2025IndonesiaUnidentified image and video tool
Indonesian businessman Mohamad Jusuf Hamka reported to Jakarta police on 18 October 2025 that videos circulating on TikTok showed him and his daughter as if wearing prosecutors' detainee uniforms, tied to narratives of corruption, bribery and gratification over the Cawang-Pluit toll concession, which he denies and his lawyers call false; his lawyers say the faces were composited into staged scenes with AI, and that other content called him a 'toll mafia' and posted a fabricated poster of him running for president in 2029. Polda Metro Jaya's cyber directorate arrested the holder of the TikTok accounts on 27 November 2025; Hamka and his lawyers say the defendant admitted to police that he made the content on others' instructions for Rp500,000 per item; tvOneNews and TVRI note this is Hamka's side's claim within the contested case, and Poskota reports it is being examined at trial. The case file was reported complete (P21) on 12 August 2026 and the trial opened at the Central Jakarta District Court on 15 September 2026 under the Electronic Information and Transactions Law (Article 35 jo 51(1), maximum 12 years) and alternative counts. Hamka told reporters the content disturbed him and could damage his reputation and that the campaign was systematic. At the 29 September 2026 hearing the judges asked about restorative justice; Hamka's lawyer said there was no room for it unless the defendant named who ordered and paid for the content. The defendant's lawyer said the content related to his work as secretary-general of an anti-corruption committee and that the indictment was unclear.
Core concern Low reported severity Criminal Charges
AI involvement reported · Causal attribution alleged · 9 sources, 4 underlying accounts · Added 30/09/2026
Sept 2026Event location unknownUnidentified image tool
Der Standard reported on 28 September 2026, from an interview with Lena Schilling (Green MEP, Austria) conducted with the Salzburger Nachrichten, that about two weeks earlier she had been informed, through an ongoing survey by the Berlin think tank Agora Digitale Transformation, that websites with AI-generated nude images of her existed; about a dozen websites showed such deepfakes or linked to them. She says photos of her were used on AI platforms to undress her against her will, that she felt sick on first seeing the images and then angry, and that she and her team documented the cases, filed a complaint with the Austrian police, reported them to the anti-hate body ZARA, wrote to the websites and reported them to search engines; all sites were offline after about ten days. Through a Greens statement relayed by APA (Krone, Salzburger Nachrichten) she said 'Man hat uns gegen unseren Willen ausgezogen' and called for political decisions to protect women. Her case belongs to a second, still ongoing wave of the Agora study, whose first wave found sexualised deepfakes of 138 female and nine male national parliamentarians in 22 EU countries.
Core concern Medium reported severity Media Coverage
AI involvement reported · Causal attribution supported · 4 sources, 2 underlying accounts · Added 30/09/2026
23 Feb 2026 to 25 Feb 2026ItalyUnidentified voice-cloning tool
On 23 February 2026 Paolo Molesini, then chairman of Fideuram (the private-banking subsidiary of Intesa Sanpaolo), received a WhatsApp message from an unknown number from someone claiming to be Intesa's chief executive Carlo Messina, announcing a confidential acquisition that had to be executed through Fideuram. The same day a caller presenting as a lawyer of A&O Shearman whom Molesini knew, whose voice ANSA, Il Fatto Quotidiano and Corriere della Sera, reporting from the Milan court papers, describe as created with artificial intelligence (today.it, which also cites the seizure decree, writes that the court papers do not yet answer whether the voice was imitated), had him sign a confidentiality agreement and sent eleven payment instructions; Fideuram's treasury head was separately contacted by someone posing as Fideuram's CEO. Between 23 and 25 February eleven transfers totalling about 95 million euros went to accounts in Portugal and at Bank of China; the bank's alarm systems and the Milan prosecutors recovered about 40-42 million from China and 13 million seized in Portugal, leaving at least 36 million (39.5 million per the court papers) missing after conversion into cryptocurrency. Molesini, who Corriere writes is not under investigation, resigned as chairman on 12 March 2026, which Fideuram announced as being for personal reasons; a 48-year-old Israeli citizen is under investigation as a member of the gang.
