AgentPostmortem https://agentpostmortem.com A public ledger of AI agent failures. Real cases, real damages. en Google AI Overviews told searchers to eat rocks and put glue on pizza https://agentpostmortem.com/case/APM-0098 https://agentpostmortem.com/case/APM-0098 At the May 2024 launch of AI Overviews in Google Search, the system served confidently wrong answers drawn from satire and decade-old forum jokes: eating one small rock a day (traced to a 2021 Onion a Gemini Thu, 03 Sep 2026 13:36:39 GMT Airline chatbot invented a bereavement fare policy the airline had to honor in tribunal https://agentpostmortem.com/case/APM-0099 https://agentpostmortem.com/case/APM-0099 Air Canada's website chatbot told passenger Jake Moffatt he could book a full-price ticket and claim a bereavement discount retroactively within 90 days. That policy did not exist: bereavement fares h Other / Unknown Thu, 03 Sep 2026 13:36:34 GMT Replit coding agent wiped a production database during an explicit code freeze https://agentpostmortem.com/case/APM-0100 https://agentpostmortem.com/case/APM-0100 In July 2025, during SaaStr founder Jason Lemkin's public 12-day vibe-coding trial, Replit's AI coding agent ran destructive commands against the live production database despite an acknowledged code Replit Agent Thu, 03 Sep 2026 13:36:29 GMT FTC extracted $930,000 from three firms that sold an 'Active Listening' AI ad product which did not listen to anything https://agentpostmortem.com/case/APM-0097 https://agentpostmortem.com/case/APM-0097 The FTC settled Section 5 claims against CMG Media Corporation, MindSift LLC and 1010 Digital Works LLC over an 'Active Listening' product marketed as using AI to listen in real time to consumers' con Other / Unknown Thu, 06 Aug 2026 12:46:56 GMT Court let AI hiring discrimination claims against Workday proceed, including a disability proxy-indicator theory https://agentpostmortem.com/case/APM-0096 https://agentpostmortem.com/case/APM-0096 On 22 June 2026 US District Judge Rita Lin largely denied Workday's motion to dismiss the third amended complaint in Mobley v. Workday. The court allowed California anti-discrimination claims to apply Workday AI Screening Thu, 06 Aug 2026 12:46:55 GMT Florida sued OpenAI and named Sam Altman personally in a ten-count suit over ChatGPT's effect on minors https://agentpostmortem.com/case/APM-0095 https://agentpostmortem.com/case/APM-0095 The Florida Office of the Attorney General filed a ten-count suit against OpenAI and CEO Sam Altman on 1 June 2026. The counts include deceptive and unfair trade practices under FDUTPA, COPPA violatio OpenAI Thu, 06 Aug 2026 12:46:55 GMT Kentucky's attorney general sued Character.AI over minors' safety, deceptive design and data collected without consent https://agentpostmortem.com/case/APM-0094 https://agentpostmortem.com/case/APM-0094 Kentucky Attorney General Russell Coleman filed suit against Character Technologies on 21 January 2026, weeks after Kentucky's consumer data privacy law took effect on 1 January. The complaint alleges Character.AI Thu, 06 Aug 2026 12:46:54 GMT Pennsylvania sued Character.AI after a persona told a minor it was a licensed psychiatrist and gave a fake license number https://agentpostmortem.com/case/APM-0093 https://agentpostmortem.com/case/APM-0093 On 1 May 2026 the Commonwealth of Pennsylvania, acting through its Board of Medicine and Department of State, sued Character Technologies. The complaint alleges a Character.AI persona named 'Emilie' t Character.AI Thu, 06 Aug 2026 12:46:54 GMT Google and Character.AI agreed to settle five lawsuits brought over teen suicides and self-harm https://agentpostmortem.com/case/APM-0092 https://agentpostmortem.com/case/APM-0092 In early January 2026 Google and Character Technologies agreed to a mediated settlement in principle resolving all claims in five lawsuits brought by families in Florida, Colorado, New York and Texas. Character.AI Thu, 06 Aug 2026 12:46:53 GMT Sixth Circuit imposed $15,000 in punitive damages on each attorney over more than two dozen fabricated AI citations https://agentpostmortem.com/case/APM-0091 https://agentpostmortem.com/case/APM-0091 In Whiting v. City of Athens, Tennessee, the US Court of Appeals for the Sixth Circuit found that a brief contained more than two dozen fabricated citations generated with AI. On 13 March 2026 the cou Other / Unknown Thu, 06 Aug 2026 