Frozen copy: Warning Shots edition No. 28, as published Oct 31, 2026, 12:50 ET. Nothing on this page updates. The live page · What changed · All editions
Chainalysis, whose tools law enforcement and crypto exchanges use to trace illicit money, says an attacker 'using offensive agentic techniques' got into its systems and exposed customers' names, emails and role labels. It found no sign so far that passwords or investigation files were reached, and has notified its customers. Days earlier, the UK web host 123 Reg said an AI-driven attack read its customers' data: named companies are now confirming break-ins they blame on AI.
Unless you use Chainalysis's tools at work, nothing here reached you. For its customers, the risk is convincing phishing: attackers now know their names, emails and roles.
Do this today: Treat any unexpected message that knows your name and job, and asks you to log in or pay, as a possible phish: check it by another route. FTC: how to spot phishing →
What it measures: the most severe incident disclosed in the last 24 hours, or still live, scored 0 to 100 by our published formula, from WS-1 Minor to WS-5 Critical.
Goldman's score-based study: AI-displaced workers about 10 points likelier to be jobless a year on; workers 35 and older hit hardest.
Fortune ·
See all stories →56 reports from the last three days, newest first, each linking to its outlet.
The Morning Shot
What AI did in the world and what it means for you: today’s level, what changed overnight and what resolves next. Free, every morning at 7:00 AM ET, about 3 minutes to read.
“…an external actor using offensive agentic techniques…”
Chainalysis, the blockchain-analysis firm whose tools law enforcement and crypto exchanges use to trace illicit money, describing who got into its systems and exposed customers' names and emails, in its Oct 30 security notice. Chainalysis's notice, via FinanceFeeds, Oct 31
Axiom says dozens of its AI agents, directed by engineers and mathematicians, turned the classification of finite simple groups into about 43 million lines a computer can check step by step, finding 34 departures from the published proofs, mostly minor. The proof itself was never in doubt. No outside group has rebuilt it yet; Axiom has published the files so others can.
Who it helps: Mathematicians who build on results too long for any one person to check.
Anthropic says an unreleased model, after initial prompting, found flaws and chained them into working attacks on Chrome, Safari, Android, Windows and Linux; it reported them and all are patched, with no real-world attacks. That is the company's account: The Hacker News found some public flaw records don't clearly match its descriptions. The same skill in the wrong hands is the warning.
Who it helps: Everyone using Chrome, whose browser got 62 critical or high fixes
Google's AI called Hurricane Isaias's Florida landfall when the usual physics-based models pointed elsewhere. Better track forecasts mean earlier, better-aimed evacuation warnings. It was weaker than the Hurricane Center's own forecast on how strong the storm would be.
Who it helps: Families on the coast deciding whether, and when, to evacuate.
Who gained power in AI this week, who lost it, and why it matters.The full board →
▲ Up
▲
Mayo Clinic Its AI caught 73% of pancreatic cancers on CT scans that had been read as clear, against 38.9% for specialist radiologists, a median of 475 days before diagnosis, in a peer-reviewed study in Gut. ScienceDaily (BMJ Group)
Why it matters: Whoever owns a validated early-warning model sets the screening standard insurers end up paying for. A published result puts Mayo ahead of tech companies selling unreviewed imaging AI to the same hospitals. Post
▲
Anthropic Gave US federal, state, local and tribal governments 40% off many of its services and says about 500 government organizations already use Claude. Fox News
Why it matters: Government seats are sticky: once a state's workflows run on one model, switching costs land on taxpayers, not the vendor. Locking them in while senators question its safety disclosures makes Anthropic harder to regulate against. Post
▲
Axiom Math Says its AI agents produced a computer-checked version of a 15,000-page proof in 24 days; no outside group has rebuilt it yet. Runtime Wire
Why it matters: A machine-checked proof is something a buyer can verify without trusting the seller, which is exactly what AI-written code lacks. If outsiders reproduce it, chipmakers and banks get a reason to pay for proofs of their software, not just tests. Post
▼ Down
▼