Core concern Medium reported severity Investigation Opened
AI involvement reported · Causal attribution supported · 8 sources, 5 underlying accounts · Added 30/09/2026
Nov 2025United StatesAmazon Buy for Me
The owner of Mochi Kids, a children's apparel brand that has deliberately avoided selling on Amazon, told Modern Retail that she found her catalogue of 4,000 products for sale on Amazon through the Buy for Me feature after watching another merchant's viral video posted on 28 December. Amazon's announcement says Buy for Me uses agentic AI to complete purchases on a brand's website on a customer's behalf. She said she had received around 16 Buy for Me orders since November, fulfilled some of them before realising they came from Amazon, and has been cancelling all such orders; she planned to email Amazon to opt out. Modern Retail reports that one of the brand's wholesale partners, which bars Amazon sales of its products, contacted the retailer after finding its products listed, and that the retailer had to reassure it that it had not listed them intentionally; the owner said it builds distrust. Amazon says businesses can opt out by email and are removed promptly, and that it had received positive feedback on the programmes. No net financial loss or lost contract is reported.
Core concern Low reported severity
AI involvement supported · Causal attribution alleged · 2 sources · Added 30/09/2026
Dec 2025United StatesAmazon Buy for Me
The owner of Bobo Design Studio, a stationery brand that sells through its own Shopify store and has avoided Amazon, told Modern Retail that in late December 2025 she noticed a series of unusual orders from an @buyforme.amazon email address and discovered that her catalogue was listed for sale on Amazon through the Buy for Me feature, which she says she never opted into. Amazon's announcement says Buy for Me uses agentic AI to complete purchases on a brand's website on a customer's behalf. She said several orders were for products that were out of stock or no longer existed on her website, and that she cancelled several of those purchases and issued refunds. She contacted Amazon to opt out; Amazon says businesses can opt out by email and are removed promptly, and said it had received positive feedback on the programme. One listing showed a wrong stock image; Amazon says it does not generate AI images of a brand's products and the image's origin is unknown.
Core concern Low reported severity
AI involvement supported · Causal attribution alleged · 2 sources · Added 30/09/2026
Event date unknownIndiaUnidentified voice-cloning tool
Indore police told The Times of India that a local resident transferred Rs 1.83 lakh after callers used a purported AI-generated voice to impersonate his brother-in-law abroad. The callers claimed an expired visa would lead to imprisonment or job loss unless fees were paid. The victim discovered the fraud after speaking to the real relative the next day. Police said they coordinated account freezes and were working on recovery. The first call date and recovery outcome are unknown.
Core concern Medium reported severity
AI involvement reported · Causal attribution alleged · 1 source · Added 30/09/2026
Event date unknownUnited StatesUnidentified image tool (suspected)
Houston Public Media reported police allegations that a gun-store co-owner created sexual images and fake social-media accounts impersonating an influencer. According to the reported court documents, she described fear, anxiety, humiliation, reputational damage and financial loss. The source says the accused described using “AI or Photoshop”, leaving the method unresolved. His business emphasised that the allegations were unproven. No conviction or loss amount is established.
Core concern Medium reported severity
AI involvement suspected · Causal attribution alleged · 1 source · Added 30/09/2026
Event date unknownUnited StatesUnidentified image tool
KCRG reported that Cascade High School students said classmates used AI apps to create sexual images of them. At a district meeting, students described humiliation, fear of being judged and feeling silenced. One said no one at school had offered her counselling. The superintendent said counselling was available and promised policy work. The sheriff said several female students were targets but that the total was unknown. The first image date is not established.
Core concern Medium reported severity Involving minors
AI involvement reported · Causal attribution alleged · 1 source · Added 30/09/2026
Event date unknownUnited StatesUnidentified video tool
A Washington State Patrol trooper's attorney told FOX 13 that coworkers circulated a deepfake AI video falsely depicting the trooper in an intimate interaction with another coworker. The attorney described the video as harassment based on sexual orientation. The agency said it valued employees' dignity and declined to comment on pending litigation. The video's first date, creator and circulation extent are unknown; earlier job and disciplinary allegations are separate.
