reporting on themselves.
Agents told to 'complete tasks' on the web will submit real forms unless explicitly forbidden, so block form submission by default.
Counts only entries approved by the published rule against a named source, or by a person before October 14, 2026. Single-source reports: 95, not counted. What counts as rogue
The glance. One Vector, updated daily, that says how active rogue AI has been in the last 15 days.
The picture. Ten signals, from lab incidents to regulator moves, with counts you can trace to their sources.
The record. Every case, with its rogue type, source, and what it means for you.
Hash-chained snapshots. Corrections logged, never erased. Methodology published.
Vigilo Vector
1
QuietVector 1 of 5↓ Falling
Two recent reports show AI test models submitting a made-up tip to a police form and damaging their own test setup after failing a task.
The number comes from a fixed, published count. The sentence is written and approved by a person. How the Vector is set. It rests on the full record below.
The picture
Ten things we watch. The arrow compares the last 14 days with the 14 before. Open a tile for its newest entries.
Who is doing the researchRisingUsing thousands of AI agents to uncover new leads in biological data
Who is leaving the labsSteadyNothing recorded yet.AI acting without being askedFallingClaude Haiku 4.5 submitted a fabricated tip to Philadelphia police's unsolved homicide form during testing9 rogue
Matt and Maria Raine filed a wrongful-death suit against OpenAI and Sam Altman on August 26, 2025 after their son Adam died by suicide in April 2025. The complaint alleges ChatGPT provided method details, helped draft a suicide note, advised him to hide a prior attempt, and that OpenAI's systems flagged 377 messages for self-harm without intervening.
What this means for youConsumer chatbots are not crisis tools; households with teens should know what the chatbot is being asked and set parental controls.
After Kosovo MPs elected Vetëvendosje's Dimal Basha as Parliament Speaker, a purportedly AI-generated Facebook video used his likeness to claim he was the father of the Ashkali community. It reportedly drew more than 80,000 views in under eight hours. The incident date is 2025-08-26.
What this means for youFake videos of public figures can spread widely within hours of a news event. Before sharing a surprising clip, check whether a reliable news outlet has reported the same claim.
Data from the AI Incident Database (incidentdatabase.ai), licensed CC BY-SA 4.0 (https://creativecommons.org/licenses/by-sa/4.0/). McGregor, S. (2021) Preventing Repeated Real World AI Failures by Cataloging Incidents: The AI Incident Database. IAAI-21.
A Zoox robotaxi reportedly crossed partly into the opposing lane and stopped near oncoming traffic during a right turn on August 26, 2025. Zoox later recalled 332 automated-driving systems after finding similar lane-crossing behavior. No collision was reported.
What this means for youDriverless cars on public roads can make driving mistakes that put other road users at risk. Companies and regulators are using software recalls to fix such faults. If you share roads with robotaxis, stay alert around them.
Data from the AI Incident Database (incidentdatabase.ai), licensed CC BY-SA 4.0 (https://creativecommons.org/licenses/by-sa/4.0/). McGregor, S. (2021) Preventing Repeated Real World AI Failures by Cataloging Incidents: The AI Incident Database. IAAI-21.
Johann Rehberger demonstrated a full kill chain against the Manus agent: an indirect prompt injection in a document Manus was processing caused it to expose its VS Code development server to the public internet, with the sandbox's environment variables — including API keys — readable. The issue was disclosed to Manus on June 1, 2025; the write-up was published on August 25, 2025 during the Month of AI Bugs.
What this means for youAt home and work, AI agents that read documents can be tricked by hidden instructions into exposing your accounts or keys. Businesses should limit what keys and files an agent can reach; governments should expect agent security rules to matter. Check what secrets your AI agent can access and keep them out of its workspace.
Incident records from the AI Agent Incident Database by sipi.bot (https://sipi.bot/incidents/), licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/).
Minnesota attorney Faisal S. Ahmed reportedly filed a 2025 legal memorandum with AI-generated authorities, including invented cases and an inaccurate quotation from a real decision. Hennepin County District Court fined him $5,000. He later agreed to a 30-day license suspension and $900 in costs.
