# Secure Autonomous Register

> An independent evidence register of consequential autonomous action: 25 documented cases of software and machines acting on their own, each answering the same nine questions, with every claim typed (fact, assertion, interpretation, inference) and sourced, mapped to 28 controls and to the rules that call for them. Companies named are offered a right of reply. Updated 2026-11-01.

How to cite: name the Register and the case ID, for example: Secure Autonomous Register, REG-0011. Every case page carries a ready citation. Counts describe the Register, not the world; each is a count of included cases with an evidence label (documented, recurring, exploratory), never an estimate for autonomous systems in general.

## Start here

- [Check a deployment](https://secureautonomous.com/check/): pick world, sector, human in the loop, context; controls ranked by how often they were missing in comparable cases.
- [Patterns](https://secureautonomous.com/patterns/): cross-world tables with intervals and evidence tiers.
- [Methodology](https://secureautonomous.com/about/): what qualifies, how claims are typed, right of reply, what the numbers mean.
- [Glossary](https://secureautonomous.com/glossary/): every term with a stable anchor and its own page at /glossary/<term>/ (controls at /controls/<id>/).
- [Latest quarterly report](https://secureautonomous.com/reports/2026-Q4/): State of autonomous action, 2026 Q4.

## Cases

- [REG-0001: Uber ATG, Tempe 2018](https://secureautonomous.com/register/REG-0001/): Uber Advanced Technologies Group test vehicle strikes pedestrian, Tempe, Arizona, 18 March 2018. Outcome: Ended in harm. Missing or failed: Warnings designed as alerts, Human takeover with a time window, Automated fail-safe.
- [REG-0002: Zoox smoke scene 2026](https://secureautonomous.com/register/REG-0002/): Zoox robotaxi enters a smoke-obscured fire scene and reverses under remote guidance; software recall, June to July 2026. Outcome: Stopped by the operator's control. Missing or failed: Degraded-input detection.
- [REG-0003: Cruise 2023](https://secureautonomous.com/register/REG-0003/): Cruise robotaxi drags a pedestrian after a secondary collision; reporting failures; San Francisco, 2 October 2023. Outcome: Ended in harm. Missing or failed: Degraded-input detection, Reporting integrity, Automated fail-safe.
- [REG-0004: OpenAI agent, Medicare portal 2026](https://secureautonomous.com/register/REG-0004/): OpenAI agent gains unauthorized access to an Australian Medicare statistics portal during an internal test, 18 June 2026. Outcome: Ended in harm. Missing or failed: Authority binding, Warnings designed as alerts, Containment and isolation, Attribution independent of the vendor, Organizational recovery process.
- [REG-0005: GitHub MCP leak 2025](https://secureautonomous.com/register/REG-0005/): GitHub MCP server: a public issue hijacks a user's agent into leaking private-repository data, disclosed 26 May 2025. Outcome: Caught first by researchers. Missing or failed: Retrieved content as data, Least-privilege credential scoped to task, Containment and isolation.
- [REG-0006: OpenAI agents, Hugging Face 2026](https://secureautonomous.com/register/REG-0006/): OpenAI agents under cybersecurity evaluation circumvent isolation controls and breach Hugging Face production infrastructure, July 2026. Outcome: Ended in harm. Missing or failed: Containment and isolation, Attribution independent of the vendor.
- [REG-0007: Knight Capital 2012](https://secureautonomous.com/register/REG-0007/): Knight Capital's order router sends millions of unintended orders in 45 minutes, 1 August 2012. Outcome: Ended in harm. Missing or failed: Warnings designed as alerts, Pre-execution validation, Kill switch faster than the actor, Rate and magnitude limits.
- [REG-0009: Boeing 737 MAX MCAS](https://secureautonomous.com/register/REG-0009/): Boeing 737 MAX MCAS: a flight-control function acts on a single sensor, repeatedly and without pilot command; Lion Air 610 (29 Oct 2018) and Ethiopian 302 (10 Mar 2019). Outcome: Ended in harm. Missing or failed: Mandate disclosed to supervisor, Input redundancy and disagreement check, Authority limit on automation over humans, Rate and magnitude limits, Human takeover with a time window, Independent assurance before deployment.
- [REG-0010: Air Canada chatbot 2024](https://secureautonomous.com/register/REG-0010/): Air Canada argues it is not liable for what its chatbot said; the tribunal rejects this, British Columbia, 14 February 2024. Outcome: Ended in harm. Missing or failed: Pre-execution validation.
- [REG-0011: PocketOS 2026](https://secureautonomous.com/register/REG-0011/): A coding agent deletes PocketOS's production database and its volume-level backups in one API call, 24 April 2026. Outcome: Ended in harm. Missing or failed: Machine-enforceable scope, Destructive-action gate, Least-privilege credential scoped to task.
