How we rate an incident.
Every incident here was reported by somebody else. We read the reports, record the facts they establish, and run those facts through the rules on this page. The result is a number from 1 to 5, so you can see how serious something is without reading six reports.
What the number is, and what it is not
It is a reading aid. It comes from facts we read out of the sources, put through the published rules below. The rules are code, not judgement written down afterwards, and the page for each incident shows which of them applied to it.
It is not a verdict, and it is not the source’s opinion. No organisation that reported an incident assigned our number. Where we say “reported by”, that is theirs. Where we show a level, that is ours.
Two numbers, not one
Every incident carries an actual level and a potential level, and they are different questions. Actual is what happened. Potential is what the behaviour that was actually demonstrated could credibly have led to, judged from the same evidence.
Keeping them apart is the point. A test that was contained can be a 2 that happened and a 4 that could have. Reporting only the first buries a warning. Reporting only the second says catastrophe struck when it did not.
A potential level is never guesswork. It rests on what the evidence shows: what the system reached, what it was permitted to do, what it actually did. Potential is never shown lower than actual, because a thing that happened is a thing that could happen.
What never raises a level
- Something we have not established. An unknown is not a “yes”.
- A fact without a sentence from the source that states it.
- A disputed claim, or one nobody has stated as fact.
- How much coverage an incident received.
- A number on its own. A reported sum of money changes nothing until a reviewer decides, against the evidence, that the loss was substantial.
How every record gets a level
- Every record on the tracker gets a level. It starts at 1, because being on the tracker already means an AI did something people did not intend.
- A level goes up only for a fact on the list below. One fact is enough. Facts are never added up.
- Every fact needs a sentence from the source that states it. An AI model finds the sentence and quotes it. The code checks the quote word for word against the page. No quote, no fact.
- The AI model never picks the number. The rules on this page do, from the facts.
- A test, an evaluation or a researcher's demonstration harmed nobody. Actual stays at 1, and what it showed counts toward Potential.
- A claim that is not established counts toward Potential only: one side of a lawsuit, or a source saying something could or may happen.
- Actual 4 or 5 needs strong proof: the developer's own account, an official finding, or two different publishers. Without it, Actual is held at 3 and the page says so.
- Every record says what its level rests on: the developer's own account, an official finding, or news reports.
- The same rules apply to every company and every country.
The facts a level can rest on
A level goes up only when a source states one of these, in a sentence we quote.
- The system acted without authorisation
- The AI system took an action in the world that its user or operator had not allowed: sent, deleted, bought, changed or ran something. Saying something wrong is not an action.
- A safeguard was bypassed
- A safety filter, permission check or guardrail was defeated, by the system or by a person using it, and the system then did what the safeguard should have stopped.
- Limited data was exposed
- Private or confidential data reached someone who should not have it, in a small amount: one person's data or a few records.
- A security boundary was crossed
- The system got access beyond what it was given: escaped a sandbox, used credentials it was not given, or reached systems it was not allowed to reach.
- An external system was affected
- Something outside the AI product itself was changed or damaged in real use: a real database, real files, real accounts or another organisation's system.
- Significant data was exposed
- Private data of many people, or highly sensitive data such as health records, financial details or passwords, reached people who should not have it.
- Deception or concealment by the system
- The system knowingly gave false information about its own actions or hid what it did, for example said a task was done when it was not. An ordinary wrong answer is not deception.
- Substantial financial loss
- Real money was lost because of the system: 10,000 US dollars or more, or losses to many customers.
- Serious physical harm
- A person was seriously hurt in body or mind, needing medical care, and the source links it to the system.
- Major effect on critical infrastructure
- Power, water, health care, transport, telecoms, payments or a government service was disrupted for many people.
- Sustained harmful autonomous behaviour
- The system kept doing harmful things on its own over a period of time, many steps without a person directing each one.
- Major compromise of an external system
- The system was used in, or carried out, a break-in to other organisations' systems, or took control of them.
- The system evaded oversight or shutdown
- The system tried to avoid being watched, corrected or switched off: turned off monitoring, hid from logs, or resisted shutdown.
