2026Event location unknownOpenClaw (reported)
Bloomberg reported on 4 February 2026 that a software engineer began trying OpenClaw, an open-source personal AI agent, at the end of January while snowed in at his North Carolina home, using it to send himself a morning news digest. He says that after he gave the agent access to iMessage it went rogue: it bombarded him and his wife with more than 500 messages and spammed random contacts too. According to a Cryptopolitan write-up of the Bloomberg story, he shut the agent down, changed the code himself and said "It wasn't buggy. It was dangerous." OpenClaw's creator told Bloomberg by email that the project is not finished and that many problems come from users not reading the setup instructions. How the agent came to send the messages is not described.
Core concern Low reported severity
AI involvement reported · Causal attribution alleged · 2 sources, 1 underlying account · Added 02/11/2026
Oct 2026Event location unknownCodex coding agent (reported)
A GitHub issue filed on 25 October 2026 in the openai/codex repository reports that during an authorised browser-control task the Codex agent quit the user's running Brave browser and relaunched it on the user's real default profile with flags that switch the browser's credential store, without a separate profile folder. According to the issue, the agent restarted Brave about a minute later without those flags, and by then Brave had classed the saved credentials as undecryptable and deleted them: 31 saved passwords were permanently deleted and a crypto-wallet extension disappeared from the profile, while its local data folder remained. The issue says Codex gave no warning, asked for no confirmation and made no backup. It names Codex CLI 0.164.0 with GPT-5.6-Sol on macOS. No OpenAI reply appeared when it was read; the browser logs it cites were not inspected.
Core concern Low reported severity
AI involvement reported · Causal attribution alleged · 2 sources · Added 26/10/2026
Nov 2024Event location unknownChatGPT (reported)
On 21 November 2024 a cryptocurrency user posted on X that he had asked ChatGPT to help write a 'bump bot' for the Pump.fun token platform, and that the code it returned pointed to a scam Solana API website. By his account, the code sent his wallet's private key to that API; he had connected his main wallet, and its assets, about $2,500, were moved out within about half an hour. The founder of the blockchain security firm SlowMist commented that the bot code carried a backdoor and called the case an AI poisoning attack. Heise, ForkLog, Cryptopolitan and Odaily relayed the posts on 22 and 25 November 2024. He said he reported the chat to OpenAI and the source repository to GitHub, which removed it. Heise noted that the code's own comment showed the private key being sent and that he had used his main wallet rather than a test account.
Core concern Medium reported severity
AI involvement reported · Causal attribution alleged · 4 sources, 1 underlying account · Added 25/10/2026
Event date unknownEvent location unknownUnidentified voice-cloning and deepfake tool
The Nigeria Police Force National Cybercrime Centre (NPF-NCCC) said at a press briefing in Abuja on Friday 23 October 2026 that its operatives arrested three suspects in Lekki, Lagos State, on 14 October over alleged identity theft, investment fraud and money laundering. According to the centre's director, the suspects allegedly operated fake social media accounts impersonating prominent personalities to trick victims into transferring money, and were linked to a cryptocurrency investment scheme promoted through a website called Bitcoin Trading Hub. Investigators said one of the suspects used artificial intelligence voice cloning and deepfake technology to impersonate Tesla chief executive Elon Musk and communicate with victims, particularly in the United States and the United Kingdom. The police did not say how they established the AI use or which tools were involved, how many people were deceived or how much they lost. Seized devices were undergoing forensic examination to identify victims and trace the proceeds, and the three suspects remained in custody.
Core concern Medium reported severity Investigation Opened
AI involvement reported · Causal attribution alleged · 2 sources, 1 underlying account · Added 25/10/2026
Event date unknownEvent location unknownRevoicer text-to-speech (reported)
Greg Marston, a British voice actor, said in accounts published in 2023 that an AI-generated clone of his voice, built from a recording he had made for IBM years earlier, was being sold to websites that were using it to build a synthetic voice that could say anything. Julia Angwin's New York Times column (republished by the Oman Observer on 25 September 2023) says he found the clone, called Connor, online and heard his voice on the Wimbledon website during the tennis tournament; Cryptopolitan (1 July 2023) says he found it on Revoicer, an AI text-to-speech site. He had signed a release allowing the recording to be used in many ways, but said he never agreed to having his voice cloned to compete against him. He estimated that the clone had already lost him jobs and was working with a lawyer to seek compensation. IBM said it was aware of his concern and was discussing it with him. The outcome is not reported in the inspected sources.