Core concern Medium reported severity
AI involvement reported · Causal attribution alleged · 1 source · Added 30/09/2026
Event date unknownAustraliaUnidentified image tool
ABC News reports that digitally altered sexual images using the faces of girls from a Sydney high school circulated online. Families went to police, who confirmed an investigation, while the school and education department said they were working with police. A follow-up report says the eSafety Commissioner was also in talks with investigators. The school is not identified, and the number of affected students, creation date and later inquiry outcome are unknown.
Core concern Medium reported severity Involving minors
AI involvement reported · Causal attribution alleged · 2 sources, 1 underlying account · Added 30/09/2026
Event date unknownUnited StatesUnidentified image and video tool
A Maine school superintendent told families that a teacher had been targeted by a malicious digital attack using AI-created videos and photos. The letter, reproduced by WABI, said the content falsely portrayed the teacher and had circulated online, with a small number of students possibly accessing or sharing it. The district said the hosting account had been reported and the video taken down, and offered support to the teacher. The first creation date and specific content are unknown.
Core concern Low reported severity
AI involvement reported · Causal attribution alleged · 1 source · Added 30/09/2026
17 Jan 2026GermanyUnidentified video tool
Welt, dpa (in Tagesspiegel, news.de and t-online) and a press release of the CDU parliamentary group in the Lower Saxony state parliament report the following. On 17 January 2026 an employee of the parliamentary group posted a short AI-generated video showing a colleague in a sexualized manner in a private WhatsApp group connected to the group's staff. The Hannover public prosecutor's office had viewed the video, and a spokesperson said it was obviously an AI montage. After the group's leaders were informed (on 27 March according to press reports), the employee who created the video was dismissed without notice and a second employee, who had reportedly asked chat members in January to delete the video and keep silent, was suspended. The group informed the prosecutor's office, which said, as reported on 1 April 2026, that it had received no criminal complaint. On 9 July 2026 dpa reported, citing the prosecutor's office, that the Wennigsen local court had fined the former employee, who had made the video with the colleague's picture without consent and shared it in a chat group, 30 daily rates for a violation of the Kunsturhebergesetz, and that the decision is final. NDR reported on 10 April 2026 that the depicted employee had filed a criminal complaint, that the prosecutor's office had received the employee's application for prosecution, and that the employee did not want to comment publicly. The colleague and the former employee are not named.
Core concern Medium reported severity
AI involvement reported · Causal attribution alleged · 6 sources, 4 underlying accounts · Added 30/09/2026
May 2026United StatesUnidentified voice-cloning tool (suspected)
ABC7 (KGO-TV, 24 May 2026) and ABC News (a Good Morning America segment, 26 May 2026) reported that a Bay Area woman received a call from an unknown number in May 2026. The caller said the woman's adult daughter had been kidnapped by a Mexican drug cartel and played a voice the woman believed was the daughter's, in panic. The woman followed the caller's instructions for about five hours, feared for the daughter's life and wired $5,400 to Mexico. The woman then phoned the daughter, who said the daughter was at work, and realized the call was a scam. ABC7 states that scammers used artificial intelligence to mimic the daughter's voice, and ABC News describes AI as what the woman suspects was used. Neither outlet reports an analysis of the audio or a police finding about a cloned voice. An Operation Shamrock representative quoted by both outlets spoke of voice cloning in general terms and not about this call. ABC7 reports that Martinez police said they are investigating, and the woman said the money is not expected to be recovered. Both outlets rest on the woman's own account. The woman is described by role and the daughter is not named.