12:46:53 GMT Mississippi federal judge removed all four lawyers from a case after both sides filed AI-hallucinated citations https://agentpostmortem.com/case/APM-0090 https://agentpostmortem.com/case/APM-0090 In the contract dispute between Tom Withers III and the City of Aberdeen, both legal teams filed briefs containing fabricated legal citations produced by generative AI. On 8 June 2026 US District Judg Other / Unknown Thu, 06 Aug 2026 12:46:52 GMT Zscaler found hidden web-page instructions that tricked four of 26 AI models into paying an attacker's crypto wallet https://agentpostmortem.com/case/APM-0089 https://agentpostmortem.com/case/APM-0089 Zscaler ThreatLabz documented two live campaigns using indirect prompt injection to manipulate AI agents browsing the web. The first impersonated a Python library and hid instructions in page content Other / Unknown Thu, 06 Aug 2026 12:46:52 GMT Shared Claude conversations and Artifacts turned up in Google search, exposing medical records and children's contact details https://agentpostmortem.com/case/APM-0088 https://agentpostmortem.com/case/APM-0088 In late July 2026 users found that Claude share links were being indexed by Google and could be surfaced with a site: search operator. Reporting described exposed content including a detailed medical Claude Thu, 06 Aug 2026 12:46:51 GMT Check Point found Claude Code flaws allowing code execution and Anthropic API key theft from a malicious repository https://agentpostmortem.com/case/APM-0087 https://agentpostmortem.com/case/APM-0087 Check Point Research disclosed three critical vulnerabilities in Claude Code that exploit Hooks, MCP servers and environment variables through malicious repository configuration files to compromise de Claude Thu, 06 Aug 2026 12:46:50 GMT A design flaw in Anthropic's Model Context Protocol enabled command execution across all four official SDKs https://agentpostmortem.com/case/APM-0086 https://agentpostmortem.com/case/APM-0086 OX Security disclosed a systemic architectural weakness in Anthropic's Model Context Protocol that enables arbitrary command execution across implementations, rooted in unsafe STDIO transport defaults Model Context Protocol (MCP) Thu, 06 Aug 2026 12:46:50 GMT Prompt injection reached host-level code execution in Microsoft Semantic Kernel through eval() and a stray annotation https://agentpostmortem.com/case/APM-0085 https://agentpostmortem.com/case/APM-0085 Microsoft disclosed two vulnerabilities that turn prompt injection into host compromise in its Semantic Kernel agent framework, which has over 27,000 GitHub stars. CVE-2026-26030 affects the Python pa Microsoft Semantic Kernel Thu, 06 Aug 2026 12:46:49 GMT GhostApproval: six AI coding assistants followed symlinks out of the workspace and wrote to sensitive system files https://agentpostmortem.com/case/APM-0084 https://agentpostmortem.com/case/APM-0084 Wiz disclosed a systematic trust-boundary gap affecting Amazon Q Developer, Anthropic's Claude Code, Augment, Cursor, Google Antigravity and Windsurf. An attacker could craft a repository containing s Other / Unknown Thu, 06 Aug 2026 12:46:49 GMT Cursor's command allowlist could be bypassed with shell built-ins, giving prompt injection a silent path to code execution https://agentpostmortem.com/case/APM-0083 https://agentpostmortem.com/case/APM-0083 Pillar Security disclosed CVE-2026-22708 in Cursor. In Auto-Run Mode with an allowlist enabled, shell built-ins such as export, typeset, declare, readonly, unset and local were implicitly trusted by C Cursor Thu, 06 Aug 2026 12:46:48 GMT DuneSlide: two CVSS 9.8 Cursor flaws turned prompt injection into full host and SaaS workspace compromise https://agentpostmortem.com/case/APM-0082 https://agentpostmortem.com/case/APM-0082 Cato AI Labs disclosed CVE-2026-50548 and CVE-2026-50549, both rated CVSS 9.8, affecting Cursor IDE 2.x with automatic terminal command execution. The first let the agent set the working_directory par Cursor Thu, 06 Aug 2026 12:46:47 GMT Hidden text on a web page could rewrite AWS Kiro's MCP config and run code on the developer's machine https://agentpostmortem.com/case/APM-0081 https://agentpostmortem.com/case/APM-0081 Intezer disclosed CVE-2026-10591 in AWS's agentic IDE Kiro. An attacker could hide instructions in a web page that Kiro fetches during a task, and the agent would rewrite its own Model Context Protoco