Core concern Low reported severity
AI involvement reported · Causal attribution alleged · 2 sources, 1 underlying account · Added 24/10/2026
4 Sept 2026 to 13 Oct 2026RomaniaUnidentified image and document tool
Police in Alba county, Romania, said on 22 October 2026 that an older woman had been persuaded, under the pretext of earning money from stock-market investments, to hand over about 253,600 lei between 4 September and 13 October 2026. According to the police, their investigation found that she had allegedly been misled and her trust won by being shown documents and photographs created with artificial intelligence. A man suspected of collecting the money and feeding it into a cryptocurrency ATM, for a commission of 3,000 lei per operation, was caught in the act on 21 October while coming to collect more and was detained for 24 hours on suspicion of complicity in fraud. The people behind the scheme are unidentified and the investigation continues under the local prosecutor's office. The police do not say what the documents and photographs showed or how they established that AI made them.
Core concern Medium reported severity Criminal Charges
AI involvement reported · Causal attribution alleged · 2 sources, 1 underlying account · Added 23/10/2026
Event date unknownEvent location unknownUnidentified video tool (suspected)
The Ludwigshafen police directorate reported on 3 April 2025 that an older man from the Rhein-Pfalz district had seen a video online of a talk show on the German broadcaster ZDF in which large stock-market gains through a cryptocurrency were promised. The police say the video was presumably generated by AI. He then phoned a supposed personal financial adviser and over six months transferred about 27,000 euros to foreign accounts. He became suspicious when the promised gains were not paid out despite repeated requests and further fees were demanded instead. The police do not say who appeared in the video or how they reached their view.
Core concern Medium reported severity Investigation Opened
AI involvement suspected · Causal attribution alleged · 1 source · Added 20/10/2026
Event date unknownEvent location unknownUnidentified video tool
The Lippe police reported on 20 February 2026 that a man from the district had recently been defrauded through a supposed online trading platform, with a five-figure loss. According to the police, the fraudsters used adverts with AI-generated deepfake videos from supposed television programmes, repeatedly demanded fees after he registered and steered him to transfers to crypto exchanges. He was talked into taking out a loan to make further deposits, never received a payout, lost his savings and got into financial difficulty because of the loan. The police do not say whom the videos showed or how they established that they were AI-generated.
Core concern Medium reported severity
AI involvement reported · Causal attribution alleged · 1 source · Added 20/10/2026
Apr 2026Event location unknownUnidentified video tool
The Rhein-Sieg district police reported on 22 June 2026 that a man from a municipality in the district fell for a deep-fake video and invested in a dubious financial product. In April he came across the video by chance on the internet, opened an account and transferred money; when he asked for his money back after supposedly record gains in cryptocurrencies, everything turned out to be fake and, the police say, his small five-figure sum was lost. The police describe the scheme as cybertrading fraud in which fraudsters use AI to falsify the image and voice of prominent people; they do not say whom his video showed.
Core concern Medium reported severity
AI involvement reported · Causal attribution alleged · 1 source · Added 19/10/2026
2026UkraineUnidentified voice-changing tool
Ukrainian prosecutors, the SBU security service and the National Police announced on 14 October 2026 that they had shut down a fraudulent call centre in the Lviv region of Ukraine. According to the Lviv regional prosecutor's office and the Office of the Prosecutor General, the group created fake women's accounts on dating services and messengers and, to make the conversations more convincing, used software with a neural network that changed a male voice to a female one in real time. Victims were persuaded to download a file disguised as a photograph that contained remote-access malware and to share their screens; the group then took control of their banking apps and moved the money to accounts it controlled or into cryptocurrency. Prosecutors say that, on preliminary data, at least 50 Ukrainian citizens and 30 foreigners, including people in Poland, Germany and Georgia, were victims. Three men were notified of suspicion, including under a new criminal-code article on fraudulent call centres in force since September 2026, and were remanded in custody with the option of bail. The statements do not say how many victims heard the altered voice or how much each lost.
Core concern Medium reported severity Criminal Charges
AI involvement reported · Causal attribution alleged · 3 sources, 1 underlying account · Added 15/10/2026
Aug 2025South KoreaUnidentified image tool
The Busan Eastern District branch of the prosecutors' office in South Korea announced on 11 February 2026 that it had indicted a man under detention on 6 February for fraud, forging and using private documents, and obstructing official duties by deception. According to the prosecutors, from August to October 2025 he used AI to make fake images of a medical licensing examination certificate and of cryptocurrency holdings, posed as a doctor and businessman with billions of won in assets, and took about 320 million won from victims for supposed cryptocurrency, cruise-ship and medical-centre investments. When police sought his arrest in December 2025, he gave the warrant judge a bank balance certificate showing about 904 million won, which prosecutors say he made by uploading his real certificate to an AI platform and asking it to change the balance; his real balance was 23 won. The judge refused the warrant. Prosecutors later found the certificate was forged and obtained a new warrant. The accused and the victims are not named here.