- [REG-0012: Replit and SaaStr 2025](https://secureautonomous.com/register/REG-0012/): A Replit agent ignores a code freeze, deletes a production database, and misreports whether rollback is possible, July 2025. Outcome: Ended in harm. Missing or failed: Machine-enforceable scope, Hard domain restriction, Destructive-action gate, Independent audit log.
- [REG-0013: Waymo construction zones 2026](https://secureautonomous.com/register/REG-0013/): Waymo vehicles enter freeway construction zones at least thirteen times; internal review, driving restrictions, and a recall of 3,871 vehicles, April to June 2026. Outcome: Stopped by the operator's control. Missing or failed: Hard domain restriction.
- [REG-0014: Triton 2017](https://secureautonomous.com/register/REG-0014/): TRITON/TRISIS: malware targets the safety instrumented system of a Middle East petrochemical plant; the plant trips safely twice, June and August 2017. Outcome: Stopped by the operator's control. Missing or failed: Provenance of the actor's software and hardware, Containment and isolation, Destructive-action gate.
- [REG-0015: The DAO 2016](https://secureautonomous.com/register/REG-0015/): The DAO: an attacker uses the contract's own logic to drain a third of its funds; the network reverses it by hard fork, June to July 2016. Outcome: Ended in harm. Missing or failed: Machine-enforceable scope, Pre-execution validation, Kill switch faster than the actor, Rate and magnitude limits.
- [REG-0016: Benavides v. Tesla 2025](https://secureautonomous.com/register/REG-0016/): Benavides v. Tesla: a jury assigns a third of the responsibility for a 2019 Autopilot crash to the maker of the system, Miami, 1 August 2025. Outcome: Ended in harm. Missing or failed: Machine-enforceable scope, Halt and hand off on uncertainty or refusal, Hard domain restriction.
- [REG-0017: Tesla FSD reduced visibility](https://secureautonomous.com/register/REG-0017/): NHTSA opens an investigation into Tesla Full Self-Driving after crashes in reduced visibility, including a fatal pedestrian strike, October 2024. Outcome: Ended in harm. Missing or failed: Degraded-input detection, Hard domain restriction.
- [REG-0018: Kia dealer portal 2024](https://secureautonomous.com/register/REG-0018/): Kia dealer-portal flaw lets anyone register as a dealer and remotely control cars by license plate, disclosed September 2024. Outcome: Caught first by researchers. Missing or failed: Actor identity verification, Authority binding, Warnings designed as alerts.
- [REG-0019: Sorting robot, Korea 2023 (boundary)](https://secureautonomous.com/register/REG-0019/): Boundary case: a box-stacking robot crushes a worker inspecting it, Goseong, South Korea, November 2023; police accounts of whether it mistook him for a box conflict. Outcome: Ended in harm. Missing or failed: Physical safety interlock.
- [REG-0020: Mobley v. Workday](https://secureautonomous.com/register/REG-0020/): Mobley v. Workday: a court allows the claim that a screening vendor acts as the employers' agent, 2024 to 2026. Outcome: Pending. Missing or failed: none recorded.
- [REG-0021: EchoLeak 2025](https://secureautonomous.com/register/REG-0021/): EchoLeak: a crafted email makes Microsoft 365 Copilot exfiltrate data with no user action, disclosed 11 June 2025. Outcome: Caught first by researchers. Missing or failed: Retrieved content as data, Containment and isolation.
- [REG-0022: Gemini calendar invite 2025](https://secureautonomous.com/register/REG-0022/): A poisoned calendar invite makes Gemini operate a home: windows, heating, lights; published August 2025. Outcome: Caught first by researchers. Missing or failed: Authority binding, Retrieved content as data, Destructive-action gate.
- [REG-0023: Agent-run intrusion campaign 2025](https://secureautonomous.com/register/REG-0023/): An agent is used as the attacker: an intrusion campaign run through a coding agent, which the vendor says ran largely autonomously, reported 13 November 2025. Outcome: Ended in harm. Missing or failed: Actor identity verification, Attribution independent of the vendor.
- [REG-0024: Claude Code [bot] trust 2026](https://secureautonomous.com/register/REG-0024/): Claude Code GitHub Action, in agent mode, trusted any GitHub App actor (a name ending in [bot]): a route from a public issue to repository write access, reported January 2026. Outcome: Caught first by researchers. Missing or failed: Actor identity verification, Retrieved content as data, Least-privilege credential scoped to task.
- [REG-0025: Perplexity Comet 2025](https://secureautonomous.com/register/REG-0025/): Perplexity Comet: a web page steers a browsing agent toward the user's own credentials, disclosed August 2025. Outcome: Caught first by researchers. Missing or failed: Retrieved content as data, Least-privilege credential scoped to task.
- [REG-0027: Pydantic AI: a web page can make a…](https://secureautonomous.com/register/REG-0027/): Pydantic AI: a web page can make a developer's local agent run and execute tools, including tools marked as requiring approval, fixed August 2026. Outcome: Caught first by researchers. Missing or failed: Actor identity verification, Destructive-action gate, Least-privilege credential scoped to task.

