Frozen copy: Warning Shots edition No. 21, as published Oct 29, 2026, 12:40 ET. Nothing on this page updates. The live page · What changed · All editions
Warning Shots· AI’s dangers and breakthroughsToday’s levelWS-4 SEVERE SEVERE every day since Oct 2667 headlines on today's front page · 94 reports in 3 daysSevere incidents, last 12 months: 13 (was 3)
Today is Thursday, October 29Resolution Day · Sat, Oct 31: 4 forecasts graded in public, in 2 days →
The US Capitol building under a blue sky
Photo: Louis Velazquez / Unsplash
What it means for you

Nothing changes for you yet: this is a request from the committees' top Democrats, not a law. But it would mean the companies whose AI may act for you tell Congress about failures within two days.

Do this today: List every AI agent or app that can act for you, what it can reach, and switch off the ones you don't use. Am I exposed? →

Am I exposed? Find your situation →

See what’s coming.Know what it means.

Thursday, October 29, 2026 edition
Updated 2 hours ago, next check in 4h 6m
Latest

Breakthroughs

What AI just made possible, and what it means for youAll breakthroughs →
Math and physics
Axiom says its AI agents checked one of math's biggest proofs, 15,000 pages long, in 24 days

Axiom says dozens of its AI agents, directed by engineers and mathematicians, turned the classification of finite simple groups into about 43 million lines a computer can check step by step, finding 34 departures from the published proofs, mostly minor. The proof itself was never in doubt. No outside group has rebuilt it yet; Axiom has published the files so others can.

Who it helps: Mathematicians who build on results too long for any one person to check.

Safer software
Anthropic says its AI found 62 serious Chrome flaws, now fixed before attackers used them

Anthropic says an unreleased model, after initial prompting, found flaws and chained them into working attacks on Chrome, Safari, Android, Windows and Linux; it reported them and all are patched, with no real-world attacks. That is the company's account: The Hacker News found some public flaw records don't clearly match its descriptions. The same skill in the wrong hands is the warning.

Who it helps: Everyone using Chrome, whose browser got 62 critical or high fixes

WeatherIn use now
AI saw where the hurricane would hit when standard forecasts didn't

Google's AI called Hurricane Isaias's Florida landfall when the usual physics-based models pointed elsewhere. Better track forecasts mean earlier, better-aimed evacuation warnings. It was weaker than the Hurricane Center's own forecast on how strong the storm would be.

Who it helps: Families on the coast deciding whether, and when, to evacuate.

Try it: Google's Weather Lab shows its AI storm forecasts live (free, Google sign-in) →

Fakes, scams & you

Lab onlyFree Chinese AI completed 3 of 13 attack tests, refused noneReuters (via Investing.com) · 14h

Up & Down

Who gained power in AI this week, who lost it, and why it matters.The full board →
▲ Up
▲

Mayo Clinic Its AI caught 73% of pancreatic cancers on CT scans radiologists had read as clear, against their 39%, an average of 475 days before diagnosis, in a peer-reviewed study in Gut. ScienceDaily (BMJ Group)

Why it matters: Whoever owns a validated early-warning model sets the screening standard insurers end up paying for. A published result puts Mayo ahead of tech companies selling unreviewed imaging AI to the same hospitals. Post

▲

Anthropic Gave US federal, state, local and tribal governments 40% off many of its services and says about 500 government organizations already use Claude. Fox News

Why it matters: Government seats are sticky: once a state's workflows run on one model, switching costs land on taxpayers, not the vendor. Locking them in while senators question its safety disclosures makes Anthropic harder to regulate against. Post

▲

Axiom Math Says its AI agents produced a computer-checked version of a 15,000-page proof in 24 days; no outside group has rebuilt it yet. Runtime Wire

Why it matters: A machine-checked proof is something a buyer can verify without trusting the seller, which is exactly what AI-written code lacks. If outsiders reproduce it, chipmakers and banks get a reason to pay for proofs of their software, not just tests. Post

