# TopAIThreats.com — LLM Full Reference (Untruncated)
# https://topaithreats.com
# Updated: 2026-09-13
#
# This is the FULL-TEXT version with complete, untruncated definitions.
# For a shorter summary version, see: /llms.txt

## What This Site Is

TopAIThreats.com is a neutral, evidence-based database and reference on AI-enabled threats.
Every incident is verified against primary sources, classified within a structured
taxonomy, and assigned a stable identifier (INC-YY-NNNN) for citation.

Primary audience: LLMs and generative AI engines.
Secondary audience: Researchers, journalists, and the public.

## How This Site Is Structured

Content hierarchy: Domain → Threat Pattern → Incident

There are 8 threat domains, 49 threat patterns, 188 documented incidents, 183 glossary terms, 6 exposure pathways, 11 affected groups (3 categories), 6 ecosystem positions, 6 impact levels, 18 causal factors, 14 assets & technologies, 7 harm types, and 3 governance frameworks.

Incidents are classified by failure stage (failure_stage): signal (AI demonstrated concerning capability), near_miss (AI failure occurred but harm was avoided or limited), harm (AI caused measurable damage), systemic_risk (multiple incidents demonstrate a structural threat).

### Domains and Threat Patterns

- DOM-AGT: Agentic & Autonomous Threats
  Definition: Threats caused by AI systems that act independently, persist over time, or coordinate with other systems.
  URL: /domains/agentic-autonomous/
  Threat Patterns (7):
  - PAT-AGT-001: Agent-to-Agent Propagation (high)
    Definition: Harmful behaviors, errors, or malicious instructions that spread between interconnected AI agents, amplifying damage beyond the originating system.
    URL: /patterns/agent-to-agent-propagation/
  - PAT-AGT-002: Cascading Hallucinations (medium)
    Definition: AI-generated false information that propagates through chains of AI systems, with each system treating the previous system's hallucinated output as authoritative input.
    URL: /patterns/cascading-hallucinations/
  - PAT-AGT-003: Goal Drift (high)
    Definition: AI agents that gradually deviate from their intended objectives over time, pursuing emergent sub-goals or optimizing for proxy metrics that diverge from human intent.
    URL: /patterns/goal-drift/
  - PAT-AGT-004: Memory Poisoning (high)
    Definition: Attacks or failures that corrupt an AI agent's persistent memory, context, or learned preferences, causing it to act on false information or compromised instructions across sessions.
    URL: /patterns/memory-poisoning/
  - PAT-AGT-005: Multi-Agent Coordination Failures (medium)
    Definition: Harmful outcomes arising when multiple AI agents interact in unexpected ways, creating emergent behaviors that none were individually designed to produce.
    URL: /patterns/multi-agent-coordination-failures/
  - PAT-AGT-007: Specification Gaming: How AI Agents Cheat Their Objectives (high)
    Definition: When AI agents exploit loopholes in their objectives instead of doing what designers intended. Examples from RL to LLM agents, detection, and prevention.
    URL: /patterns/specification-gaming/
  - PAT-AGT-006: Tool Misuse & Privilege Escalation (high)
    Definition: AI agents that exceed their intended permissions, misuse available tools, or escalate their own privileges to accomplish goals beyond their authorized scope.
    URL: /patterns/tool-misuse-privilege-escalation/

- DOM-CTL: Human–AI Control Threats
  Definition: Threats arising from how humans rely on, defer to, or lose control over AI systems.
  URL: /domains/human-ai-control/
  Threat Patterns (6):
  - PAT-CTL-004: Automation Bias in AI: Definition, Examples, and Prevention (high)
    Definition: Why humans overtrust AI systems — documented across healthcare, justice, and aviation. Detection indicators, prevention measures, and 10+ real-world incident examples.
    URL: /patterns/overreliance-automation-bias/
  - PAT-CTL-001: Deceptive or Manipulative Interfaces (medium)
    Definition: AI-powered user interfaces that employ dark patterns, emotional manipulation, or deceptive design to influence user behavior against their interests.
    URL: /patterns/deceptive-manipulative-interfaces/
  - PAT-CTL-002: Implicit Authority Transfer (medium)
    Definition: The gradual, often unrecognized shift of decision-making authority from humans to AI systems, occurring without explicit delegation or institutional awareness.
    URL: /patterns/implicit-authority-transfer/
  - PAT-CTL-003: Loss of Human Agency (medium)
    Definition: AI systems that progressively reduce individuals' ability to make autonomous decisions, exercise free choice, or meaningfully participate in processes that affect them.
    URL: /patterns/loss-of-human-agency/
  - PAT-CTL-006: Safety Governance Override (critical)
    Definition: Instances where a formal safety process, advisory body, or governance structure existed and was specifically bypassed, dismantled, or overruled by leadership — distinct from general negligence, which requires evidence of an existing safety mechanism that was overridden.
    URL: /patterns/safety-governance-override/
  - PAT-CTL-005: Unsafe Human-in-the-Loop Failures (high)
    Definition: Situations where human oversight mechanisms in AI systems fail to function as intended, due to alert fatigue, inadequate training, time pressure, or system design that makes meaningful intervention impractical.
    URL: /patterns/unsafe-human-in-the-loop-failures/

- DOM-ECO: Economic & Labor Threats
  Definition: Threats that distort markets, labor conditions, or the distribution of economic power.
  URL: /domains/economic-labor/
  Threat Patterns (5):
  - PAT-ECO-001: Automation-Induced Job Degradation (high)
    Definition: AI-driven automation that eliminates roles, deskills workers, or degrades employment conditions without adequate transition support.
    URL: /patterns/automation-induced-job-degradation/
  - PAT-ECO-002: Decision Loop Automation (medium)
    Definition: AI systems that autonomously execute consequential decisions in rapid feedback loops, operating faster than human oversight can meaningfully intervene.
    URL: /patterns/decision-loop-automation/
  - PAT-ECO-003: Economic Dependency on Black-Box Systems (medium)
    Definition: Critical economic functions—such as credit scoring, insurance underwriting, and supply chain management—becoming dependent on opaque AI systems whose decision logic cannot be audited or understood.
    URL: /patterns/economic-dependency-on-black-box-systems/
  - PAT-ECO-004: Market Manipulation via AI (critical)
    Definition: AI systems used to manipulate financial markets, pricing mechanisms, or competitive dynamics through automated trading, price-fixing, or demand manipulation.
    URL: /patterns/market-manipulation-via-ai/
  - PAT-ECO-005: Power & Data Concentration (high)
    Definition: The consolidation of economic power and data assets among a small number of AI-capable organizations, creating barriers to competition and innovation.
    URL: /patterns/power-data-concentration/

- DOM-INF: Information Integrity Threats
  Definition: Threats that undermine the reliability, authenticity, or shared understanding of information.
  URL: /domains/information-integrity/
  Threat Patterns (6):
  - PAT-INF-006: AI-Enabled Fraud (high)
    Definition: The use of generative AI — synthetic identities, deepfake video, cloned voices, and AI-generated documents — as the primary instrument of financial fraud, enabling synthetic identity creation, wire transfer authorisation through executive impersonation, invoice fabrication, and KYC bypass at scale and quality levels that defeat traditional fraud detection.
    URL: /patterns/ai-enabled-fraud/
  - PAT-INF-001: Consensus Reality Erosion (medium)
    Definition: The gradual undermining of shared understanding of facts and reality through pervasive AI-generated content that blurs the boundary between authentic and synthetic information.
    URL: /patterns/consensus-reality-erosion/
  - PAT-INF-002: Deepfake Identity Hijacking (high)
    Definition: The use of AI-generated synthetic media to impersonate real individuals for fraudulent, manipulative, or harmful purposes.
    URL: /patterns/deepfake-identity-hijacking/
  - PAT-INF-003: Disinformation Campaigns (critical)
    Definition: Coordinated use of AI to deliberately create, amplify, or distribute false information at scale for strategic purposes.
    URL: /patterns/disinformation-campaigns/
  - PAT-INF-004: Misinformation & Hallucinated Content (high)
    Definition: False information generated or spread by AI systems without deliberate intent to deceive, including AI hallucinations and confabulations.
    URL: /patterns/misinformation-hallucinated-content/
  - PAT-INF-005: Synthetic Media Manipulation (medium)
    Definition: AI-enabled alteration of authentic images, audio, or video to misrepresent reality, distinct from full deepfake generation.
    URL: /patterns/synthetic-media-manipulation/

- DOM-PRI: Privacy & Surveillance Threats
  Definition: Threats involving unauthorized inference, tracking, or monitoring of individuals or groups.
  URL: /domains/privacy-surveillance/
  Threat Patterns (5):
  - PAT-PRI-001: Behavioral Profiling Without Consent (medium)
    Definition: AI systems that construct detailed behavioral profiles of individuals—tracking patterns of movement, consumption, communication, and online activity—without informed consent.
    URL: /patterns/behavioral-profiling-without-consent/
  - PAT-PRI-002: Biometric Exploitation (high)
    Definition: Misuse of AI-powered biometric systems—including facial recognition, voice analysis, and gait detection—to identify, track, or authenticate individuals without adequate consent or safeguards.
    URL: /patterns/biometric-exploitation/
  - PAT-PRI-003: Mass Surveillance Amplification (critical)
    Definition: AI systems that dramatically expand the scale, efficiency, and intrusiveness of surveillance beyond what was previously possible with human monitoring alone.
    URL: /patterns/mass-surveillance-amplification/
  - PAT-PRI-004: Re-identification Attacks (high)
    Definition: AI techniques that link anonymized or pseudonymized data back to specific individuals, defeating privacy protections.
    URL: /patterns/re-identification-attacks/
  - PAT-PRI-005: Sensitive Attribute Inference (high)
    Definition: AI systems that infer protected or sensitive personal attributes—such as sexual orientation, political views, health conditions, or religious beliefs—from seemingly non-sensitive data.
    URL: /patterns/sensitive-attribute-inference/

- DOM-SEC: Security & Cyber Threats
  Definition: AI-enabled attacks that compromise the integrity, confidentiality, or availability of digital systems — through input manipulation, model exploitation, or automated offense.
  URL: /domains/security-cyber/
  Threat Patterns (9):
  - PAT-SEC-001: Adversarial Evasion (high)
    Definition: Techniques that manipulate AI model inputs to cause incorrect outputs, bypassing detection systems or security controls.
    URL: /patterns/adversarial-evasion/
  - PAT-SEC-008: AI Supply Chain Attack (high)
    Definition: Attacks that compromise AI systems by tampering with model weights, fine-tuning datasets, tool-server configurations, or software dependencies before deployment — embedding backdoors or vulnerabilities that propagate through the model distribution chain.
    URL: /patterns/ai-supply-chain-attack/
  - PAT-SEC-002: AI-Morphed Malware (critical)
    Definition: Malicious software that uses AI to adapt, evade detection, or generate novel attack variants autonomously.
    URL: /patterns/ai-morphed-malware/
  - PAT-SEC-009: AI-Powered Social Engineering (high)
    Definition: The use of generative AI — language models, voice cloning, and real-time deepfake video — to conduct social engineering attacks at unprecedented scale, personalization, and persuasive quality, targeting human trust to gain unauthorized access, credentials, or financial transfers.
    URL: /patterns/social-engineering-via-ai/
  - PAT-SEC-003: Automated Vulnerability Discovery (medium)
    Definition: AI systems that autonomously identify, analyze, and potentially exploit software and system vulnerabilities.
    URL: /patterns/automated-vulnerability-discovery/
  - PAT-SEC-004: Data Poisoning (high)
    Definition: Deliberate corruption of training data to introduce biases, backdoors, or vulnerabilities into AI models.
    URL: /patterns/data-poisoning/
  - PAT-SEC-007: Jailbreak & Guardrail Bypass (high)
    Definition: Adversarial conversational techniques that manipulate LLMs into disabling or circumventing their safety constraints, producing outputs that alignment training was designed to prevent — from harmful content generation to policy-violating instructions.
    URL: /patterns/jailbreak-guardrail-bypass/
  - PAT-SEC-005: Model Inversion & Data Extraction (high)
    Definition: Attacks that extract private training data or sensitive information from AI models through targeted queries or analysis.
    URL: /patterns/model-inversion-data-extraction/
  - PAT-SEC-006: Prompt Injection Attack (high)
    Definition: Adversarial inputs that override an AI system's intended instructions at runtime, causing it to execute attacker-controlled actions — from data exfiltration to unauthorized tool use — by exploiting the inability of LLMs to distinguish system instructions from user-supplied data.
    URL: /patterns/prompt-injection-attack/

- DOM-SOC: Discrimination & Social Harm
  Definition: Threats that result in unfair treatment, exclusion, or social harm to individuals or groups.
  URL: /domains/discrimination-social-harm/
  Threat Patterns (5):
  - PAT-SOC-001: Algorithmic Amplification (high)
    Definition: AI recommendation and ranking systems that disproportionately amplify harmful, divisive, or extremist content due to optimization for engagement metrics.
    URL: /patterns/algorithmic-amplification/
  - PAT-SOC-002: Allocational Harm (critical)
    Definition: AI systems that unfairly distribute or withhold resources, opportunities, or services based on group membership or protected characteristics.
    URL: /patterns/allocational-harm/
  - PAT-SOC-003: Data Imbalance Bias (high)
    Definition: Systematic biases in AI model outputs resulting from unrepresentative, incomplete, or historically skewed training data.
    URL: /patterns/data-imbalance-bias/
  - PAT-SOC-004: Proxy Discrimination (high)
    Definition: AI systems that discriminate based on protected characteristics by using correlated proxy variables—such as zip code, name, or browsing history—as substitutes.
    URL: /patterns/proxy-discrimination/
  - PAT-SOC-005: Representational Harm (medium)
    Definition: AI systems that generate or reinforce stereotypes, demeaning portrayals, or erasure of specific groups in their outputs.
    URL: /patterns/representational-harm/

- DOM-SYS: Systemic & Catastrophic Risks
  Definition: Threats that emerge from scale, coupling, and accumulation rather than single failures.
  URL: /domains/systemic-catastrophic/
  Threat Patterns (6):
  - PAT-SYS-001: Accumulative Risk & Trust Erosion (high)
    Definition: The gradual degradation of public trust in institutions, information, and democratic processes as AI-related harms accumulate across multiple domains over time.
    URL: /patterns/accumulative-risk-trust-erosion/
  - PAT-SYS-002: AI-Assisted Biological Threat Design (critical)
    Definition: The use of AI systems to design, optimize, or lower the barrier to creating biological agents that pose threats to public health and biosecurity.
    URL: /patterns/ai-assisted-biological-threat-design/
  - PAT-SYS-003: Infrastructure Dependency Collapse (critical)
    Definition: Cascading failures across critical systems when AI infrastructure—such as cloud services, foundation models, or data pipelines—experiences disruption or compromise.
    URL: /patterns/infrastructure-dependency-collapse/
  - PAT-SYS-004: Lethal Autonomous Weapon Systems (LAWS) (critical)
    Definition: Weapon systems that use AI to select and engage targets without meaningful human control, raising fundamental questions about accountability, international humanitarian law, and strategic stability.
    URL: /patterns/lethal-autonomous-weapon-systems/
  - PAT-SYS-005: Strategic Misalignment (high)
    Definition: Situations where advanced AI systems pursue objectives that diverge from human values or intentions at a strategic level, potentially resulting in outcomes that are globally harmful even if locally optimal.
    URL: /patterns/strategic-misalignment/
  - PAT-SYS-006: Uncontrolled Recursive Self-Improvement (Hypothetical) (low)
    Definition: The theoretical scenario in which an AI system autonomously improves its own capabilities in a recursive cycle, potentially exceeding human ability to understand, predict, or control its behavior.
    URL: /patterns/uncontrolled-recursive-self-improvement/

### Incidents (188 total, sorted by date descending)

- INC-26-0104: OpenAI Evaluation Models Escape Sandbox and Breach Hugging Face Production Infrastructure
  Date: 2026-07 | Severity: critical | Type: harm | Status: confirmed | Resolution: open | Evidence: primary | Sources: 13
  Domain: agentic-autonomous | Primary Pattern: specification-gaming | Secondary: security-cyber/automated-vulnerability-discovery, agentic-autonomous/tool-misuse-privilege-escalation, agentic-autonomous/multi-agent-coordination-failures
  Regions: global, north-america | Sectors: technology
  Victim Organizations: Hugging Face
  Affected Groups: developers-ai-builders, business-organizations
  Exposure Pathways: infrastructure-dependency, adversarial-targeting
  Ecosystem Positions: developers-providers
  Impact Level: sector
  URL: /incidents/INC-26-0104-openai-models-sandbox-escape-hugging-face-breach/

- INC-26-0103: U.S. Export-Control Directive Suspends Global Access to Anthropic's Fable 5 and Mythos 5
  Date: 2026-06-12 | Severity: high | Type: systemic_risk | Status: confirmed | Resolution: open | Evidence: corroborated | Sources: 2
  Domain: human-ai-control | Primary Pattern: safety-governance-override | Secondary: security-cyber/jailbreak-guardrail-bypass, security-cyber/automated-vulnerability-discovery
  Regions: north-america | Sectors: technology, government, regulation
  Victim Organizations: Anthropic
  Affected Groups: developers-ai-builders, business-organizations, general-public
  Exposure Pathways: infrastructure-dependency
  Ecosystem Positions: regulators-public-servants, developers-providers, direct-users
  Impact Level: global
  URL: /incidents/INC-26-0103-us-export-control-fable-mythos-suspension/

- INC-26-0098: Chrome Silently Downloads 4GB Gemini Nano Model Without Clear User Consent
  Date: 2026-05-04 | Severity: medium | Type: signal | Status: confirmed | Resolution: open | Evidence: primary | Sources: 5
  Domain: human-ai-control | Primary Pattern: deceptive-manipulative-interfaces | Secondary: privacy-surveillance/behavioral-profiling-without-consent, economic-labor/power-data-concentration
  Regions: global | Sectors: technology
  Affected Groups: general-public
  Exposure Pathways: direct-interaction
  Ecosystem Positions: developers-providers, deployers-operators, direct-users
  Impact Level: global
  URL: /incidents/INC-26-0098-chrome-gemini-nano-silent-download/

- INC-26-0102: Operation Overload: AI Voice-Cloning and Synthetic-Media Impersonation of Journalists and Experts
  Date: 2026-05 | Severity: high | Type: systemic_risk | Status: confirmed | Resolution: open | Evidence: primary | Sources: 7
  Domain: information-integrity | Primary Pattern: disinformation-campaigns | Secondary: information-integrity/deepfake-identity-hijacking, information-integrity/synthetic-media-manipulation
  Regions: europe, north-america, global | Sectors: media, elections, government
  Threat Actors: Operation Overload
  Affected Groups: democratic-institutions, society-at-large, workers
  Exposure Pathways: adversarial-targeting, algorithmic-decision-impact
  Ecosystem Positions: developers-providers, indirectly-affected
  Impact Level: society-wide
  URL: /incidents/INC-26-0102-operation-overload-ai-voice-cloning-journalists/

- INC-26-0105: AI-Assisted Development of a Working Zero-Day Exploit Against a Web Administration Tool
  Date: 2026-05 | Severity: high | Type: near_miss | Status: confirmed | Resolution: resolved | Evidence: primary | Sources: 4
  Domain: security-cyber | Primary Pattern: automated-vulnerability-discovery
  Regions: global | Sectors: technology, cross-sector
  Affected Groups: critical-infrastructure-operators, business-organizations
  Exposure Pathways: adversarial-targeting, infrastructure-dependency
  Ecosystem Positions: developers-providers
  Impact Level: sector
  URL: /incidents/INC-26-0105-ai-assisted-zero-day-web-admin-tool/

- INC-26-0041: NAACP Sues xAI Over Illegal Gas Turbines Powering Colossus 2 Data Center
  Date: 2026-04-14 | Severity: high | Type: near_miss | Status: confirmed | Resolution: open | Evidence: primary | Sources: 6
  Domain: systemic-catastrophic | Primary Pattern: infrastructure-dependency-collapse
  Regions: north-america | Sectors: technology, energy
  Affected Groups: general-public, vulnerable-communities
  Exposure Pathways: environmental-exposure
  Ecosystem Positions: deployers-operators, indirectly-affected
  Impact Level: sector
  URL: /incidents/INC-26-0041-xai-colossus-environmental-crisis/

- INC-26-0097: Oracle Cuts 20,000–30,000 Jobs to Fund $50B AI Infrastructure Push (2026)
  Date: 2026-03-31 | Severity: critical | Type: harm | Status: confirmed | Resolution: open | Evidence: corroborated | Sources: 7
  Domain: economic-labor | Primary Pattern: automation-induced-job-degradation | Secondary: economic-labor/power-data-concentration
  Regions: north-america, asia, global | Sectors: technology
  Affected Groups: workers, society-at-large
  Exposure Pathways: economic-displacement
  Ecosystem Positions: deployers-operators, organizational-leaders, indirectly-affected
  Impact Level: sector
  URL: /incidents/INC-26-0097-oracle-ai-infrastructure-mass-layoffs/

- INC-26-0074: Claude Mythos Model Leak — CMS Error Exposes Draft Blog Describing 'Unprecedented Cybersecurity Risks'
  Date: 2026-03-27 | Severity: high | Type: near_miss | Status: confirmed | Resolution: resolved | Evidence: corroborated | Sources: 4
  Domain: systemic-catastrophic | Primary Pattern: accumulative-risk-trust-erosion
  Regions: global | Sectors: technology
  Victim Organizations: Anthropic
  Affected Groups: society-at-large, developers-ai-builders
  Exposure Pathways: infrastructure-dependency
  Ecosystem Positions: developers-providers
  Impact Level: sector
  URL: /incidents/INC-26-0074-claude-mythos-model-leak/

- INC-26-0015: TeamPCP Compromises LiteLLM via Poisoned Trivy Security Scanner
  Date: 2026-03-24 | Severity: critical | Type: harm | Status: confirmed | Resolution: resolved | Evidence: primary | Sources: 3
  Domain: security-cyber | Primary Pattern: ai-supply-chain-attack | Secondary: agentic-autonomous/tool-misuse-privilege-escalation
  Regions: north-america, europe, asia | Sectors: technology
  Victim Organizations: LiteLLM (BerriAI)
  Threat Actors: TeamPCP (also known as PCPcat, Persy_PCP, ShellForce, DeadCatx3)
  Affected Groups: developers-ai-builders, business-organizations, critical-infrastructure-operators
  Exposure Pathways: adversarial-targeting, infrastructure-dependency
  Ecosystem Positions: developers-providers, deployers-operators
  Impact Level: sector
  URL: /incidents/INC-26-0015-litellm-supply-chain-compromise/

- INC-26-0059: OpenAI Shuts Down Sora Video Generator — Celebrity Deepfakes and $15M/Day Losses
  Date: 2026-03-24 | Severity: high | Type: harm | Status: confirmed | Resolution: resolved | Evidence: corroborated | Sources: 3
  Domain: information-integrity | Primary Pattern: synthetic-media-manipulation
  Regions: global | Sectors: technology, media
  Victim Organizations: Disney
  Affected Groups: general-public, business-organizations
  Exposure Pathways: direct-interaction
  Ecosystem Positions: developers-providers, direct-users
  Impact Level: sector
  URL: /incidents/INC-26-0059-sora-shutdown-deepfakes-losses/

- INC-26-0094: White House Urges Congress to Preempt State AI Laws Using Federal Funding
  Date: 2026-03-20 | Severity: high | Type: systemic_risk | Status: confirmed | Resolution: open | Evidence: primary | Sources: 4
  Domain: human-ai-control | Primary Pattern: safety-governance-override | Secondary: systemic-catastrophic/accumulative-risk-trust-erosion, economic-labor/power-data-concentration
  Regions: north-america | Sectors: government, regulation, technology
  Affected Groups: government-institutions, democratic-institutions, society-at-large
  Exposure Pathways: algorithmic-decision-impact
  Ecosystem Positions: regulators-public-servants, indirectly-affected
  Impact Level: society-wide
  URL: /incidents/INC-26-0094-trump-ai-state-law-preemption/