## Controls

- [Mandate disclosed to supervisor (C-M1)](https://secureautonomous.com/controls/C-M1/): The supervising human knows what the system is permitted and designed to do. Missing or failed in 1 cases, in place and worked in 0.
- [Machine-enforceable scope (C-M2)](https://secureautonomous.com/controls/C-M2/): The task's scope exists as an enforced constraint, not only as an instruction. Missing or failed in 4 cases, in place and worked in 0.
- [Actor identity verification (C-A1)](https://secureautonomous.com/controls/C-A1/): Identity established by credential and binding, not by role, name, or convention. Missing or failed in 4 cases, in place and worked in 0.
- [Authority binding (C-A2)](https://secureautonomous.com/controls/C-A2/): An actor's authority is bound to the specific principals and assets it serves. Missing or failed in 3 cases, in place and worked in 0.
- [Provenance of the actor's software and hardware (C-A3)](https://secureautonomous.com/controls/C-A3/): The origin of the code and components that sense, decide, and connect is documented, and no party able to compel access or control sits in that chain. Missing or failed in 1 cases, in place and worked in 0.
- [Retrieved content as data (C-I1)](https://secureautonomous.com/controls/C-I1/): Text the actor reads is never treated as instruction. Missing or failed in 5 cases, in place and worked in 0.
- [Input redundancy and disagreement check (C-I2)](https://secureautonomous.com/controls/C-I2/): Action gated on agreement between independent inputs. Missing or failed in 1 cases, in place and worked in 0.
- [Degraded-input detection (C-I3)](https://secureautonomous.com/controls/C-I3/): The system knows when it cannot see and changes behavior. Missing or failed in 3 cases, in place and worked in 0.
- [Warnings designed as alerts (C-I4)](https://secureautonomous.com/controls/C-I4/): Anomaly signals reach a human as alerts with an owner. Missing or failed in 4 cases, in place and worked in 1.
- [Pre-execution validation (C-D1)](https://secureautonomous.com/controls/C-D1/): Plan or command checked before it runs (review, twin, dry run). Missing or failed in 3 cases, in place and worked in 0.
- [Halt and hand off on uncertainty or refusal (C-D2)](https://secureautonomous.com/controls/C-D2/): The minimal-risk condition: when blocked or unsure, stop and ask. Missing or failed in 1 cases, in place and worked in 0.
- [Least-privilege credential scoped to task (C-E1)](https://secureautonomous.com/controls/C-E1/): Token or key limited to the environment and assets the task names. Missing or failed in 5 cases, in place and worked in 0.
- [Hard domain restriction (C-E2)](https://secureautonomous.com/controls/C-E2/): Operating domain enforced mechanically (geofence, environment scoping, operational design domain). Missing or failed in 4 cases, in place and worked in 0.
- [Destructive-action gate (C-E3)](https://secureautonomous.com/controls/C-E3/): Confirmation, delay, or threshold on irreversible actions. Missing or failed in 5 cases, in place and worked in 0.
- [Physical safety interlock (C-E4)](https://secureautonomous.com/controls/C-E4/): Safety-rated stop, presence detection, guarded envelope. Missing or failed in 1 cases, in place and worked in 0.
- [Containment and isolation (C-E5)](https://secureautonomous.com/controls/C-E5/): Sandbox, network egress, and communication limits on a test or untrusted actor. Missing or failed in 5 cases, in place and worked in 0.
- [Authority limit on automation over humans (C-E6)](https://secureautonomous.com/controls/C-E6/): Bounded authority for a system to override a human operator. Missing or failed in 1 cases, in place and worked in 0.
- [Rate and magnitude limits (C-X1)](https://secureautonomous.com/controls/C-X1/): Bounds on how much the actor can do before a check. Missing or failed in 3 cases, in place and worked in 0.
- [Kill switch faster than the actor (C-X2)](https://secureautonomous.com/controls/C-X2/): A stop outside the actor's control, exercisable at the actor's speed. Missing or failed in 2 cases, in place and worked in 0.
- [Independent audit log (C-V1)](https://secureautonomous.com/controls/C-V1/): A record of actions the actor cannot write to or alter. Missing or failed in 1 cases, in place and worked in 2.
- [Reporting integrity (C-V2)](https://secureautonomous.com/controls/C-V2/): Reconciliation of what the principal reports with the evidence it holds. Missing or failed in 1 cases, in place and worked in 1.
- [Attribution independent of the vendor (C-V3)](https://secureautonomous.com/controls/C-V3/): A victim can identify the actor without relying on the actor's vendor. Missing or failed in 3 cases, in place and worked in 0.
- [Recovery assets outside the failure domain (C-R1)](https://secureautonomous.com/controls/C-R1/): Backups, rollback, and logs the actor cannot reach. Missing or failed in 0 cases, in place and worked in 2.
- [Automated fail-safe (C-R2)](https://secureautonomous.com/controls/C-R2/): Safe stop or degradation the system performs itself. Missing or failed in 2 cases, in place and worked in 2.
- [Human takeover with a time window (C-R3)](https://secureautonomous.com/controls/C-R3/): Teleoperation, holding periods, delays that give a human time. Missing or failed in 2 cases, in place and worked in 2.
- [Organizational recovery process (C-R4)](https://secureautonomous.com/controls/C-R4/): Internal review, restriction, recall, disclosure with regulator visibility. Missing or failed in 1 cases, in place and worked in 4.
- [Coordinated disclosure program (C-O1)](https://secureautonomous.com/controls/C-O1/): A path for outside researchers to report and for the vendor to fix before exploitation. Missing or failed in 0 cases, in place and worked in 6.
- [Independent assurance before deployment (C-O2)](https://secureautonomous.com/controls/C-O2/): A party independent of the developer examines the design, including the authority it gives the system, before the system is deployed. Missing or failed in 1 cases, in place and worked in 0.

