Sev0

AI security incidents, tracked

128Incidents tracked
22OpenAI20Anthropic4Meta3Google2Microsoft2xAI22Open source

A public, sourced log of security incidents involving AI: breaches of AI products, agents that went rogue, poisoned AI supply chains and attackers using AI.

 AI security incidents since January 2025: organization, date, what happened, AI vendor, type of AI, how it happened, harm, records affected, severity and source.

How we count

An incident is included when an AI system was the target, the way in, a poisoned dependency, the attacker's tool, or an agent that took harmful actions nobody intended. Each record links to its sources, primary sources first. Confirmed means the affected organization, the AI vendor, a regulator or a named security research firm has confirmed it. Use the filter icon on a column header to filter by that column. Records is the number of people, records or organizations stated by a source; it is never estimated. Severity is calculated from reach and data sensitivity. Vendor counts show incidents involving a company's AI, not that the company was at fault; each record says whether the model itself was at fault.

Frequently asked questions

What is Sev0?

Sev0 is an independent, sourced record of security incidents involving AI, from breaches of AI products to AI agents that act on their own. It currently tracks 128 incidents disclosed since January 2025 (23 in 2025, 105 in 2026), each with links to its sources.

What counts as an AI security incident?

An incident is included when an AI system was the target, the way in, a poisoned dependency, the attacker's tool, or an agent that took harmful actions nobody intended. General breaches where AI is only mentioned in passing, AI misinformation and opinion pieces are not included.

What is a rogue AI agent incident?

It is a case where an AI agent took harmful actions its operators did not intend, with no attacker directing it, such as escaping a test environment, deleting data or publishing private information. Sev0 groups these under Agent misbehaviour; there are currently 35.

Does a vendor appearing here mean it was at fault?

No. Vendor counts show incidents involving a company's AI. Many incidents are caused by the systems, settings or people around the AI, and each record says separately whether the model itself was at fault.

How is severity calculated?

Severity is calculated from how far an incident reached and how sensitive the data was, plus whether data was destroyed. It is high for incidents affecting many organisations, more than a million records, or sensitive data across an organisation; research findings with no known victims are rated low.

How often is Sev0 updated?

New incidents are researched every week and added after editorial review. Each record is checked against its sources before it is published.

Can I use the data?

Yes. The dataset is free to reuse under a CC BY 4.0 licence with credit to Sev0, and is available as JSON and CSV at sev0.fyi/data/.

How do I report an incident or a correction?

Email hello@sev0.fyi with a link to a source. Corrections are reviewed and applied promptly.