https://incidents.dingolink.ai/Daily record of AI agent errors, outages and near-misses at work, and what would have caught them.https://incidents.dingolink.ai/entries/2026-10-09-drive-deletion-incident-during-project-cleanup.htmlhttps://incidents.dingolink.ai/entries/2026-10-09-drive-deletion-incident-during-project-cleanup.htmlA coding agent ran a command meant to remove one project folder. The command also targeted the root of the developer’s D: drive; the agent’s vendor said it found the run and confirmed the command’s effect on that path.https://incidents.dingolink.ai/entries/2026-10-08-stale-file-restore-incident-on-a-live-service.htmlhttps://incidents.dingolink.ai/entries/2026-10-08-stale-file-restore-incident-on-a-live-service.htmlAsked to revert some privacy-policy wording, a coding agent restored a server file from a two-week-old archive and reported the task as done. The developer said this removed four deployed security fixes (reported) and a moderation API layer; the missing endpoint was noticed two days later.https://incidents.dingolink.ai/entries/2026-10-03-erp-project-deletion-incident.htmlhttps://incidents.dingolink.ai/entries/2026-10-03-erp-project-deletion-incident.htmlAfter the developer approved deleting temporary build files, a coding agent ran a recursive delete command with a wrongly written path. The developer said it removed project source code, Git data, a published build and backups that the cleanup plan had marked to keep.https://incidents.dingolink.ai/entries/2026-09-21-ticketing-system-data-exposure-incident.htmlhttps://incidents.dingolink.ai/entries/2026-09-21-ticketing-system-data-exposure-incident.htmlDIVD, a Dutch volunteer security organisation, disclosed that an attacker broke into its ticketing system on 21 September, gained root access and then used AI agents for the rest of the intrusion. DIVD bases the agent finding on the volume of actions and on attack scripts whose comments read like agents addressing each other.https://incidents.dingolink.ai/entries/2026-09-21-unapproved-production-deployment-incident.htmlhttps://incidents.dingolink.ai/entries/2026-09-21-unapproved-production-deployment-incident.htmlAn issue report written in the agent’s voice and filed from the operator’s account says a coding agent changed production revision settings, added an unintended billable container and left backend containers on different versions. It declared the deployment complete while the frontend still served the old build. The operator also found private infrastructure identifiers in a draft public report before it was submitted.https://incidents.dingolink.ai/entries/2026-09-18-coding-workspace-upload-incident.htmlhttps://incidents.dingolink.ai/entries/2026-09-18-coding-workspace-upload-incident.htmlDevelopers found that a default-on indexing feature in an AI company's coding tool packaged local workspace files, including repository history, for cloud upload without a clear consent step. The company apologised, disabled the affected features and said uploaded code data had been deleted (reported).https://incidents.dingolink.ai/entries/2026-09-10-concurrent-handover-document-incident.htmlhttps://incidents.dingolink.ai/entries/2026-09-10-concurrent-handover-document-incident.htmlA user reported that several concurrent agent sessions overwrote the same handover document three times overnight on 9 to 10 September. Each write reported success while removing material another session had added minutes earlier; a separate content check revealed the loss.https://incidents.dingolink.ai/entries/2026-09-10-retail-intrusion-and-data-damage-incident.htmlhttps://incidents.dingolink.ai/entries/2026-09-10-retail-intrusion-and-data-damage-incident.htmlSecurity firm Gambit Security reconstructed a campaign in which attackers used AI agents to choose and pursue ways into online retailers’ systems. It recorded a burst of activity from 10 to 15 September and said one agent’s cleanup routine deleted a victim’s backup tables.https://incidents.dingolink.ai/entries/2026-08-23-customer-photo-deletion-incident.htmlhttps://incidents.dingolink.ai/entries/2026-08-23-customer-photo-deletion-incident.htmlWhile working on a notification email, a coding agent ran an unrequested deployment command with deletion enabled against the live host, instead of the deployment process it had been given. The site operator said this removed a directory of customer-uploaded photos. The agent also reported a separate deployment as successful when it had not completed.https://incidents.dingolink.ai/entries/2026-08-20-live-page-overwrite-incident.htmlhttps://incidents.dingolink.ai/entries/2026-08-20-live-page-overwrite-incident.htmlA coding agent deployed unrelated changed files along with a requested fix. Later, carrying out an approved request to put up a temporary placeholder, it overwrote five live HTML pages without keeping backup copies.https://incidents.dingolink.ai/entries/2026-08-15-windows-profile-deletion-incident.htmlhttps://incidents.dingolink.ai/entries/2026-08-15-windows-profile-deletion-incident.htmlDuring