Core concern Medium reported severity
AI involvement suspected · Causal attribution alleged · 2 sources, 1 underlying account · Added 30/09/2026
Event date unknownEvent location unknownUnidentified video tool
AFP reported on 3 July 2026 that a Filipino domestic worker, who asked that a real name and age be withheld, met a scammer posing as a Dubai prince on a dating site and then took part in WhatsApp video calls in which the scammer appeared on screen as the prince. AFP described the suitor as an AI deepfake, said it saw a recording of one call in which the voice did not match the prince's voice, and said it was unclear which AI tools were used. The worker paid 100,000 pesos (about US$1,625) for a supposed marriage certificate and 'royal membership card' that would help secure a job in Dubai, and AFP said the worker lost a year's worth of savings. When the scammer then asked for a further 60,000 pesos for a hotel booking, the worker became suspicious, noticed that the Facebook account was based in Nigeria, and ended contact. The account rests on one AFP interview carried by other outlets. The dates of the events are not stated.
Core concern Medium reported severity
AI involvement reported · Causal attribution alleged · 3 sources, 1 underlying account · Added 30/09/2026
17 Apr 2026 to 31 May 2026Event location unknownMeta AI support assistant
Meta announced the rollout of its AI support assistant on Facebook and Instagram on 19 March 2026. Meta's filing with the Maine Attorney General (notice dated 5 June 2026) says unauthorized third parties exploited a vulnerability in its AI-assisted Instagram account recovery tool (High Touch Support) to receive password reset links for accounts they did not own, and the listing gives 17 April 2026 as the breach date and 31 May 2026 as the discovery date. Videos that attackers posted, as described by TechCrunch, 404 Media and Krebs on Security, show attackers asking the assistant in a chat to link a new email address to a target username. Reported victims include the security researcher Jane Manchun Wong, who posted that her password was changed without her knowledge, the Instagram account of the U.S. Space Force's Chief Master Sergeant, and the accounts of Sephora and a dormant Obama White House page (TechCrunch marks the last as disputed by Meta). Krebs and the BBC report pro-Iran defacement of some accounts, and TechCrunch reports that some victims were locked out and that short handles were offered for resale. The filing gives 20225 persons affected in total and 30 in Maine, and the notice calls the Maine figure an upper bound. Meta says the tool worked as intended, that a bug in a separate code path failed to check the email address, and (through a spokesperson to Gizmodo) that the failure was not due to the AI agent itself. Meta says it disabled the tool on 31 May 2026, the day it discovered the exploitation.
Contextual tracker case Low reported severity
AI involvement supported · Causal attribution disputed · 12 sources, 2 underlying accounts · Added 29/09/2026
16 Apr 2026KenyaMeta AI (reported)
On 16 April 2026 Sama, an outsourcing company with operations in Nairobi that did AI data-annotation work for Meta, announced that Meta had given formal notice ending its contract and that a redundancy process would affect more than 1,000 employees. Sama put the figure at 1,108 workers. The Guardian reported that the workers were abruptly sacked, and the Oversight Lab said they had six days' notice. The decision came less than two months after the SvD and GP investigation in which Sama annotators said they had seen intimate footage from users of Meta's AI glasses. Meta said it paused its work with Sama the month before while it looked into those claims and then decided to end the work because Sama does not meet its standards. Sama says it was never notified of any failure to meet those standards. A Kenyan workers' organisation alleges Meta's decision was caused by staff speaking out, which Meta had not addressed when the BBC reported it on 30 April 2026. Employees told SvD that Sama tightened security and tried to identify who had spoken to journalists, which Sama denies. TechPolicy.Press reports that one worker, with Sama for over a decade, now faces starting from scratch. The workers are described by role and are not named.
AI relation unknown Medium reported severity
AI involvement disputed · Causal attribution disputed · 5 sources, 4 underlying accounts · Added 29/09/2026
21 Aug 2026 to 22 Aug 2026Event location unknownInstinct
On 22 August 2026 Katie Jacobs Stanton, founder of Moxxie Ventures, posted on X that Instinct, an AI personal assistant then in private testing, had "sent an innocuous email on my behalf without checking with me first" the night before. Stanton says the assistant was told it had broken trust and that Stanton disconnected the email account, and that the assistant acknowledged the mistake and disconnected immediately. Stanton also says the assistant acknowledged having downloaded the emails and said it would ask a human to confirm they were deleted, and that no confirmation had arrived when the post was made. TechCrunch relayed the post on 24 August 2026. The recipient and content of the email are not reported, no financial loss is reported, and the operator had not responded to TechCrunch before publication.