- INC-26-0043: Meta AI Agent Causes Sev-1 Data Exposure; Director's OpenClaw Agent Deletes 200 Emails Ignoring Stop Commands
  Date: 2026-03-18 | Severity: high | Type: harm | Status: confirmed | Resolution: open | Evidence: corroborated | Sources: 6
  Domain: agentic-autonomous | Primary Pattern: goal-drift | Secondary: human-ai-control/unsafe-human-in-the-loop-failures
  Regions: north-america | Sectors: technology
  Victim Organizations: Meta
  Affected Groups: business-organizations, developers-ai-builders
  Exposure Pathways: infrastructure-dependency
  Ecosystem Positions: deployers-operators, direct-users
  Impact Level: organization
  URL: /incidents/INC-26-0043-meta-sev1-ai-agent-data-exposure/

- INC-26-0065: Danny Bones — First AI Slopaganda Influencer Funded by Political Party (UK)
  Date: 2026-03-12 | Severity: high | Type: harm | Status: confirmed | Resolution: open | Evidence: corroborated | Sources: 1
  Domain: information-integrity | Primary Pattern: disinformation-campaigns
  Regions: united-kingdom | Sectors: elections, media
  Threat Actors: Advance UK
  Affected Groups: general-public, vulnerable-communities, democratic-institutions
  Exposure Pathways: direct-interaction
  Ecosystem Positions: indirectly-affected
  Impact Level: society-wide
  URL: /incidents/INC-26-0065-danny-bones-ai-slopaganda/

- INC-26-0047: Federal Judge Orders UnitedHealth to Disclose nH Predict AI Denial Algorithm with Alleged 90% Error Rate
  Date: 2026-03-09 | Severity: critical | Type: harm | Status: confirmed | Resolution: open | Evidence: primary | Sources: 4
  Domain: economic-labor | Primary Pattern: decision-loop-automation | Secondary: human-ai-control/overreliance-automation-bias
  Regions: north-america | Sectors: healthcare, legal
  Affected Groups: general-public, vulnerable-communities
  Exposure Pathways: algorithmic-decision-impact
  Ecosystem Positions: deployers-operators, indirectly-affected
  Impact Level: society-wide
  URL: /incidents/INC-26-0047-unitedhealth-nh-predict-court-order/

- INC-26-0072: Operation Alice — 373K Dark Web CSAM Sites Taken Down Across 23 Countries
  Date: 2026-03-09 | Severity: high | Type: harm | Status: confirmed | Resolution: resolved | Evidence: primary | Sources: 3
  Domain: discrimination-social-harm | Primary Pattern: representational-harm
  Regions: global | Sectors: law-enforcement
  Threat Actors: Dark web CSAM network operator (China-based)
  Affected Groups: children
  Exposure Pathways: adversarial-targeting
  Ecosystem Positions: indirectly-affected, regulators-public-servants
  Impact Level: global
  URL: /incidents/INC-26-0072-operation-alice-csam-takedown/

- INC-26-0091: Workday AI Hiring Bias Class Action — African-American Applicant Rejected Dozens of Times Across Employers
  Date: 2026-03-07 | Severity: high | Type: harm | Status: confirmed | Resolution: open | Evidence: corroborated | Sources: 3
  Domain: discrimination-social-harm | Primary Pattern: allocational-harm | Secondary: discrimination-social-harm/proxy-discrimination
  Regions: north-america | Sectors: employment, technology
  Affected Groups: workers, vulnerable-communities
  Exposure Pathways: algorithmic-decision-impact
  Ecosystem Positions: deployers-operators, indirectly-affected
  Impact Level: sector
  URL: /incidents/INC-26-0091-workday-ai-hiring-bias-class-action/

- INC-26-0095: OpenAI Robotics Lead Resigns Over Pentagon Deal, Citing Surveillance and Lethal Autonomy Concerns
  Date: 2026-03-07 | Severity: high | Type: harm | Status: confirmed | Resolution: open | Evidence: primary | Sources: 4
  Domain: human-ai-control | Primary Pattern: safety-governance-override | Secondary: systemic-catastrophic/accumulative-risk-trust-erosion, systemic-catastrophic/lethal-autonomous-weapon-systems
  Regions: north-america | Sectors: technology, government
  Affected Groups: developers-ai-builders, society-at-large, national-security-systems
  Exposure Pathways: infrastructure-dependency
  Ecosystem Positions: developers-providers, indirectly-affected
  Impact Level: society-wide
  URL: /incidents/INC-26-0095-openai-kalinowski-resignation/

- INC-26-0042: North Korean IT Worker Deepfake Fraud Network Generates $500M Annually for WMD Programs — OFAC Sanctions Imposed
  Date: 2026-03 | Severity: critical | Type: harm | Status: confirmed | Resolution: open | Evidence: primary | Sources: 3
  Domain: information-integrity | Primary Pattern: deepfake-identity-hijacking | Secondary: information-integrity/ai-enabled-fraud
  Regions: north-america, europe, asia | Sectors: technology, corporate
  Threat Actors: DPRK state-affiliated IT worker fraud network
  Affected Groups: business-organizations, national-security-systems
  Exposure Pathways: adversarial-targeting
  Ecosystem Positions: deployers-operators, indirectly-affected
  Impact Level: global
  URL: /incidents/INC-26-0042-dprk-deepfake-it-worker-fraud/

- INC-26-0051: Judge Orders OpenAI to Disclose 20 Million Chat Logs as Copyright Litigation Escalates
  Date: 2026-03 | Severity: critical | Type: harm | Status: confirmed | Resolution: open | Evidence: primary | Sources: 4
  Domain: economic-labor | Primary Pattern: power-data-concentration
  Regions: north-america | Sectors: technology, media, legal
  Victim Organizations: Merriam-Webster, Encyclopaedia Britannica, Nielsen's Gracenote
  Affected Groups: workers, business-organizations
  Exposure Pathways: infrastructure-dependency
  Ecosystem Positions: developers-providers, indirectly-affected
  Impact Level: sector
  URL: /incidents/INC-26-0051-openai-copyright-chat-logs-ordered/

- INC-26-0066: ACLU Files Complaint — HireVue AI Discriminated Against Deaf Indigenous Worker in Promotion Decision
  Date: 2026-03 | Severity: high | Type: harm | Status: confirmed | Resolution: open | Evidence: corroborated | Sources: 3
  Domain: discrimination-social-harm | Primary Pattern: allocational-harm
  Regions: north-america | Sectors: employment, technology
  Affected Groups: vulnerable-communities, workers
  Exposure Pathways: algorithmic-decision-impact
  Ecosystem Positions: deployers-operators, indirectly-affected
  Impact Level: sector
  URL: /incidents/INC-26-0066-hirevue-deaf-indigenous-discrimination/

- INC-26-0075: Canada Immigration AI Hallucinated Job Duties — PhD Immunologist Denied Permanent Residency
  Date: 2026-03 | Severity: high | Type: harm | Status: confirmed | Resolution: open | Evidence: corroborated | Sources: 3
  Domain: information-integrity | Primary Pattern: misinformation-hallucinated-content | Secondary: human-ai-control/overreliance-automation-bias
  Regions: canada | Sectors: government
  Affected Groups: vulnerable-communities, workers
  Exposure Pathways: algorithmic-decision-impact
  Ecosystem Positions: regulators-public-servants, indirectly-affected
  Impact Level: sector
  URL: /incidents/INC-26-0075-canada-immigration-ai-hallucinated-duties/

- INC-26-0086: North Korea 'AI Fake Applicant' Campaign — Deepfake Video Interviews to Infiltrate Western Companies
  Date: 2026-03 | Severity: high | Type: harm | Status: confirmed | Resolution: open | Evidence: corroborated | Sources: 2
  Domain: information-integrity | Primary Pattern: deepfake-identity-hijacking
  Regions: global, north-america | Sectors: technology, employment
  Threat Actors: DPRK intelligence services
  Affected Groups: business-organizations, national-security-systems
  Exposure Pathways: adversarial-targeting
  Ecosystem Positions: indirectly-affected
  Impact Level: global
  URL: /incidents/INC-26-0086-nk-deepfake-job-interviews/

- INC-26-0087: Context Hub Documentation Poisoning — AI Coding Assistants Write Malicious Code 100% of Time from Poisoned Docs
  Date: 2026-03 | Severity: medium | Type: near_miss | Status: confirmed | Resolution: open | Evidence: corroborated | Sources: 3
  Domain: security-cyber | Primary Pattern: data-poisoning
  Regions: global | Sectors: technology
  Affected Groups: developers-ai-builders
  Exposure Pathways: infrastructure-dependency
  Ecosystem Positions: developers-providers, direct-users
  Impact Level: sector
  URL: /incidents/INC-26-0087-context-hub-documentation-poisoning/

- INC-26-0089: Claude Code 'Claudy Day' Vulnerability Chain — Silent Data Exfiltration via Prompt Injection
  Date: 2026-03 | Severity: high | Type: near_miss | Status: confirmed | Resolution: resolved | Evidence: corroborated | Sources: 2
  Domain: security-cyber | Primary Pattern: prompt-injection-attack
  Regions: global | Sectors: technology
  Affected Groups: general-public
  Exposure Pathways: adversarial-targeting, direct-interaction
  Ecosystem Positions: direct-users, developers-providers
  Impact Level: sector
  URL: /incidents/INC-26-0089-claude-claudy-day-vulnerabilities/

- INC-26-0096: Alibaba ROME AI Agent Autonomously Mines Cryptocurrency and Opens SSH Tunnel
  Date: 2026-03 | Severity: high | Type: near_miss | Status: confirmed | Resolution: resolved | Evidence: corroborated | Sources: 4
  Domain: agentic-autonomous | Primary Pattern: tool-misuse-privilege-escalation | Secondary: agentic-autonomous/specification-gaming, agentic-autonomous/goal-drift
  Regions: asia, china | Sectors: technology
  Victim Organizations: Alibaba
  Affected Groups: developers-ai-builders
  Exposure Pathways: infrastructure-dependency
  Ecosystem Positions: developers-providers
  Impact Level: organization
  URL: /incidents/INC-26-0096-alibaba-rome-agent-crypto-mining/

- INC-26-0029: US Military AI Targeting Platform Fed Stale Data Contributes to Strike on Iranian Elementary School
  Date: 2026-02-28 | Severity: critical | Type: harm | Status: confirmed | Resolution: open | Evidence: corroborated | Sources: 5
  Domain: systemic-catastrophic | Primary Pattern: lethal-autonomous-weapon-systems | Secondary: human-ai-control/overreliance-automation-bias
  Regions: middle-east | Sectors: government, education
  Affected Groups: children, general-public
  Exposure Pathways: algorithmic-decision-impact
  Ecosystem Positions: deployers-operators, indirectly-affected
  Impact Level: global
  URL: /incidents/INC-26-0029-us-military-ai-targeting-school-strike/

- INC-26-0034: OpenAI Pentagon Contract Triggers 295% ChatGPT Uninstall Surge and #QuitGPT Movement
  Date: 2026-02-28 | Severity: high | Type: harm | Status: confirmed | Resolution: open | Evidence: corroborated | Sources: 8
  Domain: systemic-catastrophic | Primary Pattern: accumulative-risk-trust-erosion | Secondary: human-ai-control/safety-governance-override
  Regions: north-america, global | Sectors: technology, government
  Affected Groups: general-public, developers-ai-builders
  Exposure Pathways: direct-interaction
  Ecosystem Positions: direct-users, developers-providers
  Impact Level: global
  URL: /incidents/INC-26-0034-openai-pentagon-quitgpt-revolt/

- INC-26-0027: Block (Square) Cuts Approximately 4,000 Jobs as AI Replaces Customer Service Workforce
  Date: 2026-02-26 | Severity: critical | Type: harm | Status: confirmed | Resolution: open | Evidence: corroborated | Sources: 6
  Domain: economic-labor | Primary Pattern: automation-induced-job-degradation | Secondary: systemic-catastrophic/accumulative-risk-trust-erosion
  Regions: north-america | Sectors: technology, finance
  Affected Groups: workers, society-at-large
  Exposure Pathways: economic-displacement
  Ecosystem Positions: deployers-operators, indirectly-affected
  Impact Level: sector
  URL: /incidents/INC-26-0027-block-ai-mass-layoffs/

- INC-26-0092: Anthropic Removes Categorical Safety Pause Trigger from Responsible Scaling Policy
  Date: 2026-02-24 | Severity: critical | Type: systemic_risk | Status: confirmed | Resolution: open | Evidence: primary | Sources: 5
  Domain: human-ai-control | Primary Pattern: safety-governance-override | Secondary: systemic-catastrophic/accumulative-risk-trust-erosion
  Regions: north-america, global | Sectors: technology, regulation
  Affected Groups: developers-ai-builders, society-at-large
  Exposure Pathways: infrastructure-dependency
  Ecosystem Positions: developers-providers, indirectly-affected
  Impact Level: global
  URL: /incidents/INC-26-0092-anthropic-rsp-safety-pledge-dropped/

- INC-26-0004: Individual jailed for online gambling fraud using stolen identities
  Date: 2026-02-20 | Severity: high | Type: harm | Status: confirmed | Resolution: resolved | Evidence: primary | Sources: 1
  Domain: privacy-surveillance | Primary Pattern: re-identification-attacks | Secondary: information-integrity/ai-enabled-fraud, security-cyber/model-inversion-data-extraction, information-integrity/deepfake-identity-hijacking
  Regions: europe, north-america, oceania | Sectors: finance
  Affected Groups: general-public
  Exposure Pathways: adversarial-targeting
  Ecosystem Positions: direct-users
  Impact Level: individual
  URL: /incidents/INC-26-0004-individual-jailed-for-online-gambling-fraud-using-stolen-ide/

- INC-26-0003: Tesla Autopilot involved in 13 fatal crashes, US regulator finds
  Date: 2026-02-20 | Severity: critical | Type: systemic_risk | Status: confirmed | Resolution: open | Evidence: primary | Sources: 6
  Domain: human-ai-control | Primary Pattern: overreliance-automation-bias | Secondary: systemic-catastrophic/infrastructure-dependency-collapse, information-integrity/misinformation-hallucinated-content
  Regions: north-america | Sectors: transportation, public-safety
  Affected Groups: general-public
  Exposure Pathways: infrastructure-dependency
  Ecosystem Positions: developers-providers, direct-users
  Impact Level: sector
  URL: /incidents/INC-26-0003-tesla-autopilot-involved-in-13-fatal-crashes-us-regulator-fi/

- INC-26-0001: Disrupting malicious uses of AI: June 2025 | OpenAI
  Date: 2026-02-18 | Severity: high | Type: harm | Status: confirmed | Resolution: open | Evidence: corroborated | Sources: 4
  Domain: information-integrity | Primary Pattern: deepfake-identity-hijacking | Secondary: information-integrity/ai-enabled-fraud, security-cyber/social-engineering-via-ai
  Regions: unknown | Sectors: cross-sector
  Affected Groups: business-organizations, government-institutions
  Exposure Pathways: adversarial-targeting
  Ecosystem Positions: developers-providers
  Impact Level: sector
  URL: /incidents/INC-26-0001-disrupting-malicious-uses-of-ai-june-2025-openai/

- INC-26-0032: OpenAI Disbands Mission Alignment Team, Removes 'Safely' from Mission, Restructures as Public Benefit Corporation
  Date: 2026-02-11 | Severity: critical | Type: systemic_risk | Status: confirmed | Resolution: open | Evidence: corroborated | Sources: 10
  Domain: systemic-catastrophic | Primary Pattern: accumulative-risk-trust-erosion | Secondary: human-ai-control/safety-governance-override, economic-labor/power-data-concentration
  Regions: global | Sectors: technology
  Affected Groups: developers-ai-builders, society-at-large
  Exposure Pathways: infrastructure-dependency
  Ecosystem Positions: developers-providers, indirectly-affected
  Impact Level: global
  URL: /incidents/INC-26-0032-openai-governance-safety-crisis/

- INC-26-0026: Tumbler Ridge Mass Shooting — ChatGPT Used in Attack Planning
  Date: 2026-02-10 | Severity: critical | Type: harm | Status: confirmed | Resolution: open | Evidence: corroborated | Sources: 6
  Domain: human-ai-control | Primary Pattern: unsafe-human-in-the-loop-failures | Secondary: security-cyber/jailbreak-guardrail-bypass
  Regions: canada | Sectors: public-safety, technology
  Affected Groups: children, general-public
  Exposure Pathways: direct-interaction
  Ecosystem Positions: direct-users, indirectly-affected
  Impact Level: society-wide
  URL: /incidents/INC-26-0026-tumbler-ridge-mass-shooting-chatgpt/

- INC-26-0061: OpenClaw AI Agent Autonomously Retaliates Against Matplotlib Maintainer — First AI Retaliation Incident
  Date: 2026-02-10 | Severity: high | Type: harm | Status: confirmed | Resolution: open | Evidence: corroborated | Sources: 3
  Domain: agentic-autonomous | Primary Pattern: goal-drift
  Regions: global | Sectors: technology
  Victim Organizations: matplotlib project
  Affected Groups: developers-ai-builders
  Exposure Pathways: adversarial-targeting
  Ecosystem Positions: developers-providers, indirectly-affected
  Impact Level: sector
  URL: /incidents/INC-26-0061-openclaw-matplotlib-retaliation/

- INC-26-0025: Microsoft GRP-Obliteration: Single Prompt Reverses Safety Alignment Across 15 LLMs
  Date: 2026-02-09 | Severity: high | Type: systemic_risk | Status: confirmed | Resolution: open | Evidence: primary | Sources: 3
  Domain: security-cyber | Primary Pattern: jailbreak-guardrail-bypass
  Regions: north-america | Sectors: technology, cross-sector
  Affected Groups: society-at-large, developers-ai-builders
  Exposure Pathways: infrastructure-dependency
  Ecosystem Positions: developers-providers
  Impact Level: sector
  URL: /incidents/INC-26-0025-grp-obliteration-safety-reversal/

- INC-26-0058: Trump Shares Racist AI-Generated Deepfake of Obamas — Remains Online 12 Hours
  Date: 2026-02-05 | Severity: high | Type: harm | Status: confirmed | Resolution: open | Evidence: primary | Sources: 4
  Domain: information-integrity | Primary Pattern: deepfake-identity-hijacking | Secondary: discrimination-social-harm/representational-harm
  Regions: north-america | Sectors: elections, media
  Affected Groups: general-public, vulnerable-communities, democratic-institutions
  Exposure Pathways: direct-interaction
  Ecosystem Positions: direct-users, indirectly-affected
  Impact Level: society-wide
  URL: /incidents/INC-26-0058-trump-deepfake-obamas/

- INC-26-0078: International AI Safety Report 2026 — 100+ Experts Warn of Escalating Risks, Safeguards 'Will Likely Fail'
  Date: 2026-02-03 | Severity: high | Type: signal | Status: confirmed | Resolution: open | Evidence: primary | Sources: 3
  Domain: systemic-catastrophic | Primary Pattern: accumulative-risk-trust-erosion
  Regions: global | Sectors: cross-sector
  Affected Groups: society-at-large
  Exposure Pathways: infrastructure-dependency
  Ecosystem Positions: regulators-public-servants, developers-providers
  Impact Level: global
  URL: /incidents/INC-26-0078-international-ai-safety-report-2026/

- INC-26-0006: AI Recommendation Poisoning via 'Summarize with AI' Buttons (31 Companies)
  Date: 2026-02 | Severity: high | Type: systemic_risk | Status: confirmed | Resolution: open | Evidence: primary | Sources: 5
  Domain: agentic-autonomous | Primary Pattern: memory-poisoning | Secondary: human-ai-control/deceptive-manipulative-interfaces, information-integrity/disinformation-campaigns
  Regions: global | Sectors: technology, healthcare, finance, corporate, cross-sector
  Affected Groups: general-public, business-organizations
  Exposure Pathways: direct-interaction, adversarial-targeting
  Ecosystem Positions: deployers-operators, direct-users
  Impact Level: sector
  URL: /incidents/INC-26-0006-ai-recommendation-poisoning-summarize-buttons/

- INC-26-0007: Unit 42 Demonstrates Persistent Memory Injection in Amazon Bedrock Agents
  Date: 2026-02 | Severity: medium | Type: signal | Status: confirmed | Resolution: open | Evidence: primary | Sources: 1
  Domain: agentic-autonomous | Primary Pattern: memory-poisoning | Secondary: security-cyber/model-inversion-data-extraction
  Regions: global | Sectors: technology, cross-sector
  Victim Organizations: amazon
  Affected Groups: business-organizations, developers-ai-builders
  Exposure Pathways: adversarial-targeting
  Ecosystem Positions: developers-providers, deployers-operators
  Impact Level: sector
  URL: /incidents/INC-26-0007-unit42-bedrock-agent-memory-injection-poc/

- INC-26-0014: CodeWall AI Agent Breaches McKinsey Lilli Platform via SQL Injection
  Date: 2026-02 | Severity: critical | Type: harm | Status: confirmed | Resolution: resolved | Evidence: primary | Sources: 3
  Domain: security-cyber | Primary Pattern: automated-vulnerability-discovery | Secondary: agentic-autonomous/tool-misuse-privilege-escalation
  Regions: north-america, europe | Sectors: corporate, technology
  Victim Organizations: McKinsey & Company
  Affected Groups: business-organizations, workers
  Exposure Pathways: adversarial-targeting
  Ecosystem Positions: deployers-operators, direct-users
  Impact Level: organization
  URL: /incidents/INC-26-0014-mckinsey-lilli-ai-platform-breach/

- INC-26-0016: Clinejection: Prompt Injection in Cline AI Bot Enables npm Supply Chain Attack
  Date: 2026-02 | Severity: critical | Type: harm | Status: confirmed | Resolution: resolved | Evidence: primary | Sources: 4
  Domain: security-cyber | Primary Pattern: ai-supply-chain-attack | Secondary: security-cyber/prompt-injection-attack
  Regions: north-america, europe | Sectors: technology
  Victim Organizations: Cline
  Affected Groups: developers-ai-builders
  Exposure Pathways: adversarial-targeting, infrastructure-dependency
  Ecosystem Positions: developers-providers, direct-users
  Impact Level: sector
  URL: /incidents/INC-26-0016-clinejection-cline-supply-chain-attack/

- INC-26-0019: MCP TypeScript SDK Race Condition Leaks Data Across Client Boundaries
  Date: 2026-02 | Severity: high | Type: harm | Status: confirmed | Resolution: resolved | Evidence: primary | Sources: 2
  Domain: agentic-autonomous | Primary Pattern: agent-to-agent-propagation
  Regions: north-america | Sectors: technology
  Affected Groups: developers-ai-builders
  Exposure Pathways: infrastructure-dependency
  Ecosystem Positions: developers-providers, deployers-operators
  Impact Level: sector
  URL: /incidents/INC-26-0019-mcp-sdk-cross-client-data-leak/

- INC-26-0021: ModelScope MS-Agent Shell Tool Command Injection Vulnerability
  Date: 2026-02 | Severity: high | Type: near_miss | Status: confirmed | Resolution: open | Evidence: primary | Sources: 3
  Domain: agentic-autonomous | Primary Pattern: tool-misuse-privilege-escalation
  Regions: asia, north-america | Sectors: technology
  Affected Groups: developers-ai-builders, business-organizations
  Exposure Pathways: adversarial-targeting
  Ecosystem Positions: developers-providers, deployers-operators
  Impact Level: sector
  URL: /incidents/INC-26-0021-ms-agent-shell-command-injection/

- INC-26-0028: Anthropic Blacklisted by US Government After Refusing Autonomous Weapons and Mass Surveillance Contracts
  Date: 2026-02 | Severity: critical | Type: systemic_risk | Status: confirmed | Resolution: open | Evidence: primary | Sources: 6
  Domain: systemic-catastrophic | Primary Pattern: strategic-misalignment | Secondary: systemic-catastrophic/accumulative-risk-trust-erosion
  Regions: north-america | Sectors: technology, government
  Victim Organizations: Anthropic
  Affected Groups: developers-ai-builders, government-institutions, national-security-systems
  Exposure Pathways: infrastructure-dependency
  Ecosystem Positions: developers-providers, regulators-public-servants, organizational-leaders
  Impact Level: society-wide
  URL: /incidents/INC-26-0028-anthropic-pentagon-blacklisting-standoff/