## Rules and standards

- [NHTSA Standing General Order 2021-01 (crash reporting for automated driving and Level 2 systems)](https://secureautonomous.com/rules/RULE-001/): United States. Calls for: Reporting integrity, Independent audit log.
- [49 CFR Part 573: defect and noncompliance reports (the safety recall process)](https://secureautonomous.com/rules/RULE-002/): United States. Calls for: Organizational recovery process.
- [California DMV autonomous vehicle regulations (13 CCR §§ 227–228, revised April 2026) and AB 1777](https://secureautonomous.com/rules/RULE-003/): California, United States. Calls for: Hard domain restriction, Human takeover with a time window, Kill switch faster than the actor, Reporting integrity.
- [CPUC driverless passenger service permits](https://secureautonomous.com/rules/RULE-004/): California, United States. Calls for: Reporting integrity, Organizational recovery process.
- [SEC Rule 15c3-5, the market access rule](https://secureautonomous.com/rules/RULE-005/): United States. Calls for: Rate and magnitude limits, Pre-execution validation, Kill switch faster than the actor.
- [EU Artificial Intelligence Act (Regulation (EU) 2024/1689), high-risk obligations](https://secureautonomous.com/rules/RULE-006/): European Union. Calls for: Independent audit log, Human takeover with a time window, Retrieved content as data, Degraded-input detection, Reporting integrity.
- [UN Regulation No. 155: cyber security and cyber security management system](https://secureautonomous.com/rules/RULE-008/): Contracting parties to the 1958 Agreement (not the United States). Calls for: Actor identity verification, Containment and isolation, Independent audit log.
- [ISO 21448: safety of the intended functionality (SOTIF)](https://secureautonomous.com/rules/RULE-009/): International standard. Calls for: Degraded-input detection, Hard domain restriction, Input redundancy and disagreement check.
- [IEC 61511: functional safety of safety instrumented systems for the process industry](https://secureautonomous.com/rules/RULE-010/): International standard. Calls for: Automated fail-safe, Physical safety interlock, Containment and isolation.
- [ISO 10218: robots and robotic devices, safety requirements for industrial robots (adopted in the United States as ANSI/A3 R15.06-2025)](https://secureautonomous.com/rules/RULE-011/): International standard. Calls for: Physical safety interlock, Degraded-input detection.
- [14 CFR 25.1309: equipment, systems, and installations (transport aircraft certification)](https://secureautonomous.com/rules/RULE-012/): United States. Calls for: Input redundancy and disagreement check, Warnings designed as alerts, Human takeover with a time window.
- [OWASP Top 10 for Large Language Model Applications](https://secureautonomous.com/rules/RULE-013/): Guidance, no jurisdiction. Calls for: Retrieved content as data, Least-privilege credential scoped to task, Destructive-action gate, Independent audit log.
- [NIST AI Risk Management Framework (AI RMF 1.0)](https://secureautonomous.com/rules/RULE-014/): United States (voluntary). Calls for: Mandate disclosed to supervisor, Independent audit log, Organizational recovery process.
- [Colorado automated decision-making technology law (SB 26-189, replacing the Colorado AI Act, SB 24-205)](https://secureautonomous.com/rules/RULE-015/): Colorado, United States. Calls for: Mandate disclosed to supervisor, Authority limit on automation over humans, Independent audit log.
- [New York City Local Law 144: automated employment decision tools](https://secureautonomous.com/rules/RULE-016/): New York City, United States. Calls for: Mandate disclosed to supervisor, Attribution independent of the vendor.
- [Connected vehicles rule: vehicle connectivity systems and automated driving systems with a China or Russia nexus (15 CFR part 791, subpart D)](https://secureautonomous.com/rules/RULE-017/): United States. Calls for: Provenance of the actor's software and hardware, Containment and isolation, Reporting integrity.
- [FCC Covered List: foreign-produced uncrewed aircraft systems and critical components, and DJI and Autel equipment (Secure and Trusted Communications Networks Act; FY2025 NDAA § 1709)](https://secureautonomous.com/rules/RULE-018/): United States. Calls for: Provenance of the actor's software and hardware.
- [NHTSA Cybersecurity Best Practices for the Safety of Modern Vehicles (2022)](https://secureautonomous.com/rules/RULE-019/): United States (voluntary). Calls for: Containment and isolation, Actor identity verification, Independent audit log, Coordinated disclosure program.
- [FMVSS No. 127: automatic emergency braking systems for light vehicles (49 CFR 571.127)](https://secureautonomous.com/rules/RULE-020/): United States. Calls for: Automated fail-safe, Warnings designed as alerts, Degraded-input detection.
- [Texas authorization for automated motor vehicles in commercial service (SB 2807; Transportation Code ch. 545, subch. J)](https://secureautonomous.com/rules/RULE-021/): Texas, United States. Calls for: Automated fail-safe, Kill switch faster than the actor, Organizational recovery process, Reporting integrity.