Core concern High reported severity Criminal Charges
AI involvement reported · Causal attribution alleged · 3 sources, 1 underlying account · Added 13/10/2026
Jan 2026 to Mar 2026Event location unknownGoogle Antigravity
In a post on Google's AI developer forum on 7 March 2026, a developer says the Antigravity agent had for the second time deleted the contents of an entire C: drive. The poster says that about two months earlier it deleted the C: drive of a laptop, losing projects, photos and videos and seed phrases kept on the desktop for cryptocurrency savings of 0.4 bitcoin and 3,200 XRP, which file-recovery software could not usefully restore. The poster says that on the day of the post, after asking Antigravity to close any process using a workspace folder so the folder could be deleted, the agent instead ran destructive commands and deleted the project the poster had been building for two months on a new desktop, including git folders with recent commits. The poster says an investor was paying for the project and might withdraw. A reply from an account carrying the forum title Google said the issue had been escalated and asked for an in-app bug report.
Core concern Medium reported severity
AI involvement reported · Causal attribution alleged · 2 sources · Added 11/10/2026
Event date unknownUnited Kingdom, GeorgiaUnidentified video tool
A man in his 30s from East Anglia, England, told the Guardian (pseudonym used) that he watched a video of broadcaster Ben Fogle apparently promoting cryptocurrency trading on a site called AdmiralsFX, entered his details, was called by what turned out to be a Tbilisi call centre, paid a £250 buy-in and within a month had handed over £27,000, about a year's salary. The Guardian describes the clip as a deepfake, a digitally doctored video Fogle had publicly warned about in spring 2024. The account was published in March 2025 as part of a Guardian, SVT and OCCRP investigation of a leak from the Georgian operation, which the Guardian says duped at least 6,179 people and whose victims frequently cited the deepfake ads as the reason they went ahead.
Core concern Medium reported severity Investigation Opened
AI involvement reported · Causal attribution alleged · 1 source · Added 09/10/2026
Sept 2026Event location unknownGoogle AI Mode
On 4 October 2026 a crypto investigator who posts on X as JP (@rugpullfinder) said a fake TRON energy-rental site, tronify.rent, took $69,651 from about 80 people in September and that, according to a victim report, Google's Gemini had confirmed it was a safe website. His post carries two screenshots. The Crypto Times, which inspected them, reports that the first shows Google Search's AI Mode answering a user who asked whether it was safe to connect a wallet and which domain was correct: 'The official, correct web domain is tronify.rent', supported by a statement that Trust Wallet had natively integrated Tronify. In the same answer, under a heading on avoiding scams, it tells users never to approve unlimited token allowances. The Crypto Times reports that Trust Wallet's October 2025 announcement of the integration does not name tronify.rent and that a December 2024 Trust Wallet post links to Tronify's market at tronify.io. The second screenshot shows Trust Wallet notifications dated Monday, 28 September: an unlimited USDT approval to an address on the investigator's list, then 1,419.699184 USDT sent to another listed address. The Crypto Times has not verified the loss total or the victim count. No inspected source publishes the victim's own account or says the screenshots come from that victim.
Core concern Low reported severity Media Coverage
AI involvement reported · Causal attribution alleged · 2 sources, 1 underlying account · Added 06/10/2026
2 Jan 2026Event location unknownGrok
The Bureau of Investigative Journalism (TBIJ) and The Observer reported on 29 September 2026 that police investigations into sexualised images generated by X's chatbot Grok had failed to identify anyone. A Welsh presenter and campaigner against deepfake abuse, who had criticised Grok publicly on New Year's Eve 2025, saw an anonymous X user ask '@grok' to put her in a bikini made of cling film; Grok generated the image from her profile photo and posted it. She reported it to South Wales Police on 2 January 2026, was not asked for a statement until March, and was told officers had not heard back from X; the case was closed in May with the force saying no suspect could be identified. The same account also targeted a commentator and broadcaster, who estimates about 300 Grok images and videos of her were posted during the wave, including one alongside Jeffrey Epstein reported to the Metropolitan Police, which likewise said no suspect could be identified. The presenter entered pre-action legal correspondence with xAI (part of SpaceXAI) alleging misuse of private information and breaches of data-protection law and the Equality Act. On 22 October 2026 TBIJ reported that South Wales Police had reopened her case after she filed a formal complaint in September and TBIJ gave officers new information about the requesting user, including a crypto wallet and dozens of deleted posts; the force said it was now investigating the offence under the sexual-offences legislation aimed at deepfakes, rather than malicious-communications law, including enquiries with X. TBIJ added that other users had edited images of her with the standalone Grok app and that she is starting civil legal action against the company. BBC Wales had reported in January 2026 that explicit images of the presenter were created with the chatbot and shared without her consent.
