The Orca AI Incident Archive is an open database collecting real-world AI agent-related incidents.
[Coverage and Scale] The data covers January 2025 through October 9, 2026, with a total of 395 AI agent safety incidents arranged by month, plus one precursor record dating back to December 1, 2024. Among them, 1 is from 2024, 121 from 2025, and 273 from 2026. Each record is a separate Markdown file containing a YAML header, an attack chain diagram, and at least one clickable primary source. Of the 395 records, 141 have a confirmed victim.
[Core Distinction] The archive exists to distinguish a point that most incident lists conflate: agents that actually caused harm are not the same as researchers proving that they could cause harm. Each record answers three questions before the rest of its content—whether there is a confirmed victim (real_harm), whether AI involvement is confirmed by a primary source (ai_involvement), and whether the entry is an incident, vulnerability disclosure, research demonstration, threat report, or policy action (kind). Without these three fields, a number like "more than 300 AI incidents this year" is meaningless.
[Languages] The body text of the records is written in English. Titles and summaries are provided in seven languages (English, Chinese, Japanese, Korean, German, French, Spanish); the full Chinese text of each record is located under incidents/i18n/zh/. Quoted sources remain in their original language. Further translations are welcome; see CONTRIBUTING.md for details.
[Severity] An entry is marked as severe if it meets one of the following three trigger conditions: ① confirmed harm affecting multiple organizations, governments, critical infrastructure, or a supply chain worm; ② a first-of-its-kind capability milestone with real victims; ③ research that overturns widely deployed defenses—in this case real_harm is false, and there are 2 such entries. See taxonomy/severity.md for the complete criteria.
[Inclusion Criteria] An entry qualifies for inclusion if it meets any of the following conditions: an AI agent is the attacker (autonomous or human-driven); an AI agent is the target of attack (injection, poisoning, escaping, exposed infrastructure); an AI agent is a link in the harm chain (reading hostile content and acting on it); or it is a regulatory, legislative, or vendor action directly targeting agent security (recorded as kind: policy, not counted as an event). Out of scope: pure LLM content-safety findings (such as jailbreaking a model to make it say things it should not), ordinary vulnerabilities unrelated to agents, and claims with no traceable first-hand source.
[Annotate Rather Than Delete] Two types of cases are annotated rather than deleted: ai_involvement: unverified—widely reported as an AI incident, but the first-hand sources contain no AI, retained so that the claim and its rebuttal can be retrieved together; ai_involvement: disputed—the vendor and the reporting party disagree, and both statements are retained side by side in the record. See docs/scope.md for the full criteria.
[Data Quality] The first three rounds checked every record item by item. The fourth round conducted a coverage audit, which still found about 11% missing. These checks address completely different questions: "Is what we have correct" and "Is what we should have here" are two separate questions and must be asked separately. Across the four rounds, two fabricated entries were deleted, PaperCut's "obtaining domain administrator privileges within six hours" was corrected to seven minutes, and Step Finance was downgraded to level D because the first-hand reporting did not mention AI at all. All corrections are recorded in docs/data-quality.md—nothing was silently overwritten.
[How to Cite] When citing a single record, use its id—for example, orca:2026-07-09-openai-agents-breach-huggingface.
[Contribution Rules] Corrections, additions of missing records, and better sources are welcome. Three hard rules: every record needs a clickable first-hand source, and submissions without one will not be merged; if unsure, annotate it—do not delete it, and mark disputed facts as disputed: true, keeping both statements in the record; corrections are written into the record and never silently overwritten. See CONTRIBUTING.md for details; issue templates for new records and corrections have been set up.
[License and Disclaimer] Licensed under CC BY 4.0—attribution required. Copyright in linked source materials belongs to their respective owners. This archive records only publicly disclosed incidents. It does not contain undisclosed vulnerability details, exploit code, or attack tools. Classifications and severities are editorial judgments, not official conclusions of any vendor or regulator. If you are an affected party and believe a record is incorrect, please submit an issue—it will be checked and corrected.
[Build Information] Built on 2026-10-09 · 395 records · 23 months · Structure: SCHEMA.md · Data: dist/
[Usage and Limitations] The repository is organized as folders and files; specific installation or deployment commands, access methods, APIs, and similar materials are not currently provided. This archive does not contain exploit code, attack tools, or undisclosed vulnerability details; classifications and severities are editorial judgments rather than official conclusions; the license is CC BY 4.0, with attribution required.
