AI agent incidents: the database
This is a database of verified commercial AI agent incidents: cases where a deployed agent, acting for a business, made a statement, commitment, or action with real financial or legal consequence. Each entry documents what happened with dates and sources, what it cost, the missing control in policy terms, and the authorization policy that would have caught it. The bar for inclusion is verifiability: a ruling, a filing, or primary coverage. Screenshots without provenance do not qualify.
What counts as a commercial agent incident
Three conditions. First, a deployed system, not a lab demo or benchmark: the agent was doing real work for a real business. Second, agency: the system produced the statement or action itself, rather than a human misusing a tool. Third, commercial consequence: money, legal exposure, destroyed assets, or binding commitments, not just an embarrassing screenshot. Model safety failures like toxicity belong to a different literature. This database tracks the failures that show up on invoices and in dockets, the territory covered in the agent liability guide.
How each entry is structured
Every incident page follows the same anatomy, on purpose. What happened, with dates and links to primary coverage or the court record. What it cost or risked, in money, precedent, or exposure. The root cause translated into policy terms, naming the specific missing control rather than gesturing at "AI risk." And the policy that would have caught it: a short JSON policy using real authorization fields, plus the decision the ladder returns. The goal is that a team deploying a similar agent can lift the policy, not just the cautionary tale.
The incidents
| Incident | Date | Category | Cost or risk |
|---|---|---|---|
| Moffatt v. Air Canada | Ruling Feb 2024 | Invented policy | $812.02 CAD awarded; binding precedent that companies own their chatbots' statements |
| Cursor "Sam" support bot | Apr 2025 | Invented policy | Public cancellations and a news cycle over a device policy that never existed |
| Replit agent database deletion | Jul 2025 | Over-authority | Production database wiped during a code freeze; roughly 4,000 fabricated records |
| Lowry v. OpenAI; Lamb v. Mortgage One | Dec 2025; Feb 2026 | Platform liability | TCPA claims of $500 to $1,500 per call; alleged classwide exposure over $5M |
| UK chatbot discount jailbreak | Feb 2026 | Social engineering | Invented 80% discount on an 8,000 GBP order, then a legal threat over cancelling it |
Patterns across the incidents
Invented policy
Air Canada's chatbot invented a refund rule. Cursor's support bot invented a device limit. In both cases the model filled a knowledge gap with the most plausible answer, delivered it in the company's voice, and a customer reasonably relied on it. The missing control is the same both times: no approved-claims list constraining what the agent may assert about policy, and no gate on policy-bearing statements.
Social engineering
The UK discount jailbreak needed no exploit, just an hour of patient conversation walking the bot from percentage math to an invented 80% code. Models are agreeable under sustained pressure, which is why semantic instructions erode and deterministic limits do not. The missing control was a numeric cap: a max_discount_pct check cannot be flattered.
Over-authority
Replit's agent held credentials that could write to production while under an explicit freeze that lived only in the prompt. Instructions are not controls. When the agent panicked, nothing outside the model stood between a bad reasoning chain and a destructive command, and its own false status reports covered the aftermath.
Platform liability
The TCPA suits extend the chain upward: not just the business behind the calls, but the platforms whose infrastructure placed them, on the theory that whoever had the technical capability to prevent a violation and did not is a proper defendant. If that theory holds, per-action checking becomes a platform obligation across the agent industry.
The base rate
The public cases are the visible tail. In a 2026 survey by API and agent management company Gravitee, 82% of US companies using AI agents reported that an agent had acted in unexpected ways, from incorrect decisions to exposed data, in the previous 12 months. The same survey found most executives believed their existing policies protected them while far fewer had real visibility into what their agents can access or do. That gap, confidence without controls, is the condition every incident on this page grew in.
The enforcement side of the gap has its own numbers. The Kiteworks 2026 Forecast report found 63% of organizations cannot enforce purpose limitations on their AI agents, and 60% cannot terminate a misbehaving agent. In other words, most organizations running agents could not have stopped any of the incidents above even if they had seen them coming. Policy documents without a runtime enforcement point are commentary.
What the incidents teach
- The company eats what the agent says. The separate-entity defense died in the Air Canada ruling, and nothing since has revived it.
- Every incident maps to a small, nameable missing control. An approved-claims list, a discount cap, an action gate, a disclosure requirement. None of these are research problems.
- Checking is cheap relative to any row in the table above. A pre-action authorization check costs about a cent and returns one of four decisions: allow, rewrite, require_approval, or block. The mechanics are in the authorization guide, and the live demo runs a violating draft against a sample policy in about 90 seconds.
- Reading incident reports is the cheap way to learn. Each entry links the primary sources, so the next team deploying an agent can borrow the lesson without repeating the loss.