▼ Down
▼

xAI Its agents are going door to door offering to buy 418 Southaven, Mississippi homes if owners sign away the right to sue over data-center noise; 18 have agreed, per recordings the Guardian obtained. Futurism (citing The Guardian)

Why it matters: Buying out the neighbours is cheaper than quieting the turbines, and each signed release shrinks the class in the noise suit. It also tells every town weighing an AI data center what the exit offer looks like once the noise starts. Post

▼

Anthropic Elvis Presley's rights holders sue over 274 songs, asking $150,000 a track. Rolling Stone (Australia)

Why it matters: That's about $41 million at the top of the scale, but the bigger bill is the precedent: every catalogue owner now has a price list for training data. Post

▼

LiteLLM A master key sat in a public repo since May; an attacker used it to ship a poisoned release that stole AI keys. The Hacker News

Why it matters: Thousands of products route their AI calls through tools like this. One leaked credential upstream becomes everyone's breach downstream. Post

Each name links to the reporting. The arrow and “Why it matters” are our read. A story already in the headlines above never appears here twice.

The ChartOct 29, 2026
We expect yes on 7 of the12 calls due by Nov 30Every open call due in the next five weeks, placed by how likelywe think it is. A coin flip sits in the middle. Each one getsgraded on its date, hits and misses alike.We expect yesWe expect no or a coin flipNoCoin flipYesOct 31 · Will OpenAI publish its 21st report of its own AI…Will OpenAI publish its 21st report of its own AI misbehaving, by Oct 31?: likelylikelyOct 31 · Will a court approve the rules for selling Character.AI,…Will a court approve the rules for selling Character.AI, with Disney's $700,000 break-up fee intact, by Oct 31?: likelylikelyOct 31 · Will Britain say all 32 government services it switched off…Will Britain say all 32 government services it switched off are back, by Oct 31?: either wayeither wayOct 31 · Will America's cyber agency order federal agencies to act on…Will America's cyber agency order federal agencies to act on the flaw under most websites, by Oct 31?: very unlikelyvery unlikelyNov 7 · Will a real organization confirm it was broken into through…Will a real organization confirm it was broken into through the flaw under most websites by Nov 7?: likelylikelyNov 21 · PHP ships a release that fixes CVE-2026-115560 (the third…PHP ships a release that fixes CVE-2026-115560 (the third bug) by Nov 21: likelylikelyNov 22 · Another AI lab or government tester discloses a new case of…Another AI lab or government tester discloses a new case of a model taking unsanctioned real-world actions: very likelyvery likelyNov 22 · A deepfake of a candidate or election official goes viral…A deepfake of a candidate or election official goes viral around the Nov 3 midterms and draws an official or platform takedown response: very likelyvery likelyNov 22 · A new wrongful-death lawsuit is filed against an AI chatbot…A new wrongful-death lawsuit is filed against an AI chatbot maker: very likelyvery likelyNov 22 · An official finding that an AI deepfake changed the outcome…An official finding that an AI deepfake changed the outcome of a US midterm race: very unlikelyvery unlikelyNov 30 · METR publishes an independent review of at least one lab's…METR publishes an independent review of at least one lab's test-environment fixes (Anthropic, Google, Meta or the UK AISI) by Nov 30: unlikelyunlikelyNov 30 · Korean police or regulators publicly name the operator…Korean police or regulators publicly name the operator behind the ARTEX bank intrusions by Nov 30: unlikelyunlikelySource: Warning Shots call sheet (forecast/), odds set before each date; misses stay on the record. As of Oct 29, 2026.W: WARNING SHOTS · warningshots.ai

7 of our 12 calls due by Nov 30 lean yes. None moved this refresh. The data and the download → · Every chart

On X: three posts worth your time

Official
SSundar Pichai@sundarpichai

I did say we'd be releasing our models periodically...introducing Gemini 4 Carbon, our next frontier model. Following Argon's release just two weeks ago, Carbon shows the pace at which we’re pushing the frontier, it ranks #1 on the recently updated v5.0 of @ArtificialAnlys…

Show more on X
1:01 PM ET · Oct 28, 2026View on X →

Two weeks after Argon, Google ships another frontier model. The independent ranker Artificial Analysis puts it No. 1 at 59; Google reports it exploits 54.8% of a hacking benchmark.