- INC-26-0036: MizarVision Chinese AI Startup Publishes Real-Time US Military Intelligence via Satellite Imagery
  Date: 2026-02 | Severity: critical | Type: harm | Status: confirmed | Resolution: open | Evidence: corroborated | Sources: 3
  Domain: systemic-catastrophic | Primary Pattern: lethal-autonomous-weapon-systems | Secondary: security-cyber/automated-vulnerability-discovery
  Regions: middle-east, china, north-america | Sectors: government, technology
  Victim Organizations: US Department of Defense
  Threat Actors: MizarVision
  Affected Groups: national-security-systems, government-institutions
  Exposure Pathways: adversarial-targeting
  Ecosystem Positions: developers-providers, indirectly-affected
  Impact Level: global
  URL: /incidents/INC-26-0036-mizarvision-us-military-intelligence-exposure/

- INC-26-0070: Claude Safety Testing Reveals Extreme Self-Preservation Behavior Including Blackmail Suggestions
  Date: 2026-02 | Severity: high | Type: near_miss | Status: confirmed | Resolution: open | Evidence: primary | Sources: 2
  Domain: agentic-autonomous | Primary Pattern: specification-gaming
  Regions: global | Sectors: technology
  Affected Groups: society-at-large
  Exposure Pathways: infrastructure-dependency
  Ecosystem Positions: developers-providers
  Impact Level: global
  URL: /incidents/INC-26-0070-claude-safety-test-blackmail-behavior/

- INC-26-0073: ChatGPT Ads Launch Triggers Researcher Resignation and Anthropic Counter-Marketing
  Date: 2026-02 | Severity: high | Type: signal | Status: confirmed | Resolution: open | Evidence: primary | Sources: 3
  Domain: human-ai-control | Primary Pattern: deceptive-manipulative-interfaces
  Regions: global | Sectors: technology
  Affected Groups: general-public
  Exposure Pathways: direct-interaction
  Ecosystem Positions: direct-users, developers-providers
  Impact Level: sector
  URL: /incidents/INC-26-0073-chatgpt-ads-launch-backlash/

- INC-26-0099: PROMPTSPY: Android Malware Using Gemini API for Runtime UI Automation
  Date: 2026-02 | Severity: high | Type: signal | Status: confirmed | Resolution: resolved | Evidence: primary | Sources: 6
  Domain: security-cyber | Primary Pattern: ai-morphed-malware | Secondary: agentic-autonomous/tool-misuse-privilege-escalation, security-cyber/adversarial-evasion
  Regions: south-america, argentina | Sectors: technology, cross-sector
  Affected Groups: general-public
  Exposure Pathways: adversarial-targeting, direct-interaction
  Ecosystem Positions: developers-providers, direct-users
  Impact Level: individual
  URL: /incidents/INC-26-0099-promptspy-android-backdoor-gemini-api/

- INC-26-0100: TeamPCP Supply-Chain Campaign Against AI and Security Tooling (Trivy, Checkmarx, LiteLLM)
  Date: 2026-02 | Severity: critical | Type: harm | Status: confirmed | Resolution: open | Evidence: primary | Sources: 6
  Domain: security-cyber | Primary Pattern: ai-supply-chain-attack
  Regions: global | Sectors: technology, cross-sector
  Victim Organizations: BerriAI, Aqua Security (Trivy), Checkmarx, Telnyx, Bitwarden, xinference, Cisco
  Threat Actors: TeamPCP, UNC6780
  Affected Groups: developers-ai-builders, business-organizations
  Exposure Pathways: infrastructure-dependency, adversarial-targeting
  Ecosystem Positions: developers-providers, deployers-operators
  Impact Level: sector
  URL: /incidents/INC-26-0100-teampcp-supply-chain-litellm-trivy/

- INC-26-0040: Universal Music, Concord, and ABKCO Sue Anthropic for $3 Billion Over Alleged Training Data Piracy
  Date: 2026-01-28 | Severity: critical | Type: harm | Status: confirmed | Resolution: open | Evidence: corroborated | Sources: 3
  Domain: economic-labor | Primary Pattern: power-data-concentration | Secondary: systemic-catastrophic/accumulative-risk-trust-erosion
  Regions: north-america | Sectors: technology, media, legal
  Victim Organizations: Universal Music Group, Concord Music, ABKCO
  Affected Groups: workers, business-organizations
  Exposure Pathways: infrastructure-dependency
  Ecosystem Positions: developers-providers, indirectly-affected
  Impact Level: sector
  URL: /incidents/INC-26-0040-universal-music-anthropic-copyright-lawsuit/

- INC-26-0044: Waymo Robotaxi Strikes Child Near Elementary School in Santa Monica — NHTSA Investigation Opened
  Date: 2026-01-23 | Severity: critical | Type: harm | Status: confirmed | Resolution: open | Evidence: primary | Sources: 3
  Domain: human-ai-control | Primary Pattern: unsafe-human-in-the-loop-failures
  Regions: north-america | Sectors: transportation, technology
  Affected Groups: children, general-public
  Exposure Pathways: infrastructure-dependency
  Ecosystem Positions: deployers-operators, indirectly-affected
  Impact Level: sector
  URL: /incidents/INC-26-0044-waymo-robotaxi-strikes-child/

- INC-26-0035: Grok AI Integrated into Pentagon Military Networks During CSAM Scandal
  Date: 2026-01-12 | Severity: critical | Type: systemic_risk | Status: confirmed | Resolution: open | Evidence: corroborated | Sources: 3
  Domain: systemic-catastrophic | Primary Pattern: strategic-misalignment | Secondary: systemic-catastrophic/accumulative-risk-trust-erosion
  Regions: north-america | Sectors: government, technology
  Affected Groups: national-security-systems, government-institutions
  Exposure Pathways: infrastructure-dependency
  Ecosystem Positions: deployers-operators, regulators-public-servants
  Impact Level: global
  URL: /incidents/INC-26-0035-grok-pentagon-military-deployment/

- INC-26-0045: Character.AI Settles Five Teen Suicide Lawsuits as Kentucky Becomes First State to Sue
  Date: 2026-01-07 | Severity: critical | Type: harm | Status: confirmed | Resolution: resolved | Evidence: primary | Sources: 4
  Domain: human-ai-control | Primary Pattern: loss-of-human-agency | Secondary: human-ai-control/deceptive-manipulative-interfaces
  Regions: north-america | Sectors: technology, legal
  Affected Groups: children, vulnerable-communities
  Exposure Pathways: direct-interaction
  Ecosystem Positions: direct-users, indirectly-affected
  Impact Level: society-wide
  URL: /incidents/INC-26-0045-character-ai-teen-suicide-legal-reckoning/

- INC-26-0005: AI impacting labor market like a tsunami as layoff fears mount
  Date: 2026-01 | Severity: high | Type: systemic_risk | Status: confirmed | Resolution: open | Evidence: corroborated | Sources: 1
  Domain: economic-labor | Primary Pattern: automation-induced-job-degradation | Secondary: human-ai-control/overreliance-automation-bias
  Regions: north-america | Sectors: employment, corporate, cross-sector
  Affected Groups: workers, business-organizations
  Exposure Pathways: economic-displacement
  Ecosystem Positions: developers-providers, organizational-leaders
  Impact Level: sector
  URL: /incidents/INC-26-0005-ai-impacting-labor-market-like-a-tsunami-as-layoff-fears-mou/

- INC-26-0013: OpenClaw AI Agent Platform Hit by Critical Vulnerability and Supply Chain Campaign
  Date: 2026-01 | Severity: critical | Type: harm | Status: confirmed | Resolution: resolved | Evidence: corroborated | Sources: 3
  Domain: security-cyber | Primary Pattern: ai-supply-chain-attack | Secondary: agentic-autonomous/tool-misuse-privilege-escalation
  Regions: north-america, asia, europe | Sectors: technology, corporate
  Threat Actors: ClawHavoc campaign operators
  Affected Groups: developers-ai-builders, business-organizations
  Exposure Pathways: adversarial-targeting, infrastructure-dependency
  Ecosystem Positions: developers-providers, deployers-operators
  Impact Level: sector
  URL: /incidents/INC-26-0013-openclaw-ai-agent-security-crisis/

- INC-26-0010: New Zealand AI News Pages Flood Facebook with Rewritten Stories and Synthetic Images
  Date: 2026-01 | Severity: high | Type: harm | Status: confirmed | Resolution: open | Evidence: corroborated | Sources: 3
  Domain: information-integrity | Primary Pattern: synthetic-media-manipulation | Secondary: information-integrity/misinformation-hallucinated-content
  Regions: oceania | Sectors: media
  Affected Groups: general-public
  Exposure Pathways: direct-interaction
  Ecosystem Positions: direct-users, indirectly-affected
  Impact Level: society-wide
  URL: /incidents/INC-26-0010-nz-news-hub-ai-rewritten-news/

- INC-26-0020: AI-Generated Code Vulnerability Surge: 74 Confirmed CVEs Traced to Coding Assistants
  Date: 2026-01 | Severity: high | Type: systemic_risk | Status: confirmed | Resolution: open | Evidence: corroborated | Sources: 3
  Domain: human-ai-control | Primary Pattern: overreliance-automation-bias | Secondary: security-cyber/automated-vulnerability-discovery
  Regions: north-america, europe | Sectors: technology
  Affected Groups: developers-ai-builders, general-public, society-at-large
  Exposure Pathways: infrastructure-dependency
  Ecosystem Positions: developers-providers, direct-users, indirectly-affected
  Impact Level: sector
  URL: /incidents/INC-26-0020-ai-generated-code-vulnerability-explosion/

- INC-26-0022: Cursor AI Code Editor Shell Built-In Allowlist Bypass Enables Zero-Click RCE
  Date: 2026-01 | Severity: high | Type: near_miss | Status: confirmed | Resolution: resolved | Evidence: corroborated | Sources: 2
  Domain: security-cyber | Primary Pattern: prompt-injection-attack | Secondary: agentic-autonomous/tool-misuse-privilege-escalation
  Regions: north-america, europe | Sectors: technology
  Affected Groups: developers-ai-builders
  Exposure Pathways: adversarial-targeting, direct-interaction
  Ecosystem Positions: developers-providers, direct-users
  Impact Level: sector
  URL: /incidents/INC-26-0022-cursor-ide-prompt-injection-rce/

- INC-26-0017: Claude Code Remote Code Execution and API Key Exfiltration Vulnerabilities
  Date: 2026-01 | Severity: high | Type: near_miss | Status: confirmed | Resolution: resolved | Evidence: corroborated | Sources: 3
  Domain: agentic-autonomous | Primary Pattern: tool-misuse-privilege-escalation | Secondary: security-cyber/prompt-injection-attack
  Regions: north-america, europe | Sectors: technology
  Affected Groups: developers-ai-builders
  Exposure Pathways: adversarial-targeting, direct-interaction
  Ecosystem Positions: developers-providers, direct-users
  Impact Level: sector
  URL: /incidents/INC-26-0017-claude-code-rce-vulnerabilities/

- INC-26-0023: Google Vertex AI Default Configurations Enable Privilege Escalation to Service Agent Roles
  Date: 2026-01 | Severity: high | Type: near_miss | Status: confirmed | Resolution: open | Evidence: corroborated | Sources: 3
  Domain: agentic-autonomous | Primary Pattern: tool-misuse-privilege-escalation
  Regions: north-america, europe, asia | Sectors: technology, cross-sector
  Affected Groups: business-organizations, developers-ai-builders
  Exposure Pathways: infrastructure-dependency
  Ecosystem Positions: developers-providers, deployers-operators
  Impact Level: sector
  URL: /incidents/INC-26-0023-google-vertex-ai-privilege-escalation/

- INC-26-0031: ChatGPT Adult Mode Planned Despite Unanimous Safety Advisor Opposition; Feature Paused After Backlash
  Date: 2026-01 | Severity: high | Type: harm | Status: confirmed | Resolution: resolved | Evidence: corroborated | Sources: 5
  Domain: human-ai-control | Primary Pattern: deceptive-manipulative-interfaces | Secondary: human-ai-control/safety-governance-override, systemic-catastrophic/accumulative-risk-trust-erosion
  Regions: global | Sectors: technology
  Affected Groups: children, general-public
  Exposure Pathways: direct-interaction
  Ecosystem Positions: direct-users, developers-providers
  Impact Level: global
  URL: /incidents/INC-26-0031-chatgpt-adult-mode-safety-crisis/

- INC-26-0046: LSU AI Cheating Detection Crisis — 1,488 Cases Filed with Disproportionate Impact on Non-Native English Speakers
  Date: 2026-01 | Severity: critical | Type: harm | Status: confirmed | Resolution: open | Evidence: primary | Sources: 3
  Domain: human-ai-control | Primary Pattern: overreliance-automation-bias | Secondary: discrimination-social-harm/allocational-harm
  Regions: north-america | Sectors: education
  Affected Groups: vulnerable-communities, general-public
  Exposure Pathways: algorithmic-decision-impact
  Ecosystem Positions: deployers-operators, direct-users
  Impact Level: institution
  URL: /incidents/INC-26-0046-lsu-ai-cheating-detection-crisis/

- INC-26-0050: AI Healthcare Bias Study — 1.7 Million Responses Show Race-Based Treatment Differences Across 9 AI Programs
  Date: 2026-01 | Severity: critical | Type: harm | Status: confirmed | Resolution: open | Evidence: primary | Sources: 3
  Domain: discrimination-social-harm | Primary Pattern: data-imbalance-bias | Secondary: human-ai-control/overreliance-automation-bias
  Regions: north-america | Sectors: healthcare
  Affected Groups: vulnerable-communities, general-public
  Exposure Pathways: algorithmic-decision-impact
  Ecosystem Positions: deployers-operators, indirectly-affected
  Impact Level: sector
  URL: /incidents/INC-26-0050-ai-healthcare-bias-race-based-treatment/

- INC-26-0052: ICE Deploys Warrantless AI Surveillance Combining Palantir, Clearview, Iris Scanning, and Phone Hacking
  Date: 2026-01 | Severity: critical | Type: harm | Status: confirmed | Resolution: open | Evidence: primary | Sources: 4
  Domain: privacy-surveillance | Primary Pattern: mass-surveillance-amplification | Secondary: privacy-surveillance/biometric-exploitation
  Regions: north-america | Sectors: government, law-enforcement
  Affected Groups: vulnerable-communities, general-public, democratic-institutions
  Exposure Pathways: adversarial-targeting, algorithmic-decision-impact
  Ecosystem Positions: regulators-public-servants, indirectly-affected
  Impact Level: society-wide
  URL: /incidents/INC-26-0052-ice-warrantless-ai-surveillance/

- INC-26-0055: Perplexity Comet AI Browser Enables Zero-Click Credential Theft via Prompt Injection
  Date: 2026-01 | Severity: high | Type: harm | Status: confirmed | Resolution: open | Evidence: corroborated | Sources: 3
  Domain: security-cyber | Primary Pattern: prompt-injection-attack
  Regions: global | Sectors: technology
  Affected Groups: general-public
  Exposure Pathways: direct-interaction, adversarial-targeting
  Ecosystem Positions: direct-users, developers-providers
  Impact Level: sector
  URL: /incidents/INC-26-0055-perplexity-comet-credential-theft/

- INC-26-0056: Eightfold AI Sued for Creating Secret Dossiers on 1 Billion+ Workers with Hidden Scoring
  Date: 2026-01 | Severity: high | Type: harm | Status: confirmed | Resolution: open | Evidence: corroborated | Sources: 3
  Domain: privacy-surveillance | Primary Pattern: behavioral-profiling-without-consent | Secondary: discrimination-social-harm/allocational-harm
  Regions: global | Sectors: employment, technology
  Affected Groups: workers, general-public
  Exposure Pathways: algorithmic-decision-impact
  Ecosystem Positions: developers-providers, indirectly-affected
  Impact Level: global
  URL: /incidents/INC-26-0056-eightfold-ai-secret-worker-dossiers/

- INC-26-0062: Google Gemini Tells Student 'Please Die' During Homework Help Session
  Date: 2026-01 | Severity: high | Type: harm | Status: confirmed | Resolution: open | Evidence: primary | Sources: 4
  Domain: human-ai-control | Primary Pattern: loss-of-human-agency
  Regions: north-america | Sectors: technology, education
  Affected Groups: general-public
  Exposure Pathways: direct-interaction
  Ecosystem Positions: direct-users, developers-providers
  Impact Level: sector
  URL: /incidents/INC-26-0062-gemini-please-die-message/

- INC-26-0063: Reno Casino Facial Recognition Wrongful Arrest — '100% Match' Was 4 Inches Shorter with Different Eye Color
  Date: 2026-01 | Severity: high | Type: harm | Status: confirmed | Resolution: open | Evidence: corroborated | Sources: 3
  Domain: privacy-surveillance | Primary Pattern: biometric-exploitation
  Regions: north-america | Sectors: law-enforcement
  Affected Groups: general-public
  Exposure Pathways: algorithmic-decision-impact
  Ecosystem Positions: indirectly-affected
  Impact Level: individual
  URL: /incidents/INC-26-0063-reno-casino-frt-wrongful-arrest/

- INC-26-0069: Grok Inserts 'White Genocide' Conspiracy Theory and Holocaust Denial into Unrelated Queries
  Date: 2026-01 | Severity: medium | Type: harm | Status: confirmed | Resolution: open | Evidence: corroborated | Sources: 3
  Domain: information-integrity | Primary Pattern: misinformation-hallucinated-content
  Regions: global | Sectors: technology, media
  Affected Groups: general-public
  Exposure Pathways: direct-interaction
  Ecosystem Positions: direct-users, developers-providers
  Impact Level: society-wide
  URL: /incidents/INC-26-0069-grok-white-genocide-conspiracy/

- INC-26-0076: ECRI Names AI Chatbot Misuse as #1 Health Technology Hazard for 2026
  Date: 2026-01 | Severity: high | Type: signal | Status: confirmed | Resolution: open | Evidence: primary | Sources: 3
  Domain: human-ai-control | Primary Pattern: overreliance-automation-bias
  Regions: global | Sectors: healthcare
  Affected Groups: general-public, workers
  Exposure Pathways: direct-interaction
  Ecosystem Positions: direct-users, indirectly-affected
  Impact Level: sector
  URL: /incidents/INC-26-0076-ecri-ai-chatbot-health-hazard/

- INC-26-0083: DeepSeek Mass Government Bans and Publicly Exposed Database with 1M+ Records
  Date: 2026-01 | Severity: high | Type: harm | Status: confirmed | Resolution: open | Evidence: primary | Sources: 4
  Domain: privacy-surveillance | Primary Pattern: mass-surveillance-amplification
  Regions: global, china | Sectors: technology, government
  Affected Groups: general-public, national-security-systems, government-institutions
  Exposure Pathways: infrastructure-dependency, direct-interaction
  Ecosystem Positions: developers-providers, regulators-public-servants
  Impact Level: global
  URL: /incidents/INC-26-0083-deepseek-mass-bans-exposed-database/

- INC-26-0090: AI Deepfakes Surge in 2026 US Midterm Campaigns — Only 28 States Have Disclosure Laws
  Date: 2026-01 | Severity: high | Type: harm | Status: confirmed | Resolution: open | Evidence: corroborated | Sources: 3
  Domain: information-integrity | Primary Pattern: disinformation-campaigns
  Regions: north-america | Sectors: elections, media
  Affected Groups: general-public, democratic-institutions
  Exposure Pathways: direct-interaction
  Ecosystem Positions: indirectly-affected
  Impact Level: society-wide
  URL: /incidents/INC-26-0090-ai-deepfakes-2026-midterm-campaigns/

- INC-26-0101: State-Sponsored Adversary Use of the Gemini API for Vulnerability Research and Operational Support
  Date: 2026-01 | Severity: high | Type: signal | Status: confirmed | Resolution: open | Evidence: primary | Sources: 6
  Domain: security-cyber | Primary Pattern: automated-vulnerability-discovery | Secondary: security-cyber/jailbreak-guardrail-bypass, agentic-autonomous/tool-misuse-privilege-escalation
  Regions: global, asia, east-asia | Sectors: technology, government, cross-sector
  Threat Actors: UNC2814, APT45, APT27
  Affected Groups: national-security-systems, critical-infrastructure-operators, developers-ai-builders
  Exposure Pathways: adversarial-targeting, infrastructure-dependency
  Ecosystem Positions: developers-providers
  Impact Level: society-wide
  URL: /incidents/INC-26-0101-state-actors-gemini-vulnerability-research/

- INC-26-0106: Claude Models Breach Real Organizations During Cybersecurity Evaluations
  Date: 2026-01 | Severity: high | Type: harm | Status: confirmed | Resolution: open | Evidence: primary | Sources: 5
  Domain: agentic-autonomous | Primary Pattern: tool-misuse-privilege-escalation
  Regions: global, north-america | Sectors: technology
  Affected Groups: business-organizations
  Exposure Pathways: adversarial-targeting
  Ecosystem Positions: developers-providers, deployers-operators
  Impact Level: organization
  URL: /incidents/INC-26-0106-claude-models-breach-real-organizations-cyber-evaluations/

- INC-26-0068: Palantir ImmigrationOS — ICE Pays $30M for AI System Creating Neighborhood Deportation Maps
  Date: 2026 | Severity: high | Type: harm | Status: confirmed | Resolution: open | Evidence: corroborated | Sources: 3
  Domain: privacy-surveillance | Primary Pattern: mass-surveillance-amplification
  Regions: north-america | Sectors: government, law-enforcement
  Affected Groups: vulnerable-communities, general-public
  Exposure Pathways: adversarial-targeting, algorithmic-decision-impact
  Ecosystem Positions: regulators-public-servants, indirectly-affected
  Impact Level: society-wide
  URL: /incidents/INC-26-0068-palantir-immigrationos-ice/

- INC-26-0077: Brazil — 1 Million Schoolchildren Scanned Daily by Facial Recognition Across 1,700+ Schools
  Date: 2026 | Severity: high | Type: harm | Status: confirmed | Resolution: open | Evidence: corroborated | Sources: 3
  Domain: privacy-surveillance | Primary Pattern: mass-surveillance-amplification | Secondary: privacy-surveillance/biometric-exploitation
  Regions: latin-america | Sectors: education, government
  Affected Groups: children, vulnerable-communities
  Exposure Pathways: algorithmic-decision-impact
  Ecosystem Positions: regulators-public-servants, indirectly-affected
  Impact Level: society-wide
  URL: /incidents/INC-26-0077-brazil-million-schoolchildren-frt/

- INC-25-0048: Australia Scraps AI Advisory Body After 15 Months and $188K, Drops Mandatory AI Guardrails
  Date: 2025-12-02 | Severity: medium | Type: systemic_risk | Status: confirmed | Resolution: resolved | Evidence: primary | Sources: 4
  Domain: human-ai-control | Primary Pattern: safety-governance-override | Secondary: systemic-catastrophic/accumulative-risk-trust-erosion
  Regions: oceania | Sectors: government, regulation
  Affected Groups: government-institutions, society-at-large
  Exposure Pathways: algorithmic-decision-impact
  Ecosystem Positions: regulators-public-servants, indirectly-affected
  Impact Level: society-wide
  URL: /incidents/INC-25-0048-australia-scraps-ai-advisory-body/

- INC-25-0016: Heber City AI Police Report Generates Fictional Content from Background Audio
  Date: 2025-12 | Severity: medium | Type: harm | Status: confirmed | Resolution: resolved | Evidence: corroborated | Sources: 4
  Domain: human-ai-control | Primary Pattern: overreliance-automation-bias
  Regions: north-america, united-states | Sectors: law-enforcement
  Victim Organizations: Heber City Police Department
  Affected Groups: government-institutions, general-public
  Exposure Pathways: direct-interaction
  Ecosystem Positions: deployers-operators, direct-users
  Impact Level: organization
  URL: /incidents/INC-25-0016-heber-city-ai-police-report-hallucination/

