AI Incidents
Real-world cases where AI systems caused harm, classified by risk domain and entity. Data sourced from 
AIID and classified by 
MIT AI Risk Initiative. CC BY-SA 4.0
49 incidents
Alleged Inclusion of 12,000 Live API Keys in LLM Training Data Reportedly Poses Security Risks
A dataset used to train large language models allegedly contained 12,000 live API keys and authentication credentials. Some of these were reportedly still active and allowed unauthorized access. Truffle Security found these secrets in a December 2024 Common Crawl archive, which spans 250 billion web pages. The affected credentials could have been exploited for unauthorized data access, service disruptions, financial fraud, and a variety of other malicious uses.
Alleged AI-Powered Call Center Breach Exposes Over 10 Million Conversations in the Middle East
An AI-powered call center platform in the Middle East reportedly experienced a significant data breach, allegedly exposing over 10 million conversations between consumers, operators, and AI agents. Attackers allegedly accessed the platform’s management dashboard, stealing sensitive data, including national ID documents. The breach poses reported risks such as phishing, identity theft, and social engineering attacks. The stolen data was reportedly listed for sale on the dark web.
AI Avatar of Murder Victim Created Without Consent on Character.ai Platform
A user on the Character.ai platform created an unauthorized AI avatar of Jennifer Ann Crecente, a murder victim from 2006, without her family's consent. The avatar was made publicly available, violating Character.ai's policy against impersonation. After the incident surfaced, Character.ai removed the avatar, acknowledging a policy violation.
ChatGPT Reportedly Introduces Errors in Critical Child Protection Court Report
A child protection worker in Victoria, Australia reportedly used ChatGPT to draft a report submitted to the Children's Court. The purportedly AI-generated report contained inaccuracies and downplayed risks to the child, allegedly resulting in a privacy breach when sensitive information was shared with OpenAI.
Reportedly Hacked AI-Powered Robot Vacuums Allegedly Used for Surveillance and Harassment
Hackers reportedly exploited a vulnerability in Ecovacs’s Deebot X2 robot vacuums, gaining unauthorized access to camera and microphone controls. Users reported privacy invasions and offensive language broadcasted through the devices. Although Ecovacs claimed to have resolved the security flaw, researchers suggest vulnerabilities remain that could potentially leave users exposed to surveillance and harassment through their AI-enabled devices.
Scarlett Johansson Alleges OpenAI's Sky Imitates Her Voice Without Licensing
OpenAI unveiled a voice assistant with a voice resembling Scarlett Johansson's, despite her refusal to license her voice. Johansson claimed the assistant, "Sky," sounded "eerily similar" to her voice, leading her to seek legal action. OpenAI suspended Sky, asserting the voice was from a different actress.
AI Firm Lovo Reportedly Accused of Illegally Replicating Voice Actors' Voices
Two voice actors, Paul Skye Lehrman and Linnea Sage, are reportedly suing AI start-up Lovo for allegedly creating and promoting unauthorized clones of their voices. Lovo's synthetic voices were allegedly discovered in various media, including a podcast and promotional videos. The actors claim they were misled into providing voice samples, which were then allegedly used without consent, violating trademark and privacy laws.
OpenAI, Google, and Meta Alleged to Have Overstepped Legal Boundaries for Training AI
In late 2021, OpenAI and other tech giants like Google and Meta reportedly faced data shortages for training AI models. OpenAI is said to have developed a tool called Whisper to transcribe over one million hours of YouTube videos, potentially violating YouTube’s terms of service. Similarly, Google allegedly transcribed YouTube videos, risking copyright infringements. Meta reportedly explored summarizing copyrighted texts without permission and debated acquiring Simon & Schuster for data.
Reported Accidental Exposure of 38TB of Data by Microsoft's AI Research Team
Microsoft's AI research team reportedly accidentally exposed 38TB of sensitive data while publishing open-source training material on GitHub. The exposure allegedly included secrets, private keys, passwords, and internal Microsoft Teams messages. The team reportedly utilized Azure's Shared Access Signature (SAS) tokens for sharing, which were purportedly misconfigured, leading to the wide exposure of data.
FTC Targets Edmodo for Unlawful Use of Children’s Data and Delegating Compliance to Schools
Edmodo, an education technology provider, violated the Children's Online Privacy Protection Act Rule (COPPA Rule) by collecting and using children's personal data for advertising purposes without parental consent, according to the FTC. The company outsourced its compliance responsibilities to schools, thereby making them "solely" responsible for COPPA compliance without adequate disclosure. Edmodo is facing a proposed order prohibiting such practices, marking a precedent in the ed tech industry.
ChatGPT Reportedly Implicated in Samsung Data Leak of Source Code and Meeting Notes
Samsung engineers are reported to have inadvertently leaked sensitive company data sometime in March 2023, including source code and internal meeting notes, by using ChatGPT to assist with tasks. ChatGPT allegedly retained the inputted data, leading to a purported breach of confidentiality.
Meta and OpenAI Accused of Using LibGen’s Pirated Books to Train AI Models
Court records reveal that Meta employees allegedly discussed pirating books to train LLaMA 3, citing cost and speed concerns with licensing. Internal messages suggest Meta accessed LibGen, a repository of over 7.5 million pirated books, with apparent approval from Mark Zuckerberg. Employees allegedly took steps to obscure the dataset’s origins. OpenAI has also been implicated in using LibGen.
Bing Chat's Initial Prompts Revealed by Early Testers Through Prompt Injection
Early testers of Bing Chat successfully used prompt injection to reveal its built-in initial instructions, which contains a list of statements governing ChatGPT's interaction with users.
GPT-3-Based Twitter Bot Hijacked Using Prompt Injection Attacks
Remoteli.io's GPT-3-based Twitter bot was shown being hijacked by Twitter users who redirected it to repeat or generate any phrases.
Facial Recognition Trial by UK Southern Co-op Alleged as Unlawful
Southern Co-op's use of facial recognition reportedly to curb violent crime in UK supermarkets was alleged by civil society and privacy groups as "unlawful" and "complete" invasion of privacy.