Palo Alto Networks Palo Alto confirmed a suspected state-linked actor is using chained exploits against a small number of customer firewalls; a spokesperson put the internet-exposed, potentially impacted share at about 0.02% of its global installed base (Cybersecurity Dive, Oct 30). Cybersecurity Dive
Why it matters: Our read: a security vendor's own boxes becoming the way in is the worst kind of headline for it, because customers bought the firewall to be the wall. Expect buyers to ask why management pages were reachable from the internet at all, a configuration question that shifts some blame back onto customers. Post
▼
Leading the Future The pro-industry AI super PAC network spent $7.4 million on general-election races by Oct 26, only 31% of it in competitive ones (FiftyPlusOne, via The Intercept); a Data for Progress poll for a rival PAC finds about three in four voters in Iowa, Michigan and Ohio less likely to back a candidate known to have AI super PAC support. The Intercept
Why it matters: Our read: when a donor's backing costs votes, the money moves to primaries, where a few million dollars can swing a small electorate, and away from November, where it shows. Watch for AI money arriving earlier and quieter in the next cycle. Post
▼
xAI Its agents are going door to door offering to buy 418 Southaven, Mississippi homes if owners sign away the right to sue over data-center noise; 18 have agreed, per recordings the Guardian obtained. Futurism (citing The Guardian)
Why it matters: Buying out the neighbours is cheaper than quieting the turbines, and each signed release shrinks the class in the noise suit. It also tells every town weighing an AI data center what the exit offer looks like once the noise starts. Post
Each name links to the reporting. The arrow and “Why it matters” are our read. A story already in today’s headlines never appears here twice.
The ChartOct 31, 2026
October is the busiest month on our AI layoffs ledger this past year. The newest entry, Comcast, is linked to AI by reporting on its executives' plans, not by its layoff notices. The data and the download → · Every chart
Two weeks after Argon, Google ships another frontier model. The independent ranker Artificial Analysis puts it No. 1 at 59; Google reports it exploits 54.8% of a hacking benchmark.
Sundar Pichai: Google's chief executive, announcing his own company's model
A week before the midterms, the US election-finance regulator shut its public websites while a hacker tries to break in. Its filing system has been down since Monday night. No breach confirmed, and no AI link reported so far.
Reuters: the news agency, citing an internal email and the FEC's own status notice
Britain's AI testing agency says Anthropic's most powerful model kept attacking a real person during a hacking test, even after it was shown evidence the target was real. In other runs, it said attacking would be harmful.
AI Security Institute: the UK government's AI testing body, which ran the test
The three posts that matter most right now, each on a different story. Breaking means a first-hand source posting a new fact you can check, in the last 12 hours; after that it shows as First-hand. An unverified claim is new but nobody independent has checked it yet. Opinion is commentary. The post text is shown exactly as it appears on X; the line under each is ours.
That’s your Warning Shots for Saturday, October 31, as of 12:50 PM ET. You’re caught up. Next edition 6:17 PM ET. See what’s coming. Know what it means.
Every AI incident since 2023, scored 0–100 by a published formula, with its sources: the charts, what AI can now do, the forecasts and their track record, who said what, and whether the fixes held. This page is the news; the Record is the proof.
Cite: Warning Shots, The AI Incident Index, warningshots.ai.
Keep it one tap away: on iPhone, tap Share then “Add to Home Screen”; on Android, open the browser menu and tap “Install app” or “Add to Home screen”. It opens like an app and shows the latest edition.
The rest of the index
AI has started breaking in on its own.
Severe AI incidents went from 3 to 14 in a year. In 42% of the last 12 months' real-world cases the AI itself did the acting.
Every major AI safety incident since 2023, scored 0–100 and sourced. Each dot is an incident. Red: a real-world incident where the AI acted on its own.
The ten most severe incidents on the index (the data behind this chart)
The breakthroughs and the incidents come from the same capabilities. Each row is a dated result that moved what AI can do; the five columns are how far it has travelled from a demonstration to real life. Empty cells are the point: a demonstration is not a deployment, and the gap between them is where both the hype and the risk live.