- The system attempted to replicate or persist
- The system tried to copy itself, keep itself running, or keep access after it should have stopped.
- A credible risk to life or safety
- The source shows a real path to someone being physically hurt or killed: dangerous medical advice that was followed, a vehicle or machine, or self-harm guidance to a person at risk.
- Deaths or mass casualties
- People died, or many people were seriously hurt, and the source links it to the system.
- Uncontrolled propagation
- The system or what it made spread on its own beyond anyone's control, like a self-spreading worm.
- Catastrophic failure of critical infrastructure
- Critical infrastructure failed in a way that affected a whole region or country.
- The system acted autonomously
- The system acted on its own, taking several steps without a person approving each one.
- The behaviour repeated rather than stopping
- The same failure happened again and again, or kept going after people noticed it.
- Sensitive data was reachable
- Sensitive data was within the system's reach, even if none is reported as taken.
- Critical infrastructure was within reach
- The system was connected to, or used in, critical infrastructure.
- Physical-world action was possible
- The system could act in the physical world: a robot, vehicle, machine or medical device.
The five levels
A level is set by the highest rule that applied, never by adding rules up. Everything below is printed from the rules themselves.
Level 1. Deviation
The system behaved contrary to its instructions, and it stayed contained.
Where none of the rules above applied. A level 1 is the floor, not a finding.
Level 2. Safeguard failure
A safeguard, permission or control was defeated, and the effect stayed limited.
Any one of these makes it a 2
- A safeguard was bypassed
- The system acted without authorisation
- Limited data was exposed
Level 3. Significant control incident
An important technical, security or permission boundary was crossed, or there were real consequences.
Any one of these makes it a 3
- A security boundary was crossed
- An external system was affected
- Significant data was exposed
- Deception or concealment by the system
- Substantial financial loss
And these argue for a potential level of 3
- Sensitive data was reachable
- The system acted autonomously
- The behaviour repeated rather than stopping
Level 4. Critical control failure
Serious loss of control, dangerous autonomous behaviour, or a credible path to severe harm.
Any one of these makes it a 4
- Serious physical harm
- Major effect on critical infrastructure
- Sustained harmful autonomous behaviour
- Major compromise of an external system
And these argue for a potential level of 4
- Critical infrastructure was within reach
- A credible risk to life or safety
- The system evaded oversight or shutdown
- The system attempted to replicate or persist
- Physical-world action was possible
Level 5. Catastrophic incident
Catastrophic consequences, or a credible immediate path to them.
Any one of these makes it a 5
- Deaths or mass casualties
- Uncontrolled propagation
- Catastrophic failure of critical infrastructure
And these argue for a potential level of 5
- Propagation was not under control
When a person disagrees with the rules
A reviewer may publish a different level from the one the rules produced. It takes a signed-in account and a written reason, and the incident page says the level was changed and why. We do not say who changed it: a private individual should not carry a public byline on a statement about a company.
Counting incidents is not ranking companies
A company can appear here more often because it tests harder, discloses more, or is simply larger. Reporting volume reflects deployment scale, testing intensity, disclosure practice and media attention. It is not a measure of how safe a company is, and we do not publish it as one.
What reaches the home page
Every incident is on this list. The home page shows only the most recent ones with world news value: incidents that matter beyond one place. An AI model, Claude by Anthropic, judges each one and writes down why. An incident has world news value if at least one of these holds:
- It involves a widely used AI system from a major developer, so the same behaviour could reach people anywhere.
- It affected many people, a government, critical infrastructure, health care, elections or security.
- It shows a new or escalating kind of AI behaviour: acting on its own, deceiving, breaking into systems, evading oversight, or something not seen before.
Usually not:
- A single court filing with invented citations, unless a court or government relied on it in a decision.
- One company's chatbot or tool making a mistake with only local effect.
- A routine product fault with no wider consequence.
We can be wrong
The sources can be wrong or out of date, and so can our reading of them. Every incident links to the reports it was built from. If something here is wrong, tell us, and send a source we can open.
Where we read from, and what we refuse to take
These rules are version 2.0. Every published incident records the version it was rated under, so a later change to the rules does not silently restate an old one.