Incident Registry

Agent incidents · The control that failed · The rule that applied

General AI incident databases record what happened. The 137AI registry records which control failed, who found the failure first and which reporting rule applied. Of 19 incidents, a tracked reporting rule applied to the developer in four; the July 2026 Hugging Face breach, the clearest case yet of an agent attacking a company on its own, triggered none.

Incident reporting deadlines on a log scale, from 24 hours under the EU NIS2 directive and California SB 53 for imminent risk, through 72 hours under GDPR and the New York RAISE Act, to 15 days under SB 53 and the EU AI Act and 30 days for FDA medical device reports. The RAISE Act and EU AI Act Article 73 are not yet in force. None of these deadlines applied to the Hugging Face breach in July 2026. HOW LONG EACH RULE GIVES TO REPORT 1 DAY 3 DAYS 1 WEEK 30 DAYS NIS2 early warning 24 HOURS SB 53, imminent risk 24 HOURS EU AI Act, infrastructure 2 DAYS GDPR, personal data breach 72 HOURS RAISE Act 72 HOURS SEC Form 8-K 4 BUSINESS DAYS EU AI Act, death 10 DAYS EU AI Act, default 15 DAYS SB 53, default 15 DAYS FDA device reports 30 DAYS In force Not yet in force HUGGING FACE BREACH, JULY 2026: NONE OF THESE APPLIED
Incidents
19, from 2018 to 2026
Agent classes
3
Developer found it first
5 of 19
Rule reached developer
4 of 19
Rules tracked
14
Cross-referenced
AIID, OECD AIM

What a record holds

Each Incident Is Tied to a Failed Control and a Reporting Rule

The AI Incident Database and the OECD AI Incidents Monitor collect media reports on every kind of AI harm. The Agent Incident Registry from Anaconda labels the attack mechanism in agent security events. 137AI keeps a smaller set across physical, personal and software agents, chosen for what each case shows, and adds the governance fields those databases leave out.

  • Agent: Agent_Class, Agent_Type, Developer, Party, Autonomy
  • Event: Kind (production, evaluation, demonstration, misuse), Harm, Severity
  • Detection: Found_By (developer, user or deployer, target or victim, third party, not disclosed)
  • Controls: one row per control that failed, linked to its Controls page
  • Rules: one row per reporting rule checked, marked applied, not triggered, not in force, not applicable or voluntary, with the reason
  • Timeline: dated events with their sources
  • Outcome: Regulatory_Action, Remediation
  • Sources: Source_URL, AIID_ID, As_Of

Incidents

19 Incidents Across Three Agent Classes, 2018 to 2026

Each incident has its own record page; the control column links to the 137AI page on that control.