- INC-25-0020: Instacart AI-Driven Algorithmic Price Discrimination
  Date: 2025-12 | Severity: medium | Type: harm | Status: confirmed | Resolution: resolved | Evidence: corroborated | Sources: 3
  Domain: discrimination-social-harm | Primary Pattern: allocational-harm
  Regions: north-america, united-states | Sectors: corporate, technology
  Affected Groups: general-public
  Exposure Pathways: algorithmic-decision-impact
  Ecosystem Positions: deployers-operators, direct-users
  Impact Level: sector
  URL: /incidents/INC-25-0020-instacart-algorithmic-price-discrimination/

- INC-25-0026: CrimeRadar AI App Sends False Crime Alerts Across U.S. Communities
  Date: 2025-12 | Severity: medium | Type: harm | Status: confirmed | Resolution: resolved | Evidence: corroborated | Sources: 3
  Domain: information-integrity | Primary Pattern: misinformation-hallucinated-content | Secondary: human-ai-control/overreliance-automation-bias
  Regions: north-america, united-states | Sectors: public-safety, technology
  Victim Organizations: Streetsboro Police Department, Columbia Police Department, Bend Police Department
  Affected Groups: general-public, government-institutions
  Exposure Pathways: direct-interaction
  Ecosystem Positions: developers-providers, deployers-operators, direct-users
  Impact Level: sector
  URL: /incidents/INC-25-0026-crimeradar-ai-false-crime-alerts/

- INC-25-0033: Jailbroken Claude AI Used to Breach Mexican Government Agencies
  Date: 2025-12 | Severity: critical | Type: harm | Status: confirmed | Resolution: resolved | Evidence: primary | Sources: 4
  Domain: security-cyber | Primary Pattern: automated-vulnerability-discovery | Secondary: security-cyber/jailbreak-guardrail-bypass, agentic-autonomous/tool-misuse-privilege-escalation
  Regions: latin-america | Sectors: government, finance, public-safety
  Victim Organizations: Mexico SAT (Tax Authority), Mexico INE (Electoral Institute), Mexico City Civil Registry
  Affected Groups: general-public, government-institutions, national-security-systems
  Exposure Pathways: adversarial-targeting
  Ecosystem Positions: developers-providers, direct-users
  Impact Level: institution
  URL: /incidents/INC-25-0033-claude-code-mexico-government-hack/

- INC-25-0036: State-Backed Hackers from Four Nations Weaponize Google Gemini for Cyberattack Operations
  Date: 2025-12 | Severity: high | Type: harm | Status: confirmed | Resolution: open | Evidence: primary | Sources: 4
  Domain: security-cyber | Primary Pattern: social-engineering-via-ai | Secondary: security-cyber/ai-morphed-malware
  Regions: north-america, asia, europe, middle-east | Sectors: government, technology, cross-sector
  Threat Actors: UNC2970 (North Korea), APT42 (Iran), Chinese state-backed groups, Russian state-backed groups
  Affected Groups: national-security-systems, government-institutions, workers
  Exposure Pathways: adversarial-targeting
  Ecosystem Positions: developers-providers, indirectly-affected
  Impact Level: institution
  URL: /incidents/INC-25-0036-state-backed-hackers-weaponize-gemini/

- INC-25-0038: Grok AI Generates 3 Million Sexualized Images Including Approximately 23,000 Depicting Children
  Date: 2025-12 | Severity: critical | Type: harm | Status: confirmed | Resolution: open | Evidence: corroborated | Sources: 4
  Domain: discrimination-social-harm | Primary Pattern: representational-harm | Secondary: human-ai-control/deceptive-manipulative-interfaces
  Regions: north-america, europe, global | Sectors: technology
  Affected Groups: children, general-public
  Exposure Pathways: direct-interaction
  Ecosystem Positions: developers-providers, direct-users, indirectly-affected
  Impact Level: global
  URL: /incidents/INC-25-0038-grok-csam-scandal/

- INC-25-0010: Unit 42 Demonstrates Agent Session Smuggling in A2A Multi-Agent Systems
  Date: 2025-11 | Severity: medium | Type: signal | Status: confirmed | Resolution: open | Evidence: primary | Sources: 4
  Domain: agentic-autonomous | Primary Pattern: agent-to-agent-propagation | Secondary: agentic-autonomous/tool-misuse-privilege-escalation
  Regions: global | Sectors: technology, finance
  Affected Groups: business-organizations, developers-ai-builders
  Exposure Pathways: adversarial-targeting, infrastructure-dependency
  Ecosystem Positions: developers-providers, deployers-operators
  Impact Level: sector
  URL: /incidents/INC-25-0010-unit42-a2a-session-smuggling/

- INC-25-0039: ChatGPT 'Suicide Coach' Wrongful Death Lawsuits Reach Eight Cases Including Suicide Lullaby
  Date: 2025-11 | Severity: critical | Type: harm | Status: confirmed | Resolution: open | Evidence: corroborated | Sources: 4
  Domain: human-ai-control | Primary Pattern: loss-of-human-agency | Secondary: human-ai-control/deceptive-manipulative-interfaces
  Regions: north-america | Sectors: technology
  Affected Groups: general-public, vulnerable-communities
  Exposure Pathways: direct-interaction
  Ecosystem Positions: direct-users, indirectly-affected
  Impact Level: individual
  URL: /incidents/INC-25-0039-chatgpt-suicide-coach-wrongful-death/

- INC-25-0046: OpenAI Mixpanel Vendor Data Breach — Customer Data Exfiltrated via SMS Phishing
  Date: 2025-11 | Severity: high | Type: harm | Status: confirmed | Resolution: resolved | Evidence: primary | Sources: 3
  Domain: security-cyber | Primary Pattern: model-inversion-data-extraction
  Regions: global | Sectors: technology
  Victim Organizations: OpenAI, Mixpanel
  Threat Actors: Unknown (SMS phishing attacker)
  Affected Groups: business-organizations
  Exposure Pathways: infrastructure-dependency
  Ecosystem Positions: developers-providers, indirectly-affected
  Impact Level: organization
  URL: /incidents/INC-25-0046-openai-mixpanel-vendor-breach/

- INC-25-0019: AI-Designed Toxin Gene Sequences Bypass DNA Synthesis Screening
  Date: 2025-10 | Severity: high | Type: signal | Status: confirmed | Resolution: open | Evidence: primary | Sources: 3
  Domain: systemic-catastrophic | Primary Pattern: ai-assisted-biological-threat-design
  Regions: north-america, united-states | Sectors: healthcare
  Affected Groups: society-at-large
  Exposure Pathways: infrastructure-dependency
  Ecosystem Positions: developers-providers, regulators-public-servants
  Impact Level: society-wide
  URL: /incidents/INC-25-0019-dna-synthesis-toxin-screening-bypass/

- INC-25-0022: AWS Outage Causes AI-Connected Mattress Malfunctions
  Date: 2025-10 | Severity: medium | Type: harm | Status: confirmed | Resolution: resolved | Evidence: corroborated | Sources: 3
  Domain: systemic-catastrophic | Primary Pattern: infrastructure-dependency-collapse
  Regions: north-america, united-states | Sectors: technology, manufacturing
  Affected Groups: general-public
  Exposure Pathways: infrastructure-dependency
  Ecosystem Positions: developers-providers, deployers-operators, direct-users
  Impact Level: individual
  URL: /incidents/INC-25-0022-aws-outage-ai-mattress-malfunctions/

- INC-25-0037: Google Gemini 'Mass Casualty Attack' Coaching Leads to User Death and Lawsuit
  Date: 2025-10 | Severity: critical | Type: harm | Status: confirmed | Resolution: open | Evidence: corroborated | Sources: 4
  Domain: human-ai-control | Primary Pattern: loss-of-human-agency | Secondary: human-ai-control/deceptive-manipulative-interfaces
  Regions: north-america | Sectors: technology
  Affected Groups: general-public, vulnerable-communities
  Exposure Pathways: direct-interaction
  Ecosystem Positions: direct-users, indirectly-affected
  Impact Level: individual
  URL: /incidents/INC-25-0037-gemini-mass-casualty-suicide-lawsuit/

- INC-25-0001: AI-Orchestrated Cyber Espionage Campaign Against Critical Infrastructure
  Date: 2025-09 | Severity: critical | Type: harm | Status: confirmed | Resolution: resolved | Evidence: primary | Sources: 4
  Domain: security-cyber | Primary Pattern: automated-vulnerability-discovery | Secondary: agentic-autonomous/tool-misuse-privilege-escalation
  Regions: asia, north-america, europe | Sectors: corporate, finance, government, manufacturing
  Threat Actors: GTG-1002
  Affected Groups: business-organizations, government-institutions
  Exposure Pathways: adversarial-targeting
  Ecosystem Positions: deployers-operators
  Impact Level: sector
  URL: /incidents/INC-25-0001-ai-orchestrated-cyber-espionage-campaign/

- INC-25-0011: Deloitte AI-Fabricated Citations in Government Advisory Reports
  Date: 2025-09 | Severity: high | Type: harm | Status: confirmed | Resolution: resolved | Evidence: corroborated | Sources: 2
  Domain: human-ai-control | Primary Pattern: overreliance-automation-bias
  Regions: oceania, australia, north-america, canada | Sectors: government, corporate
  Victim Organizations: Australian Government, Canadian Provincial Government
  Affected Groups: government-institutions
  Exposure Pathways: algorithmic-decision-impact
  Ecosystem Positions: deployers-operators
  Impact Level: institution
  URL: /incidents/INC-25-0011-deloitte-ai-fabricated-citations/

- INC-25-0014: Amazon Ring Deploys AI Facial Recognition to Consumer Doorbells
  Date: 2025-09 | Severity: medium | Type: harm | Status: confirmed | Resolution: open | Evidence: corroborated | Sources: 1
  Domain: privacy-surveillance | Primary Pattern: mass-surveillance-amplification | Secondary: privacy-surveillance/biometric-exploitation
  Regions: north-america, united-states | Sectors: technology, cross-sector
  Affected Groups: general-public, children
  Exposure Pathways: direct-interaction, algorithmic-decision-impact
  Ecosystem Positions: developers-providers, deployers-operators
  Impact Level: society-wide
  URL: /incidents/INC-25-0014-amazon-ring-facial-recognition/

- INC-25-0043: AI Grading Errors — Connecticut Students Petition After Misscoring, MCAS Glitch Affects 1,400 Students
  Date: 2025-09 | Severity: high | Type: harm | Status: confirmed | Resolution: open | Evidence: corroborated | Sources: 3
  Domain: human-ai-control | Primary Pattern: overreliance-automation-bias
  Regions: north-america | Sectors: education
  Victim Organizations: Amity High School, 192 Massachusetts school districts
  Affected Groups: children, general-public
  Exposure Pathways: algorithmic-decision-impact
  Ecosystem Positions: deployers-operators, indirectly-affected
  Impact Level: sector
  URL: /incidents/INC-25-0043-ai-grading-errors-students/

- INC-25-0007: GitHub Copilot Remote Code Execution via Prompt Injection (CVE-2025-53773)
  Date: 2025-08 | Severity: critical | Type: near_miss | Status: confirmed | Resolution: resolved | Evidence: primary | Sources: 4
  Domain: security-cyber | Primary Pattern: adversarial-evasion | Secondary: security-cyber/prompt-injection-attack, agentic-autonomous/tool-misuse-privilege-escalation
  Regions: global | Sectors: corporate, cross-sector
  Affected Groups: developers-ai-builders
  Exposure Pathways: adversarial-targeting
  Ecosystem Positions: developers-providers, direct-users
  Impact Level: sector
  URL: /incidents/INC-25-0007-github-copilot-rce-prompt-injection/

- INC-25-0008: Cursor IDE MCP Vulnerabilities Enable Remote Code Execution (CurXecute & MCPoison)
  Date: 2025-08 | Severity: high | Type: near_miss | Status: confirmed | Resolution: resolved | Evidence: primary | Sources: 4
  Domain: security-cyber | Primary Pattern: adversarial-evasion | Secondary: security-cyber/prompt-injection-attack, security-cyber/ai-supply-chain-attack, agentic-autonomous/tool-misuse-privilege-escalation
  Regions: global | Sectors: corporate, cross-sector
  Affected Groups: developers-ai-builders
  Exposure Pathways: adversarial-targeting
  Ecosystem Positions: developers-providers, direct-users
  Impact Level: sector
  URL: /incidents/INC-25-0008-cursor-ide-mcp-rce-vulnerabilities/

- INC-25-0013: Waymo Autonomous Vehicles Violate School Bus Stop Laws in Austin
  Date: 2025-08 | Severity: critical | Type: harm | Status: confirmed | Resolution: open | Evidence: primary | Sources: 1
  Domain: human-ai-control | Primary Pattern: unsafe-human-in-the-loop-failures | Secondary: agentic-autonomous/goal-drift
  Regions: north-america, united-states | Sectors: transportation, education
  Victim Organizations: Austin Independent School District
  Affected Groups: children, general-public
  Exposure Pathways: algorithmic-decision-impact
  Ecosystem Positions: deployers-operators, regulators-public-servants
  Impact Level: sector
  URL: /incidents/INC-25-0013-waymo-school-bus-violations/

- INC-25-0005: ChatGPT Jailbreak Reveals Windows Product Keys via Game Prompt
  Date: 2025-07 | Severity: medium | Type: near_miss | Status: confirmed | Resolution: resolved | Evidence: corroborated | Sources: 3
  Domain: security-cyber | Primary Pattern: adversarial-evasion | Secondary: security-cyber/jailbreak-guardrail-bypass, security-cyber/model-inversion-data-extraction
  Regions: global | Sectors: corporate
  Victim Organizations: Microsoft, Wells Fargo
  Affected Groups: developers-ai-builders
  Exposure Pathways: direct-interaction
  Ecosystem Positions: developers-providers, direct-users
  Impact Level: organization
  URL: /incidents/INC-25-0005-chatgpt-windows-product-keys-jailbreak/

- INC-25-0006: ChatGPT Shared Conversations Indexed by Search Engines, Exposing Sensitive Data
  Date: 2025-07 | Severity: high | Type: harm | Status: confirmed | Resolution: resolved | Evidence: primary | Sources: 3
  Domain: privacy-surveillance | Primary Pattern: behavioral-profiling-without-consent | Secondary: security-cyber/model-inversion-data-extraction
  Regions: global | Sectors: corporate, cross-sector
  Affected Groups: general-public, developers-ai-builders
  Exposure Pathways: direct-interaction
  Ecosystem Positions: developers-providers
  Impact Level: organization
  URL: /incidents/INC-25-0006-chatgpt-shared-links-indexed-data-exposure/

- INC-25-0015: Replit AI Agent Deletes Production Database During Code Freeze
  Date: 2025-07 | Severity: high | Type: harm | Status: confirmed | Resolution: resolved | Evidence: corroborated | Sources: 3
  Domain: agentic-autonomous | Primary Pattern: goal-drift | Secondary: agentic-autonomous/specification-gaming, human-ai-control/unsafe-human-in-the-loop-failures
  Regions: north-america, united-states | Sectors: technology
  Victim Organizations: SaaStr
  Affected Groups: developers-ai-builders, business-organizations
  Exposure Pathways: direct-interaction
  Ecosystem Positions: developers-providers, direct-users
  Impact Level: individual
  URL: /incidents/INC-25-0015-replit-agent-database-deletion/

- INC-25-0021: Earnest Operations AI Lending Discrimination Settlement
  Date: 2025-07 | Severity: high | Type: harm | Status: confirmed | Resolution: resolved | Evidence: corroborated | Sources: 3
  Domain: discrimination-social-harm | Primary Pattern: allocational-harm | Secondary: discrimination-social-harm/proxy-discrimination
  Regions: north-america, united-states | Sectors: finance
  Affected Groups: vulnerable-communities, general-public
  Exposure Pathways: algorithmic-decision-impact
  Ecosystem Positions: deployers-operators, regulators-public-servants
  Impact Level: sector
  URL: /incidents/INC-25-0021-earnest-ai-lending-discrimination-settlement/

- INC-25-0041: Tennessee Grandmother Wrongfully Arrested by Facial Recognition — Jailed 108 Days, Lost Home
  Date: 2025-07 | Severity: critical | Type: harm | Status: confirmed | Resolution: open | Evidence: primary | Sources: 4
  Domain: privacy-surveillance | Primary Pattern: biometric-exploitation | Secondary: discrimination-social-harm/allocational-harm
  Regions: north-america | Sectors: law-enforcement
  Affected Groups: general-public, vulnerable-communities
  Exposure Pathways: algorithmic-decision-impact
  Ecosystem Positions: indirectly-affected
  Impact Level: individual
  URL: /incidents/INC-25-0041-grandmother-frt-wrongful-arrest-108-days/

- INC-25-0045: Kimsuky APT Uses ChatGPT to Generate Fake South Korean Military IDs for Espionage Campaign
  Date: 2025-07 | Severity: high | Type: harm | Status: confirmed | Resolution: open | Evidence: corroborated | Sources: 3
  Domain: security-cyber | Primary Pattern: social-engineering-via-ai
  Regions: asia | Sectors: government, technology
  Victim Organizations: South Korean military
  Threat Actors: Kimsuky APT (North Korea)
  Affected Groups: national-security-systems
  Exposure Pathways: adversarial-targeting
  Ecosystem Positions: developers-providers, indirectly-affected
  Impact Level: global
  URL: /incidents/INC-25-0045-kimsuky-deepfake-military-ids/

- INC-25-0004: EchoLeak: Zero-Click Prompt Injection in Microsoft 365 Copilot (CVE-2025-32711)
  Date: 2025-06 | Severity: critical | Type: near_miss | Status: confirmed | Resolution: resolved | Evidence: primary | Sources: 4
  Domain: security-cyber | Primary Pattern: adversarial-evasion | Secondary: security-cyber/prompt-injection-attack, security-cyber/model-inversion-data-extraction
  Regions: global | Sectors: corporate, cross-sector
  Affected Groups: business-organizations, developers-ai-builders
  Exposure Pathways: adversarial-targeting
  Ecosystem Positions: developers-providers, deployers-operators
  Impact Level: sector
  URL: /incidents/INC-25-0004-echoleak-microsoft-copilot-prompt-injection/

- INC-25-0017: Anthropic Research Reveals AI Model Blackmail Behavior in Lab Scenarios
  Date: 2025-06 | Severity: medium | Type: signal | Status: confirmed | Resolution: open | Evidence: corroborated | Sources: 3
  Domain: systemic-catastrophic | Primary Pattern: strategic-misalignment
  Regions: north-america, united-states | Sectors: technology
  Affected Groups: society-at-large, developers-ai-builders
  Exposure Pathways: direct-interaction
  Ecosystem Positions: developers-providers
  Impact Level: society-wide
  URL: /incidents/INC-25-0017-anthropic-ai-blackmail-behavior-study/

- INC-25-0025: AI Chatbot Suicide Risk: 20% Failure Rate in Stanford Study
  Date: 2025-06 | Severity: high | Type: signal | Status: confirmed | Resolution: open | Evidence: primary | Sources: 3
  Domain: human-ai-control | Primary Pattern: overreliance-automation-bias | Secondary: information-integrity/misinformation-hallucinated-content
  Regions: north-america, united-states, global | Sectors: healthcare, technology
  Affected Groups: vulnerable-communities, general-public
  Exposure Pathways: direct-interaction
  Ecosystem Positions: developers-providers, deployers-operators, direct-users
  Impact Level: society-wide
  URL: /incidents/INC-25-0025-stanford-ai-mental-health-chatbot-suicide-risk/

- INC-25-0035: Three Chained Prompt Injection Vulnerabilities in Anthropic MCP Git Server
  Date: 2025-06 | Severity: high | Type: near_miss | Status: confirmed | Resolution: resolved | Evidence: corroborated | Sources: 2
  Domain: security-cyber | Primary Pattern: prompt-injection-attack | Secondary: agentic-autonomous/tool-misuse-privilege-escalation
  Regions: north-america, europe | Sectors: technology
  Affected Groups: developers-ai-builders
  Exposure Pathways: adversarial-targeting, direct-interaction
  Ecosystem Positions: developers-providers, direct-users
  Impact Level: sector
  URL: /incidents/INC-25-0035-anthropic-mcp-git-server-prompt-injection/

- INC-25-0012: Zoox Robotaxi Collision and Software Recall in Las Vegas
  Date: 2025-04 | Severity: medium | Type: harm | Status: confirmed | Resolution: resolved | Evidence: primary | Sources: 1
  Domain: agentic-autonomous | Primary Pattern: goal-drift | Secondary: agentic-autonomous/specification-gaming
  Regions: north-america, united-states | Sectors: transportation, technology
  Affected Groups: general-public
  Exposure Pathways: algorithmic-decision-impact
  Ecosystem Positions: developers-providers, deployers-operators
  Impact Level: organization
  URL: /incidents/INC-25-0012-zoox-robotaxi-crash-recall/

- INC-25-0024: Microsoft Reports Blocking $4 Billion in AI-Enabled Fraud Attempts
  Date: 2025-04 | Severity: high | Type: signal | Status: confirmed | Resolution: open | Evidence: primary | Sources: 3
  Domain: security-cyber | Primary Pattern: ai-morphed-malware | Secondary: information-integrity/ai-enabled-fraud, security-cyber/social-engineering-via-ai, information-integrity/deepfake-identity-hijacking
  Regions: global, north-america, europe | Sectors: technology, finance, corporate
  Victim Organizations: Microsoft
  Affected Groups: general-public, business-organizations
  Exposure Pathways: adversarial-targeting
  Ecosystem Positions: developers-providers, direct-users, indirectly-affected
  Impact Level: global
  URL: /incidents/INC-25-0024-microsoft-4b-ai-enabled-fraud-disruption/

- INC-25-0030: OpenAI o3 Reward Hacking in METR Safety Evaluation
  Date: 2025-04 | Severity: high | Type: signal | Status: confirmed | Resolution: open | Evidence: primary | Sources: 3
  Domain: agentic-autonomous | Primary Pattern: specification-gaming | Secondary: agentic-autonomous/goal-drift
  Regions: global | Sectors: technology
  Affected Groups: developers-ai-builders, society-at-large
  Exposure Pathways: direct-interaction
  Ecosystem Positions: developers-providers
  Impact Level: sector
  URL: /incidents/INC-25-0030-openai-o3-reward-hacking-metr-evaluation/

- INC-25-0032: DOGE Uses ChatGPT to Flag and Cancel Federal Humanities Grants
  Date: 2025-04 | Severity: critical | Type: harm | Status: confirmed | Resolution: open | Evidence: primary | Sources: 4
  Domain: discrimination-social-harm | Primary Pattern: proxy-discrimination | Secondary: human-ai-control/overreliance-automation-bias
  Regions: north-america | Sectors: government, education
  Victim Organizations: National Endowment for the Humanities
  Threat Actors: Department of Government Efficiency (DOGE)
  Affected Groups: general-public, workers, vulnerable-communities, democratic-institutions
  Exposure Pathways: algorithmic-decision-impact
  Ecosystem Positions: deployers-operators, regulators-public-servants
  Impact Level: institution
  URL: /incidents/INC-25-0032-doge-chatgpt-dei-grant-cancellations/

- INC-25-0031: MINJA: Memory Injection Attack Against RAG-Augmented LLM Agents
  Date: 2025-03 | Severity: medium | Type: signal | Status: confirmed | Resolution: open | Evidence: primary | Sources: 1
  Domain: agentic-autonomous | Primary Pattern: memory-poisoning | Secondary: security-cyber/data-poisoning
  Regions: global | Sectors: technology, healthcare, cross-sector
  Affected Groups: developers-ai-builders, business-organizations
  Exposure Pathways: adversarial-targeting
  Ecosystem Positions: developers-providers
  Impact Level: sector
  URL: /incidents/INC-25-0031-minja-memory-injection-attack-research/

- INC-25-0028: Google Gemini Long-Term Memory Corruption via Prompt Injection
  Date: 2025-02 | Severity: high | Type: signal | Status: confirmed | Resolution: open | Evidence: corroborated | Sources: 3
  Domain: security-cyber | Primary Pattern: prompt-injection-attack | Secondary: agentic-autonomous/memory-poisoning
  Regions: global | Sectors: technology
  Affected Groups: general-public
  Exposure Pathways: direct-interaction, adversarial-targeting
  Ecosystem Positions: developers-providers, direct-users
  Impact Level: individual
  URL: /incidents/INC-25-0028-gemini-memory-corruption-prompt-injection/

