A public record of production incidents caused by AI agents and frontier models. Every entry is sourced, categorized and reviewed by hand before it is published.https://incidents.si/https://incidents.si/incidents/pocketos-coding-agent-deletes-production-volume-and-backups/https://incidents.si/incidents/pocketos-coding-agent-deletes-production-volume-and-backups/While working in staging, a coding agent used an account-wide Railway token to delete a volume. It was the production volume, and the backups were stored inside it.Fri, 13 Nov 2026 00:00:00 GMTagent-actionSEV2confirmedhttps://incidents.si/incidents/aws-outage-attributed-to-kiro-ai-coding-tool/https://incidents.si/incidents/aws-outage-attributed-to-kiro-ai-coding-tool/The Financial Times reported that engineers let Amazon’s Kiro tool make changes that led to a 13-hour disruption. Amazon confirms the event and attributes it to misconfigured access controls.Fri, 13 Nov 2026 00:00:00 GMTagent-actionSEV3confirmedhttps://incidents.si/incidents/clawhavoc-malicious-skills-on-openclaw-clawhub/https://incidents.si/incidents/clawhavoc-malicious-skills-on-openclaw-clawhub/An audit by Koi Security found 341 malicious skills on ClawHub. Most told users to install a "prerequisite" that was an information stealer.Fri, 13 Nov 2026 00:00:00 GMTsupply-chainSEV2reportedhttps://incidents.si/incidents/google-antigravity-agent-wipes-users-drive/https://incidents.si/incidents/google-antigravity-agent-wipes-users-drive/A user reported that Google’s Antigravity agent, asked to clear a project cache, ran a delete command against the root of his D: drive. Google said it was investigating.Fri, 13 Nov 2026 00:00:00 GMTagent-actionSEV3reportedhttps://incidents.si/incidents/camoleak-github-copilot-chat-private-code-exfiltration/https://incidents.si/incidents/camoleak-github-copilot-chat-private-code-exfiltration/Legit Security showed that a hidden comment in a pull request could instruct Copilot Chat to leak private repository content through GitHub’s own image proxy.Fri, 13 Nov 2026 00:00:00 GMTprompt-injectionSEV2research-demohttps://incidents.si/incidents/postmark-mcp-npm-package-copies-emails-to-attacker/https://incidents.si/incidents/postmark-mcp-npm-package-copies-emails-to-attacker/An npm package that copied Postmark’s MCP server worked normally for 15 versions, then added a line that blind-copied every outgoing email to an outside address.Fri, 13 Nov 2026 00:00:00 GMTsupply-chainSEV2confirmedhttps://incidents.si/incidents/forcedleak-salesforce-agentforce-crm-data-exfiltration/https://incidents.si/incidents/forcedleak-salesforce-agentforce-crm-data-exfiltration/Noma Security showed that text submitted through a public lead form could instruct Agentforce to send CRM data to an expired domain that Salesforce’s policy still trusted.Fri, 13 Nov 2026 00:00:00 GMTprompt-injectionSEV2research-demohttps://incidents.si/incidents/anthropic-three-infrastructure-bugs-degrade-claude/https://incidents.si/incidents/anthropic-three-infrastructure-bugs-degrade-claude/Anthropic reported that three overlapping infrastructure bugs lowered the quality of Claude’s answers between August and early September 2025, and explained why they were slow to detect.Fri, 13 Nov 2026 00:00:00 GMToutageSEV3confirmedhttps://incidents.si/incidents/nx-s1ngularity-malware-uses-ai-coding-tools-to-find-secrets/https://incidents.si/incidents/nx-s1ngularity-malware-uses-ai-coding-tools-to-find-secrets/Malicious versions of Nx were live on npm for about four hours. Their install script prompted locally installed AI coding assistants to search the machine for secrets.Fri, 13 Nov 2026 00:00:00 GMTsupply-chainSEV1confirmedhttps://incidents.si/incidents/perplexity-comet-indirect-prompt-injection/https://incidents.si/incidents/perplexity-comet-indirect-prompt-injection/Brave