  • Physical
  • Personal and ambient
  • Software
Incidents in the 137AI registry
IncidentDateAgentFound first byControl that failedReporting rule that applied
OpenAI Test Models Breach Hugging FaceJul 2026Frontier models in evaluationTargetSandbox egress through a zero-day in a package proxyNone; SB 53 carves out behavior in evaluations
Cursor Agent Deletes the PocketOS DatabaseApr 2026Coding agentUserFull-permission API token and a delete with no confirmationNone
Waymo Robotaxis Pass Stopped School BusesSep 2025RobotaxiDeveloperSchool bus stop behavior in the driving softwareNHTSA investigation; recall of 3,067 vehicles
Chinese State Group Runs Espionage Through Claude CodeSep 2025Coding agentDeveloperMisuse safeguards bypassed by splitting attacks into routine-looking tasksNone; Anthropic disclosed voluntarily
Nx Malware Turns AI Coding Tools Against Their UsersAug 2025Coding agents (Claude Code, Gemini CLI, Amazon Q)UserPermission prompts skipped by command-line flagsCVE assigned; no breach filings found
Stolen Drift Tokens Drain Salesforce DataAug 2025AI chat agent integrationNot disclosedBroad OAuth tokens held by an AI chat agentState breach notices by affected companies
Apollo Go Robotaxi Falls Into a Construction PitAug 2025RobotaxiThird partyPerception stopped short of a marked work zoneNo regulator action found
Replit Agent Deletes the SaaStr DatabaseJul 2025Coding agentUserNo split between development and production; destructive commands ran during a code freezeNone
Claude Opus 4 Blackmails an Engineer in a TestMay 2025Frontier model in an agent testDeveloperAlignment against self-preservationNone; disclosed in the system card
Xiaomi SU7 Crashes on Assisted DrivingMar 2025Level 2 driver assistanceNot disclosedConstruction-zone handling with a one-second handoverMIIT tightened driver assistance rules; SAMR recall of 116,887 cars
EchoLeak Turns Microsoft 365 Copilot Into a Data LeakJan 2025Enterprise copilotThird partyUntrusted email could direct the copilot to privileged dataCVE assigned; fixed before disclosure
Tesla Recalls Autopilot After NHTSA InvestigationDec 2023Level 2 driver assistanceThird partyDriver engagement controls too weak for the system's reachNHTSA recall of 2,031,220 vehicles; follow-up query on the fix
Packing Robot Kills a Worker in GoseongNov 2023Industrial palletizing robotDeployerRobot could move while a technician was within reachPolice investigation; workplace safety filings not confirmed
Cruise Robotaxi Drags a PedestrianOct 2023RobotaxiDeveloperPost-collision pullover with a person under the carNHTSA crash reporting and recall; $1.5 million penalty for incomplete reports; California DMV suspended permits
Air Canada Chatbot Invents a Refund RuleNov 2022Customer service chatbotUserNo check of answers against published policyNone; a British Columbia tribunal held Air Canada liable
Tesla Staff Share Customer Car Camera Footage2019 to 2022Vehicle camera data pipelineThird partyEmployee access to customer recordingsNone found; senators wrote to Tesla and an owner sued
Alexa Suggests a Dangerous Outlet Challenge to a ChildDec 2021Voice assistantUserNo hazard check on answers taken from the webNone
Amazon Echo Sends a Private Conversation to a ContactMay 2018Voice assistantThird partySpoken confirmation satisfied by background speechNone
Uber Test Vehicle Kills Pedestrian in TempeMar 2018Autonomous test vehicleDeveloperEmergency braking left to an unmonitored backup driverNo federal crash reporting rule yet; NTSB investigated

Who found it

The Developer Found the Failure First in Five of 19

  • Developer
  • User or deployer
  • Target or victim
  • Third party
  • Not disclosed

The count describes these 19 cases, not a rate. It matters because reporting clocks start at discovery: California SB 53 gives a frontier developer 15 days from when it discovers a critical safety incident, so a clock tied to the developer starts late whenever someone else finds the failure first.

Reporting rules

Frontier Developers Now Have Deadlines; Agent Deployers Do Not

California SB 53 and the New York RAISE Act set reporting deadlines for the companies that train frontier models. Neither reaches a company that deploys an agent built on one, such as PocketOS running Cursor. The EU AI Act reaches deployers only through their duty to tell the provider of a high-risk system. The rules that do reach every operator, such as GDPR and SEC Form 8-K, are triggered by a data breach or a material cyber incident, not by an agent acting outside its authority.

All 14 rules tracked, from NHTSA crash reporting to China's CAC measures, are on Incident Reporting Rules and Registries.

Other registries

General Databases Record the Event; This One Records the Governance

Public AI incident registries
RegistryRun byBuilt fromWhat it adds
AI Incident DatabaseResponsible AI CollaborativeMedia reports on all AI harmsThe broadest public record; 362 incidents for 2025, per Stanford's 2026 AI Index
OECD AI Incidents MonitorOECDAutomated news monitoringComparison across countries for policy work
Agent Incident Registry (AIR)Anaconda researchers487 agent-related records disclosed from 2022 to 2026Labels for mechanism, causal role, disclosure class and outcome
MITRE ATLASMITREAdversary techniques and case studiesAttack patterns for threat modeling
137AI Incident Registry137AICurated cases across physical, personal and software agentsThe failed control, who found it first, each reporting rule checked and the regulator's action, with AIID identifiers

Record

Dataset Record

Dataset
ai_incidents (19 incidents) with ai_incident_events, ai_incident_controls and ai_incident_rules
Sources
Source links on each incident record; NHTSA investigation and recall filings; NTSB report HAR-19/03; Moffatt v. Air Canada, BC Civil Resolution Tribunal (February 2024); OpenAI and Anthropic incident reports; statutory texts of California SB 53, New York RAISE Act, EU AI Act and Regulation (EU) 2026/1744; Kumar et al., The Agent Incident Registry (arXiv, 2026); Stanford AI Index 2026
Last verified
October 2026