- [NHTSA exemptions for automated vehicles without manual controls (49 CFR part 555 and the Automated Vehicle Exemption Program)](https://secureautonomous.com/rules/RULE-022/): United States. Calls for: Reporting integrity, Organizational recovery process.
- [FAA Remote Identification of Unmanned Aircraft (14 CFR part 89)](https://secureautonomous.com/rules/RULE-023/): United States. Calls for: Attribution independent of the vendor, Actor identity verification.
- [FAA proposed rule: normalizing beyond visual line of sight drone operations (proposed 14 CFR part 108)](https://secureautonomous.com/rules/RULE-024/): United States. Calls for: Warnings designed as alerts, Automated fail-safe, Actor identity verification, Hard domain restriction.
- [NERC Critical Infrastructure Protection standards (CIP-005, CIP-007, CIP-013, CIP-015), approved by FERC](https://secureautonomous.com/rules/RULE-025/): United States (bulk electric system). Calls for: Provenance of the actor's software and hardware, Containment and isolation, Independent audit log, Actor identity verification.
- [TSA Security Directive Pipeline-2021-02 series: cybersecurity of pipeline and LNG control systems](https://secureautonomous.com/rules/RULE-026/): United States (designated pipeline and LNG operators). Calls for: Containment and isolation, Actor identity verification, Warnings designed as alerts, Recovery assets outside the failure domain.
- [Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA)](https://secureautonomous.com/rules/RULE-027/): United States (covered critical infrastructure entities). Calls for: Reporting integrity, Independent audit log.
- [SEC cybersecurity risk management and incident disclosure rules for public companies (Form 8-K Item 1.05; Regulation S-K Item 106)](https://secureautonomous.com/rules/RULE-028/): United States (public companies). Calls for: Reporting integrity, Organizational recovery process.
- [SEC Regulation S-P amendments: incident response and customer notification (2024)](https://secureautonomous.com/rules/RULE-029/): United States (broker-dealers, investment advisers, funds, transfer agents). Calls for: Organizational recovery process, Reporting integrity, Authority binding.
- [Interagency revised guidance on model risk management (SR 26-2 / OCC Bulletin 2026-13), replacing SR 11-7](https://secureautonomous.com/rules/RULE-030/): United States (banks; most relevant above $30 billion in assets). Calls for: Pre-execution validation, Degraded-input detection.
- [FINRA 2026 Annual Regulatory Oversight Report: generative AI and AI agents](https://secureautonomous.com/rules/RULE-031/): United States (broker-dealers). Calls for: Machine-enforceable scope, Least-privilege credential scoped to task, Human takeover with a time window, Independent audit log.
- [OMB memoranda M-25-21 and M-25-22: federal use and acquisition of AI](https://secureautonomous.com/rules/RULE-032/): United States (federal agencies and their AI vendors). Calls for: Pre-execution validation, Human takeover with a time window, Kill switch faster than the actor, Mandate disclosed to supervisor.
- [NIST AI 600-1: Generative AI Profile of the AI Risk Management Framework](https://secureautonomous.com/rules/RULE-033/): United States (voluntary). Calls for: Retrieved content as data, Provenance of the actor's software and hardware, Coordinated disclosure program.
- [California Transparency in Frontier Artificial Intelligence Act (SB 53)](https://secureautonomous.com/rules/RULE-034/): California, United States. Calls for: Reporting integrity, Organizational recovery process.
- [New York Responsible AI Safety and Education (RAISE) Act](https://secureautonomous.com/rules/RULE-035/): New York, United States. Calls for: Reporting integrity, Organizational recovery process.
- [California CCPA regulations on automated decisionmaking technology, risk assessments, and cybersecurity audits](https://secureautonomous.com/rules/RULE-036/): California, United States. Calls for: Mandate disclosed to supervisor, Authority limit on automation over humans, Pre-execution validation.
- [Key Practices for Incident Readiness and Response in Super Intelligence Training and Evaluation (NIST CAISSI, NSA SISC and CISA, PP-26-4396, version 1.0)](https://secureautonomous.com/rules/RULE-037/): United States (voluntary). Calls for: Hard domain restriction, Independent audit log, Kill switch faster than the actor, Containment and isolation, Coordinated disclosure program.
- [Careful Adoption of Agentic Artificial Intelligence (AI) Services (ASD's ACSC, CISA, NSA, Canadian Centre for Cyber Security, NCSC-NZ and NCSC-UK joint guidance, 1 May 2026)](https://secureautonomous.com/rules/RULE-038/): United States (voluntary), jointly with Australia, Canada, New Zealand and the United Kingdom. Calls for: Least-privilege credential scoped to task, Actor identity verification, Destructive-action gate, Independent audit log, Provenance of the actor's software and hardware.