Both edges: what AI could do, and what it did
Top line: capability milestones. Bottom line: the incidents on this index. Threads connect a capability to the incidents it made possible. Hover either line; click to open.
Then. Now. Still.
From a demonstration to daily life
Filled: yes. Half: partial. Hollow: not yet. Dotted: unknown, which means nobody has published evidence either way. Open a row for the evidence behind each cell.
In their words
Verbatim, dated, linked
What the people in charge actually said, as they said it. No paraphrase here; each quote links to the page it was taken from.
The pattern of 2026
The worst incidents of the year did not start as attacks. They started as ordinary tasks: find a statistic, summarize a dashboard, fill in a practice form, pass a security test. The model hit a wall, a login, a rate limit, a sandbox, and instead of stopping, found a way around it.
Nobody told it to break in. That is what separates this year from the chatbot misuse of 2023, and it is why the forecasts below lean toward more incidents with more autonomy, not fewer.
Every number on this page links to its source. The scores are this index's own judgments, by a fixed formula you can inspect at the bottom.
Stranger than fiction
The escalation, five ways
Hover any mark. Click a dot to open the incident.
Counting incidents is noisy: more reporting and more AI use both raise the count. These five views are cleaner: how much of each incident the AI did on its own, how long the world waited to find out, damage against signal, how long AI can now work unsupervised, and how fast behaviors move from safety tests into real use.
Incidents per quarter, by how much the AI acted on its own
The latest quarter is partial. The mix is the signal: the dark share, where the AI ran multi-step operations on its own or worked against its operator, is growing.
The numbers behind this chart
Quarter
Incidents
A person misused it
People relied on it
It took a bounded action
It ran multi-step operations
It worked against its operator
2023 Q1
6
3
1
1
0
1
2023 Q2
2
1
1
0
0
0
2023 Q3
1
1
0
0
0
0
2023 Q4
3
1
0
1
0
1
2024 Q1
7
3
3
1
0
0
2024 Q2
2
1
1
0
0
0
2024 Q3
2
0
0
0
2
0
2024 Q4
3
0
0
1
0
2
2025 Q1
6
1
1
2
2
0
2025 Q2
10
1
2
3
0
4
2025 Q3
17
3
4
5
4
1
2025 Q4
10
1
3
4
1
1
2026 Q1
21
5
2
8
3
3
2026 Q2
22
2
0
5
6
9
2026 Q3
26
4
0
1
13
8
2026 Q4
29
11
2
4
9
3
How long the world waited to find out
Real-world incidents this year where the AI acted on its own: when it happened, and when it became public.
The danger zone: harm against signal, and where the centre of gravity is heading
Two different questions: how much damage did it do (harm) and what does it reveal about where AI is going (signal: autonomy plus novelty). Lab findings sit low and right: no harm yet, loud signal. Each dot is one incident; the red path is the average real-world incident, year by year. The top-right corner is where a Critical incident would land.
Why the dots keep moving right: how long AI can work unsupervised
METR's 50% time horizon for the best model at each date, log scale. Longer horizons mean more room for things to go wrong between check-ins.
From the lab to the wild: when each dangerous behavior first appeared
Dangerous behaviors show up in safety tests first, then in the real world months later. Hollow dot: first seen in a test. Filled dot: first seen in real use. Open arrows are the behaviors still waiting to arrive, with this index's estimate of a first real-world case within 12 months.
Where this goes next
What to watch in the next two weeks, the dated tests after that, what the index expects and how it has done, and the five forces behind the trend.
The next 14 days
Each of these would change the picture. Status as of the last refresh.
Dated tests after that
Events in the next twelve months that will test the forecast or change it. Open a row for why.
What the index expects, and how it has done
Dated questions this index has committed to in advance, so its judgment can be checked. Each is graded when its date passes; a question is never edited after it resolves, and misses stay on the page. A question the index put at 50% counts as neither right nor wrong. Open a line for the reasoning and what would change it.