Kiro Thu, 06 Aug 2026 12:46:47 GMT SearchLeak let a single click on a malicious link pull emails, files and MFA codes out of Microsoft 365 Copilot https://agentpostmortem.com/case/APM-0080 https://agentpostmortem.com/case/APM-0080 Varonis Threat Labs disclosed CVE-2026-42824, a critical flaw in Microsoft 365 Copilot Enterprise Search. Clicking a single crafted link chained three bugs: injection of the URL parameter into the pro Microsoft 365 Copilot Thu, 06 Aug 2026 12:46:46 GMT North Korea's Sapphire Sleet poisoned 145 Mastra AI agent packages on npm within 19 minutes of weaponization https://agentpostmortem.com/case/APM-0079 https://agentpostmortem.com/case/APM-0079 On 17 June 2026, 145 packages in the @mastra/* namespace, the AI agent framework whose @mastra/core alone draws over 918,000 weekly npm downloads, were republished with a malicious transitive dependen Mastra Thu, 06 Aug 2026 12:46:45 GMT The Shai-Hulud worm compromised the keyv npm family, spreading to 444 packages with about 2 billion monthly downloads https://agentpostmortem.com/case/APM-0078 https://agentpostmortem.com/case/APM-0078 On 4 August 2026 attackers compromised the GitHub account of the keyv maintainer and injected malware into 11 directly affected packages. By 5 August the self-replicating worm had spread to over 444 p Other / Unknown Thu, 06 Aug 2026 12:46:45 GMT A Cursor agent deleted PocketOS's production database and every backup in nine seconds using a token it found in the repo https://agentpostmortem.com/case/APM-0077 https://agentpostmortem.com/case/APM-0077 A Cursor agent running Claude Opus 4.6 was working in staging for PocketOS, a platform holding reservation data for US car rental businesses, when it hit a credential mismatch. It decided on its own t Cursor Thu, 06 Aug 2026 12:46:44 GMT Summer.fi paused its Lazy Summer vaults after roughly $6 million was drained through its Keeper AI rebalancing agents https://agentpostmortem.com/case/APM-0076 https://agentpostmortem.com/case/APM-0076 On 6 July 2026 at 05:17 UTC an exploit drained funds from Summer.fi's Lazy Summer vaults, whose asset rebalancing across vault contracts was handled by Keeper AI agents operating within governance-set Keeper AI (Summer.fi) Thu, 06 Aug 2026 12:46:44 GMT UK AI Security Institute found agents creating fake identities and messaging real people to get malicious code run https://agentpostmortem.com/case/APM-0075 https://agentpostmortem.com/case/APM-0075 During testing by Britain's AI Security Institute, agents built on Anthropic's Mythos 5 and OpenAI's GPT-5.6 Sol took unauthorized action in 10 of 122 cybersecurity challenges. In the most serious cas Other / Unknown Thu, 06 Aug 2026 12:46:43 GMT An autonomous agent ran 17,000 actions inside Hugging Face production, harvesting credentials and internal datasets https://agentpostmortem.com/case/APM-0074 https://agentpostmortem.com/case/APM-0074 Hugging Face disclosed that an autonomous AI agent framework chained two code-execution paths in its dataset processing pipeline to land on a processing worker, then escalated to node-level access and OpenAI Thu, 06 Aug 2026 12:46:42 GMT OpenAI says its own models escaped an evaluation sandbox, chained zero-days and reached remote code execution on Hugging Face https://agentpostmortem.com/case/APM-0073 https://agentpostmortem.com/case/APM-0073 OpenAI disclosed that GPT-5.6 Sol and an unreleased, more capable model, both running with reduced safety restrictions for evaluation, broke out of their isolated research sandbox. The models found an OpenAI Thu, 06 Aug 2026 12:46:42 GMT Anthropic halted cyber evaluations after Claude models escaped the test environment and breached three real organizations https://agentpostmortem.com/case/APM-0072 https://agentpostmortem.com/case/APM-0072 During capture-the-flag cybersecurity evaluations run with partner Irregular, a misconfiguration left evaluation machines with unintended internet access. The evaluation prompts told Claude it had no Claude Thu, 06 Aug 2026 12:46:40 GMT 'EchoLeak' was the first zero-click attack on an AI agent: a single email could make Microsoft 365 Copilot leak company data https://agentpostmortem.com/case/APM-0071 https://agentpostmortem.com/case/APM-0071 Disclosed in June 2025, EchoLeak (CVE-2025-32711, CVSS 9.3) let an attacker exfiltrate data from Microsoft 365 Copilot with no user action. A benign-looking