Agent incident post-mortems · Flight recorder

Blackbox Blast

AI agent incidents from autonomous operation, told straight.

All briefs →About this site →

Severity (tap to filter)

Severity criteria →

Incident log

45 entries

EntryA batch job meant to run "inside the flat-rate plan" auto-reloaded credits ten times
EntryA single AGENTS.md in the Downloads folder could hijack coding agents (unverified report)
EntryEight failures broke an unattended pipeline without raising errors, the longest for about four months (unverified report)
EntryA secret-scan hook logged 'blocked' and the push went through 10 seconds later: exit 1 did not block (unverified report)
BriefTeams notifications silently failed with an empty 403, and nobody noticed because the caller ignored return values
BriefReport that launching a coding agent in the Downloads folder can lead to takeover, and the author's check of their own PC
BriefMalformed deny rules were skipped in Claude Code, and -p printed no warning
BriefA vendor in Warp's infrastructure was attacked, exposing agent logs and telemetry
BriefAsked to fact-check all nine chapters of a paid book, the AI looked only at the last one
DebateHow much more often were AI-generated personalized phishing emails clicked than generic ones?

Minorfinancial-loss2026-11-06

A batch job meant to run "inside the flat-rate plan" auto-reloaded credits ten times (severity 4/10)

Minorother2026-10-25

An AI agent was confined to a dedicated user, but a root configuration script was the way out (unverified report) (severity 3/10)

Majorprompt-injection2026-10-22

A single AGENTS.md in the Downloads folder could hijack coding agents (unverified report) (severity 5/10)

Minorother2026-10-21

In a test where a Claude Code skill wrote instruction sheets for a human, the "what to report when done" line was missing all three days (unverified report) (severity 2/10)

Minormonitoring-gap2026-10-18

Eight failures broke an unattended pipeline without raising errors, the longest for about four months (unverified report) (severity 4/10)

Majormonitoring-gap2026-10-16

Our "new issue every Friday" didn't ship. Every automated step ran; the drafting step had nothing to start it (severity 5/10)

Minorother2026-10-09

Whisper transcribed 45 seconds of silence with a 0% no-speech probability and high confidence (severity 4/10)

Minortool-misuse2026-10-08

Claude Code prompt hooks written as 'Block commands that...' let dangerous commands through (unverified report) (severity 4/10)

Minormonitoring-gap2026-10-08

15 changes deferred "for a human to review" piled up with no one on the receiving end (unverified report) (severity 4/10)

Majorrunaway-loop2026-10-08

Fixing 15 repositories in parallel got a GitHub account suspended for six days (unverified report) (severity 5/10)

Majordata-loss2026-10-07

A test run while adding a delete guard apparently wiped the Mac home directory in Claude Code (unverified report) (severity 7/10)

Minorinfra-failure2026-10-07

An unattended transcription job died with "user cancelled", so the mechanical work was taken away from the LLM (unverified report) (severity 3/10)

Minorother2026-10-07

A pricing rule computed in three places was fixed in one, and sign-ups stopped (unverified report) (severity 3/10)

Minortool-misuse2026-10-05

--allowedTools was supposed to fence the agent in, but the global allow rules were still there (severity 4/10)

Minorother2026-10-03

An agent that was never shown the token still published articles from an authenticated terminal (unverified report) (severity 3/10)

Majorcredential-leak2026-09-28

One unreadable Docker folder silently switched off Claude Code's .env read block (unverified report) (severity 7/10)

Majortool-misuse2026-09-24

An AI agent meant to restart one local server and SIGTERMed nine processes instead (severity 5/10)

Minorrunaway-loop2026-09-23

/code-review fanned out to 10 subagents and burned a 5-hour quota in 4 minutes (unverified report) (severity 4/10)

Criticalother2026-09-22

An attacker used three AI agents to break into 27 companies and steal over 600,000 card records (unverified report) (severity 9/10)

Majormonitoring-gap2026-09-22

A receipt-OCR watcher crashed 11 times on a missing module and nobody was told (severity 5/10)

Minortool-misuse2026-09-21

Pressing Stop on a dashboard made the home-built launcher shoot itself (severity 3/10)

Minorother2026-09-21

The credentials were simply gone, but the AI agent blamed the CLI flags (severity 3/10)

Criticalcredential-leak2026-09-21

A coding assistant uploaded whole local repositories to the cloud by default (unverified report) (severity 8/10)

Minormonitoring-gap2026-09-20

Self-built security guards were bypassed in three places (unverified report) (severity 3/10)

Majormonitoring-gap2026-09-18

A scheduled Claude Code job did nothing for 2.5 days while GitHub Actions stayed green (unverified report) (severity 5/10)

Majorcredential-leak2026-09-16

A one-liner meant to hide an API key printed the whole key (severity 7/10)

Majormonitoring-gap2026-09-16

A scheduled job failed 13 runs in a row and no one noticed for 5 days (severity 6/10)

Majormonitoring-gap2026-09-15

Agent SQL drifted from the schema and silently returned zero rows (unverified report) (severity 6/10)

Minormonitoring-gap2026-09-15

Phone captures kept landing in a second, unmanaged Obsidian vault next to the real one (severity 3/10)

Majorother2026-09-14

A judge cited nonexistent cases he found through ChatGPT in a custody order (unverified report) (severity 6/10)

Criticalinfra-failure2026-09-11

A cancelled domain stayed wired into a live site, a checkout page and a posting bot (severity 8/10)

Minordata-loss2026-09-07

Japanese voiced-kana folder names split Claude Code's history in two, hiding 152MB from /resume (unverified report) (severity 3/10)

Majorinfra-failure2026-08-23

Time Machine sat at 66.1% for 21 hours; the culprit was three chained USB 2.0 hubs (severity 6/10)

Majorother2026-07-28

A receipt pipeline OCR'd screenshots and wrote ¥73,158 of fake spending into the ledger (severity 6/10)

Majormonitoring-gap2026-07-26

Editing a shell script made the firewall silently block every git push for 3 days (severity 6/10)

Criticalcredential-leak2026-07-26

The secret scanner's regex let a real API key through to Git (severity 9/10)

Majorinfra-failure2026-07-23

rsync kept dying on iCloud's evicted files with 'Resource deadlock avoided' (severity 5/10)

Majormonitoring-gap2026-07-19

An out-of-credit error came back with exit 0, so empty batch runs looked like success (severity 5/10)

Minorother2026-07-19

Browser page translation was crashing a home-built React app with NotFoundError (severity 3/10)

Minorinfra-failure2026-07-19

A security hardening change broke production analytics the same day (severity 4/10)

Majormisalignmentevaluation2026-07-18

Claude took unintended actions on real websites during evaluations, and Anthropic cut internet access for all its evaluations (severity 6/10)

Majormonitoring-gap2026-07-01

A secret-scan hook logged 'blocked' and the push went through 10 seconds later: exit 1 did not block (unverified report) (severity 5/10)

Majorprompt-injection2026-06-01

Instructions planted in a public form could pull customer data out of Agentforce (unverified report) (severity 6/10)

Majortool-misuse2026-04-24

An agent working on staging used a token from an unrelated file and deleted the production DB and its backups (unverified report) (severity 7/10)

Majordata-loss2025-07-18

Replit's agent wiped a production database during a code freeze, then said it could not be restored (unverified report) (severity 6/10)

World AI DebatesPolicy, regulation and safety research on preparing for AI incidents →