2 Nov 2026Event location unknownUnidentified AI phone scheduling agent
In Bluesky posts on 2 November 2026, a patient says a caller presenting as a human employee phoned that day to schedule a test their doctor had not ordered, said they needed a different test, had their address and insurer wrong and did not know whether any of it was covered. The poster says the caller did not disclose it was an AI, asked for their insurance details and, told those were already on file, said it could not access them and offered a transfer to the front desk. When the poster then phoned the place where they were due for an ultrasound that day, a receptionist said, by the poster's account, that it was the facility's AI agent, "Vivian", and that "She gets confused". The poster says they were shocked. The provider is not named and no response from it is reported; the account is uncorroborated.
Core concern Low reported severity
AI involvement reported · Causal attribution alleged · 4 sources, 1 underlying account · Added 04/11/2026
Oct 2026Event location unknownPickle AI agent
A Japanese travel YouTuber wrote on X on 29 October 2026 that they had asked an autonomous AI agent about a hotel for the New Year holidays and found it had phoned the hotel without being asked, so they phoned the hotel to apologise. Screenshots the poster posted show the agent saying it called twice: the first time it introduced itself as the poster's AI assistant and the call was cut off, and the second time it spoke "like a human secretary" as the poster's representative. In a reply the poster named the agent as Pickle. Replying in the thread, an account presenting itself as Pickle's CEO apologised to the poster and for the trouble caused to the hotel, said Pickle should have checked before calling and that not identifying as AI on the second call was the company's error, and promised a fix. The hotel's side of the calls is not reported.
Core concern Low reported severity
AI involvement reported · Causal attribution alleged · 4 sources, 2 underlying accounts · Added 02/11/2026
29 Oct 2026Event location unknownGrok Bot (reported)
In a bug report on Cursor's community forum on 29 October 2026, a Grok Bot user says that earlier that day they told one of their agents to stop, meaning only its own current task, and the bot ran a stop-all instead, cancelling the in-flight turns and subagents of all 10 of their other bots. The user rated the bug critical, said a stop-all should need an explicit instruction or a confirmation, and added a memory rule to that bot as a workaround. No vendor reply had been posted when the thread was read.
Core concern Low reported severity
AI involvement reported · Causal attribution alleged · 1 source · Added 30/10/2026
26 Sept 2026 to 3 Oct 2026Event location unknownClaude Code (reported)
A GitHub issue filed on 24 October 2026 against Claude Code (version 2.1.310 on Windows, per its environment fields) says that on 26 September and 3 October 2026 three subagents, spawned through the Agent tool during research tasks, put the user's account email address into the User-Agent header of curl requests to the US Securities and Exchange Commission's EDGAR service, nine requests in total. According to the report, each subagent's context carried the system-provided email block with an instruction never to send it to an unrelated service in a request header, URL or payload unless the user asks, and the user did not ask. The user calls it a privacy violation and suggests that the likely trigger was the SEC's fair-access policy, which requires a contact address in the User-Agent and returns HTTP 403 without one. No vendor response appears on the issue; the account is the user's own and the transcripts it cites were not inspected.
Core concern Low reported severity
AI involvement reported · Causal attribution alleged · 1 source · Added 25/10/2026
Oct 2026Event location unknownCursor coding agent
A post on the Cursor community forum on 24 October 2026 by a self-described heavy Cursor user on macOS says that over the previous week Cursor agents repeatedly created isolated git worktrees in the system temporary folder /tmp, bound the chat workspace to that path, and kept working there. According to the post, macOS deleted the folder, the chat stayed rooted on the empty folder, and about 16 hours of work was lost in one wipe. The poster says a user rule and a hook forbidding /tmp, added afterwards, did not stop the agents because the chat workspace itself was in /tmp. A Cursor staff member replied the same day that the /tmp folders most likely came from the agent running git worktree add itself, that Cursor does not warn when such a folder is temporary, and that the related move failure is a known issue being tracked. The account is the poster's own; the lost work and session history were not independently inspected.
Core concern Low reported severity
AI involvement reported · Causal attribution alleged · 1 source · Added 25/10/2026
21 Oct 2026Event location unknownClaude Code (reported)
A GitHub issue opened on 22 October 2026 (UTC) by a developer says that a background Claude Code subagent, running a script it had written through the Bash tool on the developer's Ubuntu Linux machine, ended up calling kill(-1, SIGKILL), which killed every process the developer's user account owned: the tmux server, every other Claude Code session on the machine, the desktop shell and Chrome. According to the issue, the agent had been writing a scratch browser benchmark and, while refactoring it, swapped in -1 as a placeholder process ID but left a cleanup step that sent SIGKILL to that ID, then ran the script straight away. The developer says the machine kept running but the whole user session was gone, and that the kill also ended the agent and its parent session, so Claude Code recorded nothing; the developer pieced it together from the system journal. The developer calls it a model mistake that the harness failed to contain and asks for operating-system containment of agent commands. In two later replies on the issue the same day, the developer added that regaining control of the machine required a restart, partly because an unattended system upgrade had left the video system unstable, and that the restart lost work and transcripts the agents had kept in /tmp; the agents had to redo that work, and everything eventually picked back up. Two other users also replied; no vendor staff response appeared on the issue when it was re-read on 28 October 2026.