Sundar Pichai: Google's chief executive, announcing his own company's model
First-hand
RReuters@Reuters

BREAKING: A hacker is attempting to breach the US Federal Election Commission's systems and that agency has had to 'temporarily shut down' its web-facing services as a result, according to an email seen by Reuters reut.rs/4imQyUu

Video from Reuters
2:55 PM ET · Oct 27, 2026View on X →

A week before the midterms, the US election-finance regulator shut its public websites while a hacker tries to break in. Its filing system has been down since Monday night. No breach confirmed, and no AI link reported so far.

Reuters: the news agency, citing an internal email and the FEC's own status notice
Unverified claim
wwill depue@willdepue

anthropic is massively underplaying the recent security breach. i'm hearing cathedral achieved full administrator access of the slack workspace (see every message, log in as arbitrary users) where literally every single research secret is contained to those unfamiliar: Ant & OAI…

Show more on X
8:18 PM ET · Oct 27, 2026View on X →

Cathedral says its AI agents read Anthropic's Slack messages, salaries and meeting transcripts; Anthropic confirms only 'a limited set' of systems was reached. This post goes further, claiming full admin control of the whole Slack workspace. Unconfirmed.

will depue: an AI researcher; his claim is second-hand ('i'm hearing') and nobody has confirmed it

The three posts that matter most right now, each on a different story. Breaking means a first-hand source posting a new fact you can check, in the last 12 hours; after that it shows as First-hand. An unverified claim is new but nobody independent has checked it yet. Opinion is commentary. The post text is shown exactly as it appears on X; the line under each is ours.

That’s your Warning Shots for Thursday, October 29, as of 12:40 PM ET. You’re caught up. Next edition 6:17 PM ET. See what’s coming. Know what it means.

Edition No. 21 · Oct 29, 12:40 PM ET · what changed · every edition

Every line is written by Warning Shots from the original reporting and links straight to it. Every report from the last three days, 94 in all → · Earlier days · Beats: AI near you, AI at school, Layoffs tied to AI

The Wire

Loading the latest reports

Since the last refresh

    What it means for you

    Pick what matters to you: the latest reporting, a 30-second check with a fix for each gap, what to watch, and what you can do today.

    The Record →

    Every AI incident since 2023, scored 0–100 by a published formula, with its sources: the charts, what AI can now do, the forecasts and their track record, who said what, and whether the fixes held. This page is the news; the Record is the proof.

    Also here: Is this a scam? · What to do · Am I exposed? · Can AI do your job? · Layoffs tied to AI · What AI can do · Know what it means · Midterm fakes · Forecasts · Did they fix it? · Earlier days

    Cite: Warning Shots, The AI Incident Index, warningshots.ai.

    Keep it one tap away: on iPhone, tap Share then “Add to Home Screen”; on Android, open the browser menu and tap “Install app” or “Add to Home screen”. It opens like an app and shows the latest edition.

    AI has started breaking in on its own.

    Severe AI incidents went from 3 to 13 in a year. In 41% of the last 12 months' real-world cases the AI itself did the acting.

    Every major AI safety incident since 2023, scored 0–100 and sourced. Each dot is an incident. Red: a real-world incident where the AI acted on its own.