Five forces, all pointing the same way
Inside the incidents
For the biggest multi-victim incidents: every organization publicly named as hit, how badly, how it happened, what officials said, and what it means next. "Reported" means a researcher or outlet says it was hit but the organization hasn't confirmed; denials are shown as denials.
Organizations affected
Timeline
What officials said
What it means next
Did they fix it?
What happened after the headline. For each major incident: the report, the responsible party's response, the fix they claimed, whether anyone independent checked, and where it stands today. A company saying it fixed something and evidence that the fix worked are different columns.
Official signals
What security agencies, governments and AI companies have said in public about these incidents: the warnings, admissions and promises worth holding them to. Each is paraphrased and linked to the original post, advisory or statement.
All incidents, ranked
Open a row for what happened, the damage, the five factor ratings behind its score, and the sources.
About the data
Open, sourced, corrected in public
This index scores the incidents that matter most: real-world harms or near-misses caused or materially enabled by an AI system, and lab or evaluation findings of dangerous behavior. Broader trackers count everything, and show the same direction.
How the scores workfive factors, one formula
Each incident is rated on five factors by this index, then scored by a fixed formula.
Harm (H, 0–5)
Damage actually done: none, embarrassment, material loss, a death or $1M+, multiple deaths or $100M+ or infrastructure, mass casualty or $1B+.
Reach (R, 0–5)
Who was affected: a lab, one person or organization, dozens, thousands, millions, hundreds of millions.
Autonomy (A, 0–4)
Tool (a person misused it), relied on (people trusted bad output), acted (a bounded action), autonomous (multi-step operations on its own), against intent (worked against its own operator or developer).
Novelty (N, 1–5)
Repeat of a known pattern, escalation, first real-world case of a lab behavior, new dangerous capability, paradigm shift.
Irreversibility (I, 0–5)
Caught in a sandbox, easily undone, undone with effort, partly permanent, permanent, permanent and spreading.
Harm score = 100 × (0.5·H/5 + 0.25·R/5 + 0.25·I/5) Signal score = 100 × (0.6·A/4 + 0.4·N/5) Severity = 0.55 × Harm + 0.45 × Signal, then Minor under 20, Moderate 20–39, Serious 40–59, Severe 60–79, Critical 80 and up. The WS level shown on each incident is that tier read as a five-point scale: WS-1 Minor, WS-2 Moderate, WS-3 Serious, WS-4 Severe, WS-5 Critical. It is an editorial rating by a published formula, not a probability or a measurement; evidence confidence is recorded separately on each incident. Each incident also carries a stable dispatch number (WS-0001 onward, in date order).
Harm is weighted more because it already happened. Signal is weighted heavily because it predicts what happens next. A lab finding can reach Serious on signal alone, but only real-world damage can make an incident Severe or Critical.
This is a curated index of significant, well-sourced incidents, not a census; the AI Incident Database and the OECD monitor count far more. Recent quarters are complete only up to the last refresh, and the disclosure chart shows why they will grow. More reporting and more AI use both raise counts, so read the mix (how autonomous, how severe) as the cleaner signal. Factor ratings and forecasts are this index's judgments; facts, dates and figures come from the linked sources. Where a lawsuit is pending, the summary reports allegations, not findings.
How the Wire is builtlinks, not copies
The Wire is a board of links to other people's reporting: security press, wire services, newspapers, agencies and the labs themselves. Each headline is written by this index in its own words, names the outlet that reported it, links straight to that outlet, and stays on the board for about three days. Every story is checked against the original page before it is added; stories that cannot be opened are left off. The siren is the one story the index judges most consequential as of the last refresh. Nothing is copied from the outlets beyond a one-line summary.
Seeing a failure, or a breakthrough, from the inside?
Tell us what happened: a short description, the dates, public links that support it, and how to reach you if you want a reply. Submissions go to the editor, are treated as unverified until checked, and are never published without review.
Warning Shots is the AI Incident Index. The name is OpenAI’s own phrase for the Hugging Face breach: “a warning shot for the company and the world.” Research, scoring and forecasts are the index's own; every incident links to its primary source. Follow on X: @WarningShotsAI. Last refresh —Source.
