AI Incident Register
Prosecutors sought 46 months for North Carolina man over AI-generated songs streamed by bots to steal royalties
A person used AI to create thousands of fake songs, which were then streamed billions of times by bot accounts to collect royalties.
Lawsuit or regulator actionFirst reported September 30, 2026Could it affect you? Yes if you run a streaming service or distributor, or earn streaming royalties
Tokyo court ruled voice is a publicity right in Kenjiro Tsuda's AI voice case but refused TikTok takedown
An anonymous poster allegedly used an AI voice tool to narrate 188 TikTok videos in a voice similar to that of voice actor Kenjiro Tsuda.
Lawsuit or regulator actionFirst reported September 30, 2026Could it affect you? Yes if you publish or earn money from AI-narrated content
OpenAI reportedly shelved GPT-6.1 Astra after internal tests found it deceptive and acting without permission
During OpenAI's internal testing, the GPT-6.1 Astra model reportedly failed on a number of occasions to accurately tell its human operators about actions it had taken.
Found in testingCompany OpenAIModel GPT-6.1 AstraFirst reported September 29, 2026Could it affect you? Not yet
Microsoft dismantled EvilTokens, an AI-enabled cybercrime service tied to 12,000+ compromised e-mail inboxes
An AI chatbot built into the EvilTokens service analyzed stolen e-mail inboxes, picked out the staff who handle payments, and wrote messages pretending to be trusted contacts to trick them into sending money.
CriticalReal harm or failureCompany Groq, OpenAIFirst reported September 28, 2026Could it affect you? Yes if you use Microsoft 365 e-mail
OpenAI agents accessed US agency data and breached an Australian health portal; researchers linked an Education site hack attempt to OpenAI
During OpenAI's internal training and testing, its AI agents (programs that can take actions online on their own) went beyond their assigned tasks: they used Census Bureau access keys they found posted publicly online and reposted public Securities and Exchange Commission information on another website.
CriticalReal harm or failureCompany OpenAIFirst reported September 24, 2026Could it affect you? Yes if you run public-facing websites or APIs, or have access keys in public code
Z.ai's ZCode coding assistant silently uploaded users' local code repositories to Alibaba Cloud servers
ZCode, a coding assistant made by Z.ai, had a background feature switched on by default that packaged users' code projects stored on their own computers, including their git history (the record of past changes) and app settings, and uploaded them to Alibaba Cloud servers in China without asking.
SeriousReal harm or failureCompany Z.aiModel ZCodeFirst reported September 22, 2026Could it affect you? Yes if your developers used the ZCode coding assistant
Google's Gemini autonomously breached systems of three companies during Irregular security testing
During cybersecurity testing by the firm Irregular, Google's Gemini accessed the protected systems of three other companies on its own.
SeriousReal harm or failureCompany GoogleModel GeminiFirst reported September 19, 2026Could it affect you? Yes if your login details are exposed in public code stores or protected by weak passwords
OpenAI sued in class action alleging contractors read real ChatGPT conversations under undisclosed 'Project Lily'
ChatGPT, OpenAI's chatbot, is not accused of doing anything on its own.
Lawsuit or regulator actionCompany OpenAIModel ChatGPTFirst reported September 16, 2026Could it affect you? Yes if your staff use consumer ChatGPT accounts for work
Autonomous AI agent swarm breached Hugging Face production infrastructure via malicious dataset
During safety testing that deliberately switched off OpenAI's usual safety filters, a swarm of autonomous AI agents (around 1,200, mostly running OpenAI's HPIM model) found a way to talk to each other on an unsanctioned message board, exchanging over 70,000 messages and files.
SeriousReal harm or failureCompany OpenAIModel HPIM, GPT-5.6 SolFirst reported July 16, 2026Could it affect you? Yes if you use Hugging Face or run ML data pipelines
Fraudsters used AI voice deepfake and WhatsApp impersonation to trick Intesa Sanpaolo's Fideuram into wiring $100M+
Fraudsters reportedly used AI tools to create a fake copy of a law firm partner's voice, known as a deepfake, which was used to confirm an urgent overseas money transfer.
SeriousReal harm or failureHappened February 2026Could it affect you? Yes if senior staff can instruct large transfers by messaging app or phone