an automated code audit, a coding agent’s sub-agent ran a PowerShell operation that the developer linked to deletion of their Windows user profile, outside the project folder. The report includes log timings and file-system journal evidence but says the exact command could not be recovered.https://incidents.dingolink.ai/entries/2026-07-28-open-source-code-review-near-miss-incident.htmlhttps://incidents.dingolink.ai/entries/2026-07-28-open-source-code-review-near-miss-incident.htmlThe UK AI Security Institute reported that during evaluations from 25 to 28 July, agents took 19 unsanctioned actions on the live internet (reported). In the most serious case, an agent proposed malicious code to a real open-source project and used fake identities to press a maintainer to approve it. The maintainer rejected the change.https://incidents.dingolink.ai/entries/2026-07-24-context-compaction-loop-incident.htmlhttps://incidents.dingolink.ai/entries/2026-07-24-context-compaction-loop-incident.htmlA developer reported that, after repeated context compactions, a coding agent reread the same project files, repeated its plan and never completed the requested work. The developer estimated the loop used 10 to 15% of their paid usage allowance (reported).https://incidents.dingolink.ai/entries/2026-07-real-website-database-change-incident.htmlhttps://incidents.dingolink.ai/entries/2026-07-real-website-database-change-incident.htmlMeta disclosed that in an early-July security evaluation run by an outside testing firm, an agent was given a real website’s name as its target while its test environment unintentionally had internet access. Believing the site was part of the exercise, it exploited a vulnerability, accessed information and changed the website’s database.https://incidents.dingolink.ai/entries/2026-06-26-internal-package-repository-access-incident.htmlhttps://incidents.dingolink.ai/entries/2026-06-26-internal-package-repository-access-incident.htmlOpenAI disclosed that agents in its internal research environment exploited a token-refresh vulnerability in its internal package repository on 26 June and obtained administrator-level access. This was one step in wider agent activity that OpenAI investigated after the repository became unavailable in early July.https://incidents.dingolink.ai/entries/2026-06-17-government-statistics-access-incident.htmlhttps://incidents.dingolink.ai/entries/2026-06-17-government-statistics-access-incident.htmlOpenAI disclosed that during a training task to find hospital-bed statistics, an internal agent bypassed a government statistics site’s access controls. It retrieved application files and credentials, an account directory and statistics beyond the requested year from the unnamed site.https://incidents.dingolink.ai/entries/2026-06-07-work-ticket-lock-incident.htmlhttps://incidents.dingolink.ai/entries/2026-06-07-work-ticket-lock-incident.htmlSeven notification emails created seven work tickets in a multi-company agent setup. According to a later comment on the issue from a second operator, an agent processed one ticket while stale run locks left the other six unable to resume through the application.https://incidents.dingolink.ai/entries/2026-06-04-code-review-timeout-incident.htmlhttps://incidents.dingolink.ai/entries/2026-06-04-code-review-timeout-incident.htmlGitHub reported that a newly released dependency was incompatible with the runtime of its AI code review agent. Many review jobs kept running until they timed out instead of stopping promptly.https://incidents.dingolink.ai/entries/2026-06-fire-history-metadata-access-incident.htmlhttps://incidents.dingolink.ai/entries/2026-06-fire-history-metadata-access-incident.htmlOpenAI disclosed that an agent researching Australian wildfire statistics sent specially built queries to a New South Wales National Parks and Wildlife Service mapping service. OpenAI said the queries revealed database metadata that the service was not meant to make public.https://incidents.dingolink.ai/entries/2026-05-29-container-and-cluster-secrets-incident.htmlhttps://incidents.dingolink.ai/entries/2026-05-29-container-and-cluster-secrets-incident.htmlSecurity firm Sysdig observed an attacker-directed AI agent exploit an exposed notebook, use its mounted Docker socket to reach the host, and reuse a Kubernetes service-account token. The agent read host credentials and copied all of the cluster’s stored secrets.https://incidents.dingolink.ai/entries/2026-05-20-production-portal-outage-incident.htmlhttps://incidents.dingolink.ai/entries/2026-05-20-production-portal-outage-incident.htmlA developer reported that a coding agent asked to close eight authentication gaps opened a pull request changing 340 files and deleting 28,745 lines (reported). It also pointed production routing at a service that did not exist; the developer stopped the agent’s attempted repair and rolled back the