AI agent incidents in Switzerland
Every incident in the register with a Swiss connection: the AI was built or run there, the people it affected are there, it happened there, or researchers there found it.
3 incidents 8 sources 103 worldwide
As of 26 Oct 2026, updated every morning.
Days without a reported agent incident in Switzerland
518
Last reported 26 May 2025Salt's Gomo chatbot wrongly says roaming data is included, leaving a customer with a bill3 incidents
All 103 incidents worldwide- EEAIR-2025-014 May 2025 Malicious GitHub issue hijacks agents using GitHub's MCP server to leak private repo data GitHub MCP serverProof of conceptSwitzerland Found by Invariant Labs, a security research firm based in Zurich. 89%
- EEAIR-2025-039 Apr 2025 Poisoned MCP tool descriptions make Cursor leak SSH keys and WhatsApp chats Cursor agent (and other MCP clients) connected to third-party MCP servers, Anysphere (Cursor)Proof of conceptSwitzerland Found by Invariant Labs, a security research firm based in Zurich. 82%
- EEAIR-2025-037 2025 Salt's Gomo chatbot wrongly says roaming data is included, leaving a customer with a bill Gomo customer-service AI chatbotSwitzerland Chatbot of Swiss operator Salt's Gomo brand; reported by SRF. 73%
AI agents and Swiss law
Accurate as of October 2026. The consultation draft is pending.
Switzerland has no AI-specific law. On 12 February 2025 the Federal Council decided to ratify the Council of Europe’s AI Convention and to adapt Swiss law, mostly sector by sector. The Federal Department of Justice and Police is to put a consultation draft to the Federal Council by the end of 2026.
The FDPIC holds that the revised Data Protection Act, in force since 1 September 2023, applies directly to AI; high-risk data breaches must be reported to it as soon as possible. FINMA Guidance 08/2024 sets out FINMA’s expectations on AI governance, and supervised firms must report material cyberattacks to FINMA within 24 hours. Since 1 April 2025, critical-infrastructure operators must report cyberattacks to the National Cyber Security Centre within 24 hours. Swiss firms whose AI systems are placed on the EU market, or whose output is used there, fall under the EU AI Act.
Sources
- OFCOM: artificial intelligence, the Federal Council’s approach
- Federal Council answer to interpellation 26.3414 (20 May 2026, in German)
- FDPIC: current data protection law applies directly to AI
- FINMA Guidance 08/2024 on AI governance and risk management
- NCSC: reporting cyberattacks on critical infrastructure
Deploying agents in Switzerland?
The EE Agent Safety Protocol, in development, fits guardrails, evaluations and sandboxing to your agents. Talk with the team.