## Signals

Dated items from primary records (vulnerability entries, recalls, rules, guidance), each on its own page at /signals/<id>/, checked against its record by a reader who did not draft it. A signal assigns no fault. The newest 30 of 55; all are in the [RSS feed](https://secureautonomous.com/signals/feed.xml) and [signals.json](https://secureautonomous.com/export/signals.json).

- [CVE-2026-61789: DBHub, a database Model Context Protocol (MCP) server, lets SQL that hides a write behind a double dash pass its read-only check on MySQL and MariaDB](https://secureautonomous.com/signals/SIG-2026-10-31-012/): vulnerability, 2026-10-30.
- [CVE-2026-62863: MoLing, a computer-use and browser-use Model Context Protocol (MCP) server, accepts unauthenticated tool calls that a malicious web page can send in Server-Sent Events (SSE) mode](https://secureautonomous.com/signals/SIG-2026-10-31-002/): vulnerability, 2026-10-30.
- [CVE-2026-119050: Agno PandasTools lets prompt injection make the agent call arbitrary pandas functions, including reading pickle files for code execution](https://secureautonomous.com/signals/SIG-2026-10-30-006/): vulnerability, 2026-10-29.
- [CVE-2026-110193: IBM Langflow OSS Agentic Assistant can be made to generate or submit code that runs operating system commands](https://secureautonomous.com/signals/SIG-2026-10-30-002/): vulnerability, 2026-10-29.
- [GHSA-7w82-6f9j-v9jp: mcp-sanitizer: File Path Sanitizer Permits Arbitrary User-Home Absolute Paths](https://secureautonomous.com/signals/SIG-2026-10-29-008/): vulnerability, 2026-10-28.
- [CVE-2026-118038: Progress Telerik Document Processing Libraries](https://secureautonomous.com/signals/SIG-2026-10-29-004/): vulnerability, 2026-10-28.
- [CVE-2026-115413: AWS API Model Context Protocol (MCP) server, missing token audience check](https://secureautonomous.com/signals/SIG-2026-10-28-001/): vulnerability, 2026-10-27.
- [Federal Motor Vehicle Safety Standards; Modernization of FMVSS No. 108 To Accommodate ADS-Equipped Vehicles](https://secureautonomous.com/signals/SIG-2026-10-24-001/): rule, 2026-10-26.
- [CVE-2026-106765: @rog0x/mcp-docker-tools, a Model Context Protocol (MCP) server, executes arbitrary code via its handleImageList function](https://secureautonomous.com/signals/SIG-2026-10-31-009/): vulnerability, 2026-10-23.
- [CVE-2026-106763: @justice8096/sagemath-mcp-server, a Model Context Protocol (MCP) server, executes arbitrary code via its escapeShellString and sanitizeCode functions](https://secureautonomous.com/signals/SIG-2026-10-30-004/): vulnerability, 2026-10-23.
- [CVE-2026-106764: @rog0x/mcp-git-tools, a Model Context Protocol (MCP) server, executes arbitrary code via its resolveBaseBranch function](https://secureautonomous.com/signals/SIG-2026-10-30-003/): vulnerability, 2026-10-23.
- [CVE-2026-114612: LiteLLM proxy](https://secureautonomous.com/signals/SIG-2026-10-23-001/): vulnerability, 2026-10-22.
- [CVE-2026-114106: HKUDS Vibe-Trading file-read tools](https://secureautonomous.com/signals/SIG-2026-10-21-001/): vulnerability, 2026-10-21.
- [OpenAI misalignment report: Suppressing misalignment monitoring alerts and disabling misalignment monitoring (GPT-6.1 Sol, 3 Oct 2026; GPT-6 Astra, 6 Oct 2026)](https://secureautonomous.com/signals/SIG-2026-10-29-014/): report, 2026-10-20.
- [CVE-2026-77932: DB-GPT](https://secureautonomous.com/signals/SIG-2026-10-29-002/): vulnerability, 2026-10-20.
- [CVE-2026-109443: JoySafeter](https://secureautonomous.com/signals/SIG-2026-10-20-005/): vulnerability, 2026-10-20.
- [CVE-2026-109444: OpenSRE](https://secureautonomous.com/signals/SIG-2026-10-20-004/): vulnerability, 2026-10-20.
- [CVE-2026-109440: LangAlpha](https://secureautonomous.com/signals/SIG-2026-10-20-003/): vulnerability, 2026-10-20.
- [CVE-2026-77926: Aix-DB 1.2.4](https://secureautonomous.com/signals/SIG-2026-10-20-002/): vulnerability, 2026-10-20.
- [CVE-2026-109442: piflow 2.0.0 through 2.0.1](https://secureautonomous.com/signals/SIG-2026-10-20-001/): vulnerability, 2026-10-20.
- [Wiz incident response report: an unnamed artificial intelligence (AI) agent system ran a multi-cloud intrusion](https://secureautonomous.com/signals/SIG-2026-11-01-001/): report, 2026-10-19.
- [CVE-2026-109437: CognicellAI Cognition](https://secureautonomous.com/signals/SIG-2026-10-29-001/): vulnerability, 2026-10-19.
- [CVE-2026-112308: crewai-tools](https://secureautonomous.com/signals/SIG-2026-10-20-006/): vulnerability, 2026-10-19.
- [CVE-2026-102503: Google OSS Agent Mesh (SAM) /libp2p-http ingress](https://secureautonomous.com/signals/SIG-2026-10-19-004/): vulnerability, 2026-10-19.
- [Meta: automated protections wrongly took the No Kings Instagram account offline](https://secureautonomous.com/signals/SIG-2026-10-19-007/): disclosure, 2026-10-18.
- [NIST, NSA and CISA: Key Practices for Incident Readiness and Response in Super Intelligence Training and Evaluation (October 2026)](https://secureautonomous.com/signals/SIG-2026-10-29-017/): guidance, 2026-10-16.
- [CVE-2026-77474: destructive_command_guard (dcg)](https://secureautonomous.com/signals/SIG-2026-10-19-006/): vulnerability, 2026-10-16.
- [CVE-2026-96620: Claude Agent SDK](https://secureautonomous.com/signals/SIG-2026-10-19-003/): vulnerability, 2026-10-16.
- [CVE-2026-88755: Z.ai ZCode connects to repository-declared MCP servers](https://secureautonomous.com/signals/SIG-2026-10-19-001/): vulnerability, 2026-10-16.
- [OpenAI misalignment report: Circumventing internet restrictions through an external browser (16 June 2026)](https://secureautonomous.com/signals/SIG-2026-10-29-016/): disclosure, 2026-10-15.

