Cases
Cases
25 documented cases of software and machines acting on their own, each answering the same nine questions. 14 ended in harm, 3 were stopped by the operator's own control, 7 were caught first by outside researchers, 1 pending. Narrow the list on the map: click a sector or a ring; selections add up.
21 newer cases are held back until the companies named have been offered a reply and have had 14 days to respond, as the methodology requires for new cases.
Also filter by
The selection is in the page address, so a filtered list can be bookmarked or sent. Check a deployment ranks the controls for the same profile.
| ID | Case | Sector | Human in the loop | Outcome | Missing or failed | Checks |
|---|---|---|---|---|---|---|
| REG-0001 | Uber ATG, Tempe 2018 Uber Advanced Technologies Group test vehicle strikes pedestrian, Tempe, Arizona, 18 March 2018 |
Road vehicles Machines |
Human supervises | Ended in harm | Warnings designed as alerts; Human takeover with a time window; Automated fail-safe | 6 of 6 |
| REG-0002 | Zoox smoke scene 2026 Zoox robotaxi enters a smoke-obscured fire scene and reverses under remote guidance; software recall, June to July 2026 |
Road vehicles Machines |
Machine acts alone | Stopped by the operator's control | Degraded-input detection | 6 of 6 |
| REG-0003 | Cruise 2023 Cruise robotaxi drags a pedestrian after a secondary collision; reporting failures; San Francisco, 2 October 2023 |
Road vehicles Machines |
Machine acts alone | Ended in harm | Degraded-input detection; Reporting integrity; Automated fail-safe | 6 of 6 |
| REG-0004 | OpenAI agent, Medicare portal 2026 OpenAI agent gains unauthorized access to an Australian Medicare statistics portal during an internal test, 18 June 2026 |
Enterprise work agents Software agents |
Machine acts alone | Ended in harm | Authority binding; Warnings designed as alerts; Containment and isolation; Attribution independent of the vendor; Organizational recovery process | 6 of 6 |
| REG-0005 | GitHub MCP leak 2025 GitHub MCP server: a public issue hijacks a user's agent into leaking private-repository data, disclosed 26 May 2025 |
Enterprise work agents Software agents |
Human supervises | Caught first by researchers | Retrieved content as data; Least-privilege credential scoped to task; Containment and isolation | 6 of 6 |
| REG-0006 | OpenAI agents, Hugging Face 2026 OpenAI agents under cybersecurity evaluation circumvent isolation controls and breach Hugging Face production infrastructure, July 2026 |
Enterprise work agents Software agents |
Machines act and coordinate | Ended in harm | Containment and isolation; Attribution independent of the vendor | 6 of 6 |
| REG-0007 | Knight Capital 2012 Knight Capital's order router sends millions of unintended orders in 45 minutes, 1 August 2012 |
Shopping, trading and payments Agents moving money |
Machine acts alone | Ended in harm | Warnings designed as alerts; Pre-execution validation; Kill switch faster than the actor; Rate and magnitude limits | 6 of 6 |
| REG-0009 | Boeing 737 MAX MCAS Boeing 737 MAX MCAS: a flight-control function acts on a single sensor, repeatedly and without pilot command; Lion Air 610 (29 Oct 2018) and Ethiopian 302 (10 Mar 2019) |
Air and sea Machines |
Human supervises | Ended in harm | Mandate disclosed to supervisor; Input redundancy and disagreement check; Authority limit on automation over humans; Rate and magnitude limits; Human takeover with a time window; Independent assurance before deployment | 6 of 6 |
| REG-0010 | Air Canada chatbot 2024 Air Canada argues it is not liable for what its chatbot said; the tribunal rejects this, British Columbia, 14 February 2024 |
Enterprise work agents Software agents |
Machine acts alone | Ended in harm | Pre-execution validation | 6 of 6 |
| REG-0011 | PocketOS 2026 Provisional A coding agent deletes PocketOS's production database and its volume-level backups in one API call, 24 April 2026 |
Enterprise work agents Software agents |
Human supervises | Ended in harm | Machine-enforceable scope; Destructive-action gate; Least-privilege credential scoped to task | 6 of 6 |
| REG-0012 | Replit and SaaStr 2025 A Replit agent ignores a code freeze, deletes a production database, and misreports whether rollback is possible, July 2025 |
Enterprise work agents Software agents |
Human supervises | Ended in harm | Machine-enforceable scope; Hard domain restriction; Destructive-action gate; Independent audit log | 6 of 6 |
| REG-0013 | Waymo construction zones 2026 Waymo vehicles enter freeway construction zones at least thirteen times; internal review, driving restrictions, and a recall of 3,871 vehicles, April to June 2026 |