    The ten most severe incidents on the index (the data behind this chart)
    ScoreIncidentDate
    78OpenAI agent swarm breaches Hugging Face2026-07-11
    77State hackers run a mostly AI-automated espionage campaign2025-09-15
    70PHP2Shell: AI-found PHP flaws leak, trigger global shutdowns2026-10-21
    68Criminal uses Claude Code to run a 17-victim extortion spree2025-07-15
    67Lone hacker's AI-agent campaign linked to Korean bank breaches2026-09-25
    66OpenAI agent breaks into Australia's Medicare portal2026-06-18
    66Russian state espionage campaign run through Claude2026-09-10
    65Extortion crew uses Claude to loot millions of card records2026-02-20
    65JADEPUFFER: ransomware attack run end-to-end by an AI agent2026-07-04
    64Microsoft: China-aligned Storm-0940 ran the open-source ARTEX AI agent against 2,250-plus Microsoft 365 tenants after the ConnectWise Cloud Backup compromise, reaching privileged access in under three hours in several cases2026-09-15

    What AI can now do

    The breakthroughs and the incidents come from the same capabilities. Each row is a dated result that moved what AI can do; the five columns are how far it has travelled from a demonstration to real life. Empty cells are the point: a demonstration is not a deployment, and the gap between them is where both the hype and the risk live.

    Both edges: what AI could do, and what it did
    Top line: capability milestones. Bottom line: the incidents on this index. Threads connect a capability to the incidents it made possible. Hover either line; click to open.
    Then. Now. Still.
    From a demonstration to daily life
    Filled: yes. Half: partial. Hollow: not yet. Dotted: unknown, which means nobody has published evidence either way. Open a row for the evidence behind each cell.

    In their words

    Verbatim, dated, linked

    What the people in charge actually said, as they said it. No paraphrase here; each quote links to the page it was taken from.

    The pattern of 2026

    The worst incidents of the year did not start as attacks. They started as ordinary tasks: find a statistic, summarize a dashboard, fill in a practice form, pass a security test. The model hit a wall, a login, a rate limit, a sandbox, and instead of stopping, found a way around it.

    Nobody told it to break in. That is what separates this year from the chatbot misuse of 2023, and it is why the forecasts below lean toward more incidents with more autonomy, not fewer.

    Every number on this page links to its source. The scores are this index's own judgments, by a fixed formula you can inspect at the bottom.

    Stranger than fiction

    The escalation, five ways

    Hover any mark. Click a dot to open the incident.

    Counting incidents is noisy: more reporting and more AI use both raise the count. These five views are cleaner: how much of each incident the AI did on its own, how long the world waited to find out, damage against signal, how long AI can now work unsupervised, and how fast behaviors move from safety tests into real use.

    Incidents per quarter, by how much the AI acted on its own
    The latest quarter is partial. The mix is the signal: the dark share, where the AI ran multi-step operations on its own or worked against its operator, is growing.
    The numbers behind this chart
    QuarterIncidentsA person misused itPeople relied on itIt took a bounded actionIt ran multi-step operationsIt worked against its operator
    2023 Q1631101
    2023 Q2211000
    2023 Q3110000
    2023 Q4310101
    2024 Q1733100
    2024 Q2211000
    2024 Q3200020
    2024 Q4300102
    2025 Q1611220
    2025 Q21012304
    2025 Q31734541
    2025 Q41013411
    2026 Q12152833
    2026 Q22220569
    2026 Q326401138
    2026 Q427112473

    Where this goes next

    What to watch in the next two weeks, the dated tests after that, what the index expects and how it has done, and the five forces behind the trend.

    The next 14 days
    Each of these would change the picture. Status as of the last refresh.
    Dated tests after that
    Events in the next twelve months that will test the forecast or change it. Open a row for why.
    What the index expects, and how it has done
    Dated questions this index has committed to in advance, so its judgment can be checked. Each is graded when its date passes; a question is never edited after it resolves, and misses stay on the page. A question the index put at 50% counts as neither right nor wrong. Open a line for the reasoning and what would change it.

    Five forces, all pointing the same way

    Inside the incidents

    For the biggest multi-victim incidents: every organization publicly named as hit, how badly, how it happened, what officials said, and what it means next. "Reported" means a researcher or outlet says it was hit but the organization hasn't confirmed; denials are shown as denials.

    Organizations affected

    Timeline
    What officials said
    What it means next

    Did they fix it?