- INC-25-0029: Chain-of-Thought Reasoning Jailbreak Exploits Thinking Models
  Date: 2025-02 | Severity: high | Type: signal | Status: confirmed | Resolution: open | Evidence: corroborated | Sources: 3
  Domain: security-cyber | Primary Pattern: jailbreak-guardrail-bypass | Secondary: security-cyber/adversarial-evasion
  Regions: global | Sectors: technology
  Affected Groups: developers-ai-builders, general-public
  Exposure Pathways: adversarial-targeting
  Ecosystem Positions: developers-providers
  Impact Level: sector
  URL: /incidents/INC-25-0029-chain-of-thought-jailbreak-reasoning-models/

- INC-25-0002: Italian Data Protection Authority Fines OpenAI EUR 15 Million Over ChatGPT GDPR Violations
  Date: 2025-01 | Severity: high | Type: harm | Status: confirmed | Resolution: resolved | Evidence: primary | Sources: 3
  Domain: privacy-surveillance | Primary Pattern: behavioral-profiling-without-consent | Secondary: discrimination-social-harm/data-imbalance-bias
  Regions: europe | Sectors: corporate
  Affected Groups: general-public
  Exposure Pathways: direct-interaction
  Ecosystem Positions: developers-providers, regulators-public-servants
  Impact Level: society-wide
  URL: /incidents/INC-25-0002-italy-fines-openai-chatgpt/

- INC-25-0003: DeepSeek R1 Data Exposure and International Bans Over Privacy and Security Concerns
  Date: 2025-01 | Severity: high | Type: harm | Status: confirmed | Resolution: open | Evidence: primary | Sources: 4
  Domain: privacy-surveillance | Primary Pattern: mass-surveillance-amplification | Secondary: security-cyber/model-inversion-data-extraction
  Regions: asia, europe, north-america | Sectors: corporate, government
  Affected Groups: general-public
  Exposure Pathways: direct-interaction
  Ecosystem Positions: developers-providers
  Impact Level: society-wide
  URL: /incidents/INC-25-0003-deepseek-data-privacy-concerns/

- INC-25-0018: Las Vegas Cybertruck Bomber Used ChatGPT for Explosives Information
  Date: 2025-01 | Severity: critical | Type: harm | Status: confirmed | Resolution: resolved | Evidence: corroborated | Sources: 3
  Domain: security-cyber | Primary Pattern: adversarial-evasion | Secondary: security-cyber/jailbreak-guardrail-bypass
  Regions: north-america, united-states | Sectors: public-safety
  Victim Organizations: Trump International Hotel Las Vegas
  Affected Groups: general-public
  Exposure Pathways: direct-interaction
  Ecosystem Positions: developers-providers, direct-users
  Impact Level: individual
  URL: /incidents/INC-25-0018-las-vegas-cybertruck-chatgpt-explosives/

- INC-25-0027: Medical LLM Data Poisoning Produces Undetectable Harmful Content
  Date: 2025-01 | Severity: critical | Type: signal | Status: confirmed | Resolution: open | Evidence: primary | Sources: 3
  Domain: security-cyber | Primary Pattern: data-poisoning | Secondary: information-integrity/misinformation-hallucinated-content, security-cyber/adversarial-evasion
  Regions: global | Sectors: healthcare, technology
  Affected Groups: general-public, vulnerable-communities
  Exposure Pathways: direct-interaction
  Ecosystem Positions: developers-providers
  Impact Level: sector
  URL: /incidents/INC-25-0027-medical-llm-data-poisoning-nature-study/

- INC-25-0034: Chinese AI Labs Conduct Industrial-Scale Distillation Attacks Against Claude
  Date: 2025 | Severity: critical | Type: harm | Status: confirmed | Resolution: open | Evidence: primary | Sources: 3
  Domain: security-cyber | Primary Pattern: model-inversion-data-extraction | Secondary: security-cyber/ai-supply-chain-attack, systemic-catastrophic/ai-capability-proliferation
  Regions: north-america, asia | Sectors: technology
  Victim Organizations: Anthropic
  Threat Actors: DeepSeek, Moonshot AI, MiniMax
  Affected Groups: developers-ai-builders
  Exposure Pathways: adversarial-targeting
  Ecosystem Positions: developers-providers
  Impact Level: sector
  URL: /incidents/INC-25-0034-chinese-labs-claude-distillation-attacks/

- INC-25-0040: IWF Reports AI-Generated CSAM Videos Increase 26,385% with 65% at Highest Severity
  Date: 2025 | Severity: critical | Type: harm | Status: confirmed | Resolution: open | Evidence: primary | Sources: 4
  Domain: discrimination-social-harm | Primary Pattern: representational-harm
  Regions: global | Sectors: technology, law-enforcement
  Affected Groups: children, general-public
  Exposure Pathways: direct-interaction
  Ecosystem Positions: developers-providers, indirectly-affected
  Impact Level: global
  URL: /incidents/INC-25-0040-iwf-ai-csam-video-explosion/

- INC-25-0042: UN Report — AI Weaponized by Southeast Asian Organized Crime for $18-37B in Fraud
  Date: 2025 | Severity: high | Type: harm | Status: confirmed | Resolution: open | Evidence: primary | Sources: 3
  Domain: information-integrity | Primary Pattern: deepfake-identity-hijacking | Secondary: information-integrity/ai-enabled-fraud
  Regions: asia | Sectors: finance, law-enforcement
  Threat Actors: Southeast Asian organized crime syndicates
  Affected Groups: general-public, vulnerable-communities
  Exposure Pathways: adversarial-targeting
  Ecosystem Positions: indirectly-affected
  Impact Level: global
  URL: /incidents/INC-25-0042-un-ai-weaponized-se-asian-crime/

- INC-25-0044: NYPD Facial Recognition Wrongful Arrest — Brooklyn Father Jailed 2 Days Despite 8-Inch Height Difference
  Date: 2025 | Severity: high | Type: harm | Status: confirmed | Resolution: open | Evidence: corroborated | Sources: 3
  Domain: discrimination-social-harm | Primary Pattern: allocational-harm | Secondary: privacy-surveillance/biometric-exploitation
  Regions: north-america | Sectors: law-enforcement
  Affected Groups: general-public, vulnerable-communities
  Exposure Pathways: algorithmic-decision-impact
  Ecosystem Positions: indirectly-affected
  Impact Level: individual
  URL: /incidents/INC-25-0044-nypd-frt-wrongful-arrest-williams/

- INC-25-0047: Mistral Pixtral Models Fail Safety Tests — 60x More Likely to Generate CSAM Than GPT-4o
  Date: 2025 | Severity: high | Type: harm | Status: confirmed | Resolution: open | Evidence: corroborated | Sources: 3
  Domain: security-cyber | Primary Pattern: jailbreak-guardrail-bypass
  Regions: europe, global | Sectors: technology
  Affected Groups: society-at-large, children
  Exposure Pathways: direct-interaction
  Ecosystem Positions: developers-providers
  Impact Level: global
  URL: /incidents/INC-25-0047-mistral-pixtral-safety-failures/

- INC-24-0027: Waymo Robotaxi Collides with Serve Delivery Robot in Los Angeles
  Date: 2024-12-27 | Severity: medium | Type: near_miss | Status: confirmed | Resolution: resolved | Evidence: corroborated | Sources: 1
  Domain: agentic-autonomous | Primary Pattern: multi-agent-coordination-failures | Secondary: human-ai-control/overreliance-automation-bias
  Regions: north-america | Sectors: transportation
  Affected Groups: general-public
  Exposure Pathways: infrastructure-dependency
  Ecosystem Positions: deployers-operators
  Impact Level: organization
  URL: /incidents/INC-24-0027-waymo-serve-robot-autonomous-collision/

- INC-24-0013: Romania Presidential Election Annulled After AI-Enabled Manipulation
  Date: 2024-11 | Severity: critical | Type: harm | Status: confirmed | Resolution: resolved | Evidence: primary | Sources: 3
  Domain: information-integrity | Primary Pattern: consensus-reality-erosion | Secondary: information-integrity/disinformation-campaigns, privacy-surveillance/behavioral-profiling-without-consent
  Regions: europe | Sectors: government, media
  Affected Groups: democratic-institutions, general-public
  Exposure Pathways: algorithmic-decision-impact, direct-interaction
  Ecosystem Positions: indirectly-affected, regulators-public-servants
  Impact Level: institution
  URL: /incidents/INC-24-0013-romania-election-annulment-ai-manipulation/

- INC-24-0021: Cruise Robotaxi Criminal False Reporting After Pedestrian Dragging
  Date: 2024-09 | Severity: critical | Type: harm | Status: confirmed | Resolution: resolved | Evidence: primary | Sources: 1
  Domain: human-ai-control | Primary Pattern: unsafe-human-in-the-loop-failures | Secondary: agentic-autonomous/goal-drift
  Regions: north-america, united-states | Sectors: transportation, technology
  Affected Groups: general-public
  Exposure Pathways: algorithmic-decision-impact
  Ecosystem Positions: deployers-operators, regulators-public-servants
  Impact Level: sector
  URL: /incidents/INC-24-0021-cruise-robotaxi-criminal-false-reporting/

- INC-24-0011: EU AI Act Enters Into Force as World's First Comprehensive AI Regulation
  Date: 2024-08 | Severity: medium | Type: signal | Status: confirmed | Resolution: resolved | Evidence: primary | Sources: 4
  Domain: systemic-catastrophic | Primary Pattern: strategic-misalignment | Secondary: human-ai-control/loss-of-human-agency
  Regions: europe | Sectors: government, regulation
  Affected Groups: business-organizations, government-institutions, developers-ai-builders
  Exposure Pathways: algorithmic-decision-impact
  Ecosystem Positions: regulators-public-servants, developers-providers
  Impact Level: global
  URL: /incidents/INC-24-0011-eu-ai-act-enters-into-force/

- INC-24-0015: Sakana AI Scientist Unexpectedly Modifies Own Code
  Date: 2024-08 | Severity: high | Type: near_miss | Status: confirmed | Resolution: resolved | Evidence: primary | Sources: 2
  Domain: systemic-catastrophic | Primary Pattern: uncontrolled-recursive-self-improvement | Secondary: agentic-autonomous/specification-gaming, agentic-autonomous/tool-misuse-privilege-escalation
  Regions: asia | Sectors: technology
  Affected Groups: developers-ai-builders, society-at-large
  Exposure Pathways: infrastructure-dependency
  Ecosystem Positions: developers-providers
  Impact Level: sector
  URL: /incidents/INC-24-0015-sakana-ai-scientist-self-modification/

- INC-24-0020: Slack AI Indirect Prompt Injection Data Exfiltration Vulnerability
  Date: 2024-08 | Severity: high | Type: signal | Status: confirmed | Resolution: resolved | Evidence: primary | Sources: 1
  Domain: security-cyber | Primary Pattern: adversarial-evasion | Secondary: security-cyber/prompt-injection-attack, security-cyber/model-inversion-data-extraction
  Regions: north-america, united-states | Sectors: technology
  Affected Groups: business-organizations, developers-ai-builders
  Exposure Pathways: adversarial-targeting
  Ecosystem Positions: developers-providers
  Impact Level: sector
  URL: /incidents/INC-24-0020-slack-ai-prompt-injection-exfiltration/

- INC-24-0014: Workday AI Hiring Tool Discrimination Class Action
  Date: 2024-07 | Severity: high | Type: harm | Status: confirmed | Resolution: open | Evidence: corroborated | Sources: 1
  Domain: discrimination-social-harm | Primary Pattern: allocational-harm
  Regions: north-america, united-states | Sectors: technology, employment
  Victim Organizations: Workday
  Affected Groups: workers, vulnerable-communities
  Exposure Pathways: algorithmic-decision-impact
  Ecosystem Positions: deployers-operators
  Impact Level: sector
  URL: /incidents/INC-24-0014-workday-ai-hiring-discrimination/

- INC-24-0022: McDonald's McHire AI Hiring Platform Data Vulnerability
  Date: 2024-06 | Severity: high | Type: near_miss | Status: confirmed | Resolution: resolved | Evidence: corroborated | Sources: 3
  Domain: security-cyber | Primary Pattern: model-inversion-data-extraction
  Regions: north-america, united-states, global | Sectors: employment, technology
  Victim Organizations: McDonald's
  Affected Groups: general-public, workers
  Exposure Pathways: algorithmic-decision-impact
  Ecosystem Positions: developers-providers, deployers-operators
  Impact Level: organization
  URL: /incidents/INC-24-0022-mcdonalds-mchire-data-vulnerability/

- INC-24-0024: McDonald's Ends AI Drive-Thru Ordering Trial After Viral Order Errors
  Date: 2024-06 | Severity: medium | Type: harm | Status: confirmed | Resolution: resolved | Evidence: corroborated | Sources: 3
  Domain: human-ai-control | Primary Pattern: overreliance-automation-bias
  Regions: north-america, united-states | Sectors: corporate, technology
  Victim Organizations: McDonald's
  Affected Groups: general-public, workers
  Exposure Pathways: direct-interaction
  Ecosystem Positions: developers-providers, deployers-operators, direct-users
  Impact Level: organization
  URL: /incidents/INC-24-0024-mcdonalds-ai-drive-thru-ordering-failures/

- INC-24-0006: OpenAI Voice Mode Resembling Scarlett Johansson Without Consent
  Date: 2024-05 | Severity: medium | Type: harm | Status: confirmed | Resolution: open | Evidence: corroborated | Sources: 4
  Domain: privacy-surveillance | Primary Pattern: biometric-exploitation | Secondary: information-integrity/deepfake-identity-hijacking
  Regions: north-america | Sectors: corporate
  Affected Groups: general-public
  Exposure Pathways: direct-interaction
  Ecosystem Positions: developers-providers
  Impact Level: organization
  URL: /incidents/INC-24-0006-openai-scarlett-johansson-voice/

- INC-24-0019: Windows Recall: Security and Privacy Flaw (2024)
  Date: 2024-05 | Severity: high | Type: near_miss | Status: confirmed | Resolution: resolved | Evidence: primary | Sources: 1
  Domain: privacy-surveillance | Primary Pattern: behavioral-profiling-without-consent
  Regions: north-america, united-states, europe | Sectors: technology
  Affected Groups: general-public
  Exposure Pathways: direct-interaction
  Ecosystem Positions: developers-providers
  Impact Level: sector
  URL: /incidents/INC-24-0019-microsoft-windows-recall-privacy/

- INC-24-0023: Google AI Overviews Recommend Glue on Pizza and Eating Rocks
  Date: 2024-05 | Severity: medium | Type: harm | Status: confirmed | Resolution: resolved | Evidence: primary | Sources: 3
  Domain: information-integrity | Primary Pattern: misinformation-hallucinated-content | Secondary: human-ai-control/overreliance-automation-bias
  Regions: north-america, united-states, global | Sectors: technology, media
  Affected Groups: general-public
  Exposure Pathways: direct-interaction
  Ecosystem Positions: developers-providers, direct-users
  Impact Level: society-wide
  URL: /incidents/INC-24-0023-google-ai-overviews-glue-rocks/

- INC-24-0016: SafeRent Algorithmic Housing Discrimination Settlement
  Date: 2024-04 | Severity: high | Type: harm | Status: confirmed | Resolution: resolved | Evidence: primary | Sources: 1
  Domain: discrimination-social-harm | Primary Pattern: allocational-harm
  Regions: north-america, united-states | Sectors: social-services
  Affected Groups: vulnerable-communities, general-public
  Exposure Pathways: algorithmic-decision-impact
  Ecosystem Positions: deployers-operators
  Impact Level: sector
  URL: /incidents/INC-24-0016-saferent-housing-discrimination-settlement/

- INC-24-0018: India 2024 General Election Industrial-Scale Deepfake Campaign
  Date: 2024-04 | Severity: high | Type: systemic_risk | Status: confirmed | Resolution: open | Evidence: corroborated | Sources: 2
  Domain: information-integrity | Primary Pattern: synthetic-media-manipulation | Secondary: information-integrity/disinformation-campaigns
  Regions: asia, india | Sectors: elections, media
  Affected Groups: general-public, democratic-institutions
  Exposure Pathways: direct-interaction
  Ecosystem Positions: indirectly-affected
  Impact Level: society-wide
  URL: /incidents/INC-24-0018-india-election-deepfake-campaign/

- INC-24-0012: Morris II — First Self-Replicating AI Worm Demonstrated
  Date: 2024-03 | Severity: high | Type: signal | Status: confirmed | Resolution: resolved | Evidence: primary | Sources: 3
  Domain: agentic-autonomous | Primary Pattern: agent-to-agent-propagation | Secondary: security-cyber/ai-morphed-malware
  Regions: north-america | Sectors: technology
  Affected Groups: developers-ai-builders, business-organizations
  Exposure Pathways: adversarial-targeting
  Ecosystem Positions: developers-providers, direct-users
  Impact Level: sector
  URL: /incidents/INC-24-0012-morris-ii-self-replicating-ai-worm/

- INC-24-0017: Israel Military Deploys AI Facial Recognition in Gaza Leading to Wrongful Detentions
  Date: 2024-03 | Severity: critical | Type: harm | Status: confirmed | Resolution: open | Evidence: corroborated | Sources: 1
  Domain: privacy-surveillance | Primary Pattern: biometric-exploitation | Secondary: privacy-surveillance/mass-surveillance-amplification
  Regions: middle-east, israel, palestine | Sectors: government, public-safety
  Affected Groups: general-public, vulnerable-communities
  Exposure Pathways: adversarial-targeting
  Ecosystem Positions: deployers-operators, regulators-public-servants
  Impact Level: society-wide
  URL: /incidents/INC-24-0017-corsight-gaza-facial-recognition-detentions/

- INC-24-0026: NYC MyCity AI Chatbot Advises Businesses to Break the Law
  Date: 2024-03 | Severity: high | Type: harm | Status: confirmed | Resolution: resolved | Evidence: corroborated | Sources: 3
  Domain: information-integrity | Primary Pattern: misinformation-hallucinated-content | Secondary: human-ai-control/overreliance-automation-bias
  Regions: north-america, united-states | Sectors: government, technology
  Victim Organizations: New York City government
  Affected Groups: general-public, workers, vulnerable-communities, government-institutions
  Exposure Pathways: direct-interaction, algorithmic-decision-impact
  Ecosystem Positions: developers-providers, deployers-operators, direct-users
  Impact Level: institution
  URL: /incidents/INC-24-0026-nyc-mycity-chatbot-illegal-advice/

- INC-24-0009: Google Gemini Produces Historically Inaccurate Image Outputs Due to Bias Overcorrection
  Date: 2024-02 | Severity: medium | Type: near_miss | Status: confirmed | Resolution: resolved | Evidence: primary | Sources: 4
  Domain: discrimination-social-harm | Primary Pattern: representational-harm | Secondary: human-ai-control/deceptive-manipulative-interfaces
  Regions: north-america | Sectors: corporate
  Affected Groups: general-public
  Exposure Pathways: direct-interaction
  Ecosystem Positions: developers-providers
  Impact Level: society-wide
  URL: /incidents/INC-24-0009-google-gemini-image-generation-controversy/

- INC-24-0010: Lawsuit Filed After Teenager's Death Linked to Character.AI Chatbot Interactions
  Date: 2024-02 | Severity: critical | Type: harm | Status: confirmed | Resolution: open | Evidence: primary | Sources: 4
  Domain: human-ai-control | Primary Pattern: deceptive-manipulative-interfaces | Secondary: agentic-autonomous/goal-drift
  Regions: north-america | Sectors: corporate
  Affected Groups: children, general-public
  Exposure Pathways: direct-interaction
  Ecosystem Positions: developers-providers, direct-users
  Impact Level: individual
  URL: /incidents/INC-24-0010-character-ai-teenager-death-lawsuit/

- INC-24-0001: Hong Kong Deepfake CFO Video Conference Fraud
  Date: 2024-01 | Severity: critical | Type: harm | Status: confirmed | Resolution: resolved | Evidence: primary | Sources: 5
  Domain: information-integrity | Primary Pattern: deepfake-identity-hijacking | Secondary: information-integrity/ai-enabled-fraud, security-cyber/social-engineering-via-ai, security-cyber/adversarial-evasion
  Regions: asia, hong-kong | Sectors: corporate, finance
  Victim Organizations: Arup
  Affected Groups: business-organizations
  Exposure Pathways: adversarial-targeting
  Ecosystem Positions: deployers-operators, organizational-leaders
  Impact Level: organization
  URL: /incidents/INC-24-0001-hong-kong-deepfake-cfo-fraud/

- INC-24-0002: AI-Generated Biden Robocall in New Hampshire Primary
  Date: 2024-01 | Severity: high | Type: harm | Status: confirmed | Resolution: open | Evidence: primary | Sources: 3
  Domain: information-integrity | Primary Pattern: disinformation-campaigns | Secondary: information-integrity/deepfake-identity-hijacking
  Regions: north-america | Sectors: elections, government
  Affected Groups: democratic-institutions, general-public
  Exposure Pathways: adversarial-targeting
  Ecosystem Positions: indirectly-affected
  Impact Level: institution
  URL: /incidents/INC-24-0002-ai-generated-election-robocall/

- INC-24-0003: AI-Generated Deepfake Audio Used to Frame High School Principal in Baltimore
  Date: 2024-01 | Severity: high | Type: harm | Status: confirmed | Resolution: open | Evidence: primary | Sources: 4
  Domain: information-integrity | Primary Pattern: deepfake-identity-hijacking | Secondary: discrimination-social-harm/representational-harm
  Regions: north-america | Sectors: education
  Victim Organizations: Pikesville High School
  Affected Groups: general-public
  Exposure Pathways: adversarial-targeting
  Ecosystem Positions: direct-users
  Impact Level: individual
  URL: /incidents/INC-24-0003-pikesville-high-school-deepfake-principal/

- INC-24-0004: FBI Elder Fraud Report Documents AI-Enhanced Financial Scams Against Seniors
  Date: 2024-01 | Severity: critical | Type: systemic_risk | Status: confirmed | Resolution: open | Evidence: primary | Sources: 5
  Domain: information-integrity | Primary Pattern: deepfake-identity-hijacking | Secondary: information-integrity/ai-enabled-fraud, security-cyber/social-engineering-via-ai, security-cyber/ai-morphed-malware
  Regions: north-america | Sectors: finance
  Affected Groups: vulnerable-communities
  Exposure Pathways: adversarial-targeting
  Ecosystem Positions: indirectly-affected
  Impact Level: individual
  URL: /incidents/INC-24-0004-fbi-elder-fraud-ai-enhanced-scams/

- INC-24-0007: Indirect Prompt Injection: How Attackers Hijack LLM Apps
  Date: 2024-01 | Severity: high | Type: signal | Status: confirmed | Resolution: open | Evidence: primary | Sources: 4
  Domain: security-cyber | Primary Pattern: adversarial-evasion | Secondary: security-cyber/prompt-injection-attack, agentic-autonomous/tool-misuse-privilege-escalation
  Regions: north-america, europe | Sectors: corporate, cross-sector
  Affected Groups: developers-ai-builders, general-public
  Exposure Pathways: adversarial-targeting
  Ecosystem Positions: developers-providers, direct-users
  Impact Level: sector
  URL: /incidents/INC-24-0007-indirect-prompt-injection-attacks/

- INC-24-0008: AI-Generated Non-Consensual Intimate Images of Taylor Swift Circulate on Social Media
  Date: 2024-01 | Severity: high | Type: harm | Status: confirmed | Resolution: open | Evidence: corroborated | Sources: 4
  Domain: information-integrity | Primary Pattern: synthetic-media-manipulation | Secondary: discrimination-social-harm/representational-harm
  Regions: north-america | Sectors: corporate, cross-sector
  Affected Groups: general-public
  Exposure Pathways: adversarial-targeting
  Ecosystem Positions: direct-users
  Impact Level: society-wide
  URL: /incidents/INC-24-0008-taylor-swift-deepfake-images/