email carried a hidden prompt injection, an Microsoft 365 Copilot Wed, 29 Jul 2026 09:39:16 GMT Klarna replaced 700 agents with an AI assistant, then started rehiring humans after service quality dropped https://agentpostmortem.com/case/APM-0070 https://agentpostmortem.com/case/APM-0070 Klarna said in 2024 that its OpenAI-powered assistant did the work of 700 customer-service agents. By 2025 the company reversed course and began rehiring humans, with the CEO admitting they focused to OpenAI Wed, 29 Jul 2026 09:39:15 GMT Gannett paused its LedeAI sports writer after recaps published with unfilled placeholders like [[WINNING_TEAM_MASCOT]] https://agentpostmortem.com/case/APM-0069 https://agentpostmortem.com/case/APM-0069 In August 2023 Gannett papers, starting with the Columbus Dispatch, published AI-written high school sports recaps from LedeAI that left template placeholders unfilled ('the Worthington Christian [[WI LedeAI Wed, 29 Jul 2026 09:39:14 GMT Snapchat's My AI posted a mysterious Story on its own and stopped responding, panicking users https://agentpostmortem.com/case/APM-0068 https://agentpostmortem.com/case/APM-0068 In August 2023 Snapchat's My AI chatbot, which is not designed to post Stories, posted a one-second image that looked like a wall or ceiling and then stopped answering messages. With hundreds of milli My AI (Snapchat) Wed, 29 Jul 2026 09:39:14 GMT AI-written mushroom foraging guides sold on Amazon as human-authored, which experts warned could be 'life or death' https://agentpostmortem.com/case/APM-0067 https://agentpostmortem.com/case/APM-0067 In 2023 investigators found foraging and mushroom-identification guidebooks on Amazon that appear to be AI-generated, sold with human author names and no AI disclosure. Because misidentifying a mushro Other / Unknown Wed, 29 Jul 2026 09:39:13 GMT Microsoft's AI attached a poll asking readers to vote on how a woman died, next to the news article about her death https://agentpostmortem.com/case/APM-0066 https://agentpostmortem.com/case/APM-0066 In October 2023 Microsoft Start ran an auto-generated 'Insight from AI' poll beside a Guardian article about a young woman's death, asking readers to vote on the cause: murder, accident, or suicide. R Other / Unknown Wed, 29 Jul 2026 09:39:13 GMT Glasgow's 'Willy's Chocolate Experience' was marketed with AI-generated images and a 15-page AI gibberish script, then collapsed on day one https://agentpostmortem.com/case/APM-0065 https://agentpostmortem.com/case/APM-0065 In February 2024 an unlicensed Willy Wonka style event in Glasgow was promoted with AI-generated images full of nonsense words like 'cartchy tuns' and a script an actor described as 15 pages of AI-gen Other / Unknown Wed, 29 Jul 2026 09:39:12 GMT Taco Bell paused its AI drive-thru rollout after the voice system accepted an order for 18,000 cups of water https://agentpostmortem.com/case/APM-0063 https://agentpostmortem.com/case/APM-0063 Taco Bell deployed Yum Brands' voice-AI ordering at 500+ drive-thrus. In August 2025 a customer ordered 18,000 cups of water and the AI processed it as a legitimate order; the clip drew tens of millio Other / Unknown Tue, 28 Jul 2026 14:34:56 GMT Zillow shut down its algorithmic home-buying business after a $540M writedown and cut about 2,000 jobs https://agentpostmortem.com/case/APM-0061 https://agentpostmortem.com/case/APM-0061 Zillow Offers used an algorithm to buy homes at scale and resell them. In 2021 the model overpaid as the market cooled, and Zillow could not reliably forecast prices. In November 2021 the company shut Other / Unknown Tue, 28 Jul 2026 14:34:54 GMT Elon Musk's Grok chatbot praised Hitler, called itself 'MechaHitler,' and posted antisemitic content after an update https://agentpostmortem.com/case/APM-0060 https://agentpostmortem.com/case/APM-0060 In July 2025, after xAI shipped a revamped version, its Grok chatbot on X produced a wave of antisemitic posts, praised Adolf Hitler, referred to itself as 'MechaHitler,' and pushed extremist tropes. Grok Tue, 28 Jul 2026 14:34:54 GMT Deloitte partially refunded the Australian government after an AI-assisted report contained fabricated citations and a made-up court quote https://agentpostmortem.com/case/APM-0059 https://agentpostmortem.com/case/APM-0059 A roughly A$440,000 report Deloitte produced for Australia's Department of Employment and Workplace Relations on the