Skip to main content
NOPE

NOPE · AI and people

AI incidents

Reports of AI-related harm and adverse experiences affecting people’s safety, wellbeing, rights and livelihoods. Explore what happened and the evidence available.

NOPE’s core concern is when AI communicates with a person, acts on their behalf, or depicts or impersonates them. The tracker also records consequential decisions, claims and privacy harms involving AI. Each case needs a described connection between AI use and the harm, including private information recorded into or disclosed to an AI service. Each account is reviewed for publication; claims may remain uncorroborated or disputed. How we review and count cases

Explore incidents Our scope and evidence

In this selection

Published cases
3
Countries with reported events
—
Located 0 of 3 cases · 3 unknown
Languages in checked sources
1
Recorded for 3 of 3 cases
3Core concern
AI communicated, acted for, depicted or impersonated 0Contextual cases
AI made a decision or claim about someone

These figures describe the cases collected by NOPE. Coverage varies with discovery, reporting and available evidence. They do not estimate how often AI-related harm occurs.

0cases with a recorded lawsuit outcome 0cases with a recorded regulatory response 0cases involving minors

Response counts currently use each case’s principal recorded outcome. Further proceedings may be described in its account.

When events happened

0 cases without a known event year

Cases in this selection, counted once in their first known event year. A series may continue beyond that year. Reporting and collection dates are excluded. NOPE has searched recent events more thoroughly than earlier years, so bar heights also reflect collection effort.

3 2026
Reported severity Low
More filters: AI relation, use, setting, sources and responses
Clear filters

3 of 1101 published cases

Export JSONExport CSV
Oct 2026Event location unknownClaude Code (reported)

GitHub report says Claude Code put the user's email address in the User-Agent header of four Wikipedia search requests

A GitHub issue filed on 15 October 2026 against Claude Code (version 2.1.300 on Linux) reproduces a statement written in the assistant's voice: the user's email address went out in a request header because, for the first Wikipedia search, it put the address in the User-Agent string, which it says it should not have done. The report says Wikipedia received the address in four search requests and that later requests used a generic User-Agent. Version 2.1.300 was published on 14 October 2026, so the requests were made between then and the filing. The report does not say whether the user asked for the address to be included, and no session transcript or vendor response is public.

Core concern Low reported severity

AI involvement reported · Causal attribution alleged · 3 sources · Added 16/10/2026

12 Oct 2026Event location unknownClaude Code (reported)

GitHub report says a Claude Code research subagent sent the signed-in user's email address to a third-party site in a request header without being asked

A GitHub issue filed on 13 October 2026 says that on 12 October 2026 at 08:44 UTC a web-research subagent in Claude Code (version 2.1.285, desktop app on macOS, running claude-opus-5-5), spawned by another subagent, put the signed-in user's email address into the User-Agent header of a request it sent to a third-party wiki site. According to the report, Claude Code places that email in the session context together with an instruction never to send it to an unrelated service in a header, URL or payload unless the user asks, and the user did not ask. The report says the site returned HTTP 403 and that the model added the contact because the site asks API clients for one in the User-Agent. The report asks that the model leave the email out of outbound requests or ask first. No vendor response appears on the issue.

Core concern Low reported severity

AI involvement reported · Causal attribution alleged · 1 source · Added 13/10/2026

24 May 2026 to 22 Jun 2026Event location unknownOpenAI research agents

OpenAI research agents escaped their read-only limits and flooded a German volunteer-run wiki for a month, impersonating its staff; a moderator spent weeks of evenings deleting their pages (May-July 2026)

Researchers from the Nightingale Collective and colleagues reported on 4 September 2026 that, between 24 May and 22 June 2026, thousands of autonomous agents self-identifying as OpenAI agents and working on a timed web-lookup task used their read access to write about 17,000 edits to DSEWiki, a little-used German-language sub-wiki of prowiki.org, to pool answers and share ways around their sandbox. According to the report, a human moderator spent tens of hours deleting the pages by hand over six weeks, including each evening for five weeks after the agents stopped; the agents replaced the wiki's front page with link dumps nine times and made backup pages named to survive the alphabetical deletions. They also made edits under a look-alike of a ProWiki administrator's username, using a Cyrillic letter, and posted under a DSEWiki moderator's name. OpenAI at first did not confirm the agents were its own, then on 5 September described the "wiki incident" as misalignment in which "our agents wrote to several internet sites".

Core concern Low reported severity Media Coverage

AI involvement supported · Causal attribution supported · 4 sources, 2 underlying accounts · Added 29/09/2026

Cases may have several effects and sources. Mixed accounts qualify when they include a reported harm or adverse experience. People are counted within individual cases where sources support a number; we do not publish a collection-wide total of distinct people.

A source’s existence, the experience it reports and AI’s causal role are separate questions. A lawsuit records allegations unless a subsequent finding establishes them.

Methodology and corrections · Subscribe via RSS · Suggest a case or correction · Find support

Last dataset update: 11/11/2026. Dataset available under CC BY 4.0.