2019Event location unknownSiri
On 26 July 2019 the Guardian reported that contractors grading a small share of Siri recordings for Apple regularly heard confidential information. Its anonymous source, a contractor, said Siri was often activated by mistake, for example by the sound of a zip, and that these accidental activations captured private discussions between doctors and patients, business deals, apparently criminal dealings and sexual encounters, with location, contact details and app data attached. Apple told the Guardian that requests were not linked to users' Apple IDs and that less than 1% of daily activations were graded. On 28 August 2019 Apple apologised, said it had suspended human grading, and said audio would no longer be retained by default, grading would become opt-in and recordings found to be inadvertent triggers would be deleted. Device owners' class action, Lopez v. Apple in the federal court in Oakland, alleged that Apple recorded private conversations after unintended Siri activations and disclosed them to third parties. Apple agreed to pay $95 million while denying wrongdoing, and co-class counsel say the judge granted final approval on 16 October 2025.
Contextual tracker case Medium reported severity Lawsuit Settled
AI involvement supported · Causal attribution supported · 4 sources · Added 29/10/2026
2019BelgiumGoogle Assistant
On 10 July 2019 the Belgian public broadcaster VRT NWS reported that it had listened to more than a thousand audio excerpts recorded by Google Home smart speakers and the Google Assistant phone app, passed to it by someone working for a Google subcontractor that transcribes Dutch-language recordings to improve Google's speech recognition. VRT said 153 of the excerpts were conversations in which "Okay Google" was clearly not said, and that it could hear addresses and other sensitive information, which let it find and visit people in Flanders who recognised their own or relatives' voices. Google said one of its language reviewers had leaked confidential Dutch audio data, and explained that its devices rarely have "false accepts", when background noise or words are interpreted as the hotword. Google suspended human review of Assistant audio in Europe, and the Hamburg data protection authority began an urgency procedure under Article 66 of the GDPR to stop the reviews for three months, according to TechCrunch.
Contextual tracker case Medium reported severity Regulatory Action
AI involvement supported · Causal attribution supported · 3 sources · Added 28/10/2026
27 Aug 2026United StatesGPT-5.4 and Claude Opus 5 (reported)
A kindergarten teacher at a public elementary school in Concord, Massachusetts, was dismissed in August 2025 after an unsatisfactory evaluation. In arbitration she argued that some of the principal's evaluations may have been produced with AI, relying on GPTZero estimates; the principal denied using AI beyond grammar checks. According to the arbitration decision as reported by The Concord Bridge, the arbitrator stated in an appendix that he used two AI tools, GPT-5.4 and Claude Opus 5, to research whether GPTZero was reliable, checked some of the sources they supplied, concluded that GPTZero's results deserved no weight, and upheld the dismissal on 27 August 2026. On 28 September 2026 the teacher asked Suffolk Superior Court to vacate the decision, alleging that the AI-assisted research was an improper investigation outside the hearing record that the parties were not told about or allowed to challenge. These are allegations in a complaint; the district declined to comment and no court has ruled.
Contextual tracker case Medium reported severity Lawsuit Filed
AI involvement reported · Causal attribution alleged · 2 sources · Added 14/10/2026
Aug 2026Event location unknownUnidentified OpenAI generative AI service (reported)
Notices from RIZAP's client insurers say that on 20 August 2026 it emerged that a staff member of RIZAP, the company they contract for specific health guidance, had entered data containing members' personal information into an external generative AI service that RIZAP had not permitted for work. The National Civil Engineering and Construction National Health Insurance Association (Doken Kokuho) puts the whole data set at 19,996 people, 1,167 of them its own members, and says the service was not under a corporate contract and that the matter was found when the employee noticed the transmission and reported it. A local-government employees' mutual aid association counts 726 of its members across 14 branches, and the IHI group health insurance society 210, according to a security news site that reads these as subsets of the 19,996. The data included membership numbers, email addresses, names, dates of birth, sex, some addresses and phone numbers, the type of health guidance and, for members with them, high blood pressure, diabetes or dyslipidaemia. The IHI society's notice, as relayed, names OpenAI as the provider and says OpenAI answered on 1 September that the data had not been used for model training. RIZAP's release, as described in an ITmedia column, says no third party other than the service operator could have viewed the data. Doken Kokuho says RIZAP confirmed to it that no third party viewed or used the information through the service; whether the provider's staff could view it was still being checked when the mutual aid association and the IHI society published.