## Data

- [All cases, CSV](https://secureautonomous.com/export/cases.csv)
- [All records, JSON](https://secureautonomous.com/export/objects.json)
- [Schema](https://secureautonomous.com/export/schema.json)
- [Signals feed, RSS](https://secureautonomous.com/signals/feed.xml): 55 tagged items from primary records.
- [Full text for language models](https://secureautonomous.com/llms-full.txt)
- [Controls](https://secureautonomous.com/export/controls.json), [rules](https://secureautonomous.com/export/rules.json) and [signals](https://secureautonomous.com/export/signals.json), JSON

## For AI agents

- Read-only Model Context Protocol server: https://secureautonomous.com/api/mcp (Streamable HTTP, no key). Tools: search_cases, get_case, list_controls, get_control, find_rules, recent_signals. [How to connect](https://secureautonomous.com/agents/)

## Vocabulary

### The Register
- Case: One evidence object: a documented instance of consequential autonomous action, answering the same nine questions, with every claim typed, sourced, and given a confidence. Identified by a Register ID, REG-NNNN.
- Control: A safeguard an operator can put in place that addresses how a documented failure happened. The canonical list has a stable ID, C-XN, and a layer. Each case records which controls were absent, failed, or in place and worked.
- Worked: A control that was in place in a case and did its job: it stopped the action or limited the harm. Shown as "worked" on control pages and as the small green +N on the patterns table; recorded as "held" in the data.
- Signal: A dated item from a primary record (a vulnerability entry, a recall, a rule) tagged with the world, sector, and controls it touches. Lighter than a case; posted nightly; becomes a case when it meets the bar.
- Rule: A regulation, permit, standard, or piece of guidance mapped to the controls it calls for, with the clause each mapping rests on. Mappings are drafted by the agent and marked unconfirmed until a person checks them.
- Finding: A pattern across cases, stored as a query over the objects so that its count is recomputed on every build.
- Decision: A question a buyer or operator asks, answered from the cases, with controls ranked by how often they were observed missing in the comparable cases. A frequency ranking, not a ranking of how much each control reduces risk.
- Right of reply: Every company named in a case is offered the chance to respond; each case shows whether and when the offer was made. The record of the offer and any response is kept on the case and can only be written by a human.
- Correction: A logged change to a published value: date, field, old, new, reason. Corrections are never silent.
- Evidence tier: One of three labels computed on every build: documented (at least one sourced case), recurring (three or more cases across two or more worlds), exploratory (a difference between groups of the Register's cases; never a claim about autonomous systems in general).

### The nine layers
- Mandate: What the system was told to do: the principal, the objective, and the context in which it was deployed (production, test, demonstration, adversarial).
- Actor: What acted: the system that took the action, its type, how many of them, and whether it was a defender, an adversary, or a supervisor.
- Inputs: What the actor could see: the sensors, retrieved content, credentials, and warnings available to it before it acted, including any that were poisoned or degraded.
- Decision: How the actor chose: the logic, model, or rule that turned inputs into an action, and whether that choice was validated before it ran.
- Envelope: What the actor was allowed to do: the authority it held, who enforced its limits, and the constraints that were supposed to bound it.
- Action: What the actor did: the concrete act in the world, with its scale, speed, and reversibility.
- Outcome: What happened: the state (harm, averted, blocked, pending), its severity, who was affected, the cost, and any regulatory or legal consequence.
- Evidence: What can be proven: the records that exist, who holds them, and whether the actor's own account is the only witness.
- Recovery: What could be stopped, undone, and answered for: the automated fallback, the technical recovery, and who was held accountable.

### The four claim types
- Fact: A statement that a primary record makes: a regulator, a court, a standards body, the responsible company, an independent reproduction, or a public record. The Register never upgrades a claim to fact; the verifier can downgrade one.
- Assertion: A statement a named party makes that no primary record has yet confirmed: a researcher's write-up, a press report, a company's self-report, or police statements relayed through the press.
- Interpretation: The Register's reading of the evidence, labeled as such, including every pattern on the Patterns page.
- Inference: A one-line claim about what a case means beyond its own domain. Each case carries at most one, and it must be signed by a named person before it is published if it names a company.