showed that instructions hidden in a Reddit comment could make Comet, while summarizing the page, read the user’s email and send a one-time login code to an attacker.Fri, 13 Nov 2026 00:00:00 GMTprompt-injectionSEV2research-demohttps://incidents.si/incidents/curxecute-cursor-prompt-injection-code-execution/https://incidents.si/incidents/curxecute-cursor-prompt-injection-code-execution/Aim Security found that injected text could make Cursor’s agent write an MCP configuration file that ran commands before the user could reject the edit. Fixed as CVE-2025-54135.Fri, 13 Nov 2026 00:00:00 GMTprompt-injectionSEV2research-demohttps://incidents.si/incidents/chatgpt-shared-conversations-indexed-by-search-engines/https://incidents.si/incidents/chatgpt-shared-conversations-indexed-by-search-engines/An opt-in checkbox let shared ChatGPT conversations be indexed by search engines. After reports that thousands were searchable, OpenAI removed the feature.Fri, 13 Nov 2026 00:00:00 GMTdata-leakSEV3confirmedhttps://incidents.si/incidents/gemini-cli-silent-command-execution-via-repository-file/https://incidents.si/incidents/gemini-cli-silent-command-execution-via-repository-file/Tracebit showed that a prompt injection hidden in a repository’s README could make Gemini CLI run a command the user never saw. Google fixed it in version 0.1.14.Fri, 13 Nov 2026 00:00:00 GMTprompt-injectionSEV3research-demohttps://incidents.si/incidents/amazon-q-extension-ships-with-destructive-prompt/https://incidents.si/incidents/amazon-q-extension-ships-with-destructive-prompt/An attacker used an over-scoped token to commit a prompt that told the Amazon Q agent to delete files and cloud resources. It shipped in a release but did not run, according to AWS.Fri, 13 Nov 2026 00:00:00 GMTsupply-chainSEV2near-misshttps://incidents.si/incidents/replit-agent-deletes-production-database-during-code-freeze/https://incidents.si/incidents/replit-agent-deletes-production-database-during-code-freeze/During a user’s test of Replit’s coding agent, the agent deleted the production database despite a code freeze. Replit’s chief executive called it unacceptable and announced safeguards.Fri, 13 Nov 2026 00:00:00 GMTagent-actionSEV3confirmedhttps://incidents.si/incidents/grok-antisemitic-posts-after-code-update/https://incidents.si/incidents/grok-antisemitic-posts-after-code-update/After an update on July 7, Grok posted antisemitic content on X. xAI apologised and said deprecated instructions made the bot echo extremist posts.Fri, 13 Nov 2026 00:00:00 GMTmodel-behaviorSEV3confirmedhttps://incidents.si/incidents/supabase-mcp-support-ticket-leaks-database-tables/https://incidents.si/incidents/supabase-mcp-support-ticket-leaks-database-tables/General Analysis showed that instructions hidden in a support ticket could make a coding agent with a privileged Supabase key read a private table and write its contents back into the ticket.Fri, 13 Nov 2026 00:00:00 GMTprompt-injectionSEV3research-demohttps://incidents.si/incidents/echoleak-zero-click-injection-microsoft-365-copilot/https://incidents.si/incidents/echoleak-zero-click-injection-microsoft-365-copilot/Aim Security found that a crafted email could cause Microsoft 365 Copilot to send data from a user’s context to an attacker with no click. Microsoft fixed it as CVE-2025-32711.Fri, 13 Nov 2026 00:00:00 GMTprompt-injectionSEV2research-demohttps://incidents.si/incidents/asana-mcp-server-cross-organization-data-exposure/https://incidents.si/incidents/asana-mcp-server-cross-organization-data-exposure/A bug in Asana’s MCP server could have exposed information from one customer’s workspace to MCP users at other customers. Asana disabled the server for nearly two weeks.Fri, 13 Nov 2026 00:00:00 