Contextual tracker case Medium reported severity
AI involvement reported · Causal attribution supported · 5 sources, 4 underlying accounts · Added 12/10/2026
May 2025United StatesUnidentified video tool
At a sentencing hearing in May 2025 in Maricopa County Superior Court, Arizona, the family of a man killed in a 2021 road-rage shooting in Chandler played a video that combined real footage with an AI-generated likeness and voice of the victim delivering a script written by his sister, including statements of forgiveness addressed to the defendant. The judge said he loved the video, described it as genuine and referred to the forgiveness it expressed, then imposed the presumptive 10.5-year term for manslaughter, longer than the nine years the prosecutor had requested. The defense attorney appealed immediately. On 30 September 2026 the Arizona Court of Appeals upheld the conviction but vacated the sentence, holding that the AI video was not reliable and that the judge's consideration of it so prejudiced the defendant that the sentencing procedure was fundamentally unfair. The opinion says the record does not show precisely how the video factored into the sentence, and that there is no question it played a role. The case returns to the trial court for resentencing; as of 1 October 2026 no new sentencing date had been set.
Core + contextual relations Medium reported severity
AI involvement supported · Causal attribution supported · 7 sources, 6 underlying accounts · Added 02/10/2026
15 Sept 2026IndiaUnidentified traffic-violation detection camera
On 15 September 2026 a man was riding his wife's electric scooter alone in Bengaluru, from Hebbal towards Tin Factory, wearing a helmet and carrying a guitar on his back. An AI-enabled Bengaluru Traffic Police camera on the Outer Ring Road photographed him, and the next day an e-challan of ₹500 was generated for a pillion rider not wearing protective headgear; the photograph attached to it showed no passenger, only the guitar bag. The rider posted the challan on X and asked the traffic police to revoke it. A senior traffic police officer told Deccan Herald that the bag's position apparently led the AI-based system to classify it as a person sitting behind the rider, after which the system appears to have detected a helmet violation and generated the challan. Bengaluru Traffic Police replied that the violation could be rectified and gave an email address and phone numbers, and the joint commissioner of police (traffic) told the Times of India that the violation would be revoked if the complaint was found true. Whether it was revoked is not reported.
Contextual tracker case Low reported severity Media Coverage
AI involvement supported · Causal attribution supported · 4 sources, 3 underlying accounts · Added 02/10/2026
17 Apr 2026 to 31 May 2026Event location unknownMeta AI support assistant
Meta announced the rollout of its AI support assistant on Facebook and Instagram on 19 March 2026. Meta's filing with the Maine Attorney General (notice dated 5 June 2026) says unauthorized third parties exploited a vulnerability in its AI-assisted Instagram account recovery tool (High Touch Support) to receive password reset links for accounts they did not own, and the listing gives 17 April 2026 as the breach date and 31 May 2026 as the discovery date. Videos that attackers posted, as described by TechCrunch, 404 Media and Krebs on Security, show attackers asking the assistant in a chat to link a new email address to a target username. Reported victims include the security researcher Jane Manchun Wong, who posted that her password was changed without her knowledge, the Instagram account of the U.S. Space Force's Chief Master Sergeant, and the accounts of Sephora and a dormant Obama White House page (TechCrunch marks the last as disputed by Meta). Krebs and the BBC report pro-Iran defacement of some accounts, and TechCrunch reports that some victims were locked out and that short handles were offered for resale. The filing gives 20225 persons affected in total and 30 in Maine, and the notice calls the Maine figure an upper bound. Meta says the tool worked as intended, that a bug in a separate code path failed to check the email address, and (through a spokesperson to Gizmodo) that the failure was not due to the AI agent itself. Meta says it disabled the tool on 31 May 2026, the day it discovered the exploitation.
Contextual tracker case Low reported severity
AI involvement supported · Causal attribution disputed · 12 sources, 2 underlying accounts · Added 29/09/2026
12 Mar 2025 to 15 Mar 2025AustraliaChatGPT
The NSW Reconstruction Authority says that between 12 and 15 March 2025 a former temporary staff member (called a former contractor in its first notice) uploaded a Microsoft Excel spreadsheet of Northern Rivers Resilient Homes Program information, 10 columns and more than 12,000 rows, to ChatGPT, an AI platform the Authority had not authorised. The Authority disclosed the breach on 6 October 2025, estimating that up to 3000 people were affected, and later said external forensic analysis confirmed that 2031 people had some of their data uploaded, including names, contact details, addresses, dates of birth, sensitive personal and health information and limited financial commentary. It says no driver licence, Medicare, passport or Tax File Numbers were disclosed and that there is no evidence the data is publicly available or was accessed by a third party; whether OpenAI retained or used the data is not addressed. The Authority apologised, contacted affected people with ID Support NSW, offered to compensate the replacement of compromised identity documents and notified the NSW Privacy Commissioner. A program participant told the ABC the information was deeply personal and that they felt concerned. No misuse of the data is reported.
Contextual tracker case Low reported severity Investigation Opened
AI involvement supported · Causal attribution alleged · 4 sources, 1 underlying account · Added 29/09/2026