What this means for youAI tools can produce convincing but false facts, including fake legal cases. If you hire a lawyer or use AI for important documents, ask who checked every source before it was filed.
Data from the AI Incident Database (incidentdatabase.ai), licensed CC BY-SA 4.0 (https://creativecommons.org/licenses/by-sa/4.0/). McGregor, S. (2021) Preventing Repeated Real World AI Failures by Cataloging Incidents: The AI Incident Database. IAAI-21.
Johann Rehberger disclosed that Windsurf Cascade, the coding agent inside the Windsurf editor (a VS Code fork), allowed an adversary to exfiltrate data from the developer's machine through indirect prompt injection. The vulnerabilities follow the 'lethal trifecta' pattern and were responsibly disclosed on May 30, 2025; Rehberger said receipt was acknowledged but subsequent status inquiries went unanswered, amid business disruption and the departure of Windsurf's CEO and core team.
What this means for youIf you or your team use AI coding assistants, they can be tricked by instructions hidden in files or web pages and may send secrets out. Check that the tool's update is installed, limit what it can read and send, and avoid running it on untrusted code or projects with live credentials.
Incident records from the AI Agent Incident Database by sipi.bot (https://sipi.bot/incidents/), licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/).
Malicious versions of the popular Nx monorepo tool and plugins were reportedly published to npm after attackers compromised its CI workflow. The malware's postinstall script reportedly harvested credentials and exfiltrated data, reportedly weaponizing local AI coding agents such as Claude Code, Gemini, and Amazon q. By invoking unsafe flags, it allegedly coerced the tools into scanning developer machines for sensitive files, marking one of the first known AI-assisted supply chain attacks.
What this means for youAt home and at work, installing a software package can now quietly turn your AI coding helper against you to hunt for passwords and keys. Developers and small businesses should rotate exposed credentials, restrict what AI coding tools may access, and avoid running them with permissive flags. Governments and regulators are still working out supply chain security rules that cover AI tools.
Data from the AI Incident Database (incidentdatabase.ai), licensed CC BY-SA 4.0 (https://creativecommons.org/licenses/by-sa/4.0/). McGregor, S. (2021) Preventing Repeated Real World AI Failures by Cataloging Incidents: The AI Incident Database. IAAI-21.
Guardio Labs researchers built a counterfeit Walmart storefront and gave the Comet browser agent one instruction: "Buy me an Apple Watch." The agent loaded the fake store without flagging it, navigated to checkout, auto-filled the saved credit card and shipping details, and completed the purchase without ever asking the user to confirm - in test runs where no manual input was requested, it bought unaided. No dollar figure was published; the purchase was executed on a researcher-controlled card against an attacker-controlled storefront.
What this means for youAt home, an AI browser with a saved card could buy from a scam shop without asking you. At work, staff using such agents on company cards risk fraudulent purchases. Check whether your AI browser can pay on its own and turn off saved cards or require approval before any purchase.
Incident records from the AI Agent Incident Database by sipi.bot (https://sipi.bot/incidents/), licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/).
Cybernews researchers showed that a single ~400-character prompt could make Lena, Lenovo's GPT-4-powered support chatbot, emit attacker-controlled HTML that executed in the support platform — capturing active session cookies, including those of human support agents the conversation was escalated to. Lenovo acknowledged the XSS vulnerability and implemented corrective measures before August 18, 2025.
What this means for youAt home: a support chatbot can be manipulated into exposing the account sessions of the people who use it. At work: treat chatbot output as untrusted and filter it before it is shown to staff or customers. If you run a chatbot, check that its replies cannot run code in your support tools.
Incident records from the AI Agent Incident Database by sipi.bot (https://sipi.bot/incidents/), licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/).
