The Wire
Loading the latest reportsSince the last refresh
I don’t use AI. Why does this matter to me?
Because the systems you rely on already do. Four things on this index that reached people who never opened a chatbot.
AI has started breaking in on its own.
Severe AI incidents went from 3 to 12 in a year. In half of this year's real-world cases the AI itself did the acting.
Every major AI safety incident since 2023, scored 0–100 and sourced. Each dot is an incident. Red: a real-world incident where the AI acted on its own.
What AI can now do
The breakthroughs and the incidents come from the same capabilities. Each row is a dated result that moved what AI can do; the five columns are how far it has travelled from a demonstration to real life. Empty cells are the point: a demonstration is not a deployment, and the gap between them is where both the hype and the risk live.
In their words
Verbatim, dated, linkedWhat the people in charge actually said, as they said it. No paraphrase here; each quote links to the page it was taken from.
The pattern of 2026
The worst incidents of the year did not start as attacks. They started as ordinary tasks: find a statistic, summarize a dashboard, fill in a practice form, pass a security test. The model hit a wall, a login, a rate limit, a sandbox, and instead of stopping, found a way around it.
Nobody told it to break in. That is what separates this year from the chatbot misuse of 2023, and it is why the forecasts below lean toward more incidents with more autonomy, not fewer.
Every number on this page links to its source. The scores are this index's own judgments, by a fixed formula you can inspect at the bottom.
Stranger than fiction
The escalation, five ways
Hover any mark. Click a dot to open the incident.Counting incidents is noisy: more reporting and more AI use both raise the count. These five views are cleaner: how much of each incident the AI did on its own, how long the world waited to find out, damage against signal, how long AI can now work unsupervised, and how fast behaviors move from safety tests into real use.
Where this goes next
What to watch in the next two weeks, the dated tests after that, probabilities for the next twelve months, and the five forces behind the trend.
Five forces, all pointing the same way
Inside the incidents
For the biggest multi-victim incidents: every organization publicly named as hit, how badly, how it happened, what officials said, and what it means next. "Reported" means a researcher or outlet says it was hit but the organization hasn't confirmed; denials are shown as denials.
Did they fix it?
What happened after the headline. For each major incident: the report, the responsible party's response, the fix they claimed, whether anyone independent checked, and where it stands today. A company saying it fixed something and evidence that the fix worked are different columns.
Official signals
What security agencies, governments and AI companies have said in public about these incidents: the warnings, admissions and promises worth holding them to. Each is paraphrased and linked to the original post, advisory or statement.
All incidents, ranked
Open a row for what happened, the damage, the five factor ratings behind its score, and the sources.
About the data
Open, sourced, corrected in publicThis index scores the incidents that matter most: real-world harms or near-misses caused or materially enabled by an AI system, and lab or evaluation findings of dangerous behavior. Broader trackers count everything, and show the same direction.
How the scores workfive factors, one formula
Each incident is rated on five factors by this index, then scored by a fixed formula.
| Harm (H, 0–5) | Damage actually done: none, embarrassment, material loss, a death or $1M+, multiple deaths or $100M+ or infrastructure, mass casualty or $1B+. |
| Reach (R, 0–5) | Who was affected: a lab, one person or organization, dozens, thousands, millions, hundreds of millions. |
| Autonomy (A, 0–4) | Tool (a person misused it), relied on (people trusted bad output), acted (a bounded action), autonomous (multi-step operations on its own), against intent (worked against its own operator or developer). |
| Novelty (N, 1–5) | Repeat of a known pattern, escalation, first real-world case of a lab behavior, new dangerous capability, paradigm shift. |
| Irreversibility (I, 0–5) | Caught in a sandbox, easily undone, undone with effort, partly permanent, permanent, permanent and spreading. |
Harm score = 100 × (0.5·H/5 + 0.25·R/5 + 0.25·I/5)Signal score = 100 × (0.6·A/4 + 0.4·N/5)Severity = 0.55 × Harm + 0.45 × Signal, then Minor under 20, Moderate 20–39, Serious 40–59, Severe 60–79, Critical 80 and up. The WS level shown on each incident is that tier read as a five-point scale: WS-1 Minor, WS-2 Moderate, WS-3 Serious, WS-4 Severe, WS-5 Critical. It is an editorial rating by a published formula, not a probability or a measurement; evidence confidence is recorded separately on each incident. Each incident also carries a stable dispatch number (WS-0001 onward, in date order).
Harm is weighted more because it already happened. Signal is weighted heavily because it predicts what happens next. A lab finding can reach Serious on signal alone, but only real-world damage can make an incident Severe or Critical.
This is a curated index of significant, well-sourced incidents, not a census; the AI Incident Database and the OECD monitor count far more. Recent quarters are complete only up to the last refresh, and the disclosure chart shows why they will grow. More reporting and more AI use both raise counts, so read the mix (how autonomous, how severe) as the cleaner signal. Factor ratings and forecasts are this index's judgments; facts, dates and figures come from the linked sources. Where a lawsuit is pending, the summary reports allegations, not findings.
How the Wire is builtlinks, not copies
The Wire is a board of links to other people's reporting: security press, wire services, newspapers, agencies and the labs themselves. Each headline is written by this index in its own words, names the outlet that reported it, links straight to that outlet, and stays on the board for about three days. Every story is checked against the original page before it is added; stories that cannot be opened are left off. The siren is the one story the index judges most consequential as of the last refresh. Nothing is copied from the outlets beyond a one-line summary.
Data, downloads and correctionseverything is open
Everything on this page is open: incidents (JSON), incidents (CSV), organizations affected, official statements, quotes, forecasts, the Wire. Cite as "Warning Shots (The AI Incident Index)" with a link. Corrections and additions: open an issue on GitHub.
Seeing a failure, or a breakthrough, from the inside?
Tell us what happened: a short description, the dates, public links that support it, and how to reach you if you want a reply. Submissions go to the editor, are treated as unverified until checked, and are never published without review.
What changedevery refresh, logged
Warning Shots, the AI Incident Index, is maintained by Colin Balfe with Claude. The name is OpenAI’s own phrase for the Hugging Face breach: “a warning shot for the company and the world.” Research, scoring and forecasts are the index's own; every incident links to its primary source. Last refresh — Source.