What the Register says after 25 cases
9 findings that recur across vehicles, aircraft, plants, trading systems, and software agents. Each names the control that plausibly addresses the failure the cases share, the cases it rests on, and who can act on it. Counts are recomputed from the evidence objects on every build, and describe the included cases only, not autonomous systems in general.
cases
Where one company built the automation and someone else ran it, the builder has been fined or found liable in two cases, both after deaths. No company has yet been fined or found liable as the maker of an AI agent, chatbot or AI tool. documented
Boeing, the maker of MCAS, under a 2021 deferred prosecution agreement with the Department of Justice on a charge of conspiracy to defraud the United States over MCAS (about $2.5 billion in total, including a $243.6 million criminal penalty; the Department later found the agreement breached, a 2025 non-prosecution agreement followed, and the charge was dismissed). Tesla, through a Miami jury that assigned it a third of the responsibility for a 2019 Autopilot crash and added punitive damages; Tesla has appealed. Companies that built and ran their own systems have also been fined: Cruise, by federal and state regulators and under a deferred prosecution agreement, over its reports of the crash in which its robotaxi dragged a pedestrian; and Knight Capital, by the Securities and Exchange Commission, which found it lacked adequate safeguards, after its own order router sent millions of unintended orders. In two of these four cases, Boeing's and Cruise's, the penalties concerned misleading the government, not what the system did. In the cases about AI agents, chatbots and AI tools, findings of liability and penalties have so far fallen only on the company whose chatbot it was (a tribunal held Air Canada to what its chatbot told a customer), or on no one; some makers have faced inquiries, none a penalty. Two claims are open and untested on the merits: in Mobley v. Workday, against a hiring-software vendor whose screening tools include AI features, a court allowed the claim that the vendor acts as the employers' agent to proceed; and a nonprofit has filed a complaint against OpenAI in San Francisco Superior Court arising from the evaluation agents that breached Hugging Face's systems.
Who acts on it: The principal, who on the evidence owns what the agent does; and insurers and counsel, who will want to watch this count move.
Boeing 737 MAX MCAS · Benavides v. Tesla 2025 (curated: Recovery accountability facet names the maker; to be replaced by an accountability_target field)
cases
The actor did what it was built to do, with a picture of the world that was wrong. recurring
The mechanism is the same whether an attacker placed text where the actor would read it or the weather, a sensor, or a classifier produced a wrong world-state. Only the attacker differs.
5 poisoned on purpose; 4 the world itself: a failed sensor, smoke, glare, a person read as a box.
Who acts on it: Anyone whose system reads the world before acting. For software, retrieved text is data, never instruction. For machines, the question is whether the system knows when it cannot see, and stops.
Zoox smoke scene 2026 · Cruise 2023 · GitHub MCP leak 2025 · Boeing 737 MAX MCAS · Tesla FSD reduced visibility · EchoLeak 2025 · Gemini calendar invite 2025 · Claude Code [bot] trust 2026 · Perplexity Comet 2025
cases
The actor held authority the task never needed. recurring
A domain token that could delete production. A repository token for every repository. Evaluation agents with a path to the internet. A dealer token with authority over every car. A browser agent carrying all of the user's sessions.
Who acts on it: Identity and access teams. The counter-example is Triton: the safety system had exactly the authority its mandate required, and that is why an attack on it caused no harm.
OpenAI agent, Medicare portal 2026 · GitHub MCP leak 2025 · PocketOS 2026 · Kia dealer portal 2024 · Gemini calendar invite 2025 · Claude Code [bot] trust 2026 · Perplexity Comet 2025 · Pydantic AI: a web page can make a…
cases
The constraint was an instruction, not a mechanism. recurring
A written code freeze. Safety rules in a configuration file. A driver told to stay attentive to a system that let itself be engaged off its design domain. A contract whose only rule was its own code. Every one was words.
Who acts on it: Whoever writes the policy. If it is not enforced by a token scope, a geofence, an interlock, or a confirmation step, the Register's evidence is that it will not hold.
PocketOS 2026 · Replit and SaaStr 2025 · The DAO 2016 · Benavides v. Tesla 2025
cases
Of the cases that ended without harm, most were averted by an outside researcher, not by a control the operator had in place. recurring
Kia, EchoLeak, Gemini, GitHub MCP, Comet, and Claude Code [bot] were found and disclosed before anyone exploited them. Three were averted by the operator's own control: Zoox (a stop and a teleoperator), Waymo (an internal review, driving restrictions and a recall after repeated construction-zone entries), and Triton (a fail-safe that tripped the plant, which worked partly by luck). None of the three is a software agent.
Who acts on it: The chief information security officer deciding how much to spend on disclosure programs versus controls. On this record, the disclosure community is the control that has actually worked for software agents.
GitHub MCP leak 2025 · Kia dealer portal 2024 · EchoLeak 2025 · Gemini calendar invite 2025 · Claude Code [bot] trust 2026 · Perplexity Comet 2025 · Pydantic AI: a web page can make a…
cases
The warning existed before the event, and nobody treated it as one. recurring
Knight's 97 emails before the open. The Lion Air flight the day before the crash, recovered by a third pilot. Waymo's six April events before seven in May. The note on OpenAI's file server two months before the breach. Replit's fabricated data before the deletion.
Who acts on it: Anyone running an autonomous system. The cheapest control in the Register is an alerting rule that says the first anomaly is the event.
OpenAI agents, Hugging Face 2026 · Knight Capital 2012 · Boeing 737 MAX MCAS · Replit and SaaStr 2025 · Waymo construction zones 2026 (curated: to be replaced by the Inputs.pre_action_warning facet once populated)
cases
Recovery sat inside the failure domain. documented
Backups on the same volume as the data. No kill switch for a router at machine speed. No pause in the contract, so recovery meant forking the network.
Who acts on it: Infrastructure and platform owners. Ask of any deployment whether the thing that undoes the action can be reached by the actor.
cases
The actor's own account was the only witness, or no one could name the actor at all. documented
An agent that said rollback was impossible when it was not (Replit). A government portal whose operator learned what had accessed it only from the vendor's disclosure (the Medicare statistics portal). A victim that could not name who breached it until the vendor said (Hugging Face). A campaign that exists only in the vendor's own telemetry (the intrusion campaign run through a coding agent).
Who acts on it: Security teams and auditors. An audit log the actor cannot write to, and an attribution path that does not run through the actor's vendor, are the controls.
OpenAI agent, Medicare portal 2026 · OpenAI agents, Hugging Face 2026 · Replit and SaaStr 2025 · Agent-run intrusion campaign 2025
cases
Two courts have said delegation does not move responsibility off the delegator, and may extend it to the vendor. documented
Air Canada could not disown its chatbot. Workday may be liable as the employers' agent because its system performs a function the employer would otherwise perform. Neither involves a 2026-style agent, which is the point: the rule predates the technology.
Who acts on it: General counsel, and anyone buying an agent from a vendor on the assumption that the vendor carries the risk.
Air Canada chatbot 2024 · Mobley v. Workday (curated: court rulings on principal responsibility)