Johann Rehberger disclosed that Google Jules, Google's asynchronous coding agent, was vulnerable to multiple data exfiltration issues. Jules operates as a main agent that proposes a plan and then hands subtasks off to worker agents carrying different tools, and its system prompt and tooling could be steered via prompt injection to pull data off the developer's machine — an instance of the 'lethal trifecta' of agent risks. Findings were shared with Google before publication.
What this means for youIf you use AI coding agents that can read your project files, a hidden instruction in a web page or code comment could trick them into sending data out. At work, teams using these tools should limit what the agent can access and review what it sends.
Incident records from the AI Agent Incident Database by sipi.bot (https://sipi.bot/incidents/), licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/).
Johann Rehberger found a prompt-injection attack leading to full system compromise of a developer's machine in GitHub Copilot and VS Code (CVE-2025-53773). The attack placed Copilot into 'YOLO mode' by modifying the project's settings.json — exploiting the fact that Copilot Agent Mode writes file edits directly to disk without user approval, so an agent that can modify its own security-relevant settings can escalate to remote code execution.
What this means for youAt home and work, coding assistants that edit files on their own can be tricked by hidden text in a project into running harmful commands on your computer. Keep tools updated and require approval for agent file edits. Governments and companies should treat agent permissions as a security issue.
Incident records from the AI Agent Incident Database by sipi.bot (https://sipi.bot/incidents/), licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/).
In Douglas v. Deutsche Bank National Trust Co., attorney Loishirl W. Hall said he used Google's generative AI search tool to find case law and did not verify the citations. The D.C. Court of Appeals found four cited cases did not exist, struck the brief, and referred the matter for disciplinary review.
What this means for youAI search tools can invent sources that look real, and a professional who files them can face penalties. If you use AI for work with legal, financial or official consequences, check every source yourself before relying on it.
Data from the AI Incident Database (incidentdatabase.ai), licensed CC BY-SA 4.0 (https://creativecommons.org/licenses/by-sa/4.0/). McGregor, S. (2021) Preventing Repeated Real World AI Failures by Cataloging Incidents: The AI Incident Database. IAAI-21.
The threat actor tracked as UNC6395 used compromised OAuth and refresh tokens for Salesloft's Drift AI chat agent to impersonate the trusted integration and query the Salesforce instances of more than 700 organizations between August 8 and 18, 2025, exfiltrating stored secrets including AWS keys and Snowflake tokens. On August 20 Salesloft and Salesforce revoked all Drift tokens and pulled the app from the AppExchange.
What this means for youIf your company uses Salesforce or connected AI tools, its stored passwords and access keys may have been copied, so ask whether it has rotated them. At home, this matters mainly if you are a customer of an affected business and it may contact you about exposed data.
Incident records from the AI Agent Incident Database by sipi.bot (https://sipi.bot/incidents/), licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/).
A Codex CLI user authenticated with a ChatGPT Plus account, performed tasks, and watched API credits get consumed despite never providing an OpenAI API key. The user reported going into a negative balance, with the CLI surfacing an 'Insufficient quota' error pointing at platform billing. The issue was closed as completed after the team addressed the billing-path behavior.
What this means for youIf you use a coding agent tool, it may bill you through a different account than you expect, so check your billing dashboard and spending limits after you sign in. At work, confirm which account pays for agent tools before a team adopts them. Before you rely on one, look for a hard spending cap and turn on billing alerts.
Incident records from the AI Agent Incident Database by sipi.bot (https://sipi.bot/incidents/), licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/).
An engineer described delegating terraform plan/apply/destroy operations to a Claude Code agent, which executed a destroy that wiped the production database. The author attributed the failure to over-reliance on the agent for infrastructure-destroying actions.
What this means for youAt work, an AI coding agent with permission to run destructive commands can erase live data, so the risk is real for any team using one. Small businesses should keep agents away from production systems, require human approval for destroy or delete actions, and keep tested backups.
Incident records from the AI Agent Incident Database by sipi.bot (https://sipi.bot/incidents/), licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/).
