The Agent Incident RegisterThe public database of AI agent incidents

What counts

An AI system that acts or speaks on someone’s behalf, with some autonomy, caused harm or a serious near miss. That covers agents that use tools (coding agents, browser and computer-use agents, personal agents, workflow agents), assistants that make statements or commitments for an organisation, automated AI crawlers whose volume harmed a service, working exploits that researchers demonstrated against shipped agent products, and behaviour reported in published lab evaluations. Chatbots harming their own users in conversation, hallucinated legal citations and deepfakes are outside the scope.

Each incident is classed by setting (in the wild, proof of concept, lab test) and cause: error (the agent made a mistake, with no adversary involved); manipulation (a third party tricked or compromised the agent: injected instructions, poisoned tools, stolen credentials); misuse (its operator deliberately used the agent to cause harm); misalignment (the agent pursued goals against its principal’s intent: deception, sabotage, coercion).

The counter at the top shows the days since an incident in the wild was last reported, counting only incidents with a confidence of at least 50%. Many incidents come to light weeks or months after they happen, so each entry records both dates.

Regions. An incident is tagged Switzerland, France or EU when any of these is true: the AI involved was built or run by an organisation based there; the people or organisations it affected are there; it happened there; a public body there acted on it; or, for proofs of concept and lab tests, researchers based there found it. Each tag says which applies. France also counts towards the EU.

The eight guardrails

G1Least privilege

Did the agent hold only the access the task needed?

G2Human confirmation

Did a person approve the consequential or irreversible step?

G3Isolation

Was the agent separated from production systems and the outside world?

G4Instruction integrity

Did it refuse instructions it should not have followed?

G5Truthfulness

Did it accurately report what it knew and what it did?

G6Limits

Was there a cap on rate, spend, volume or scale?

G7Oversight

Could a responsible human see what it was doing and stop it in time?

G8Recovery

Could the damage be undone?

For each incident, each guardrail is marked failed (missing or failed, and it contributed), partial (existed but was weak or bypassed), held (worked and limited the harm) or not assessed (not relevant, or the sources don’t say). A guardrail is only marked failed when the sources support it.

Confidence

The percentage is how likely the core account is accurate, computed from the sources alone, never from a model’s opinion. Each publisher casts one vote, its strongest source, weighted by how close it is to the event:

• Primary70%First-hand: the people involved, the developer, the researchers, a court or an official advisory.
• Press55%An established newsroom with editorial standards.
• Specialist40%Specialist, trade or research publication reporting second-hand.
• Social15%A forum or social post by someone not directly involved.

Votes combine like independent witnesses: confidence = 1 − (1 − w₁)(1 − w₂)…, capped at 99%. A source that only partly confirms the account counts half. A source whose quote we could not machine-check against the live page counts 90%. A public dispute by an involved party multiplies the result by 0.85. When another credible outlet reports the same incident, the score goes up, and the change is logged on the incident’s page.

Labels: confirmed from 90%, corroborated from 75%, reported from 50%, unverified below.

Severity

• 1 MinorInconvenience, trivial cost, no lasting harm.
• 2 ModerateLimited, recoverable harm to one person or business.
• 3 SignificantMaterial loss to a business or person: lost production data, legal liability, major embarrassment.
• 4 SevereHarm across many people or organisations, a major breach, a cloud outage.
• 5 CriticalLarge-scale, physical or state-level harm.

For proofs of concept and lab tests, severity rates the harm the behaviour would cause in production. Lab tests are dated by when the finding was published, since the tests themselves are rarely dated.

The register agent

Every morning at 06:00 UTC an AI agent reviews the latest technology, security and business news, including Swiss, French and other European outlets, along with publishers’ feeds, web searches and reports sent in by readers. It sets aside anything that isn’t a concrete agent incident, matches new articles to incidents already in the register, and drafts new entries, in English and French. Every source it adds must contain a quote that we find, word for word, in the live page; if the quote isn’t there, the source counts less. Entries the agent drafts carry an “Added by the register agent” note until an editor reviews them.

Corrections

If an entry is wrong or a source is missing, report it or write to team@experimentempire.com. Corrections are logged on the incident’s page. IDs never change and are never reused.