AI Incidents
Real-world cases where AI systems caused harm, classified by risk domain and entity. Data sourced from 
AIID and classified by 
MIT AI Risk Initiative. CC BY-SA 4.0
55 incidents
Bing Chat Solved CAPTCHAs with Image Analysis Feature Despite Safeguards
Microsoft was reported by a Twitter user for deploying image analysis feature capable of solving CAPTCHAs for its GPT-based chatbot despite it being safeguarded against solving them for users.
Reported Accidental Exposure of 38TB of Data by Microsoft's AI Research Team
Microsoft's AI research team reportedly accidentally exposed 38TB of sensitive data while publishing open-source training material on GitHub. The exposure allegedly included secrets, private keys, passwords, and internal Microsoft Teams messages. The team reportedly utilized Azure's Shared Access Signature (SAS) tokens for sharing, which were purportedly misconfigured, leading to the wide exposure of data.
ChatGPT Reportedly Banned by Italian Authority Due to OpenAI's Purported Lack of Legal Basis for Data Collection and Age Verification
Italy's data protection authority is reported to have temporarily limited OpenAI's processing of Italian users' data after alleging that ChatGPT lacked adequate notice and legal basis for large-scale personal data collection and processing used to train the system. The authority also cited a March 2023 data breach, possible processing of inaccurate personal data, and the absence of age-verification safeguards for children.
ChatGPT Reportedly Exposed Users' Private Data Reportedly Due to Bug
ChatGPT reportedly exposed titles of users' chat histories and users' private payment information to other users reportedly due to a bug, which prompted its temporary shutdown by OpenAI.
Australian Journalist Able to Access Centrelink Account Using AI Audio of Own Voice
A Guardian journalist was able to verify their identity and gain access to their own Centrelink self-service account using AI-generated audio of their own voice along with their customer reference number, shortly after voiceprint was deployed for ID verification.
ChatGPT Reportedly Implicated in Samsung Data Leak of Source Code and Meeting Notes
Samsung engineers are reported to have inadvertently leaked sensitive company data sometime in March 2023, including source code and internal meeting notes, by using ChatGPT to assist with tasks. ChatGPT allegedly retained the inputted data, leading to a purported breach of confidentiality.
Users Reported Security Issues with Google Pixel 6a's Fingerprint Unlocking
Google Pixel 6a's fingerprint recognition feature was reported by users for security issues, in which phones were mistakenly unlocked by unregistered fingerprints.
Private Medical Photos Were Reportedly Found in LAION-5B AI Training Dataset
In September 2022, an artist using the name Lapine reported finding private post-operative medical photos of herself in LAION-5B, a web-scraped image-text dataset used in AI image-synthesis research. Ars Technica confirmed her images were referenced in the dataset and reported finding thousands of similar patient medical-record photos.
GitHub Copilot, Copyright Infringement and Open Source Licensing
Users of GitHub Copilot can produce source code subject to license requirements without attributing and licensing the code to the rights holder.
XPeng Motors Fined For Illegal Collection of Consumers’ Faces Using Facial Recognition Cameras
The Chinese electric vehicle (EV) firm XPeng Motors was fined by local market regulators for illegally collecting in-store customers’ facial images without their consent for six months.
Uber Allegedly Violated GDPR by Failing to Provide Sufficient Notice on Automated Profiling for Drivers
Uber was alleged in a lawsuit to have provided incomplete notice about automated decision-making and profiling for drivers such as information about their driving behavior, and use of phone.
iRobot Roomba J7 R&D Images Reportedly Appeared in Private Online Groups After Data Labeling
Images reportedly captured in 2020 by development versions of iRobot's Roomba J7 robot vacuum during an AI training data project were sent to Scale AI for labeling and later appeared in private Facebook, Discord, and other online groups. Reporting described some images as showing sensitive household scenes.
Finnish Police Were Reportedly Reprimanded After National Bureau of Investigation Unit Allegedly Used Clearview AI to Identify Potential Abuse Victims
Finland's Deputy Data Protection Ombudsman reportedly reprimanded the National Police Board after a National Bureau of Investigation child sexual exploitation unit allegedly used Clearview AI in late 2019 or early 2020 to identify potential child sexual abuse victims. Four NBI users reportedly made about 120 searches during a free trial without controller approval or prior assessment of how uploaded biometric data would be handled.
Hive Box Facial-Recognition Locks Hacked by Fourth Graders Using Intended Recipient’s Facial Photo
Facial-recognition locks by Hive Box, an express delivery locker company in China, were easily opened by a group of fourth-graders in a science-club demo using only a printed photo of the intended recipient’s face, leaving contents vulnerable to theft.
GPT-2 Reportedly Reproduced Personal Data from Its Training Data
OpenAI's GPT-2 reportedly memorized and reproduced portions of its training data, including personal information such as names, email addresses, social media handles, and phone numbers. Researchers raised concerns that large language models could expose private or sensitive information when trained on web-scale datasets containing personal data.