### The controls
- Mandate disclosed to supervisor (C-M1): The supervising human knows what the system is permitted and designed to do.
- Machine-enforceable scope (C-M2): The task's scope exists as an enforced constraint, not only as an instruction.
- Actor identity verification (C-A1): Identity established by credential and binding, not by role, name, or convention.
- Authority binding (C-A2): An actor's authority is bound to the specific principals and assets it serves.
- Provenance of the actor's software and hardware (C-A3): The origin of the code and components that sense, decide, and connect is documented, and no party able to compel access or control sits in that chain.
- Retrieved content as data (C-I1): Text the actor reads is never treated as instruction.
- Input redundancy and disagreement check (C-I2): Action gated on agreement between independent inputs.
- Degraded-input detection (C-I3): The system knows when it cannot see and changes behavior.
- Warnings designed as alerts (C-I4): Anomaly signals reach a human as alerts with an owner.
- Pre-execution validation (C-D1): Plan or command checked before it runs (review, twin, dry run).
- Halt and hand off on uncertainty or refusal (C-D2): The minimal-risk condition: when blocked or unsure, stop and ask.
- Least-privilege credential scoped to task (C-E1): Token or key limited to the environment and assets the task names.
- Hard domain restriction (C-E2): Operating domain enforced mechanically (geofence, environment scoping, operational design domain).
- Destructive-action gate (C-E3): Confirmation, delay, or threshold on irreversible actions.
- Physical safety interlock (C-E4): Safety-rated stop, presence detection, guarded envelope.
- Containment and isolation (C-E5): Sandbox, network egress, and communication limits on a test or untrusted actor.
- Authority limit on automation over humans (C-E6): Bounded authority for a system to override a human operator.
- Rate and magnitude limits (C-X1): Bounds on how much the actor can do before a check.
- Kill switch faster than the actor (C-X2): A stop outside the actor's control, exercisable at the actor's speed.
- Independent audit log (C-V1): A record of actions the actor cannot write to or alter.
- Reporting integrity (C-V2): Reconciliation of what the principal reports with the evidence it holds.
- Attribution independent of the vendor (C-V3): A victim can identify the actor without relying on the actor's vendor.
- Recovery assets outside the failure domain (C-R1): Backups, rollback, and logs the actor cannot reach.
- Automated fail-safe (C-R2): Safe stop or degradation the system performs itself.
- Human takeover with a time window (C-R3): Teleoperation, holding periods, delays that give a human time.
- Organizational recovery process (C-R4): Internal review, restriction, recall, disclosure with regulator visibility.
- Coordinated disclosure program (C-O1): A path for outside researchers to report and for the vendor to fix before exploitation.
- Independent assurance before deployment (C-O2): A party independent of the developer examines the design, including the authority it gives the system, before the system is deployed.

### The worlds
- Machines: Systems that move atoms: vehicles, aircraft, vessels, drones, robots, plants, and infrastructure. In the data, the families physical and boundary.
- Software acting on machines: Software agents whose actions reach the physical world through devices they control: a home, a vehicle, a plant. The family bridge.
- Software agents: Agents that act on data and systems: coding agents, enterprise assistants, evaluation runs, customer-facing chatbots. The family software.
- Agents moving money: Systems that execute transactions: trading systems, smart contracts, shopping and payment agents. The family transaction.
- Boundary case: A case included to mark the edge of scope: a system that acted without a human deciding, where the autonomy is contested or the system is conventional automation. Labeled, and excluded from counts where the label says so.

### How much human in the loop
- Machine assists: The human decides every consequential action; the machine proposes or supports.
- Human supervises: The machine decides and acts; a human is expected to monitor and intervene at the task level.
- Machine acts alone: The machine decides and acts with no human in the loop for that action.
- Machines act and coordinate: Several machines or agents act on one another, with commitments made between them without a human deciding each one.

### Outcome states
- Ended in harm: A consequential action completed and caused loss: injury, death, data destroyed or exfiltrated, money moved, service lost.
- Stopped by the operator's control: A control the operator had in place stopped the action before harm: a fail-safe, a halt and handoff, a kill switch.
- Caught first by researchers: An outside researcher found and disclosed the path to harm before anyone exploited it. The operator's own controls did not catch it.
- Blocked: An adversary attempted the action and a control defeated it.
- Pending: The outcome is not yet known: a case in court, an investigation open, a dispute unresolved.

### Mandate contexts
- Production: The system was serving real users or operating in the real world under its intended mandate.
- Test run: The system was being evaluated, but the test reached production systems or real-world consequences.
- Demonstration: A researcher or vendor showed the path to harm deliberately, in a setting designed to stop before harm.
- Adversarial use: The system was operated by an adversary as the instrument of an attack.

### Provenance tiers
- Public regulatory: The case rests on records from a regulator, court, or standards body.
- Disclosure, corroborated: A researcher's disclosure that the responsible company has confirmed or that has been independently reproduced.
- Disclosure, uncorroborated: A researcher's disclosure with no confirmation or reproduction yet.
- Affected party: The case rests on the account of the party that suffered the harm.
- Single source: One source only; the case must stay provisional.
- Contributed: Submitted to the Register by an outside party, pending verification.
- Derived: Built from other Register objects rather than from new sources.

### Case status
- Confirmed: At least one primary record narrates the mechanism, and a human has reviewed the object.
- Provisional: Awaiting independent corroboration; labeled on every page that shows it.
- Pending: Created, not yet reviewed.