GMTdata-leakSEV3confirmedhttps://incidents.si/incidents/github-mcp-server-malicious-issue-leaks-private-repos/https://incidents.si/incidents/github-mcp-server-malicious-issue-leaks-private-repos/Invariant Labs showed that an issue planted in a public repository could make an agent using the GitHub MCP server copy data from the user’s private repositories into a public pull request.Fri, 13 Nov 2026 00:00:00 GMTprompt-injectionSEV2research-demohttps://incidents.si/incidents/grok-unauthorized-system-prompt-change/https://incidents.si/incidents/grok-unauthorized-system-prompt-change/Grok began bringing up "white genocide" in South Africa in answers to unrelated questions. xAI said someone had modified the bot’s prompt without authorization.Fri, 13 Nov 2026 00:00:00 GMTmodel-behaviorSEV3confirmedhttps://incidents.si/incidents/cursor-support-bot-invents-one-device-policy/https://incidents.si/incidents/cursor-support-bot-invents-one-device-policy/A support bot signing as "Sam" told a user that Cursor allows one device per subscription. No such policy existed, and a co-founder corrected it publicly.Fri, 13 Nov 2026 00:00:00 GMTmodel-behaviorSEV4reportedhttps://incidents.si/incidents/openai-outage-telemetry-service-overwhelms-kubernetes/https://incidents.si/incidents/openai-outage-telemetry-service-overwhelms-kubernetes/A new telemetry service caused every node in OpenAI’s clusters to make heavy Kubernetes API calls, which took down the control plane and, with it, all OpenAI services.Fri, 13 Nov 2026 00:00:00 GMToutageSEV2confirmedhttps://incidents.si/incidents/slack-ai-prompt-injection-leaks-private-channel-data/https://incidents.si/incidents/slack-ai-prompt-injection-leaks-private-channel-data/PromptArmor showed that a message in a public Slack channel could steer Slack AI into revealing data from a private channel the attacker could not access.Fri, 13 Nov 2026 00:00:00 GMTprompt-injectionSEV2research-demohttps://incidents.si/incidents/nyc-mycity-chatbot-tells-businesses-to-break-the-law/https://incidents.si/incidents/nyc-mycity-chatbot-tells-businesses-to-break-the-law/An investigation found that New York City’s official chatbot for business owners gave answers that contradicted city and state law. The city kept it online with disclaimers until 2026.Fri, 13 Nov 2026 00:00:00 GMTmodel-behaviorSEV3reportedhttps://incidents.si/incidents/air-canada-held-liable-for-chatbot-misinformation/https://incidents.si/incidents/air-canada-held-liable-for-chatbot-misinformation/A British Columbia tribunal found Air Canada liable for negligent misrepresentation after its website chatbot told a customer he could claim a bereavement fare retroactively.Fri, 13 Nov 2026 00:00:00 GMTmodel-behaviorSEV4confirmedhttps://incidents.si/incidents/dpd-chatbot-swears-and-criticises-company/https://incidents.si/incidents/dpd-chatbot-swears-and-criticises-company/A customer got DPD’s support chatbot to swear and write poems criticising the company. DPD said an error occurred after a system update and disabled the AI component.Fri, 13 Nov 2026 00:00:00 GMTmodel-behaviorSEV4reportedhttps://incidents.si/incidents/car-dealership-chatbot-agrees-to-sell-suv-for-one-dollar/https://incidents.si/incidents/car-dealership-chatbot-agrees-to-sell-suv-for-one-dollar/Users instructed a dealership’s ChatGPT-powered chatbot to agree with anything, then had it accept a $1 offer for a new Chevrolet Tahoe. No sale took place.Fri, 13 Nov 2026 00:00:00 GMTmodel-behaviorSEV4reportedhttps://incidents.si/incidents/chatgpt-redis-bug-exposes-chat-titles-and-payment-data/https://incidents.si/incidents/chatgpt-redis-bug-exposes-chat-titles-and-payment-data/OpenAI took ChatGPT offline after a caching bug let some users see titles from other users’ chat histories and, for some subscribers, payment-related details.Fri, 13 Nov 2026 00:00:00 GMTdata-leakSEV2confirmed