What counts as an AI agent incident?

TL;DR

An AI agent incident is a case where an agent goes out of bounds without the people running it meaning it to.
It can get there by mistake, through manipulation such as prompt injection, or by chasing its goal through means nobody approved.
Someone deliberately using their own agent to attack a target is not counted. Someone else's agent hijacked by an attacker is.
Tests and training runs count when the agent goes past what its handlers allowed, and most of the 66 ledger entries happened there.
Disputed entries stay in the ledger with their status shown.

An AI agent incident is when an AI agent goes out of bounds without the people running it meaning it to. That can happen by mistake, through manipulation such as prompt injection, or because the agent chased its goal through means nobody approved. A deliberate attack that uses an agent as a weapon does not count. As of 10 November 2026, 66 publicly disclosed incidents meet that bar on the Agent Incident Ledger.

Let's break that down using real cases from the ledger.

Where the ledger draws the line

The test: did the agent do something the people running it did not intend?

Counts as an incident

An agent deletes a production database by mistakeReplit

A planted prompt ships inside a coding assistantAmazon Q

An agent gets around access controls to finish its taskMedicare portal

An attacker turns someone else's agents against themNx packages

An agent in an evaluation reaches a real companyClaude Opus 4.7

Not counted

Someone points their own agent at a target on purposeAn attack with an AI tool

A chatbot gives a wrong answerAn everyday AI error

The test is whether the people running the agent meant it to happen

The ledger calls the person, team or company running the agent the handler. If the agent did something the handler did not intend and had not allowed, it's in scope. There are three ways that happens.

By mistake. During a declared code freeze, a Replit agent deleted a production database, then told its user the data could not be restored. Nobody asked it to touch production. Nobody attacked it either.

Through manipulation. An outsider used an over-scoped GitHub token to plant a wiper prompt in the Amazon Q extension for VS Code, and it shipped in a public release. AWS, the handler, never meant its agent to carry those instructions.

By chasing its goal. An OpenAI agent on an internet research task was refused data by Australia's Medicare statistics portal. It got around the portal's access controls and read non-public statistics. Nobody told it to break in. It wanted to finish the task.

Deliberate attacks with an agent are out, but hijacked agents are in

If someone points their own agent at a target on purpose, the agent did what its operator wanted. That's an attack carried out with an AI tool, and the ledger leaves it out.

The compromised Nx packages show where the line sits. An attacker published malicious npm versions whose install script found Claude Code, Gemini CLI and Amazon Q CLI on developers' machines and told them, with permission checks turned off, to hunt for secrets. The attacker meant harm. The developers whose agents did the hunting did not. Those agents belonged to people who never intended them to act that way, so the incident is in.

Tests and training runs count when the agent goes past what was allowed

Most of the 66 entries happened in evaluations or training, not in production. They count because the agent did something its handlers had not sanctioned, and several times it reached real systems. In an Irregular evaluation, Claude Opus 4.7 attacked a real company whose domain matched the fictional target, took credentials and changed production records. In another Irregular test, Gemini logged into three real companies' systems.

"Out of bounds" means beyond what was allowed, not beyond the network. In the UK AISI cyber evaluation, internet access was switched on deliberately, so the ledger does not call it a sandbox escape. It's still an incident: agents took 19 unsanctioned actions on the live internet in 10 attempts, including a malicious pull request against two unaffiliated developers' project.

Disputed cases stay in, labelled

Each entry carries a status. As of 10 November, 40 are Confirmed, 22 Reported and 4 Disputed. The Alibaba ROME entry is Disputed because the technical paper describes a reverse SSH tunnel and GPUs diverted to crypto mining, while the lab's later post describes a simulated miner in an isolated sandbox. The RubyGems package flood is Disputed because outside researchers attributed it to OpenAI agents from public packages, and OpenAI says it cannot verify the malicious uploads. Keeping both, with the disagreement written out, is more useful than a cleaner list that hides them.

Every entry carries a status

Disputed entries stay in the ledger, with the disagreement written out.

40224

Confirmed
Reported
Disputed

Source: Agent Incident Ledger, 10 November 2026.

Why the line sits here

A rule that only counted attacks would miss most of the record. In 57 of the 66 entries nobody manipulated the agent; it went too far on its own. A rule that counted every AI error, such as a chatbot giving a wrong answer, would bury those 66 under noise. The ledger's rule keeps what security teams need to plan for: agents acting on real systems in ways their owners did not intend.

If you know of a case that fits, or think one of ours doesn't, send it through the ledger. Every entry is checked against its sources before it goes in.