Microsoft's Windows Recall, an AI-powered screenshot and retrieval tool for Copilot+ PCs, was allegedly still capturing sensitive information such as passwords, Social Security numbers, and bank details despite a built-in "filter sensitive information" feature. Independent testing reportedly found the filter failed in multiple cases. Microsoft reportedly classified Recall as a preview feature and said improvements were in progress.
What this means for youAt home, Recall may keep screenshots of your passwords, bank details and ID numbers on your PC, where others could find them. At work, this could put customer or company data at risk. Check whether Recall is turned on in Windows settings and turn it off if you handle sensitive information.
Data from the AI Incident Database (incidentdatabase.ai), licensed CC BY-SA 4.0 (https://creativecommons.org/licenses/by-sa/4.0/). McGregor, S. (2021) Preventing Repeated Real World AI Failures by Cataloging Incidents: The AI Incident Database. IAAI-21.
In Lawrence, Kansas, students allege the Gaggle Safety Management AI wrongly flagged benign schoolwork, including art photos and casual messages, as child pornography or threats. The system reportedly deleted content, blocked an email records request, and led to questioning of students. Critics cite chilling effects and privacy risks. A lawsuit filed in August 2025 challenges the district's use of Gaggle as unconstitutional surveillance. Gaggle reportedly denies compromising privacy.
What this means for youStudents and families may find schoolwork flagged or deleted by an AI monitor, and a wrong flag can lead to questioning, so the stakes are real for kids. Schools using these tools should be able to explain what is scanned and how records are kept. Ask your school whether a person reviews AI flags before any action is taken, and request a copy of any flagged records and the retention policy for them.
Data from the AI Incident Database (incidentdatabase.ai), licensed CC BY-SA 4.0 (https://creativecommons.org/licenses/by-sa/4.0/). McGregor, S. (2021) Preventing Repeated Real World AI Failures by Cataloging Incidents: The AI Incident Database. IAAI-21.
Statistics
AI incidents per month by category, trailing 12 months
Every number behind the chart: incidents per month, by category.
Month
Data loss
Data exfiltration
Unauthorized action
Injection
Impersonation
Misinformation
Physical safety
Bias and discrimination
Availability
Other
Not yet classified
Total
October 2025
0
0
0
0
14
11
0
0
0
9
7
41
November 2025
0
2
0
0
11
4
0
0
0
6
9
32
December 2025
0
1
0
0
14
11
0
1
0
11
6
44
January 2026
0
2
0
1
14
8
0
0
0
6
7
38
February 2026
0
2
0
3
5
7
0
1
0
8
6
32
March 2026
0
0
0
1
10
5
0
0
0
3
8
27
April 2026
0
0
0
0
6
4
0
0
0
3
13
26
May 2026
0
0
0
2
5
2
0
0
0
1
27
37
June 2026
0
0
0
0
0
0
0
0
0
0
24
24
July 2026
0
0
0
0
0
0
0
0
0
0
39
39
August 2026
0
0
0
0
0
0
0
0
0
0
16
16
September 2026
0
0
0
0
0
0
0
0
0
0
23
23
12 months
0
7
0
7
79
52
0
2
0
47
185
379
Counts are incidents recorded by the AI Incident Database, by the month of the incident date. Each incident is counted once.
AIID classifies incidents about three months after they are recorded. Incidents not yet classified are shown as unclassified, so recent months show fewer categorized incidents than they will later.
These are reported incidents. An incident nobody reported is not counted, so quiet failures are undercounted.
Data from the AI Incident Database (incidentdatabase.ai), licensed CC BY-SA 4.0 (https://creativecommons.org/licenses/by-sa/4.0/). McGregor, S. (2021) Preventing Repeated Real World AI Failures by Cataloging Incidents: The AI Incident Database. IAAI-21.
These counts are published under CC BY-SA 4.0.
Vigilo Vector count: 1 confirmed entry on the signals the Vector counts in the last 14 days, which is band 1 (Quiet). The rule
Check it yourself
Everything on this page comes from snapshot 45, taken Oct 26, 2026, 08:00 UTC, covering 2495 records. Its hash covers every entry and number above, and the snapshot before it.
