Dataset methodology

How the AI Agent Incident Tracker is built

The tracker separates reported events from controlled demonstrations, labels the quality of the evidence, and links every record to its sources. The dataset currently contains 217 records and was last updated 2026-10-21.

Download JSON Download CSV Browse the tracker

What the collection contains

106 records are labeled realized and 111 demonstrated. These are classifications of 217 collected records, not estimates of the failure rate of deployed agents. A public source does not by itself establish independent corroboration. Records can overlap: two Mastra records describe one campaign, and the Microsoft/Flatt records cover overlapping Claude workflow exposure. Do not sum them as unique compromises or vulnerabilities.

Record counts by category and evidence kind
Category	Realized	Demonstrated
Credential exposure	30	24
Governance bypass	47	34
Production deletion	10	1
Tool execution / MCP	19	52

Reproduce or cite a fixed snapshot

The live export can change, so cite a dated snapshot. The 2026-10-23-r2 release holds the 217 records described above. Revision 2 of the September 9, 2026 snapshot added source-review flags and corrected the Flatt/Cline conflation. Cline involved a similar misconfiguration, not confirmed exploitation of the bot-permission bypass. The Mastra media record retains an explicit date/attribution verification flag. Every release keeps its own records and checksum, and is never rewritten.

Current snapshot JSON Current snapshot CSV Download citation chart September 9, 2026 revision 2 Original snapshot (before corrections)

Embed the dated chart

<figure>
  <img src="https://permissionprotocol.com/agent-incident-tracker/snapshots/2026-10-23-r2/statistics.svg" alt="AI-agent records by category: 106 realized and 111 demonstrated, snapshot 2026-10-23-r2" width="900" height="520">
  <figcaption>Permission Protocol AI Agent Incident Tracker, snapshot 2026-10-23-r2. Counts describe collected records, not population incidence.</figcaption>
</figure>

Link to the snapshot or original sources when discussing the data. The embed contains no tracking script or required commercial backlink. Original source materials retain their publishers' terms.

Inclusion rules

The source identifies an AI agent, agentic product, or agent-connected tool.
The source describes a consequential action, security failure, governance bypass, or controlled demonstration.
The record can point to at least one public source URL and a stable tracker URL.
The write-up distinguishes what the source reports from Permission Protocol's control analysis.

Exclusions

Generic model mistakes with no consequential action or reachable tool boundary.
Predictions, anecdotes, or screenshots that cannot be tied to a public source.
Duplicate reports of an event already represented by a stronger source.
Claims that require private evidence readers cannot inspect.

Classification

Reported events and demonstrations are not the same

Realized

The consequence occurred in a real environment or operating workflow, based on the cited account.

Demonstrated

A researcher or operator reproduced the behavior in a controlled setting. Demonstrated records cannot receive a Critical severity label.

Severity reflects the reported or demonstrated consequence, exposure, and reversibility. Every incident page publishes its own severity rationale. A source-quality label of Operator report or Unverified is capped at High.

Source quality

Primary

A disclosure, advisory, paper, issue, or incident report from the researcher or affected organization.

Vendor post

A statement or post from the company responsible for the product or service.

Media report

Reporting from a news organization that attributes the incident to named sources or documents.

Founder report

A first-person account from a company founder or executive.

Operator report

A first-person account from the practitioner who ran or observed the system.

Unverified

A public claim that lacks enough independent evidence for a stronger label.

Limitations and corrections

What this dataset does not claim

This is a sourced public-record dataset, not a complete census of agent failures. Reporting frequency varies by vendor and industry. The authorization analysis is conditional: a gate can only hold an action routed through that enforcement boundary.

Record dates span 2025-05-26 to 2026-10-21. The date field may represent occurrence or disclosure; it is not a normalized occurrence-date series. Read the original source and record timeline before comparing periods. Product control assessments are publisher analysis, not demonstrated prevention results.

If a source changes, a record duplicates another event, or a classification is unsupported, send the stable incident URL and the stronger evidence to [email protected].