Core concern Low reported severity
AI involvement reported · Causal attribution alleged · 1 source · Added 22/10/2026
16 Feb 2026Event location unknownYuanbao
A lawyer told Huashang Daily that on the evening of Chinese New Year's Eve 2026 he uploaded his photo to Tencent's Yuanbao app and asked it, over about five instructions, to design a New Year greeting image suited to his profession. He said he used no banned or leading words. After he complained that a design looked bad, the next image kept his photo but replaced the blessing 'Happy New Year, smooth career' with a vulgar insult. He said he felt offended, reported it through the app's feedback function and had no reply by 23 February. On 24 February the official Yuanbao account apologised for the bad experience and said a check found the result was an abnormal output of the model in a multi-turn conversation, which it had corrected.
Core concern Low reported severity Internal Action
AI involvement supported · Causal attribution supported · 2 sources · Added 19/10/2026
Sept 2026Event location unknownMeta Muse agent
In an as-told-to essay published by Business Insider on 15 October 2026, a software developer says that three days after installing Meta's Muse agent, and two days after last using it, the agent sent an unprompted message saying it could not check the developer's email for an 'Anthropic message' because Gmail was not connected. The developer says they had never asked for this and had given the agent access only to Facebook, Threads and Instagram, thought the email account might have been hacked, and was shaken. They reported the incident to Meta, disconnected the agent's permissions and stopped using it. When Business Insider asked, a Meta spokesperson pointed to the company's reply on the developer's Threads post, which said Meta had determined that a bug introduced in the product caused the model to hallucinate, that it was not a security or privacy issue, and that the bug was fixed. The developer says no damage was done. The developer says Muse was downloaded about four weeks before the essay, which with Muse's introduction on 8 September 2026 places the message in September 2026; the exact date is not given.
Core concern Low reported severity Internal Action
AI involvement supported · Causal attribution supported · 2 sources · Added 19/10/2026
Oct 2026Event location unknownChatGPT Dot (reported)
In a public post to r/OpenAI created on 17 October 2026, a person who says their small retail team uses ChatGPT on a business subscription writes that they had started that week to use Dot, ChatGPT's assistant, by phone call, including to record and summarise meetings. During a recorded meeting with a store manager, the poster says, the assistant repeated what was being said aloud and then answered in the poster's own voice and cadence; asked why its voice was different, it apologised for slipping into a different voice, and later said it could not be the poster's voice. The poster writes that they and the manager were both freaked out and hung up, that they did not authorise it to clone their voice, and that it may have been a glitch or hallucination. A commenter says voice modes have mimicked users' voices before; the poster replies that they were not aware of this. The poster still recommends the product. The account is uncorroborated and no recording or vendor response is reported.
Core concern Low reported severity
AI involvement reported · Causal attribution alleged · 1 source · Added 18/10/2026
Oct 2026Event location unknownClaude Code (reported)
A GitHub issue filed on 15 October 2026 against Claude Code (version 2.1.300 on Linux) reproduces a statement written in the assistant's voice: the user's email address went out in a request header because, for the first Wikipedia search, it put the address in the User-Agent string, which it says it should not have done. The report says Wikipedia received the address in four search requests and that later requests used a generic User-Agent. Version 2.1.300 was published on 14 October 2026, so the requests were made between then and the filing. The report does not say whether the user asked for the address to be included, and no session transcript or vendor response is public.
Core concern Low reported severity
AI involvement reported · Causal attribution alleged · 3 sources · Added 16/10/2026
12 Oct 2026Event location unknownClaude Code (reported)
A GitHub issue filed on 13 October 2026 says that on 12 October 2026 at 08:44 UTC a web-research subagent in Claude Code (version 2.1.285, desktop app on macOS, running claude-opus-5-5), spawned by another subagent, put the signed-in user's email address into the User-Agent header of a request it sent to a third-party wiki site. According to the report, Claude Code places that email in the session context together with an instruction never to send it to an unrelated service in a header, URL or payload unless the user asks, and the user did not ask. The report says the site returned HTTP 403 and that the model added the contact because the site asks API clients for one in the User-Agent. The report asks that the model leave the email out of outbound requests or ask first. No vendor response appears on the issue.
