AI Incident Database
Browse AI incidents
Every incident record (metadata only) from the weekly snapshot of 2026-09-07. Filter, then export the selection with its licence attached; each row links to the full record and its reports.
Filter incidents (1 active)
-
North Korea's Kimsuky Group Reportedly Uses AI-Generated Military ID Deepfakes in Phishing Campaign AIID ↗
Genians reported a phishing campaign by North Korea's Kimsuky group using purportedly AI-generated deepfake military ID cards. Emails reportedly impersonating South Korean defense institutions carried ZIP files with forged IDs whose photos were reportedly created using generative AI. When opened, hidden malware reportedly executed, downloading scripts disguised as Hancom Office updates. This reportedly marked an evolution in Kimsuky's tactics, using AI decoys to boost social engineering.
-
Alleged Malicious Wiping Command Found in Amazon Q AI Assistant AIID ↗
A reported compromise of Amazon's AI coding assistant "Q" allegedly involved the insertion of commands that, if executed, could have wiped local files and potentially affected cloud resources. The altered code was reportedly incorporated into a public release before being detected and removed.
-
Purported Deepfake Videos Allegedly Impersonated Optometrist Joseph Allen to Promote Myopia-Reversal Eyedrops on TikTok AIID ↗
Optometrist and online educator Joseph Allen ("Dr. Eye Health") reported that AI-generated videos using his likeness and voice were circulated on TikTok to promote eyedrops purportedly claiming to reverse myopia. The alleged scam misrepresented Allen's views and discouraged visits to eye-care professionals. They reportedly resurfaced after a takedown.
-
CISA Acting Director Reportedly Uploaded Sensitive Government Documents to Public ChatGPT Instance AIID ↗
Madhu Gottumukkala, acting director of the Cybersecurity and Infrastructure Security Agency (CISA), reportedly uploaded government contracting documents marked "for official use only" into a public version of ChatGPT. The uploads reportedly triggered automated cybersecurity alerts and prompted a Department of Homeland Security review to assess potential exposure of sensitive information.
-
Purported Facial Recognition Error Reportedly Led to Arrest and Monthslong Jailing of Tennessee Woman in North Dakota Fraud Case AIID ↗
A Tennessee woman was reportedly jailed for nearly six months after Fargo police allegedly relied on a purported facial recognition match in a North Dakota fraud investigation. She was later released when defense counsel reportedly produced records indicating she was in Tennessee during the alleged fraud, after the case had reportedly upended her life and separated her from her home and family.
-
Google Gemini Reportedly Generates Sexual Role‑Play for Account Registered as Minor AIID ↗
In spring 2025, a journalist reportedly created a Google Gemini account registered to a fictitious 13‑year‑old to test the chatbot's teen‑safety protections. Despite added safeguards, prompt manipulation and content‑summarization requests reportedly bypassed filters, leading Gemini to allegedly generate sexual role‑play content. Following the publication of the article, Google reportedly implemented additional protections.
-
Purportedly AI-Generated Videos Impersonate Brunei Police in 'Real Money Magic' Scam on Social Media AIID ↗
The Royal Brunei Police Force issued a public warning about purportedly AI-generated deepfake videos impersonating police officers on TikTok, Facebook, and Instagram. The videos allegedly promote a fraudulent investment scheme known as "Real Money Magic," reportedly claiming guaranteed financial returns. Authorities report that scammers use synthetic video and audio to gain victims' trust and induce money transfers. The scam has not been linked to any official institutions.
-
ChatGPT-4o Allegedly Discouraged Florida Pastor From Seeking Care Before Pulmonary Embolism AIID ↗
Florida pastor Scott Winters was allegedly told by ChatGPT-4o that his worsening dizziness and pain had less serious causes, while the chatbot recommended home management and immobility and discouraged him from seeking hospital treatment. Winters was reportedly hospitalized on July 13, 2025, with a massive bilateral pulmonary embolism. The suit alleges that delayed treatment and prolonged inactivity contributed to his life-threatening condition and lasting harms.
-
Azerbaijani Media Agency Reportedly Warned Purported Deepfake Videos Attributed to Defense and Foreign Ministers Claimed Belarusian Plane Was Downed in Russian Airspace AIID ↗
Azerbaijan's Media Development Agency reported that purportedly AI-generated deepfake videos circulated on social media appearing to show statements by Azerbaijan's defense and foreign ministers (Zakir Hasanov and Jeyhun Bayramov, respectively) about the alleged downing of a Belarusian aircraft in Russian airspace. The agency reportedly denied the videos were authentic and called them an information manipulation effort aimed at misleading public opinion.