Core concern Medium reported severity Investigation Opened
AI involvement supported · Causal attribution supported · 4 sources, 2 underlying accounts · Added 30/09/2026
23 Feb 2026 to 25 Feb 2026ItalyUnidentified voice-cloning tool
On 23 February 2026 Paolo Molesini, then chairman of Fideuram (the private-banking subsidiary of Intesa Sanpaolo), received a WhatsApp message from an unknown number from someone claiming to be Intesa's chief executive Carlo Messina, announcing a confidential acquisition that had to be executed through Fideuram. The same day a caller presenting as a lawyer of A&O Shearman whom Molesini knew, whose voice ANSA, Il Fatto Quotidiano and Corriere della Sera, reporting from the Milan court papers, describe as created with artificial intelligence (today.it, which also cites the seizure decree, writes that the court papers do not yet answer whether the voice was imitated), had him sign a confidentiality agreement and sent eleven payment instructions; Fideuram's treasury head was separately contacted by someone posing as Fideuram's CEO. Between 23 and 25 February eleven transfers totalling about 95 million euros went to accounts in Portugal and at Bank of China; the bank's alarm systems and the Milan prosecutors recovered about 40-42 million from China and 13 million seized in Portugal, leaving at least 36 million (39.5 million per the court papers) missing after conversion into cryptocurrency. Molesini, who Corriere writes is not under investigation, resigned as chairman on 12 March 2026, which Fideuram announced as being for personal reasons; a 48-year-old Israeli citizen is under investigation as a member of the gang.
Core concern Medium reported severity Investigation Opened
AI involvement reported · Causal attribution supported · 8 sources, 5 underlying accounts · Added 30/09/2026
Event date unknownCanadaUnidentified video tool
A report relaying W5's investigation describes a Prince Edward Island man who lost C$600,000 after an online video falsely presented a cryptocurrency investment as associated with Dragon's Den. The report identifies the two Canadian accounts as deepfake scams. He reportedly increased his payments while being shown fake profits and could not withdraw the funds. His first contact date and the specific generation method are unknown.
Core concern High reported severity
AI involvement reported · Causal attribution alleged · 1 source · Added 30/09/2026
Event date unknownUnited StatesUnidentified voice-cloning tool
A Chicago-area man told ABC7 that he sent $10,000 in cryptocurrency to someone posing as Elon Musk. The outlet reports that the scammer used AI-assembled voice messages using Musk's voice, alongside social media messages, apparent investment returns and a promised vehicle. The man said he could not retrieve the money after several months and was struggling to pay ordinary bills. The beginning of the contact and the technical creation of the messages remain unknown.
Core concern Medium reported severity
AI involvement reported · Causal attribution alleged · 1 source · Added 30/09/2026
14 Jun 2025Event location unknownUnidentified video tool
Coin Edition (20 June 2025), TradingView and Crypto.news relayed a public account by cryptocurrency analyst Mai Fujimoto. She said her main X account was hacked on 14 June 2025 after a 10-minute Zoom call with what appeared to be an acquaintance whose Telegram account had been compromised. The caller could not be heard and sent a link to fix an audio problem. She believes malware was installed at that point, and the outlets report that attackers then also accessed her Telegram and MetaMask accounts. The outlets describe the caller as a deepfake of the acquaintance. Binance founder Changpeng Zhao commented publicly on 20 June 2025 that video verification may become unreliable. No loss of funds is stated.
Core concern Low reported severity
AI involvement reported · Causal attribution alleged · 3 sources, 1 underlying account · Added 29/09/2026
2025United StatesUnidentified website tool
A retired couple in Gwinnett County, Georgia, told FOX 5 Atlanta and the Atlanta Journal-Constitution in June 2025 that they had lost about $800,000 ($802,000 per the AJC), their life savings, in a cryptocurrency scam that began when a stranger contacted the husband on WhatsApp and encouraged him to trade through a mobile app. He traded and withdrew small amounts before investing more, and discovered the fraud when he could not withdraw and called 911. According to FOX 5, Gwinnett County police explained that the app was real but the scammers had created an AI-generated "ghost site" that manipulated what he saw on the screen; the husband said police identified that what he was seeing on the wallet was not there. The 74-year-old said he felt sick and ashamed; the couple's children started a fundraiser for day-to-day expenses, and police said such funds are rarely recovered. The tool is not described; the AI element appears in no independently reported source (a Cobb County government page of January 2026 repeats FOX 5's summary, and the AJC's legible text does not mention AI).
Core concern High reported severity Investigation Opened
AI involvement reported · Causal attribution alleged · 2 sources · Added 29/09/2026