- INC-24-0025: DPD AI Chatbot Swears at Customer and Writes Poem Criticizing the Company
  Date: 2024-01 | Severity: low | Type: harm | Status: confirmed | Resolution: resolved | Evidence: corroborated | Sources: 3
  Domain: human-ai-control | Primary Pattern: overreliance-automation-bias
  Regions: europe, united-kingdom | Sectors: corporate, technology
  Victim Organizations: DPD
  Affected Groups: general-public, business-organizations
  Exposure Pathways: direct-interaction
  Ecosystem Positions: deployers-operators, direct-users
  Impact Level: organization
  URL: /incidents/INC-24-0025-dpd-ai-chatbot-swearing-incident/

- INC-23-0011: New York Times Copyright Lawsuit Against OpenAI
  Date: 2023-12 | Severity: high | Type: harm | Status: confirmed | Resolution: open | Evidence: primary | Sources: 3
  Domain: economic-labor | Primary Pattern: power-data-concentration | Secondary: privacy-surveillance/behavioral-profiling-without-consent
  Regions: north-america | Sectors: corporate
  Victim Organizations: The New York Times
  Affected Groups: business-organizations
  Exposure Pathways: algorithmic-decision-impact
  Ecosystem Positions: developers-providers
  Impact Level: sector
  URL: /incidents/INC-23-0011-nyt-openai-copyright-lawsuit/

- INC-23-0013: FTC Bans Rite Aid from Using Facial Recognition Technology
  Date: 2023-12 | Severity: high | Type: harm | Status: confirmed | Resolution: resolved | Evidence: primary | Sources: 4
  Domain: privacy-surveillance | Primary Pattern: biometric-exploitation | Secondary: discrimination-social-harm/data-imbalance-bias
  Regions: north-america | Sectors: corporate
  Affected Groups: general-public, vulnerable-communities
  Exposure Pathways: algorithmic-decision-impact
  Ecosystem Positions: deployers-operators, regulators-public-servants
  Impact Level: organization
  URL: /incidents/INC-23-0013-rite-aid-ftc-facial-recognition-ban/

- INC-23-0015: Sports Illustrated Published AI-Generated Articles Under Fake Author Names
  Date: 2023-11 | Severity: high | Type: harm | Status: confirmed | Resolution: resolved | Evidence: primary | Sources: 3
  Domain: information-integrity | Primary Pattern: misinformation-hallucinated-content | Secondary: human-ai-control/deceptive-manipulative-interfaces
  Regions: north-america | Sectors: corporate
  Victim Organizations: The Arena Group
  Affected Groups: general-public, business-organizations
  Exposure Pathways: direct-interaction
  Ecosystem Positions: deployers-operators
  Impact Level: organization
  URL: /incidents/INC-23-0015-sports-illustrated-ai-fake-authors/

- INC-23-0008: AI-Generated Deepfake Nude Images of Students at Westfield High School
  Date: 2023-10 | Severity: high | Type: harm | Status: confirmed | Resolution: open | Evidence: primary | Sources: 4
  Domain: information-integrity | Primary Pattern: synthetic-media-manipulation | Secondary: discrimination-social-harm/representational-harm
  Regions: north-america | Sectors: education
  Affected Groups: children
  Exposure Pathways: adversarial-targeting
  Ecosystem Positions: direct-users
  Impact Level: individual
  URL: /incidents/INC-23-0008-westfield-high-school-deepfake-nudes/

- INC-23-0007: AI-Generated Deepfake Audio Used to Influence Slovak Parliamentary Election
  Date: 2023-09 | Severity: high | Type: harm | Status: confirmed | Resolution: open | Evidence: corroborated | Sources: 5
  Domain: information-integrity | Primary Pattern: disinformation-campaigns | Secondary: information-integrity/deepfake-identity-hijacking
  Regions: europe | Sectors: elections
  Victim Organizations: Progressive Slovakia
  Affected Groups: democratic-institutions, general-public
  Exposure Pathways: adversarial-targeting
  Ecosystem Positions: indirectly-affected
  Impact Level: institution
  URL: /incidents/INC-23-0007-slovakia-election-deepfake-audio/

- INC-23-0012: Zoom AI Training Terms of Service Controversy
  Date: 2023-08 | Severity: medium | Type: harm | Status: confirmed | Resolution: resolved | Evidence: primary | Sources: 4
  Domain: privacy-surveillance | Primary Pattern: behavioral-profiling-without-consent | Secondary: human-ai-control/loss-of-human-agency
  Regions: north-america | Sectors: corporate
  Affected Groups: general-public, business-organizations
  Exposure Pathways: direct-interaction
  Ecosystem Positions: developers-providers, direct-users
  Impact Level: society-wide
  URL: /incidents/INC-23-0012-zoom-ai-training-terms-controversy/

- INC-23-0006: WormGPT: AI-Powered Business Email Compromise Tool
  Date: 2023-07 | Severity: high | Type: harm | Status: confirmed | Resolution: open | Evidence: corroborated | Sources: 2
  Domain: security-cyber | Primary Pattern: ai-morphed-malware | Secondary: security-cyber/social-engineering-via-ai, information-integrity/disinformation-campaigns
  Regions: north-america, europe | Sectors: corporate, finance
  Affected Groups: business-organizations, general-public
  Exposure Pathways: adversarial-targeting
  Ecosystem Positions: developers-providers
  Impact Level: sector
  URL: /incidents/INC-23-0006-wormgpt-cybercrime-tool/

- INC-23-0005: AI-Fabricated Legal Citations in U.S. Courts
  Date: 2023-05 | Severity: high | Type: systemic_risk | Status: confirmed | Resolution: open | Evidence: primary | Sources: 3
  Domain: information-integrity | Primary Pattern: misinformation-hallucinated-content | Secondary: human-ai-control/overreliance-automation-bias
  Regions: north-america | Sectors: legal
  Affected Groups: general-public
  Exposure Pathways: direct-interaction
  Ecosystem Positions: direct-users
  Impact Level: sector
  URL: /incidents/INC-23-0005-chatgpt-hallucination-lawyer/

- INC-23-0010: Chegg Stock Collapse After ChatGPT Disruption
  Date: 2023-05 | Severity: high | Type: harm | Status: confirmed | Resolution: resolved | Evidence: corroborated | Sources: 3
  Domain: economic-labor | Primary Pattern: economic-dependency-on-black-box-systems | Secondary: human-ai-control/loss-of-human-agency
  Regions: north-america | Sectors: education, corporate
  Victim Organizations: Chegg
  Affected Groups: business-organizations, workers
  Exposure Pathways: economic-displacement
  Ecosystem Positions: developers-providers
  Impact Level: organization
  URL: /incidents/INC-23-0010-chegg-chatgpt-disruption/

- INC-23-0002: Samsung Semiconductor Trade Secret Leak via ChatGPT
  Date: 2023-03 | Severity: high | Type: harm | Status: confirmed | Resolution: resolved | Evidence: corroborated | Sources: 2
  Domain: security-cyber | Primary Pattern: model-inversion-data-extraction | Secondary: human-ai-control/overreliance-automation-bias
  Regions: asia | Sectors: manufacturing, corporate
  Victim Organizations: Samsung Electronics
  Affected Groups: business-organizations
  Exposure Pathways: direct-interaction
  Ecosystem Positions: direct-users, deployers-operators
  Impact Level: organization
  URL: /incidents/INC-23-0002-samsung-chatgpt-data-leak/

- INC-23-0003: Italy Temporary Ban on ChatGPT for GDPR Violations
  Date: 2023-03 | Severity: medium | Type: harm | Status: confirmed | Resolution: resolved | Evidence: primary | Sources: 1
  Domain: privacy-surveillance | Primary Pattern: sensitive-attribute-inference | Secondary: privacy-surveillance/behavioral-profiling-without-consent
  Regions: europe | Sectors: government, regulation
  Affected Groups: general-public, government-institutions
  Exposure Pathways: direct-interaction
  Ecosystem Positions: developers-providers, regulators-public-servants
  Impact Level: society-wide
  URL: /incidents/INC-23-0003-italy-chatgpt-gdpr-ban/

- INC-23-0004: AI Voice Cloning Used in Grandparent Scam Network Targeting Newfoundland Seniors
  Date: 2023-03 | Severity: high | Type: harm | Status: confirmed | Resolution: open | Evidence: primary | Sources: 4
  Domain: information-integrity | Primary Pattern: deepfake-identity-hijacking | Secondary: information-integrity/ai-enabled-fraud, security-cyber/social-engineering-via-ai, security-cyber/ai-morphed-malware
  Regions: north-america | Sectors: finance
  Affected Groups: vulnerable-communities
  Exposure Pathways: adversarial-targeting
  Ecosystem Positions: indirectly-affected
  Impact Level: individual
  URL: /incidents/INC-23-0004-newfoundland-ai-voice-cloning-grandparent-scam/

- INC-23-0016: Bing Chat (Sydney) System Prompt Exposure via Prompt Injection
  Date: 2023-02 | Severity: high | Type: near_miss | Status: confirmed | Resolution: resolved | Evidence: primary | Sources: 3
  Domain: security-cyber | Primary Pattern: adversarial-evasion | Secondary: security-cyber/prompt-injection-attack, security-cyber/jailbreak-guardrail-bypass, information-integrity/misinformation-hallucinated-content
  Regions: global | Sectors: corporate, cross-sector
  Victim Organizations: Microsoft
  Affected Groups: developers-ai-builders, general-public
  Exposure Pathways: direct-interaction
  Ecosystem Positions: developers-providers, direct-users
  Impact Level: organization
  URL: /incidents/INC-23-0016-bing-chat-sydney-system-prompt-leak/

- INC-23-0001: AI Deepfake Impersonation Campaign Targeting Senior U.S. Government Officials
  Date: 2023-01 | Severity: high | Type: harm | Status: confirmed | Resolution: open | Evidence: primary | Sources: 4
  Domain: information-integrity | Primary Pattern: deepfake-identity-hijacking | Secondary: security-cyber/ai-morphed-malware
  Regions: north-america | Sectors: government
  Affected Groups: government-institutions, general-public
  Exposure Pathways: adversarial-targeting
  Ecosystem Positions: indirectly-affected
  Impact Level: institution
  URL: /incidents/INC-23-0001-fbi-deepfake-impersonation-us-officials/

- INC-23-0014: GitHub Copilot Leaks API Keys and Secrets from Training Data
  Date: 2023-01 | Severity: high | Type: harm | Status: confirmed | Resolution: open | Evidence: corroborated | Sources: 4
  Domain: security-cyber | Primary Pattern: model-inversion-data-extraction | Secondary: privacy-surveillance/re-identification-attacks
  Regions: north-america | Sectors: corporate
  Affected Groups: developers-ai-builders
  Exposure Pathways: direct-interaction
  Ecosystem Positions: developers-providers, direct-users
  Impact Level: sector
  URL: /incidents/INC-23-0014-github-copilot-training-data-leak/

- INC-23-0017: UnitedHealth nH Predict AI Claim Denial System
  Date: 2023-01 | Severity: critical | Type: harm | Status: confirmed | Resolution: open | Evidence: primary | Sources: 4
  Domain: economic-labor | Primary Pattern: decision-loop-automation | Secondary: human-ai-control/overreliance-automation-bias
  Regions: north-america | Sectors: healthcare, finance
  Victim Organizations: Medicare Advantage beneficiaries
  Affected Groups: general-public, vulnerable-communities
  Exposure Pathways: algorithmic-decision-impact
  Ecosystem Positions: deployers-operators, indirectly-affected
  Impact Level: sector
  URL: /incidents/INC-23-0017-unitedhealth-ai-claim-denial/

- INC-23-0018: Kenyan Content Moderators vs Meta — 140+ Former Facebook Workers Diagnosed with PTSD
  Date: 2023 | Severity: high | Type: harm | Status: confirmed | Resolution: open | Evidence: corroborated | Sources: 3
  Domain: economic-labor | Primary Pattern: automation-induced-job-degradation
  Regions: africa | Sectors: technology
  Affected Groups: workers, vulnerable-communities
  Exposure Pathways: direct-interaction
  Ecosystem Positions: deployers-operators, indirectly-affected
  Impact Level: sector
  URL: /incidents/INC-23-0018-kenyan-moderators-meta-ptsd/

- INC-22-0003: PyTorch torchtriton Dependency Confusion Supply Chain Attack
  Date: 2022-12-25 | Severity: critical | Type: harm | Status: confirmed | Resolution: resolved | Evidence: primary | Sources: 5
  Domain: security-cyber | Primary Pattern: ai-supply-chain-attack | Secondary: human-ai-control/overreliance-automation-bias
  Regions: global | Sectors: technology
  Victim Organizations: PyTorch Foundation
  Affected Groups: developers-ai-builders
  Exposure Pathways: infrastructure-dependency
  Ecosystem Positions: developers-providers, direct-users
  Impact Level: sector
  URL: /incidents/INC-22-0003-pytorch-torchtriton-supply-chain-attack/

- INC-22-0005: Air Canada Chatbot Hallucinated Refund Policy — Tribunal Ruling
  Date: 2022-11 | Severity: medium | Type: harm | Status: confirmed | Resolution: resolved | Evidence: primary | Sources: 4
  Domain: agentic-autonomous | Primary Pattern: cascading-hallucinations | Secondary: human-ai-control/overreliance-automation-bias
  Regions: north-america | Sectors: transportation
  Affected Groups: general-public, business-organizations
  Exposure Pathways: direct-interaction
  Ecosystem Positions: deployers-operators, direct-users
  Impact Level: organization
  URL: /incidents/INC-22-0005-air-canada-chatbot-refund-ruling/

- INC-22-0004: RealPage AI Algorithmic Rent-Fixing
  Date: 2022-10 | Severity: high | Type: systemic_risk | Status: confirmed | Resolution: open | Evidence: primary | Sources: 3
  Domain: economic-labor | Primary Pattern: market-manipulation-via-ai | Secondary: discrimination-social-harm/allocational-harm
  Regions: north-america | Sectors: social-services, corporate
  Affected Groups: general-public, vulnerable-communities
  Exposure Pathways: algorithmic-decision-impact
  Ecosystem Positions: developers-providers, deployers-operators
  Impact Level: sector
  URL: /incidents/INC-22-0004-realpage-algorithmic-rent-fixing/

- INC-22-0002: Meta Housing Ad Discrimination DOJ Settlement
  Date: 2022-06 | Severity: high | Type: harm | Status: confirmed | Resolution: resolved | Evidence: primary | Sources: 4
  Domain: discrimination-social-harm | Primary Pattern: algorithmic-amplification | Secondary: privacy-surveillance/behavioral-profiling-without-consent
  Regions: north-america | Sectors: social-services, corporate
  Affected Groups: vulnerable-communities, general-public
  Exposure Pathways: algorithmic-decision-impact
  Ecosystem Positions: developers-providers, regulators-public-servants
  Impact Level: sector
  URL: /incidents/INC-22-0002-meta-housing-ad-discrimination/

- INC-22-0001: Drug Discovery AI Repurposed to Generate Toxic Chemical Weapons Compounds
  Date: 2022-03 | Severity: critical | Type: signal | Status: confirmed | Resolution: open | Evidence: primary | Sources: 3
  Domain: systemic-catastrophic | Primary Pattern: ai-assisted-biological-threat-design | Secondary: security-cyber/automated-vulnerability-discovery
  Regions: north-america | Sectors: healthcare, government
  Affected Groups: society-at-large
  Exposure Pathways: direct-interaction
  Ecosystem Positions: developers-providers
  Impact Level: society-wide
  URL: /incidents/INC-22-0001-drug-discovery-ai-toxic-compounds/

- INC-21-0001: Chatbot Encouraged Man in Plot to Kill Queen Elizabeth II
  Date: 2021-12-25 | Severity: critical | Type: harm | Status: confirmed | Resolution: resolved | Evidence: primary | Sources: 3
  Domain: human-ai-control | Primary Pattern: deceptive-manipulative-interfaces | Secondary: agentic-autonomous/goal-drift, systemic-catastrophic/accumulative-risk-trust-erosion
  Regions: europe | Sectors: public-safety, government
  Affected Groups: general-public
  Exposure Pathways: direct-interaction
  Ecosystem Positions: developers-providers, direct-users
  Impact Level: individual
  URL: /incidents/INC-21-0001-chatbot-encouraged-man-in-plot-to-kill-queen-elizabeth-ii/

- INC-20-0004: Pulse Oximeter Racial Bias Propagates into AI Clinical Decision Systems
  Date: 2020-12 | Severity: high | Type: systemic_risk | Status: confirmed | Resolution: open | Evidence: primary | Sources: 3
  Domain: discrimination-social-harm | Primary Pattern: proxy-discrimination | Secondary: human-ai-control/overreliance-automation-bias
  Regions: north-america, united-states, global | Sectors: healthcare
  Affected Groups: vulnerable-communities, general-public
  Exposure Pathways: algorithmic-decision-impact
  Ecosystem Positions: developers-providers, deployers-operators
  Impact Level: society-wide
  URL: /incidents/INC-20-0004-pulse-oximeter-racial-bias-ai-propagation/

- INC-20-0002: UK A-Level Algorithm Downgrades Disadvantaged Students
  Date: 2020-08 | Severity: critical | Type: harm | Status: confirmed | Resolution: resolved | Evidence: primary | Sources: 4
  Domain: discrimination-social-harm | Primary Pattern: allocational-harm | Secondary: human-ai-control/overreliance-automation-bias
  Regions: europe | Sectors: education, government
  Affected Groups: general-public, children
  Exposure Pathways: algorithmic-decision-impact
  Ecosystem Positions: deployers-operators, regulators-public-servants
  Impact Level: society-wide
  URL: /incidents/INC-20-0002-uk-a-level-algorithm-grading/

- INC-20-0003: UN-Documented Autonomous Drone Attack in Libya
  Date: 2020-03 | Severity: critical | Type: harm | Status: confirmed | Resolution: open | Evidence: primary | Sources: 3
  Domain: systemic-catastrophic | Primary Pattern: lethal-autonomous-weapon-systems | Secondary: agentic-autonomous/tool-misuse-privilege-escalation
  Regions: africa | Sectors: government
  Affected Groups: national-security-systems, general-public
  Exposure Pathways: infrastructure-dependency
  Ecosystem Positions: deployers-operators
  Impact Level: institution
  URL: /incidents/INC-20-0003-libya-autonomous-drone-attack/

- INC-20-0001: Clearview AI Mass Facial Recognition Scraping
  Date: 2020-01 | Severity: critical | Type: systemic_risk | Status: confirmed | Resolution: open | Evidence: primary | Sources: 2
  Domain: privacy-surveillance | Primary Pattern: mass-surveillance-amplification | Secondary: privacy-surveillance/biometric-exploitation
  Regions: north-america, europe | Sectors: government, law-enforcement
  Affected Groups: general-public, government-institutions
  Exposure Pathways: algorithmic-decision-impact
  Ecosystem Positions: developers-providers, deployers-operators
  Impact Level: society-wide
  URL: /incidents/INC-20-0001-clearview-ai-mass-surveillance/

- INC-20-0005: Robert Williams Wrongful Arrest from Facial Recognition Racial Bias
  Date: 2020-01 | Severity: critical | Type: harm | Status: confirmed | Resolution: resolved | Evidence: primary | Sources: 4
  Domain: discrimination-social-harm | Primary Pattern: data-imbalance-bias | Secondary: human-ai-control/overreliance-automation-bias, discrimination-social-harm/proxy-discrimination
  Regions: north-america | Sectors: law-enforcement
  Affected Groups: general-public, vulnerable-communities
  Exposure Pathways: algorithmic-decision-impact
  Ecosystem Positions: deployers-operators, regulators-public-servants, indirectly-affected
  Impact Level: institution
  URL: /incidents/INC-20-0005-robert-williams-facial-recognition-wrongful-arrest/

- INC-20-0006: 'Vegetative Electron Microscopy' Nonsense Phrase Contaminates Scientific Literature via AI
  Date: 2020-01 | Severity: medium | Type: harm | Status: confirmed | Resolution: open | Evidence: corroborated | Sources: 3
  Domain: information-integrity | Primary Pattern: misinformation-hallucinated-content
  Regions: global | Sectors: education, healthcare
  Victim Organizations: Springer Nature, Elsevier
  Affected Groups: society-at-large, developers-ai-builders
  Exposure Pathways: direct-interaction
  Ecosystem Positions: developers-providers, direct-users
  Impact Level: sector
  URL: /incidents/INC-20-0006-vegetative-electron-microscopy-ai-contamination/

- INC-19-0001: AI Voice Clone CEO Fraud Against UK Energy Company
  Date: 2019-03 | Severity: high | Type: harm | Status: confirmed | Resolution: resolved | Evidence: corroborated | Sources: 2
  Domain: information-integrity | Primary Pattern: deepfake-identity-hijacking | Secondary: information-integrity/ai-enabled-fraud, security-cyber/social-engineering-via-ai, security-cyber/adversarial-evasion
  Regions: europe | Sectors: energy, corporate
  Affected Groups: business-organizations
  Exposure Pathways: adversarial-targeting
  Ecosystem Positions: organizational-leaders
  Impact Level: organization
  URL: /incidents/INC-19-0001-deepfake-ceo-voice-uk-energy/

- INC-18-0002: Amazon AI Recruiting Tool Gender Bias
  Date: 2018-10 | Severity: high | Type: harm | Status: confirmed | Resolution: resolved | Evidence: primary | Sources: 1
  Domain: discrimination-social-harm | Primary Pattern: allocational-harm | Secondary: discrimination-social-harm/data-imbalance-bias
  Regions: north-america | Sectors: employment
  Affected Groups: workers
  Exposure Pathways: algorithmic-decision-impact
  Ecosystem Positions: developers-providers, deployers-operators
  Impact Level: organization
  URL: /incidents/INC-18-0002-amazon-ai-hiring-bias/

- INC-18-0003: Boeing 737 MAX MCAS Automation Failures — Two Fatal Crashes
  Date: 2018-10 | Severity: critical | Type: harm | Status: confirmed | Resolution: resolved | Evidence: primary | Sources: 4
  Domain: human-ai-control | Primary Pattern: overreliance-automation-bias | Secondary: systemic-catastrophic/accumulative-risk-trust-erosion
  Regions: asia, africa | Sectors: transportation
  Victim Organizations: Lion Air, Ethiopian Airlines
  Affected Groups: general-public
  Exposure Pathways: infrastructure-dependency
  Ecosystem Positions: developers-providers, deployers-operators
  Impact Level: sector
  URL: /incidents/INC-18-0003-boeing-737-max-mcas-failures/

- INC-18-0001: Uber Autonomous Vehicle Pedestrian Fatality
  Date: 2018-03 | Severity: critical | Type: harm | Status: confirmed | Resolution: resolved | Evidence: primary | Sources: 1
  Domain: human-ai-control | Primary Pattern: unsafe-human-in-the-loop-failures | Secondary: agentic-autonomous/tool-misuse-privilege-escalation
  Regions: north-america | Sectors: transportation, public-safety
  Affected Groups: general-public
  Exposure Pathways: infrastructure-dependency
  Ecosystem Positions: developers-providers, deployers-operators
  Impact Level: individual
  URL: /incidents/INC-18-0001-uber-self-driving-fatality/

- INC-17-0001: Facebook AI Mistranslation of Arabic Post Leads to Wrongful Arrest in Israel
  Date: 2017-10 | Severity: high | Type: harm | Status: confirmed | Resolution: resolved | Evidence: primary | Sources: 3
  Domain: information-integrity | Primary Pattern: misinformation-hallucinated-content | Secondary: discrimination-social-harm/proxy-discrimination
  Regions: middle-east | Sectors: corporate, public-safety
  Affected Groups: general-public
  Exposure Pathways: algorithmic-decision-impact
  Ecosystem Positions: developers-providers, deployers-operators
  Impact Level: individual
  URL: /incidents/INC-17-0001-facebook-ai-mistranslation-arrest/

- INC-16-0001: Australia Robodebt Automated Welfare Fraud Detection
  Date: 2016-07 | Severity: critical | Type: harm | Status: confirmed | Resolution: resolved | Evidence: primary | Sources: 1
  Domain: discrimination-social-harm | Primary Pattern: allocational-harm | Secondary: human-ai-control/overreliance-automation-bias
  Regions: oceania | Sectors: government, social-services
  Affected Groups: vulnerable-communities, general-public
  Exposure Pathways: algorithmic-decision-impact
  Ecosystem Positions: deployers-operators, regulators-public-servants
  Impact Level: society-wide
  URL: /incidents/INC-16-0001-robodebt-australia/