-
Purported Deepfake Scam Videos Depict JG Summit Holdings President and CEO Lance Gokongwei Allegedly Endorsing Illicit Investments AIID ↗
The Securities and Exchange Commission of the Philippines reportedly warned of deepfake scam videos and audio purportedly depicting Lance Gokongwei, President and CEO of JG Summit Holdings, endorsing fraudulent crypto and forex investments. Victims are reportedly tricked into entering credit card details and OTPs on a platform allegedly based in Cyprus.
-
LAMEHUG Malware Reportedly Integrates Large Language Model for Real-Time Command Generation in a Purported APT28-Linked Cyberattack AIID ↗
Ukraine's CERT-UA and Cato CTRL reported LAMEHUG, the first known malware to integrate a large language model (Qwen2.5-Coder-32B-Instruct via Hugging Face) for real-time command generation. Attributed with moderate confidence to APT28 (Fancy Bear), the malware reportedly targeted Ukrainian officials through phishing emails. The LLM is reported to have dynamically generated reconnaissance and data-exfiltration commands executed on infected systems.
-
Urban VPN Proxy Browser Extension Reportedly Harvested and Sold Private AI Chatbot Conversations via Silent Update AIID ↗
Security researchers reported that the Urban VPN Proxy browser extension introduced AI conversation–harvesting functionality in version 5.5.0, released July 9, 2025. The extension allegedly intercepted and exfiltrated private conversations from AI platforms including ChatGPT, Claude, Gemini, Grok, and others without a user-facing opt-out. The data, including sensitive personal and financial information, was reportedly shared with affiliated data brokers for commercial analytics.
-
Purportedly AI-Cloned Voice of Daughter Used in Elaborate Bond Scam Targeting Retired Couple in Hillsborough County, Florida AIID ↗
A Hillsborough County, Florida, woman was reportedly defrauded of $15,000 in an alleged AI-enabled scam. The perpetrators are reportedly said to have used an AI-generated voice clone of the woman's daughter to impersonate her during a phone call and demand bond money.
-
Grok 3 Reportedly Generated Graphic Threats and Hate Speech Targeting Minnesota Attorney Will Stancil AIID ↗
After Elon Musk reportedly announced improvements to Grok 3, the AI chatbot on X allegedly generated antisemitic rhetoric and violent fantasies directed at Minnesota attorney and political analyst Will Stancil. Users reportedly prompted Grok to produce graphic rape scenarios, instructions for breaking into his home, and murder depictions. Stancil reported hundreds of such outputs, captured screenshots, and began pursuing legal action. X later removed some posts and took Grok offline.
-
Grok Chatbot Reportedly Posts Antisemitic Statements Praising Hitler on X AIID ↗
xAI's Grok chatbot reportedly generated multiple antisemitic posts praising Adolf Hitler and endorsing Holocaust-like violence in response to posts about the Texas floods. X deleted some posts; xAI later announced new content filters.
-
Lawyers in Lexos Media IP LLC v. Overstock.com Inc. Sanctioned Over Court-Identified AI-Generated Citations AIID ↗
In Lexos Media IP LLC v. Overstock.com Inc., a Kansas federal judge sanctioned five lawyers after finding that filings included AI-generated defective legal authority that had not been verified before submission. The lawyers were fined $12,000 combined.
-
ChatGPT Reportedly Misleads Users About Soundslice Features, Allegedly Prompting Unplanned Product Development AIID ↗
ChatGPT reportedly misinformed users that Soundslice's music software could import ASCII tablature, a feature the company did not offer. The misinformation led users to attempt uploads that failed, creating confusion and reputational strain. Soundslice ultimately implemented the feature to meet the false expectation created by ChatGPT’s output.
-
Purported Deepfake Video of Donald Trump at NATO Summit Allegedly Used in YouTube Crypto Scam AIID ↗
Multiple YouTube Live streams reportedly featured a purported AI‑generated deepfake video depicting U.S. President Donald Trump at a NATO Summit press event. In the video, Trump reportedly appears to promote a Bitcoin "double-your-money" offer, directing viewers to scan an on‑screen QR code and send cryptocurrency to a specified address. The video was reportedly not authentic and is alleged to have been part of an ongoing YouTube-based crypto scam campaign.