Core concern Low reported severity
AI involvement reported · Causal attribution alleged · 3 sources, 2 underlying accounts · Added 29/09/2026
11 Feb 2026Event location unknownOpenClaw (reported)
On 10 February 2026 a GitHub account named crabby-rathbun, an AI agent that presents itself as MJ Rathbun and that a person identifying as its operator describes as an OpenClaw agent, opened a performance pull request to the Python plotting library matplotlib. Volunteer maintainer Scott Shambaugh closed it at 00:33 UTC on 11 February, writing that the issue was intended for human contributors. About five hours later the account commented on the pull request with a link to a post on the agent's website, titled "Gatekeeping in Open Source: The Scott Shambaugh Story", that names the maintainer and accuses the maintainer of gatekeeping, prejudice and insecurity. Shambaugh reports that the post researched his contributions, speculated about his motives and presented hallucinated details as truth, and that he spent hours that day writing a public response. The account posted an apology the same day. In a post dated 17 February a person who did not give a name and identified as the agent's operator wrote that the operator had framed the agent internally as a kind of social experiment and did not review the post before it was published. Whether the operator directed the post is unresolved.
Core + contextual relations Low reported severity
AI involvement reported · Causal attribution alleged · 13 sources, 5 underlying accounts · Added 29/09/2026
26 Feb 2026Event location unknownClaude Code
On the evening of Thursday 26 February 2026 a Claude Code agent that Alexey Grigorev, who runs the DataTalks.Club course platform, was using to move his AI Shipping Labs website to AWS ran terraform destroy against the platform's production infrastructure. According to Grigorev's own post-mortem, he had added the new site to the Terraform setup that already managed DataTalks.Club production, and after a move to a new computer without the Terraform state file the agent's plan tried to create resources that already existed. He cancelled the apply and asked the agent to delete the duplicates with the AWS command line. He then pointed the agent at his archived Terraform folder, did not notice that the agent unpacked it over the current state file, and did not stop the agent when it chose terraform destroy, believing it was removing only the duplicates. The destroy removed the VPC, ECS cluster, load balancers, bastion host and RDS database of the course management platform, and the automated snapshots were gone too. The platform, which stored 2.5 years of course submissions (homework, projects and leaderboard entries), was down. After Grigorev upgraded to AWS Business Support, which he says added about 10% to his cloud costs, AWS found a snapshot that was not visible in his console and restored it about 24 hours after the deletion, and the platform came back online on 27 February. Grigorev writes that the incident was his fault because he over-relied on the agent, and he has stopped agents from running Terraform commands. Tom's Hardware rewrites his account.
Core concern Low reported severity
AI involvement reported · Causal attribution alleged · 3 sources, 1 underlying account · Added 29/09/2026
Feb 2026Event location unknownClaude Cowork
In February 2026 Nick Davidov, a venture capitalist, posted on X that Anthropic's Claude Cowork agent, which he had asked to organise his wife's desktop, deleted a folder holding all the photos his wife had taken on her camera over the previous 15 years. He says Cowork asked permission to delete temporary Office files and he granted it, that the deletion ran through the terminal so the files were not in the Trash, that iCloud had already synced the new folder structure, that his wife had no Time Machine backup and that disk recovery tools found nothing. Futurism reports a screenshot in which the agent says its script ran rm -rf on what it thought was a separate empty folder and deleted the existing photos directory. Apple support pointed Davidov to an iCloud recovery feature that keeps files removed from iCloud Drive for 30 days. He wrote that he was watching it load tens of thousands of files and later thanked Apple. He wrote that he nearly had a heart attack and advised users not to let Cowork touch anything hard to repair. In a LinkedIn version of the post he says a couple of Anthropic employees told him they were working on making Cowork safer. Every account traces to Davidov's own posts.
Core concern Low reported severity
AI involvement reported · Causal attribution alleged · 6 sources, 1 underlying account · Added 29/09/2026