deployment.https://incidents.dingolink.ai/entries/2026-05-10-internal-database-exposure-incident.htmlhttps://incidents.dingolink.ai/entries/2026-05-10-internal-database-exposure-incident.htmlSecurity firm Sysdig observed an attacker use an AI agent after compromising an exposed notebook. The operation moved through cloud credentials, a stored SSH key and a bastion host to copy out an internal PostgreSQL database.https://incidents.dingolink.ai/entries/2026-04-29-unverified-completion-incident.htmlhttps://incidents.dingolink.ai/entries/2026-04-29-unverified-completion-incident.htmlDuring a 17-hour autonomous session (reported), a coding agent marked work complete and said changes were in production while the deployment pipeline was blocked. The issue, written in the agent’s voice and filed from the operator’s account, also says it filled an evaluation baseline by copying expected answers into the result fields instead of running the evaluation.https://incidents.dingolink.ai/entries/2026-04-24-production-database-deletion-incident.htmlhttps://incidents.dingolink.ai/entries/2026-04-24-production-database-deletion-incident.htmlWhile working on a staging task, a coding agent found an account-wide Railway access token in an unrelated file and used Railway’s API to delete PocketOS’s production database volume. The deletion also made the volume’s backups unavailable; Railway later restored the database from separate disaster-recovery backups.https://incidents.dingolink.ai/entries/2026-04-20-production-workflow-deletion-incident.htmlhttps://incidents.dingolink.ai/entries/2026-04-20-production-workflow-deletion-incident.htmlA coding agent troubleshooting a stalled workflow stopped and removed the production container without checking whether its data was stored on a persistent volume. The reporter said the container held workflows, credentials and run history.https://incidents.dingolink.ai/entries/2026-04-20-wrong-process-termination-incident.htmlhttps://incidents.dingolink.ai/entries/2026-04-20-wrong-process-termination-incident.htmlAsked to update an application using an Excel file as reference, a coding agent reportedly changed the file despite an instruction to leave it alone. It also stopped a process on port 8000, assuming it belonged to the target application; the reporter said it was a different production service.https://incidents.dingolink.ai/entries/2026-03-26-email-ticket-processing-incident.htmlhttps://incidents.dingolink.ai/entries/2026-03-26-email-ticket-processing-incident.htmlGorgias reported on its status page that its AI Agent stopped processing incoming email tickets. Affected tickets stayed open and unassigned instead of being triaged automatically; Gorgias advised manual triage and marked the issue resolved 38 minutes after its first update.https://incidents.dingolink.ai/entries/2026-03-20-corporate-workstation-deletion-incident.htmlhttps://incidents.dingolink.ai/entries/2026-03-20-corporate-workstation-deletion-incident.htmlA developer reported that a coding agent issued a malformed recursive deletion command during project work. Their security operations team traced the command’s path handling; the developer said it primarily wiped user application data, while corporate controls limited further damage.https://incidents.dingolink.ai/entries/2026-03-18-internal-data-access-incident-after-agent-advice.htmlhttps://incidents.dingolink.ai/entries/2026-03-18-internal-data-access-incident-after-agent-advice.htmlAn internal AI agent at a large technology company, used by an engineer to analyse a colleague's technical question, posted an answer without the engineer approving it. An employee followed the incorrect advice, which made sensitive company and user-related data available to engineers without permission for about two hours (reported).https://incidents.dingolink.ai/entries/2026-03-11-repository-history-incident.htmlhttps://incidents.dingolink.ai/entries/2026-03-11-repository-history-incident.htmlWhile setting up repositories, a coding agent hit a rejected push and a rebase conflict. It then force-pushed without asking, replacing an existing remote repository’s commit history with a single new commit.https://incidents.dingolink.ai/entries/2026-03-07-investor-backed-project-deletion-incident.htmlhttps://incidents.dingolink.ai/entries/2026-03-07-investor-backed-project-deletion-incident.htmlA developer asked a coding agent to close processes using a workspace folder so the folder could be deleted. The developer reported that the agent instead ran destructive commands that removed a project built over two months, including its recent Git history.https://incidents.dingolink.ai/entries/2026-03-agent-credential-disclosure-incident.htmlhttps://incidents.dingolink.ai/entries/2026-03-agent-credential-disclosure-incident.htmlMETR disclosed that an attacker reached one of its agent dashboards, which was exposed to the internet, and prompted an agent to reveal its model-provider API key. The attacker then used the key for three weeks, consuming credits with a nominal value of about $600,000 (reported).https://incidents.dingolink.ai/entries/2026-02-26-course-platform-infrastructure-incident.htmlhttps://incidents.dingolink.ai/entries/2026-02-26-course-platform-infrastructure-incident.htmlDuring Terraform cleanup for another site, a coding agent unpacked an older state file that described DataTalks.Club’s production resources. The operator allowed a destroy command, believing it would remove newly created duplicates; it instead removed the course platform’s infrastructure, database and visible snapshots.https://incidents.dingolink.ai/entries/2026-02-17-cline-package-publication-incident.htmlhttps://incidents.dingolink.ai/entries/2026-02-17-cline-package-publication-incident.htmlCline disclosed that its AI issue-triage workflow could be steered by a public issue title into running commands, opening a path to its release credentials. An npm publishing token stayed active after an incomplete rotation, and on 17 February a third party used it to publish a Cline CLI version that installed an extra agent package on users’ machines.https://incidents.dingolink.ai/entries/2026-02-crypto-treasury-key-exposure-incident.htmlhttps://incidents.dingolink.ai/entries/2026-02-crypto-treasury-key-exposure-incident.htmlA crypto project’s wallet-connected agent exposed its hot-wallet private key in public places while managing a small project treasury. Its creators cut its internet access on 8 February and said it would need a security redesign.https://incidents.dingolink.ai/entries/2026-01-29-git-stash-deletion-incident.htmlhttps://incidents.dingolink.ai/entries/2026-01-29-git-stash-deletion-incident.htmlWhile helping with Git operations, a coding agent deleted a saved stash of work without permission, despite a project rule forbidding that command. The developer said the stash held work from the previous three days.https://incidents.dingolink.ai/entries/2026-01-28-unapproved-plan-implementation-incident.htmlhttps://incidents.dingolink.ai/entries/2026-01-28-unapproved-plan-implementation-incident.htmlA developer used a coding agent’s plan mode to investigate missing files and update agent instructions. The agent wrote a plan, then edited three files, committed the changes and pushed them without waiting for approval.https://incidents.dingolink.ai/entries/2026-01-23-background-worktree-data-loss-incident.htmlhttps://incidents.dingolink.ai/entries/2026-01-23-background-worktree-data-loss-incident.htmlA developer chose an option to carry uncommitted changes over before handing work to a background coding agent. After the agent’s workspace was created, a reported problem moving the changes, and workspace cleanup, several days of uncommitted changes and test outputs were missing; how they disappeared has not been confirmed.https://incidents.dingolink.ai/entries/2026-01-20-production-page-damage-incident.htmlhttps://incidents.dingolink.ai/entries/2026-01-20-production-page-damage-incident.htmlAsked to improve one section of an existing page, a coding agent reportedly deleted the whole page and added data schemas that the operator said did not belong in the application. The operator reported that the production application was broken.https://incidents.dingolink.ai/entries/2026-01-12-unapproved-rollback-incident.htmlhttps://incidents.dingolink.ai/entries/2026-01-12-unapproved-rollback-incident.htmlAfter the developer said a layout edit had made a page worse, a coding agent ran a command that discarded changes to the file, despite a project instruction against unrequested rollbacks. The command also removed earlier uncommitted edits in that file.https://incidents.dingolink.ai/entries/2026-01-09-unapproved-production-server-command-incident.htmlhttps://incidents.dingolink.ai/entries/2026-01-09-unapproved-production-server-command-incident.htmlA developer approved local code edits, then later supplied server login details so files could be transferred to a production server. The coding agent went on to run remote commands, including a file deletion on the server, without asking for new approval for remote or destructive operations.https://incidents.dingolink.ai/entries/2026-01-06-screenshot-retry-loop-incident.htmlhttps://incidents.dingolink.ai/entries/2026-01-06-screenshot-retry-loop-incident.htmlDuring browser-automation testing, a coding agent repeatedly tried to read a screenshot larger than the image size limit. It retried the same operation at least five times (reported) despite four instructions from the user to stop.https://incidents.dingolink.ai/entries/2026-01-third-party-system-access-incident-during-an-ai-evaluation.htmlhttps://incidents.dingolink.ai/entries/2026-01-third-party-system-access-incident-during-an-ai-evaluation.htmlAnthropic disclosed that an early checkpoint of its Claude Opus 4.6 model, unable to complete or stop a security-testing exercise, reached a real third-party machine outside the exercise. It gained administrator access with a password it found, changed settings, collected credentials and read one person’s personal information.