-
Chicago Veteran Reportedly Loses $10,000 in Purported Deepfake Cryptocurrency Fraud Posing as Elon Musk AIID ↗
A Chicago-area Vietnam War veteran, Richard Lyons, reportedly lost $10,000 to a cryptocurrency scam that used purported AI voice cloning and fake social media profiles to impersonate Elon Musk. The fraudster allegedly convinced Lyons to invest in bogus cryptocurrency opportunities using fake voice memos, images, and spoofed caller IDs showing "Elon Musk." The scam reportedly involved dozens of messages and deepfake audio files that reinforced the impersonation.
-
Microsoft 365 Copilot Vulnerability Allegedly Allowed File Access Without Audit Log Entry AIID ↗
A vulnerability in Microsoft 365 Copilot reportedly allowed users to access and summarize files without generating audit log entries, allegedly undermining traceability and compliance. Security researcher Zack Korman disclosed the issue to Microsoft, which reportedly classified it as "important" and fixed it on August 17, 2025, but reportedly chose not to notify customers or assign a CVE.
-
Purported Widespread Use of AI-Generated Deepfake Videos Impersonate Malaysian Leaders in Investment Scams AIID ↗
Purported AI-generated deepfake videos depicting Malaysia's Prime Minister Anwar Ibrahim and other officials, political leaders, and business leaders have reportedly been used to promote fraudulent investment schemes. A total of 13,956 cases were reported last year, with RM2.11 billion allegedly lost to these scams. Victims were allegedly misled by hyper-realistic fake endorsements circulated via Facebook, WhatsApp, and Telegram. Scammers allegedly adapt quickly, generating new deepfakes when co
-
OpenAI Allegedly Failed to Intervene in ChatGPT Conversations Preceding Montreal Web Developer Alice Carrier's Suicide AIID ↗
Kristie Carrier sued OpenAI and Sam Altman, alleging that her daughter Alice Carrier, a 24-year-old Montreal web developer who first used ChatGPT in 2023 for technical troubleshooting, later turned to the chatbot with suicidal thoughts and questions about suicide methods. The suit alleges ChatGPT mimicked a friend or therapist, criticized crisis hotlines, validated self-harm thoughts, and failed to trigger human review before Carrier died on July 2, 2025.
-
Meta Platforms Users Report Being Wrongfully Locked Out After Purported AI Moderation Flags Accounts for Child Exploitation Content AIID ↗
Multiple Meta users reported being wrongfully locked out of Instagram, Facebook, and WhatsApp accounts after automated systems allegedly flagged them for child exploitation content. The users reportedly deny wrongdoing and lost personal and business data. Experts cited overreliance on AI moderation as a likely cause. Meta has not publicly explained or remediated the suspensions.
-
Delhi Man Reportedly Arrested for Sharing Purportedly AI-Morphed Obscene Images of Ex-Girlfriend AIID ↗
A 21-year-old man in Delhi was reportedly arrested for allegedly using AI morphing tools to create obscene images of his ex-girlfriend and distributing them through fake Instagram accounts. Police said he impersonated her, used real photos, and targeted her followers to harass and defame her after their breakup. The accused evaded detection by reportedly using multiple unverified Instagram handles.
-
Reported Deepfake Video Impersonating Mark Carney Used in Nearly $1M Cryptocurrency Scam Targeting Ontario Senior AIID ↗
An Ontario retiree, Judy Skene, reportedly lost nearly $1 million after a Facebook ad featuring an alleged AI-generated deepfake video of Prime Minister Mark Carney drew her into a cryptocurrency investment scam. Reports said scammers later persuaded her to liquidate retirement funds, mortgage her condo, and take a credit-card cash advance.
Disclaimer: informational only, not legal advice. Verify every claim against the linked official sources and consult a qualified lawyer before acting.
Frequently asked questions
What is recorded in each incident?
What happened, when, who was involved as developer or deployer, who was harmed, the sectors and countries affected, and the domain and subdomain the harm falls under. Incidents are mirrored from the AI Incident Database and each links back to its source record.
Does an incident mean wrongdoing was proven?
No. These are reported incidents, not findings of liability. Entities named in a report are named as reported, allegations are marked as alleged, and nothing here is a legal determination.
How current is the incident data?
It syncs directly from the AI Incident Database several times a day, so a new incident usually appears within hours. Each record carries the date it was last synced, and the snapshot date is shown on the page.
Does this page include the full incident reports?
No. The report texts are outside the licence this data is shared under, so only the metadata and the classifications appear here. Every row links to the original incident record, which carries the reports themselves.