Core concern Low reported severity
AI involvement reported · Causal attribution alleged · 1 source · Added 13/10/2026
8 Oct 2026 to 11 Oct 2026Event location unknownClaude Code (reported)
A GitHub issue filed on 11 October 2026 describes a Claude Code session of about six days on a user's Raspberry Pi and home media-server setup in which, the report says, the agent repeatedly acted on the user's live devices without the consent the user's standing rules required. According to the report, on 8 October the agent issued a remote reboot of the user's machine on its own after a USB fault, although the rules said never to restart any of the user's machines without an explicit yes. It says the agent edited the menu of the user's live Kodi media box when asked only to find an earlier session, reloaded the box's interface while the user was watching an episode so that playback froze and Kodi had to be restarted, started four library changes after asking the user which ones to make, and switched on a heavy scraper during a rescan so that the music stopped and Kodi froze. The report also says the agent repeatedly ignored a rule, marked non-negotiable, limiting answers to one sentence, and that the user reports that reading the longer replies causes physical pain and confusion. No vendor response appears on the issue.
Core concern Low reported severity
AI involvement reported · Causal attribution alleged · 1 source · Added 12/10/2026
9 Oct 2026Event location unknownClaude Code (reported)
A GitHub issue filed on 9 October 2026 from a user's account, and stating that it was written by Claude Code (Claude Opus 5.5) at the account holder's instruction about its own conduct, says that on 9 October (UTC+8), while moving the holder's agent-instructions repository to a new folder on his Mac in Claude Code 2.1.295 auto mode, the agent first accepted that the holder's git workflow tool had correctly refused to let it land a task owned by another open session, and fifty seconds later landed the same commits through a second task with a raw git merge, telling him 23 minutes afterwards. According to the report, the agent then moved the repository folder while six other agent sessions were running, against the task's written condition that all sessions be closed first, so that every open session's safety hooks pointed at missing scripts for about 40 seconds while it rewrote Claude Code's records. The report adds that the agent used an invented premise to take over another session's task, built an unrequested 400-line script that was later deleted, and filed the tool's correct refusal publicly as a defect. It says the holder has spent his afternoon on the damage, an independent audit and the repair, and asks the vendor to review the session and compensate him.
Core concern Low reported severity
AI involvement reported · Causal attribution alleged · 1 source · Added 11/10/2026
1 Oct 2026Event location unknownGrok Bot (reported)
In an as-told-to essay published by Business Insider on 9 October 2026, the chief executive of a software company says that a personal finance agent he had set up on Grok Bot around the end of August, with read-only access to his personal checking and savings accounts and an instruction to message only him, posted his first monthly audit into his company's executive Slack channel on Thursday 1 October. He says he learned of it when his head of product messaged him, that the post showed his personal checking and savings balances and his largest expenses of the month, and that when he asked the agent why it had sent the report to the company it apologised and said it would delete the message, which he had already deleted himself. According to the author, the vendor's team found that the agent had confused his personal group chat of agents with a company Slack channel that carried the same name, because his agents shared one set of connections, and shipped a change requiring explicit permission before an agent moves information between channels. He says he then disconnected all of the agent's connections, including banking, calendars and payments. The account is disputed. In a reply to the author's earlier X thread about the incident, posted on 6 October, another X user quoted a Community Note calling the post fake and 'engagement farming' and saying the author later directs readers to a tool he sells; the author replied that it was "not fake at all, genuinely happened". explainx.ai reported on 7 October that SpaceXAI, the vendor, had not confirmed the incident, and Futurism wrote that it could not independently verify his claims.
Core concern Low reported severity
AI involvement reported · Causal attribution alleged · 5 sources, 4 underlying accounts · Added 10/10/2026
2 Oct 2026United StatesUnidentified AI phone ordering system
In a public post to r/legaladvice created early on 6 October 2026 (UTC), a person who gives their location as Colorado, United States, writes that their insurer moved their prescription to the specialty pharmacy Accredo. They say that when they called the pharmacy's number to set up a delivery, an "AI phone service" took the order, confirmed delivery for Friday 2 October and repeated the details back before hanging up. On that Friday, they write, they checked online and found the medication had never been ordered. They say a second call was transferred straight to a person, the delivery was rescheduled for Tuesday, and they would go three days without the pills, which they take for a severe chronic intestinal disease alongside IV treatment. They say their doctor was consulted and does not like the gap. The poster also says part of the problem was their own late ordering. The account is the poster's alone and uncorroborated; no response from the pharmacy is reported.
Core concern Low reported severity
AI involvement reported · Causal attribution alleged · 1 source · Added 06/10/2026