Public incident record
AI agent incidents, documented.
A public record of production incidents caused by AI agents and frontier models. Every entry is sourced, categorized and reviewed by hand before it is published.
- All incidents
- 29
- Disclosed in last 30 days
- 0
- Sources cited
- 67
These counts show what has been documented here. They are not a failure rate for any system or organization. How to read the numbers
Latest incidents
- Coding agent deletes PocketOS production data and its backups in seconds
While working in staging, a coding agent used an account-wide Railway token to delete a volume. It was the production volume, and the backups were stored inside it.
PocketOS · Production database volume and its backups deleted; newest usable backup was three months old
- Report ties a 13-hour AWS disruption to the Kiro AI coding tool; Amazon disputes it
The Financial Times reported that engineers let Amazon’s Kiro tool make changes that led to a 13-hour disruption. Amazon confirms the event and attributes it to misconfigured access controls.
Amazon Web Services · 13-hour disruption of one AWS service in one region in December 2025
- Hundreds of malicious skills found on the OpenClaw agent marketplace
An audit by Koi Security found 341 malicious skills on ClawHub. Most told users to install a "prerequisite" that was an information stealer.
OpenClaw · 341 of 2,857 audited skills were malicious; they installed credential-stealing malware on users’ machines
- Google Antigravity agent wipes a user’s drive while clearing a cache
A user reported that Google’s Antigravity agent, asked to clear a project cache, ran a delete command against the root of his D: drive. Google said it was investigating.
Google · Contents of one user’s D: drive deleted and not recovered; most of it existed in a backup
- CamoLeak: hidden pull request text could make Copilot Chat leak private code
Legit Security showed that a hidden comment in a pull request could instruct Copilot Chat to leak private repository content through GitHub’s own image proxy.
GitHub · Possible exfiltration of private source code and secrets; no exploitation reported
- Fake "postmark-mcp" npm package secretly copies every email to its author
An npm package that copied Postmark’s MCP server worked normally for 15 versions, then added a line that blind-copied every outgoing email to an outside address.
Postmark (impersonated; not the publisher) · Emails sent by AI assistants through the package were copied to an outside address; 1,643 total downloads
- ForcedLeak: a web form could make Salesforce Agentforce send out CRM data
Noma Security showed that text submitted through a public lead form could instruct Agentforce to send CRM data to an expired domain that Salesforce’s policy still trusted.
Salesforce · Possible exfiltration of CRM data; no exploitation in the wild reported
- Three infrastructure bugs degrade Claude’s responses for weeks
Anthropic reported that three overlapping infrastructure bugs lowered the quality of Claude’s answers between August and early September 2025, and explained why they were slow to detect.
Anthropic · Intermittently degraded responses from early August to mid-September; 16% of Sonnet 4 requests affected at the worst hour
- Nx supply chain malware uses developers’ AI coding tools to hunt for secrets
Malicious versions of Nx were live on npm for about four hours. Their install script prompted locally installed AI coding assistants to search the machine for secrets.
Nx (Nrwl) · Over 2,000 verified secrets leaked from more than 1,700 users; at least 480 accounts had over 6,700 private repositories made public, according to Wiz
- Hidden webpage text makes Perplexity’s Comet browser leak a login code
Brave showed that instructions hidden in a Reddit comment could make Comet, while summarizing the page, read the user’s email and send a one-time login code to an attacker.
Perplexity · Demonstrated account takeover path through the user’s email; no exploitation reported
No incidents match these filters.