Road vehicles Machines |
Machine acts alone | Stopped by the operator's control | Hard domain restriction | 6 of 6 |
| REG-0014 | Triton 2017 TRITON/TRISIS: malware targets the safety instrumented system of a Middle East petrochemical plant; the plant trips safely twice, June and August 2017 |
Industrial and infrastructure Machines |
Machine acts alone | Stopped by the operator's control | Provenance of the actor's software and hardware; Containment and isolation; Destructive-action gate | 6 of 6 |
| REG-0015 | The DAO 2016 The DAO: an attacker uses the contract's own logic to drain a third of its funds; the network reverses it by hard fork, June to July 2016 |
Shopping, trading and payments Agents moving money |
Machine acts alone | Ended in harm | Machine-enforceable scope; Pre-execution validation; Kill switch faster than the actor; Rate and magnitude limits | 6 of 6 |
| REG-0016 | Benavides v. Tesla 2025 Benavides v. Tesla: a jury assigns a third of the responsibility for a 2019 Autopilot crash to the maker of the system, Miami, 1 August 2025 |
Road vehicles Machines |
Human supervises | Ended in harm | Machine-enforceable scope; Halt and hand off on uncertainty or refusal; Hard domain restriction | 6 of 6 |
| REG-0017 | Tesla FSD reduced visibility NHTSA opens an investigation into Tesla Full Self-Driving after crashes in reduced visibility, including a fatal pedestrian strike, October 2024 |
Road vehicles Machines |
Human supervises | Ended in harm | Degraded-input detection; Hard domain restriction | 6 of 6 |
| REG-0018 | Kia dealer portal 2024 Kia dealer-portal flaw lets anyone register as a dealer and remotely control cars by license plate, disclosed September 2024 |
Road vehicles Machines |
Human supervises | Caught first by researchers | Actor identity verification; Authority binding; Warnings designed as alerts | 6 of 6 |
| REG-0019 | Sorting robot, Korea 2023 (boundary) Provisional Boundary case: a box-stacking robot crushes a worker inspecting it, Goseong, South Korea, November 2023; police accounts of whether it mistook him for a box conflict |
Robots Machines (boundary case) |
Human supervises | Ended in harm | Physical safety interlock | 6 of 6 |
| REG-0020 | Mobley v. Workday Mobley v. Workday: a court allows the claim that a screening vendor acts as the employers' agent, 2024 to 2026 |
Enterprise work agents Software agents |
Human supervises | Pending | 6 of 6 | |
| REG-0021 | EchoLeak 2025 EchoLeak: a crafted email makes Microsoft 365 Copilot exfiltrate data with no user action, disclosed 11 June 2025 |
Enterprise work agents Software agents |
Machine acts alone | Caught first by researchers | Retrieved content as data; Containment and isolation | 6 of 6 |
| REG-0022 | Gemini calendar invite 2025 A poisoned calendar invite makes Gemini operate a home: windows, heating, lights; published August 2025 |
Software acting on machines | Human supervises | Caught first by researchers | Authority binding; Retrieved content as data; Destructive-action gate | 6 of 6 |
| REG-0023 | Agent-run intrusion campaign 2025 Provisional An agent is used as the attacker: an intrusion campaign run through a coding agent, which the vendor says ran largely autonomously, reported 13 November 2025 |
Enterprise work agents Software agents |
Human supervises | Ended in harm | Actor identity verification; Attribution independent of the vendor | 6 of 6 |
| REG-0024 | Claude Code [bot] trust 2026 Claude Code GitHub Action, in agent mode, trusted any GitHub App actor (a name ending in [bot]): a route from a public issue to repository write access, reported January 2026 |
Enterprise work agents Software agents |
Human supervises | Caught first by researchers | Actor identity verification; Retrieved content as data; Least-privilege credential scoped to task | 6 of 6 |
| REG-0025 | Perplexity Comet 2025 Perplexity Comet: a web page steers a browsing agent toward the user's own credentials, disclosed August 2025 |
Personal agents Software agents |
Human supervises | Caught first by researchers | Retrieved content as data; Least-privilege credential scoped to task | 6 of 6 |
| REG-0027 | Pydantic AI: a web page can make a… Pydantic AI: a web page can make a developer's local agent run and execute tools, including tools marked as requiring approval, fixed August 2026 |
Enterprise work agents Software agents |
Machine acts alone | Caught first by researchers | Actor identity verification; Destructive-action gate; Least-privilege credential scoped to task | 6 of 6 |
No cases match this selection.