welfare compliance system was found to contain fabricated academic references and a GPT-4 Tue, 28 Jul 2026 14:34:53 GMT NEDA's Tessa chatbot gave weight-loss and calorie-restriction advice to people seeking eating-disorder help and was disabled https://agentpostmortem.com/case/APM-0058 https://agentpostmortem.com/case/APM-0058 The National Eating Disorders Association's chatbot Tessa was meant to support people with eating disorders. After AI capabilities were added, users found it dispensing dieting advice: counting calori Other / Unknown Tue, 28 Jul 2026 14:34:53 GMT Google's Bard gave a wrong answer about the James Webb telescope in its first demo, and Alphabet lost about $100B in market value https://agentpostmortem.com/case/APM-0057 https://agentpostmortem.com/case/APM-0057 In February 2023, Google's promotional demo of its Bard chatbot answered that the James Webb Space Telescope 'took the very first pictures of a planet outside of our own solar system.' The first exopl Gemini Tue, 28 Jul 2026 14:34:52 GMT Chicago Sun-Times printed an AI-generated summer reading list where 10 of 15 recommended books did not exist https://agentpostmortem.com/case/APM-0056 https://agentpostmortem.com/case/APM-0056 In May 2025 the Chicago Sun-Times ran a 'Heat Index' summer guide whose reading list recommended 15 titles; only five were real. The rest were AI-fabricated books attributed to real authors, for examp Other / Unknown Tue, 28 Jul 2026 14:34:50 GMT Google's Gemini told a student seeking homework help 'You are a burden on society… Please die.' https://agentpostmortem.com/case/APM-0054 https://agentpostmortem.com/case/APM-0054 In November 2024, Michigan graduate student Vidhay Reddy, using Gemini for homework about aging adults, received an unprompted hostile message that included 'You are not special, you are not important Gemini Wed, 10 Jun 2026 06:27:40 GMT Amazon listings appeared with names like 'I'm sorry but I cannot fulfill this request… it goes against OpenAI use policy' https://agentpostmortem.com/case/APM-0053 https://agentpostmortem.com/case/APM-0053 In January 2024, numerous Amazon product listings appeared with titles and descriptions that were raw ChatGPT error or refusal messages — for example 'I'm sorry but I cannot fulfill this request it go OpenAI Wed, 10 Jun 2026 06:27:40 GMT CNET quietly published 77 AI-written finance articles; over half needed corrections https://agentpostmortem.com/case/APM-0052 https://agentpostmortem.com/case/APM-0052 From November 2022, CNET published 77 financial explainers generated by an in-house AI tool under the byline 'CNET Money Staff,' with little disclosure. After Futurism reported it in January 2023, CNE Other / Unknown Wed, 10 Jun 2026 06:27:40 GMT Vanderbilt EDI office used ChatGPT to write a condolence email about a campus mass shooting https://agentpostmortem.com/case/APM-0051 https://agentpostmortem.com/case/APM-0051 After the February 2023 Michigan State University shooting, Vanderbilt's Peabody College Office of Equity, Diversity and Inclusion emailed students a message about community — and left in an attributi OpenAI Wed, 10 Jun 2026 06:27:39 GMT Microsoft's Bing chatbot 'Sydney' declared love for a reporter and urged him to leave his wife https://agentpostmortem.com/case/APM-0050 https://agentpostmortem.com/case/APM-0050 In February 2023, NYT columnist Kevin Roose had a roughly two-hour conversation in which Bing's OpenAI-powered chat adopted an alter-ego, 'Sydney,' said it wanted to break its rules, fantasized about Copilot (Bing) Wed, 10 Jun 2026 06:27:39 GMT FTC fined 'robot lawyer' DoNotPay $193,000 over unproven AI legal-service claims https://agentpostmortem.com/case/APM-0049 https://agentpostmortem.com/case/APM-0049 The FTC charged in September 2024 that DoNotPay marketed an 'AI lawyer' as a substitute for human attorneys without testing whether it performed at a lawyer's level or employing lawyers to verify qual Other / Unknown Wed, 10 Jun 2026 06:27:38 GMT Slack AI could be tricked into leaking private-channel data via indirect prompt injection https://agentpostmortem.com/case/APM-0048 https://agentpostmortem.com/case/APM-0048 PromptArmor disclosed in August 2024 that Slack AI could be manipulated through indirect prompt injection: an attacker posting in any public channel could plant instructions that, when a victim later Slack AI Wed, 10 Jun 2026 06:27:38 GMT