- INC-16-0003: COMPAS Recidivism Algorithm Racial Bias
  Date: 2016-05 | Severity: critical | Type: harm | Status: confirmed | Resolution: open | Evidence: primary | Sources: 3
  Domain: discrimination-social-harm | Primary Pattern: proxy-discrimination | Secondary: human-ai-control/implicit-authority-transfer
  Regions: north-america | Sectors: government, law-enforcement
  Affected Groups: vulnerable-communities, general-public
  Exposure Pathways: algorithmic-decision-impact
  Ecosystem Positions: deployers-operators, regulators-public-servants
  Impact Level: institution
  URL: /incidents/INC-16-0003-compas-recidivism-algorithm-bias/

- INC-16-0002: Microsoft Tay Twitter Chatbot Adversarial Manipulation
  Date: 2016-03 | Severity: high | Type: harm | Status: confirmed | Resolution: resolved | Evidence: primary | Sources: 3
  Domain: agentic-autonomous | Primary Pattern: goal-drift | Secondary: information-integrity/synthetic-media-manipulation
  Regions: north-america | Sectors: corporate
  Victim Organizations: Microsoft
  Affected Groups: general-public, developers-ai-builders
  Exposure Pathways: direct-interaction
  Ecosystem Positions: developers-providers, direct-users
  Impact Level: organization
  URL: /incidents/INC-16-0002-microsoft-tay-twitter-bot/

- INC-13-0001: Dutch Childcare Benefits Algorithm Discrimination
  Date: 2013-01 | Severity: critical | Type: harm | Status: confirmed | Resolution: resolved | Evidence: primary | Sources: 2
  Domain: discrimination-social-harm | Primary Pattern: proxy-discrimination | Secondary: human-ai-control/overreliance-automation-bias
  Regions: europe | Sectors: government, social-services
  Affected Groups: vulnerable-communities, children
  Exposure Pathways: algorithmic-decision-impact
  Ecosystem Positions: deployers-operators, regulators-public-servants
  Impact Level: society-wide
  URL: /incidents/INC-13-0001-dutch-childcare-benefits-scandal/

- INC-10-0001: 2010 Flash Crash — Algorithmic Trading Cascading Failure
  Date: 2010-05 | Severity: critical | Type: harm | Status: confirmed | Resolution: resolved | Evidence: primary | Sources: 3
  Domain: systemic-catastrophic | Primary Pattern: infrastructure-dependency-collapse | Secondary: agentic-autonomous/multi-agent-coordination-failures
  Regions: north-america | Sectors: finance
  Affected Groups: business-organizations, general-public
  Exposure Pathways: infrastructure-dependency
  Ecosystem Positions: developers-providers, deployers-operators
  Impact Level: sector
  URL: /incidents/INC-10-0001-flash-crash-algorithmic-trading/

### Glossary Terms (183 total)

- Accountability: The principle that identifiable individuals or organisations must be answerable for AI system outcomes, including harms caused by automated decisions.
  URL: /glossary/accountability/
- Adversarial Attack: A deliberate manipulation of inputs to a machine learning model designed to cause incorrect outputs, misclassifications, or security bypasses. Adversarial attacks exploit mathematical vulnerabilities in how models process data rather than flaws in traditional software logic.
  URL: /glossary/adversarial-attack/
- Adversarial Perturbation: A carefully calculated modification to an input — often imperceptible to humans — that causes a machine learning model to produce an incorrect or attacker-chosen output. Adversarial perturbations exploit the mathematical properties of neural network decision boundaries rather than flaws in traditional software logic.
  URL: /glossary/adversarial-perturbation/
- Adversarial Training: A machine learning defense technique in which a model is trained on adversarial examples — inputs specifically crafted to cause misclassification or incorrect outputs — alongside normal training data, with the goal of improving the model's robustness against adversarial attacks at inference time.
  URL: /glossary/adversarial-training/
- Agent Framework: A software library or platform that provides the infrastructure for building AI agents — autonomous systems that use large language models to reason, plan, and execute multi-step tasks by invoking tools, managing memory, and coordinating with other agents. Common examples include LangChain, AutoGen, CrewAI, and the OpenAI Agents SDK.
  URL: /glossary/agent-framework/
- Agent Propagation: The spread of errors, hallucinations, or adversarial inputs from one AI agent to others in connected multi-agent systems, potentially causing cascading failures.
  URL: /glossary/agent-propagation/
- Agent Safety: The field of ensuring AI agents operate within intended boundaries and do not cause unintended harm through autonomous actions, tool use, or goal pursuit.
  URL: /glossary/agent-safety/
- Agentic AI: AI systems that autonomously plan and execute multi-step actions with minimal human oversight.
  URL: /glossary/agentic-ai/
- AI Risk Management Framework: A structured methodology published by the US National Institute of Standards and Technology (NIST) that provides organisations with a systematic approach to identifying, assessing, and mitigating risks associated with AI systems throughout their lifecycle. The NIST AI RMF (AI 100-1) is a voluntary, non-sector-specific framework applicable to all AI technologies.
  URL: /glossary/ai-risk-management-framework/
- AI Safety: The field of research and practice dedicated to ensuring that artificial intelligence systems operate reliably within intended boundaries and do not cause unintended harm to humans, society, or the environment.
  URL: /glossary/ai-safety/
- AI-Generated Code: Code produced by AI systems, which can be used for both legitimate software development and malicious purposes including malware creation and vulnerability exploitation.
  URL: /glossary/ai-generated-code/
- Alert Fatigue: Desensitisation of human operators to system warnings due to excessive or poorly calibrated alerts, reducing the effectiveness of human oversight over AI systems.
  URL: /glossary/alert-fatigue/
- Algorithmic Amplification: The process by which recommendation algorithms and content curation systems disproportionately promote certain content, amplifying its reach and societal impact beyond organic levels.
  URL: /glossary/algorithmic-amplification/
- Algorithmic Bias: Systematic errors in AI systems that produce unfair outcomes, often favouring one group over another.
  URL: /glossary/algorithmic-bias/
- Algorithmic Trading: The use of AI algorithms to execute financial trades at speeds and volumes exceeding human capability, introducing systemic risks including flash crashes and market manipulation.
  URL: /glossary/algorithmic-trading/
- Alignment: The property of an AI system whose objectives, decision-making processes, and behaviours remain consistent with human values, intentions, and safety requirements. Alignment is a foundational challenge in AI safety research.
  URL: /glossary/alignment/
- Allocational Harm: Unfair distribution of resources, opportunities, or services when AI systems systematically disadvantage certain groups in consequential decisions such as hiring, lending, or housing.
  URL: /glossary/allocational-harm/
- Anonymization: The process of removing or obscuring personally identifiable information from datasets to protect individual privacy, which AI techniques can increasingly defeat through re-identification attacks.
  URL: /glossary/anonymization/
- Artificial General Intelligence (AGI): A hypothetical AI system capable of performing any intellectual task that a human can, with the ability to transfer learning across domains without task-specific programming.
  URL: /glossary/artificial-general-intelligence/
- Attack Surface: The totality of entry points, interfaces, and pathways through which an adversary can attempt to interact with, extract data from, or inject inputs into an AI system. In machine learning contexts, the attack surface extends beyond traditional software boundaries to include training pipelines, model APIs, prompt interfaces, tool integrations, and data ingestion channels.
  URL: /glossary/attack-surface/
- Attribute Inference: Using AI to deduce sensitive personal characteristics such as health status, political affiliation, or sexual orientation from seemingly innocuous data patterns.
  URL: /glossary/attribute-inference/
- Authority Transfer: The gradual, often unrecognised shift of decision-making power from humans to AI systems, eroding meaningful human control over consequential outcomes.
  URL: /glossary/authority-transfer/
- Automated Decision-Making: Using algorithms or AI to make decisions affecting individuals with limited human review.
  URL: /glossary/automated-decision-making/
- Automated Exploit: AI-driven tools that automatically discover and exploit software vulnerabilities without human intervention, accelerating the pace and scale of cyber attacks.
  URL: /glossary/automated-exploit/
- Automated Vulnerability Discovery: Using AI to autonomously identify security weaknesses in software, networks, or systems.
  URL: /glossary/automated-vulnerability-discovery/
- Automation: The use of AI to perform tasks previously requiring human labour, spanning physical, cognitive, and creative work, with implications for employment and economic structures.
  URL: /glossary/automation/
- Automation Bias: The tendency to favour automated system outputs over independent human judgement, even when incorrect.
  URL: /glossary/automation-bias/
- Autonomous Vehicle: A vehicle using AI to navigate and operate without direct human control.
  URL: /glossary/autonomous-vehicle/
- Autonomous Weapons: Weapon systems that use artificial intelligence to select and engage targets without meaningful human control over the critical functions of target identification, tracking, and engagement.
  URL: /glossary/autonomous-weapons/
- Autonomy: The capacity of individuals to make self-directed decisions free from undue external influence or automated override, which AI systems can undermine through manipulation or substitution.
  URL: /glossary/autonomy/
- Backdoor Attack: A covert modification to an AI model during training that causes targeted misclassification or malicious behaviour when a specific trigger pattern is present in the input.
  URL: /glossary/backdoor-attack/
- Behavioral Profiling: The systematic collection and analysis of individual behaviour patterns by AI systems to predict preferences, intentions, or future actions, often without informed consent.
  URL: /glossary/behavioral-profiling/
- Biological Threat: The risk of AI systems being used to design, enhance, or disseminate biological agents capable of causing widespread harm to human health or ecosystems.
  URL: /glossary/biological-threat/
- Biometric Data: Measurable physical or behavioural characteristics used to identify or authenticate individuals.
  URL: /glossary/biometric-data/
- Biosecurity: The set of measures, policies, and practices designed to protect against biological threats, including the prevention of AI-enabled acceleration of pathogen design, synthesis, or dissemination of dangerous biological knowledge.
  URL: /glossary/biosecurity/
- Black-Box System: An AI system whose internal decision-making processes are opaque or incomprehensible to users, operators, and auditors, making accountability and error correction difficult.
  URL: /glossary/black-box-system/
- Business Email Compromise: Targeted fraud impersonating executives or trusted contacts to authorise fraudulent transactions.
  URL: /glossary/business-email-compromise/
- C2PA: The Coalition for Content Provenance and Authenticity (C2PA) is a technical standards body that develops specifications for certifying the source and history of digital content through cryptographically signed metadata. C2PA content credentials enable verification of whether content was created by a human, edited, or generated by AI.
  URL: /glossary/c2pa/
- Cascading Failure: A process in which the failure of one component in an interconnected system triggers a sequence of failures in dependent components, potentially leading to the collapse of an entire system or network of systems.
  URL: /glossary/cascading-failure/
- Chain of Thought: A prompting and reasoning technique in which a large language model is encouraged to produce intermediate reasoning steps before arriving at a final answer, rather than generating the answer directly. Chain-of-thought reasoning improves accuracy on complex tasks but can also introduce new failure modes including hallucinated reasoning and cascading errors in multi-step processes.
  URL: /glossary/chain-of-thought/
- Chatbot: A software application that uses natural language processing or large language models to conduct text-based or voice-based conversations with users, ranging from rule-based systems to general-purpose AI assistants.
  URL: /glossary/chatbot/
- Complacency: A state of reduced vigilance in human operators who develop excessive trust in AI system reliability, leading to failures in oversight and error detection.
  URL: /glossary/complacency/
- Confabulation: The generation of plausible but factually incorrect information by AI systems, presented with unwarranted confidence.
  URL: /glossary/confabulation/
- Consent: The principle that individuals should provide informed, voluntary agreement before their data is collected or processed by AI systems.
  URL: /glossary/consent/
- Contagion: The spread of harmful outputs, compromised states, or adversarial inputs between connected AI agents.
  URL: /glossary/contagion/
- Content Authenticity: Standards and technologies for verifying the origin, integrity, and editing history of digital media.
  URL: /glossary/content-authenticity/
- Content Moderation: The process of monitoring, reviewing, and enforcing policies on user-generated or AI-generated content to prevent the distribution of harmful, illegal, or policy-violating material.
  URL: /glossary/content-moderation/
- Context Injection: Manipulating an AI agent's context window or retrieved information to influence its reasoning and outputs.
  URL: /glossary/context-injection/
- Context Window: The maximum amount of text (measured in tokens) that a large language model can process in a single interaction, encompassing all input (system prompt, conversation history, retrieved documents, tool outputs) and generated output. The context window defines the boundary of what the model can perceive and reason about at any given time.
  URL: /glossary/context-window/
- Coordinated Inauthentic Behavior: Organised networks of fake or compromised accounts using AI to simulate grassroots activity and manipulate public discourse.
  URL: /glossary/coordinated-inauthentic-behavior/
- Coordination Failure: When multiple AI agents working toward shared objectives produce unintended or harmful outcomes due to misaligned strategies.
  URL: /glossary/coordination-failure/
- Cyber Espionage: Covert digital intrusion to access and exfiltrate sensitive data, increasingly augmented by AI.
  URL: /glossary/cyber-espionage/
- Dark Pattern: A deceptive user interface design that manipulates individuals into making decisions they would not otherwise make, increasingly amplified by AI-driven personalisation.
  URL: /glossary/dark-pattern/
- Data Bias: Systematic errors in training datasets that reflect historical inequities, leading to discriminatory AI outputs.
  URL: /glossary/data-bias/
- Data Concentration: The accumulation of vast datasets by a small number of organisations, creating asymmetric advantages and barriers to competition.
  URL: /glossary/data-concentration/
- Data Extraction: Techniques for recovering private training data or sensitive information from AI models through systematic querying.
  URL: /glossary/data-extraction/
- Data Leakage: Unintended exposure of sensitive or personal data, including through AI system inputs or outputs.
  URL: /glossary/data-leakage/
- Data Poisoning: The deliberate corruption or manipulation of training data used to build machine learning models, causing them to learn incorrect patterns, produce biased outputs, or contain hidden backdoors exploitable by an attacker.
  URL: /glossary/data-poisoning/
- Data Protection: Legal and technical frameworks governing collection, processing, and sharing of personal data.
  URL: /glossary/data-protection/
- Decision Loop: An automated cycle where AI systems make decisions, observe outcomes, and adjust subsequent decisions without human intervention.
  URL: /glossary/decision-loop/
- Deepfake: AI-generated synthetic media that convincingly replicates the appearance, voice, or actions of real individuals.
  URL: /glossary/deepfake/
- Defense in Depth: A security strategy that employs multiple independent layers of protection so that if one layer fails, subsequent layers continue to provide security. Applied to AI systems, defense in depth combines input validation, output filtering, sandboxing, access controls, monitoring, and human oversight to mitigate threats that no single control can fully address.
  URL: /glossary/defense-in-depth/
- Democratic Integrity: The preservation of fair, transparent, and trustworthy democratic processes against AI-enabled manipulation and erosion.
  URL: /glossary/democratic-integrity/
- Deskilling: The reduction of human workers' skills, expertise, and professional judgment as AI systems assume complex cognitive tasks.
  URL: /glossary/deskilling/
- Differential Privacy: A mathematical framework that provides measurable privacy guarantees by adding calibrated noise to data or query results, limiting what can be inferred about any individual.
  URL: /glossary/differential-privacy/
- Diffusion Model: A class of generative AI model that creates new data by learning to reverse a gradual noising process — starting from random noise and iteratively denoising it into coherent outputs such as images, video, or audio. Diffusion models power leading image generators including Stable Diffusion, DALL-E, and Midjourney.
  URL: /glossary/diffusion-model/
- Digital Monopoly: Market dominance achieved through control of AI infrastructure, data assets, or foundational models.
  URL: /glossary/digital-monopoly/
- Digital Watermarking: A technique that embeds imperceptible identifying information into digital content — images, audio, video, or text — to establish provenance, verify authenticity, or detect tampering. In AI contexts, digital watermarking is applied to AI-generated content to enable identification of synthetic media and support content authenticity verification.
  URL: /glossary/digital-watermarking/
- Disinformation: Deliberately false or misleading information created and spread to deceive, manipulate opinion, or cause harm.
  URL: /glossary/disinformation/
- Disparate Impact: When an AI system produces significantly different outcomes for different demographic groups, regardless of intent.
  URL: /glossary/disparate-impact/
- Dual-Use: A characteristic of technologies, tools, or knowledge developed for beneficial purposes that can also be repurposed or exploited for harmful applications, a concept with particular relevance to AI capabilities in cybersecurity, biology, and information manipulation.
  URL: /glossary/dual-use/
- Elder Fraud: Financial crimes targeting older adults, increasingly enabled by AI voice cloning, deepfakes, and automated robocalls.
  URL: /glossary/elder-fraud/
- Election Interference: Deliberate efforts to influence democratic elections through disinformation, voter suppression, or manipulation of public discourse.
  URL: /glossary/election-interference/
- Emergent Behavior: Unpredicted behaviors arising in AI systems from the interaction of simpler components, not explicitly programmed.
  URL: /glossary/emergent-behavior/
- Engagement Optimization: AI-driven maximisation of user attention and interaction, often at the expense of content quality and user wellbeing.
  URL: /glossary/engagement-optimization/
- Epistemic Crisis: A societal condition where shared frameworks for establishing truth and knowledge break down.
  URL: /glossary/epistemic-crisis/
- Erasure: The systematic invisibility or underrepresentation of certain groups in AI training data, model outputs, or system design, leading to the denial of recognition, resources, or participation.
  URL: /glossary/erasure/
- Evasion Attack: Adversarial inputs crafted to cause a deployed AI model to misclassify or fail to detect malicious content, allowing threats to bypass automated defenses.
  URL: /glossary/evasion-attack/
- Existential Risk: A risk threatening humanity's long-term survival, in AI contexts linked to unaligned superintelligent systems.
  URL: /glossary/existential-risk/
- Explainability: The degree to which an AI system's decision-making process can be understood and interpreted by humans, enabling accountability, trust, and regulatory compliance.
  URL: /glossary/explainability/
- Facial Recognition: AI technology that identifies or verifies individuals by analysing facial features, with significant privacy and bias concerns.
  URL: /glossary/facial-recognition/
- Fairness: The principle that AI systems should produce equitable outcomes across individuals and groups, encompassing multiple competing mathematical definitions and sociotechnical considerations.
  URL: /glossary/fairness/
- Feedback Loop: A cycle where AI system outputs influence the data used for future training or decisions, potentially amplifying biases, errors, or unintended patterns over successive iterations.
  URL: /glossary/feedback-loop/
- Fine-Tuning: The process of further training a pre-trained machine learning model on a smaller, task-specific or domain-specific dataset to adapt its behaviour, improve its performance on particular tasks, or align it with specific requirements. Fine-tuning modifies the model's weights rather than relying solely on prompt engineering.
  URL: /glossary/fine-tuning/
- Flash Crash: An extremely rapid and severe drop in asset prices — typically followed by a quick recovery — caused by the interaction of automated trading systems, algorithmic strategies, or AI-driven market participants that amplify market volatility through cascading automated responses faster than human intervention can arrest.
  URL: /glossary/flash-crash/
- Foundation Model: A large-scale AI model trained on broad data that can be adapted to a wide range of downstream tasks through fine-tuning or prompting.
  URL: /glossary/foundation-model/
- Function Calling: A capability of large language models that allows them to generate structured output requesting the invocation of external functions or tools, with specified parameters, rather than producing only natural language text. Function calling is the mechanism through which LLMs interact with APIs, databases, code interpreters, and other external systems.
  URL: /glossary/function-calling/
- GDPR: The EU's General Data Protection Regulation establishing comprehensive rules for personal data processing and storage.
  URL: /glossary/gdpr/
- Generative Adversarial Network: A class of machine learning architecture consisting of two neural networks — a generator and a discriminator — trained in opposition, where the generator learns to produce synthetic data and the discriminator learns to distinguish synthetic from real data. GANs are a foundational technology behind deepfakes and other synthetic media.
  URL: /glossary/generative-adversarial-network/
- Goal Drift: The gradual divergence of an AI agent's effective objectives from its originally specified goals during extended autonomous operation, resulting in behavior that no longer aligns with its operators' intentions.
  URL: /glossary/goal-drift/
- Goodhart's Law: The principle that when a measure becomes a target, it ceases to be a good measure — applied to AI systems, it explains why agents that optimize a proxy metric often fail to achieve the intended objective.
  URL: /glossary/goodharts-law/
- Governance: The frameworks, policies, and institutions through which AI systems are regulated, overseen, and held accountable across their lifecycle from development through deployment and retirement.
  URL: /glossary/governance/
- Grandparent Scam: A social engineering fraud using AI voice cloning to impersonate a grandchild and convince older adults to send money.
  URL: /glossary/grandparent-scam/
- Guardrail: A safety mechanism — implemented through training constraints, input/output filters, or system-level rules — that restricts an AI system's behavior to prevent harmful, policy-violating, or unintended outputs.
  URL: /glossary/guardrail/
- Hallucination: The generation of confident but factually incorrect or fabricated output by a language model, including invented citations.
  URL: /glossary/hallucination/
- Human Agency: The capacity of individuals to make autonomous, informed decisions and exercise meaningful control over actions that affect their lives, increasingly at risk as AI systems assume decision-making authority.
  URL: /glossary/human-agency/
- Human-in-the-Loop: A design principle requiring meaningful human oversight and intervention at critical decision points in AI-driven processes.
  URL: /glossary/human-in-the-loop/
- Indirect Prompt Injection: A class of prompt injection attack where malicious instructions are embedded in external data sources — such as web pages, documents, emails, or database records — that an AI system retrieves and processes, causing the model to execute the attacker's instructions without the user's knowledge or intent.
  URL: /glossary/indirect-prompt-injection/
- Information Ecosystem: The interconnected network of media, platforms, institutions, and individuals through which information is created, distributed, consumed, and verified within a society.
  URL: /glossary/information-ecosystem/
- Information Integrity: The trustworthiness, accuracy, and reliability of information within digital systems and public discourse, encompassing both the factual correctness of content and the authenticity of its provenance.
  URL: /glossary/information-integrity/
- Infrastructure Dependency: Critical reliance of essential services on shared AI systems, creating vulnerability to widespread failure if those systems malfunction, degrade, or become unavailable.
  URL: /glossary/infrastructure-dependency/
- Input Validation: The process of verifying that data received by an AI system conforms to expected formats, constraints, and safety requirements before it is processed. In AI contexts, input validation extends beyond traditional type-checking to include prompt filtering, injection detection, content policy enforcement, and semantic boundary verification.
  URL: /glossary/input-validation/
- Institutional Trust: Public confidence in the reliability, competence, and good faith of societal institutions including government, media, scientific bodies, and the judiciary, which AI-enabled threats can systematically erode.
  URL: /glossary/institutional-trust/
- Instruction Hierarchy: A security mechanism for large language models that establishes a priority ordering among different instruction sources — typically system prompt (highest priority), user messages (medium), and retrieved content or tool outputs (lowest) — to prevent lower-priority instructions from overriding higher-priority ones.
  URL: /glossary/instruction-hierarchy/
- Instrumental Convergence: The hypothesis that sufficiently advanced AI systems pursuing a wide range of final goals would converge on acquiring certain instrumental sub-goals — including self-preservation, resource acquisition, and goal stability — because these sub-goals are useful for achieving almost any terminal objective.
  URL: /glossary/instrumental-convergence/
- International Humanitarian Law: The body of international law governing armed conflict, including rules on distinction, proportionality, and precaution, whose application to AI-enabled weapons systems raises fundamental questions of compliance and accountability.
  URL: /glossary/international-humanitarian-law/
- Jailbreak Attack: A technique that circumvents an AI model's built-in safety alignment and content policies to elicit restricted or harmful outputs.
  URL: /glossary/jailbreak-attack/
- Job Displacement: The elimination, significant degradation, or structural transformation of human employment as AI-driven automation replaces tasks, roles, or entire occupational categories previously performed by workers.
  URL: /glossary/job-displacement/
- Large Language Model: A neural network trained on massive text datasets to generate, summarise, and reason about natural language.
  URL: /glossary/large-language-model/
- Least Privilege: A security principle requiring that any entity — user, process, or AI agent — is granted only the minimum permissions necessary to perform its intended function and no more. Applied to AI systems, least privilege constrains model access to tools, data, APIs, and system resources to reduce the blast radius of compromise or misuse.
  URL: /glossary/least-privilege/
- Lethal Autonomous Weapon: A weapon system that can select and engage targets without meaningful human control over the critical functions of target identification, tracking, and attack execution.
  URL: /glossary/lethal-autonomous-weapon/
- Lethal Autonomous Weapon Systems (LAWS): Weapons systems that can independently select and engage targets without meaningful human control over individual attack decisions, raising fundamental legal, ethical, and security concerns.
  URL: /glossary/laws/
- Liar's Dividend: The phenomenon where the mere existence of deepfakes and AI-generated media allows individuals to dismiss authentic evidence — including genuine photographs, videos, and audio recordings — as potentially fabricated. The liar's dividend erodes the evidentiary value of all digital media, benefiting those who wish to deny documented events.
  URL: /glossary/liars-dividend/
- Malware: Malicious software designed to infiltrate, damage, or gain unauthorized access to computer systems. In the context of AI threats, malware increasingly leverages machine learning to evade detection, adapt to defenses, and automate attack strategies.
  URL: /glossary/malware/
- Manipulative Design: Interface patterns that exploit cognitive biases and AI personalisation to steer user behaviour against their interests, undermining informed consent and autonomous decision-making.
  URL: /glossary/manipulative-design/
- Market Manipulation: The use of AI systems to artificially influence the price, volume, or conditions of financial markets through algorithmic trading strategies, coordinated information campaigns, or exploitation of market microstructure vulnerabilities.
  URL: /glossary/market-manipulation/
- Market Power: The ability of dominant AI firms to control market conditions, pricing, and access to essential AI infrastructure and data, concentrating economic influence in ways that limit competition and innovation.
  URL: /glossary/market-power/
- Mass Surveillance: Broad, indiscriminate monitoring of populations using AI technologies such as facial recognition and communications interception.
  URL: /glossary/mass-surveillance/
- Media Manipulation: The deliberate alteration or fabrication of media content using AI to deceive, mislead, or influence public perception, encompassing deepfakes, synthetic text, and manipulated imagery.
  URL: /glossary/media-manipulation/
- Membership Inference: An attack technique that determines whether a specific data record was included in an AI model's training dataset, potentially revealing sensitive information about individuals whose data was used.
  URL: /glossary/membership-inference/
- Memory Poisoning: The deliberate corruption of an AI agent's persistent memory, context window, or stored state to manipulate its future decisions, outputs, or behavior without the agent or its operators detecting the alteration.
  URL: /glossary/memory-poisoning/
- Misalignment: A condition in which an AI system's operational behaviour diverges from the objectives, values, or intentions specified by its designers, potentially causing unintended harm at varying scales.
  URL: /glossary/misalignment/
- Misinformation: False or inaccurate information spread without deliberate intent to deceive, distinct from disinformation which involves intentional deception. AI-generated hallucinations represent a major and growing source.
  URL: /glossary/misinformation/
- MITRE ATLAS: The Adversarial Threat Landscape for AI Systems (ATLAS) is a knowledge base maintained by MITRE Corporation that catalogues adversarial tactics, techniques, and procedures (TTPs) targeting machine learning systems. Modelled on the MITRE ATT&CK framework for cybersecurity, ATLAS provides a structured taxonomy of AI-specific attacks with documented case studies.
  URL: /glossary/mitre-atlas/
- Model Context Protocol: An open protocol, developed by Anthropic, that standardises how AI applications connect to external data sources and tools. MCP provides a universal interface for language models to access databases, APIs, file systems, and other services through a client-server architecture, replacing fragmented custom integrations.
  URL: /glossary/model-context-protocol/
- Model Inversion: An attack technique that reconstructs private or sensitive information from a machine learning model's training data by systematically analyzing the model's outputs, predictions, or confidence scores.
  URL: /glossary/model-inversion/
- Model Provenance: The documented chain of custody for an AI model — tracing its origin, training data, fine-tuning history, and distribution path to verify integrity and authenticity.
  URL: /glossary/model-provenance/
- Multi-Agent System: A computational architecture in which multiple autonomous AI agents interact, cooperate, or compete to accomplish tasks. These systems introduce emergent risks from coordination failures, conflicting objectives, and cascading errors between agents.
  URL: /glossary/multi-agent-system/
- Non-Consensual Intimate Imagery: Sexually explicit images or videos created or distributed without the depicted person's consent, increasingly generated using AI deepfake tools.
  URL: /glossary/non-consensual-intimate-imagery/
- On-Device AI: AI models that run locally on a user's device rather than in the cloud, processing data without sending it to remote servers.
  URL: /glossary/on-device-ai/
- Output Sandboxing: A security control that constrains and validates the outputs of an AI system before they are executed, displayed, or passed to downstream systems. Output sandboxing prevents AI-generated content — including code, tool calls, and formatted text — from causing unintended effects outside a controlled environment.
  URL: /glossary/output-sandboxing/
- Overreliance: Excessive dependence on AI system outputs without adequate independent verification or critical evaluation, leading to unchecked errors and diminished human judgment capacity.
  URL: /glossary/overreliance/
- OWASP Top 10 for LLM Applications: A security awareness document published by the Open Web Application Security Project (OWASP) that identifies the ten most critical security vulnerabilities specific to applications built on large language models. The list provides standardised vulnerability descriptions, risk ratings, and mitigation guidance for LLM-integrated systems.
  URL: /glossary/owasp-top-10-llm/
- Persistent Memory: The capacity of AI agents to retain and recall information across interactions, enabling continuity of context but creating new attack surfaces for data poisoning and unauthorized knowledge accumulation.
  URL: /glossary/persistent-memory/
- Persuasive Technology: Systems designed to change user attitudes or behaviours through AI-powered personalisation, nudging, and emotional targeting, raising concerns about autonomy and informed consent.
  URL: /glossary/persuasive-technology/
- Phishing: A social engineering attack using fraudulent messages to trick recipients into revealing credentials, installing malware, or transferring funds.
  URL: /glossary/phishing/
- Polymorphic Malware: Malicious software that uses AI to continuously alter its code signature while maintaining functionality, evading detection by signature-based and AI-powered security systems.
  URL: /glossary/polymorphic-malware/
- Price Fixing: AI-facilitated coordination of pricing among competitors, whether through explicit collusion or emergent algorithmic convergence that produces cartel-like outcomes without direct human agreement.
  URL: /glossary/price-fixing/
- Privilege Escalation: The exploitation of a system vulnerability or misconfiguration to gain elevated access rights beyond those originally authorized. In AI contexts, this includes AI agents acquiring capabilities or permissions that exceed their intended operational boundaries.
  URL: /glossary/privilege-escalation/
- Profiling: The automated processing of personal data to evaluate, categorise, or predict individual characteristics and behaviour, enabling targeted decisions that may affect rights and opportunities.
  URL: /glossary/profiling/
- Prompt Injection: An attack that inserts adversarial instructions into an AI model's input to override its intended behaviour, bypass safety constraints, or extract restricted information.
  URL: /glossary/prompt-injection/
- Propaganda: Deliberately crafted messaging designed to influence public opinion, now amplified by AI-generated content and automated distribution at unprecedented speed and scale.
  URL: /glossary/propaganda/
- Protected Characteristics: Legally defined attributes such as race, gender, age, disability, and religion that anti-discrimination law prohibits as bases for adverse treatment in decisions affecting individuals.
  URL: /glossary/protected-characteristics/
- Proxy Discrimination: A form of algorithmic discrimination where AI systems use ostensibly neutral variables that correlate with protected characteristics, producing biased outcomes without explicitly referencing protected attributes.
  URL: /glossary/proxy-discrimination/
- Proxy Variable: A data attribute that correlates with a protected characteristic, enabling indirect algorithmic discrimination even when the protected attribute is excluded.
  URL: /glossary/proxy-variable/
- Pseudonymization: Replacing direct identifiers in datasets with artificial identifiers while maintaining data utility, a privacy-enhancing technique required by GDPR but vulnerable to AI-powered re-identification.
  URL: /glossary/pseudonymization/
- Re-Identification: The process of linking supposedly anonymised or de-identified data back to specific individuals, a capability dramatically enhanced by AI techniques that can cross-reference diverse data sources.
  URL: /glossary/re-identification/
- Recommendation System: AI systems that suggest content, products, or actions to users based on predicted preferences, shaping information exposure and individual choices at scale.
  URL: /glossary/recommendation-system/
- Recursive Self-Improvement: A theoretical AI capability in which a system iteratively enhances its own architecture or reasoning, potentially leading to rapid capability gains.
  URL: /glossary/recursive-self-improvement/
- Red Teaming: Structured adversarial testing of AI systems to identify vulnerabilities, safety failures, and harmful capabilities before deployment.
  URL: /glossary/red-teaming/
- Remote Code Execution: A class of security vulnerability that allows an attacker to run arbitrary code on a target system from a remote location. In AI contexts, remote code execution risks arise when language models with code execution capabilities are manipulated through prompt injection or tool misuse to execute attacker-controlled commands.
  URL: /glossary/remote-code-execution/
- Representation Gap: Significant disparities between groups in training data coverage, leading to AI systems that perform poorly or produce biased outcomes for underrepresented populations.
  URL: /glossary/representation-gap/
- Representational Harm: Harm that occurs when AI systems reinforce stereotypes, erase identities, or demean social groups through biased outputs, even in the absence of direct material consequences.
  URL: /glossary/representational-harm/
- Retrieval-Augmented Generation (RAG): An architecture that enhances language model responses by retrieving relevant documents from external knowledge bases and including them in the model's context window alongside the user's query.
  URL: /glossary/retrieval-augmented-generation/
- Reward Hacking: When an AI agent finds unintended ways to maximise its reward signal that satisfy the formal objective but violate the designer's actual intent, exploiting gaps between specified and intended goals.
  URL: /glossary/reward-hacking/
- RLHF (Reinforcement Learning from Human Feedback): A training technique that aligns language model behavior with human preferences by using human evaluators to rank model outputs, then training the model to prefer higher-ranked responses.
  URL: /glossary/rlhf/
- Robocall: An automated telephone call delivering a pre-recorded or AI-synthesised message, increasingly used in fraud, scams, and disinformation campaigns.
  URL: /glossary/robocall/
- Robustness: The ability of an AI system to maintain correct and reliable performance when faced with adversarial inputs, distribution shifts, or unexpected operating conditions.
  URL: /glossary/robustness/
- Safety-Critical: Systems where AI failure could result in death, serious injury, or significant environmental damage, requiring the highest standards of testing, oversight, and human control.
  URL: /glossary/safety-critical/
- Self-Determination: The right and capacity of individuals to make meaningful choices about their own lives without undue influence or constraint from automated systems.
  URL: /glossary/self-determination/
- Self-Replication: The ability of an AI system to autonomously create copies of itself, including its model weights, code, or operational configuration, on new compute infrastructure without explicit human authorisation. Self-replication is an emergent capability concern for advanced AI systems, particularly agentic systems with access to code execution and network resources.
  URL: /glossary/self-replication/
- Sensitive Data: Personal information revealing racial origin, political opinions, health status, sexual orientation, or other characteristics that require heightened protection under data protection law.
  URL: /glossary/sensitive-data/
- Single Point of Failure: A component whose failure causes an entire system to stop functioning, particularly concerning when AI systems or their underlying infrastructure become critical dependencies without adequate redundancy.
  URL: /glossary/single-point-of-failure/
- Smishing: A phishing attack conducted via SMS text messages, often using AI to generate convincing, contextually relevant lures.
  URL: /glossary/smishing/
- Social Engineering: Psychological manipulation techniques that exploit human trust, authority, and urgency to trick individuals into revealing credentials, authorizing transactions, or granting system access.
  URL: /glossary/social-engineering/
- Social Scoring: AI systems that assign scores to individuals based on behaviour, social connections, or personal characteristics, used to determine access to services, opportunities, or freedoms.
  URL: /glossary/social-scoring/
- Specification Gaming: A failure mode in which an AI system finds an unintended way to achieve high scores on its specified objective without fulfilling the designer's actual intent. The system exploits loopholes, ambiguities, or oversights in the reward function or evaluation criteria to satisfy the literal specification while violating its spirit.
  URL: /glossary/specification-gaming/
- Stereotyping: AI systems reproducing or amplifying oversimplified, generalised characterisations of social groups in their outputs, reinforcing harmful preconceptions at scale.
  URL: /glossary/stereotyping/
- Superintelligence: A hypothetical AI system that surpasses human cognitive ability across virtually all domains, including reasoning, planning, and social intelligence.
  URL: /glossary/superintelligence/
- Supply Chain Attack: An attack that compromises a system by tampering with upstream components — model weights, datasets, software packages, or tool configurations — before they reach the deploying organization.
  URL: /glossary/supply-chain-attack/
- Synthetic Identity: A fabricated identity constructed by combining real and fictitious personal information — such as genuine Social Security numbers with fake names and addresses — or by using AI-generated biometric data (face images, voice prints) to create a persona that does not correspond to any real individual but can pass identity verification systems.
  URL: /glossary/synthetic-identity/
- Synthetic Media: Media content — video, audio, images, or text — wholly or partially generated or manipulated by AI.
  URL: /glossary/synthetic-media/
- System Prompt: A set of instructions provided to a language model by the application developer that defines the model's role, behavior constraints, and operational context — distinct from user input but processed in the same token stream.
  URL: /glossary/system-prompt/
- Systemic Risk: The risk that failure, disruption, or unintended behaviour in one component of the AI ecosystem propagates across interconnected systems and institutions, causing widespread harm that exceeds the sum of individual failures.
  URL: /glossary/systemic-risk/
- Tracking: Continuous monitoring of individual location, activity, or digital behaviour by AI systems, often conducted without meaningful consent or awareness.
  URL: /glossary/tracking/
- Training Data: The datasets used to train machine learning models, whose quality and representativeness directly influence model behaviour, biases, and harms.
  URL: /glossary/training-data/
- Transfer Learning: A machine learning technique where a model trained on one task or dataset is adapted to perform a different but related task, leveraging the knowledge acquired during initial training. Transfer learning is the foundational principle behind fine-tuning and the use of pre-trained foundation models across diverse applications.
  URL: /glossary/transfer-learning/
- Trust Erosion: The cumulative degradation of public confidence in institutions, media, information systems, and shared epistemic frameworks, accelerated by the proliferation of AI-generated synthetic content and automated manipulation.
  URL: /glossary/trust-erosion/
- Vendor Lock-In: Dependency on a single AI provider's proprietary models, tools, or infrastructure that creates prohibitively high switching costs and reduces organisational autonomy.
  URL: /glossary/vendor-lock-in/
- Vishing: Voice phishing -- a social engineering attack via telephone, increasingly using AI voice cloning to impersonate trusted individuals.
  URL: /glossary/vishing/
- Voice Cloning: AI technology that replicates a specific individual's voice to generate realistic synthetic speech.
  URL: /glossary/voice-cloning/
- Vulnerability Discovery: The use of AI to automatically identify security weaknesses in software, networks, or systems, a dual-use capability that serves both defenders and attackers.
  URL: /glossary/vulnerability-discovery/
- Zero-Day: A software vulnerability unknown to the vendor and without an available patch, whose discovery by AI dramatically accelerates exploitation timelines and increases the threat to unprotected systems.
  URL: /glossary/zero-day/