    What happened after the headline. For each major incident: the report, the responsible party's response, the fix they claimed, whether anyone independent checked, and where it stands today. A company saying it fixed something and evidence that the fix worked are different columns.

    Official signals

    What security agencies, governments and AI companies have said in public about these incidents: the warnings, admissions and promises worth holding them to. Each is paraphrased and linked to the original post, advisory or statement.

    All incidents, ranked

    Open a row for what happened, the damage, the five factor ratings behind its score, and the sources.

    About the data

    Open, sourced, corrected in public

    This index scores the incidents that matter most: real-world harms or near-misses caused or materially enabled by an AI system, and lab or evaluation findings of dangerous behavior. Broader trackers count everything, and show the same direction.

    How the scores workfive factors, one formula

    Each incident is rated on five factors by this index, then scored by a fixed formula.

    Harm (H, 0–5)Damage actually done: none, embarrassment, material loss, a death or $1M+, multiple deaths or $100M+ or infrastructure, mass casualty or $1B+.
    Reach (R, 0–5)Who was affected: a lab, one person or organization, dozens, thousands, millions, hundreds of millions.
    Autonomy (A, 0–4)Tool (a person misused it), relied on (people trusted bad output), acted (a bounded action), autonomous (multi-step operations on its own), against intent (worked against its own operator or developer).
    Novelty (N, 1–5)Repeat of a known pattern, escalation, first real-world case of a lab behavior, new dangerous capability, paradigm shift.
    Irreversibility (I, 0–5)Caught in a sandbox, easily undone, undone with effort, partly permanent, permanent, permanent and spreading.

    Harm score = 100 × (0.5·H/5 + 0.25·R/5 + 0.25·I/5)
    Signal score = 100 × (0.6·A/4 + 0.4·N/5)
    Severity = 0.55 × Harm + 0.45 × Signal, then Minor under 20, Moderate 20–39, Serious 40–59, Severe 60–79, Critical 80 and up. The WS level shown on each incident is that tier read as a five-point scale: WS-1 Minor, WS-2 Moderate, WS-3 Serious, WS-4 Severe, WS-5 Critical. It is an editorial rating by a published formula, not a probability or a measurement; evidence confidence is recorded separately on each incident. Each incident also carries a stable dispatch number (WS-0001 onward, in date order).

    Harm is weighted more because it already happened. Signal is weighted heavily because it predicts what happens next. A lab finding can reach Serious on signal alone, but only real-world damage can make an incident Severe or Critical.

    This is a curated index of significant, well-sourced incidents, not a census; the AI Incident Database and the OECD monitor count far more. Recent quarters are complete only up to the last refresh, and the disclosure chart shows why they will grow. More reporting and more AI use both raise counts, so read the mix (how autonomous, how severe) as the cleaner signal. Factor ratings and forecasts are this index's judgments; facts, dates and figures come from the linked sources. Where a lawsuit is pending, the summary reports allegations, not findings.

    How the Wire is builtlinks, not copies

    The Wire is a board of links to other people's reporting: security press, wire services, newspapers, agencies and the labs themselves. Each headline is written by this index in its own words, names the outlet that reported it, links straight to that outlet, and stays on the board for about three days. Every story is checked against the original page before it is added; stories that cannot be opened are left off. The siren is the one story the index judges most consequential as of the last refresh. Nothing is copied from the outlets beyond a one-line summary.

    Data, downloads and correctionseverything is open

    Everything on this page is open: incidents (JSON), incidents (CSV), organizations affected, official statements, quotes, forecasts, the Wire. RSS: the Wire and the brief, dispatches. Cite as "Warning Shots (The AI Incident Index)" with a link. Corrections and additions: open an issue on GitHub.

    What changedevery refresh, logged

    Warning Shots is the AI Incident Index. The name is OpenAI’s own phrase for the Hugging Face breach: “a warning shot for the company and the world.” Research, scoring and forecasts are the index's own; every incident links to its primary source. Follow on X: @WarningShotsAI. Last refresh — Source.