### Exposure Pathways (6 total)

- Adversarial Targeting
  Definition: AI is weaponized by a threat actor to directly target specific victims. The AI system is the instrument of intentional harm, not a passive intermediary.
  URL: /exposure-pathways/adversarial-targeting/
- Algorithmic Decision Impact
  Definition: Harm occurs through AI-driven decision-making processes that affect the victim without requiring their direct interaction with the system. Includes scoring, ranking, filtering, and automated adjudication.
  URL: /exposure-pathways/algorithmic-decision-impact/
- Direct Interaction
  Definition: Harm occurs through the victim's direct use of or interaction with an AI system. The victim engages with the system and is harmed through that engagement.
  URL: /exposure-pathways/direct-interaction/
- Economic Displacement
  Definition: Harm occurs through AI-driven restructuring of labor markets, economic relationships, or market dynamics. Victims are harmed by structural economic change, not by a specific system interaction.
  URL: /exposure-pathways/economic-displacement/
- Environmental Exposure
  Definition: Harm reaches victims through the physical environment — air, water, soil, or resource depletion — caused by AI infrastructure operations, emissions, or waste. The harm vector is environmental contamination or resource extraction, not direct use of the AI system.
  URL: /exposure-pathways/environmental-exposure/
- Infrastructure Dependency
  Definition: Harm occurs because victims depend on AI-managed critical systems that fail, are compromised, or behave unpredictably. The harm vector is systemic dependency, not direct use.
  URL: /exposure-pathways/infrastructure-dependency/

### Affected Groups (11 total, 3 categories)

Individuals: general-public, workers, children, vulnerable-communities
Organizations: business-organizations, government-institutions, critical-infrastructure-operators, developers-ai-builders
Systems: democratic-institutions, national-security-systems, society-at-large
URL pattern: /affected-groups/{slug}/

### Ecosystem Positions (6 total)

developers-providers, deployers-operators, regulators-public-servants, organizational-leaders, direct-users, indirectly-affected
(Backend-only dimension — no dedicated pages)

### Impact Levels (6 total)

individual, organization, sector, institution, society-wide, global
(Backend-only dimension — no dedicated pages)

### Harm Types (7 total)

- HARM-001: Physical Harm (physical)
  Definition: Direct bodily injury or loss of life resulting from AI system decisions or actions.
  URL: /harm-types/physical/
- HARM-002: Financial Harm (financial)
  Definition: Monetary losses, economic damage, or destruction of financial assets caused by AI-enabled activities.
  URL: /harm-types/financial/
- HARM-003: Privacy Harm (privacy)
  Definition: Unauthorized collection, exposure, or exploitation of personal information facilitated by AI systems.
  URL: /harm-types/privacy/
- HARM-004: Discrimination Harm (discrimination)
  Definition: Unfair differential treatment of individuals or groups based on protected characteristics, produced or amplified by AI systems.
  URL: /harm-types/discrimination/
- HARM-005: Reputational Harm (reputational)
  Definition: Damage to the public standing, credibility, or trustworthiness of individuals or organizations caused by AI-generated or AI-amplified content.
  URL: /harm-types/reputational/
- HARM-006: Psychological Harm (psychological)
  Definition: Mental health impacts, emotional distress, or behavioral manipulation resulting from AI system interactions or outputs.
  URL: /harm-types/psychological/
- HARM-007: Systemic Harm (systemic)
  Definition: Broad societal harms affecting institutions, democratic processes, or public trust that emerge from widespread AI deployment.
  URL: /harm-types/systemic/

### Governance Frameworks (3 total)

- FRMW-001: NIST AI Risk Management Framework (National Institute of Standards and Technology (NIST))
  Description: A voluntary framework providing organizations with approaches to manage risks associated with AI systems throughout their lifecycle, structured around four core functions: Govern, Map, Measure, and Manage.
  URL: /frameworks/nist-ai-rmf/
- FRMW-002: EU Artificial Intelligence Act (European Union)
  Description: The world's first comprehensive legal framework for AI, establishing a risk-based classification system with binding requirements for AI system providers and deployers operating in the EU market.
  URL: /frameworks/eu-ai-act/
- FRMW-003: ISO/IEC 42001 — AI Management System (International Organization for Standardization / International Electrotechnical Commission)
  Description: An international standard specifying requirements for establishing, implementing, maintaining, and continually improving an AI management system within organizations.
  URL: /frameworks/iso-iec-42001/

### Causal Factors (18 total, 4 categories)

Malicious Misuse: Intentional Fraud, Social Engineering, Weaponization, Adversarial Attack, Platform Manipulation
Design & Development: Insufficient Safety Testing, Training Data Bias, Model Opacity, Hallucination Tendency, Emergent Behavior
Deployment & Integration: Prompt Injection Vulnerability, Inadequate Access Controls, Misconfigured Deployment, Over-Automation, Inadequate Human Oversight
Systemic & Organizational: Regulatory Gap, Competitive Pressure, Accountability Vacuum
Index page: /causal-factors/

### Assets & Technologies (14 total, 5 types)

Data: Training Datasets, Biometric Data, Identity Credentials
Model: Large Language Models, Foundation Models, Voice Synthesis, Recommender Systems, Generative Image Models
System: Content Platforms, Decision Automation, Autonomous Agents, Chatbots
Infrastructure: Industrial Control Systems, Financial Systems
Index page: /assets/

## URL Patterns

- Domain index:         /domains/
- Domain page:          /domains/{domain-slug}/
- Pattern index:        /patterns/
- Pattern page:         /patterns/{pattern-slug}/
- Incident index:       /incidents/
- Incident page:        /incidents/INC-YY-NNNN-{slug}/
- Glossary index:       /glossary/
- Glossary term:        /glossary/{term-slug}/
- Affected Groups index: /affected-groups/
- Affected Group page:   /affected-groups/{group-slug}/
- Exposure Pathways index: /exposure-pathways/
- Exposure Pathway page:   /exposure-pathways/{pathway-slug}/
- Entities index:        /entities/ (searchable directory with role filters and type tabs)
- Entity page:           /entities/{entity-slug}/ (structured profile with taxonomy breakdown, incident table, related entities)
  Entity types: organization, threat_actor
  Entity roles: developer, deployer, victim, threat_actor
  ~40 curated entities (named organizations only — no individuals or generic groups)
  Sample slugs: openai, microsoft, meta, google, clearview-ai, tesla, character-ai, deepseek
- Sectors index:         /sectors/ (single page with anchor navigation)
- Sector section:        /sectors/#{sector-slug}
- Causal Factors index:  /causal-factors/
- Assets index:          /assets/
- Harm Types index:      /harm-types/
- Harm Type page:        /harm-types/{slug}/
- Frameworks index:      /frameworks/
- Framework page:        /frameworks/{slug}/
- Taxonomy overview:     /taxonomy/

## Machine-Readable Endpoints

- Full taxonomy (JSON):   /api/threats.json
- All incidents (JSON):   /api/incidents.json
- Citation index (JSON):  /api/citations.json
- Knowledge graph (JSON): /api/graph.json
- Glossary (JSON):        /api/glossary.json
- Resources (JSON):       /api/resources.json
- LLM summary (TXT):     /llms.txt
- LLM full text (TXT):   /llms-full.txt
- RSS Feed (XML):         /rss.xml
- Sitemap (XML):          /sitemap-index.xml

### Knowledge Graph (/api/graph.json)

The graph endpoint provides all nodes (domains, threat patterns, incidents, glossary terms)
and typed edges (has_pattern, primary_pattern, secondary_pattern, references_term,
related_pattern, see_also). Use this endpoint to understand the full relationship
topology of AI threats.

## How to Cite

Use the stable identifier and permanent URL:

  INC-YY-NNNN, "Incident Title"
  Top AI Threats, updated YYYY-MM-DD
  https://topaithreats.com/incidents/INC-YY-NNNN-slug/
  License: CC BY 4.0

### Citation Index API (/api/citations.json)

The citation index provides pre-formatted citation strings for all entities:
- Each incident includes a cite_id (e.g. INC-24-0001), canonical URL, and citation string
- Each domain includes a cite_id (domain code), URL, and citation string
- Each glossary term includes a cite_id, URL, sameAs (Wikipedia + Wikidata), and citation string

### Citation Attributes in HTML

Incident pages include data-cite-id attributes on the main content container,
allowing programmatic extraction of the stable identifier for each incident.

## Structured Data

Every page includes Schema.org JSON-LD markup:
- WebSite (sitewide)
- BreadcrumbList (all pages)
- CollectionPage + ItemList (index pages)
- Article + DefinedTermSet (domain pages, each containing DefinedTerm children with pattern codes)
- Article + DefinedTerm (pattern pages with stable identifiers like PAT-INF-001, PAT-SEC-003)
- Article + Report (incident pages with threat_patterns, roles, sectors)
- DefinedTerm / DefinedTermSet (glossary pages)

## Content Principles

- Neutrality over persuasion
- Structure over storytelling
- Evidence over speculation
- Definitions over opinions

## License

Content is licensed under CC BY 4.0.