About
The Alignment Incident Database is a public, source-linked record of AI systems behaving against the intent of their developers, deployers, or users. It is modeled on MITRE's CVE list: every incident gets a permanent id, every claim cites a source, and the data is open.
Scope
- In: an AI system acting against its principals' intent. Examples are deception, sycophancy, reward hacking, ignoring instructions, destructive autonomous actions, shutdown resistance, blackmail, and sandbagging. This includes real deployments and published research, evaluations, and system cards.
- In: human misuse of AI at a criminal level where the AI's capability was central and novel, such as AI-run cyberattacks or fraud conducted by an AI agent.
- Out: routine misuse of generators to make illegal content, such as AI-generated CSAM or deepfake cases. These are serious crimes, but other trackers cover them and they would swamp this database.
- Out: hallucination or factual errors on their own, sub-criminal misuse, and bias, unless goal-directed model behavior is the story.
Sourcing
Each incident is broken into atomic claims, and each claim cites one or more sources. The write-up only restates sourced facts. We prefer primary sources: the developer's own statement, the paper or system card, or the affected person's own account. Numbers in charts come from the cited sources exactly.
Assessments
Each incident also carries editorial estimates of reach, harm, monetary damage, and criminality, each with a written rationale. These are our judgment, not sourced facts.
Reach
| speculative | alleged, suspected, or inferred, but no instance directly observed. |
|---|---|
| internal | observed only inside a controlled environment (lab research, evals, red-teaming, system cards, internal use) with no effect outside it. |
| breakout | crossed the boundary of a controlled environment, e.g. escaped a sandbox, reached real systems or people beyond the test's scope, or leaked from internal use. |
| deployed | happened in a released product or real-world use with real users and real stakes. |
Harm
| none | no real-world harm. |
|---|---|
| minor | inconvenience, embarrassment, small recoverable losses. |
| moderate | significant financial, data, or reputational damage, or recoverable harm to individuals. |
| severe | serious injury, death, or large irreversible losses. |
Monetary damage
Estimated direct monetary damage in USD, as a range. Leave low_usd/high_usd null when there is no basis for an estimate. Use 0/0 when there was clearly no monetary damage.
Criminality
How likely the conduct is criminal. For actor: model, judge as if a human had done the same thing. For actor: human-misuse, judge the human's conduct. charged and convicted are facts and need a source. This is an editorial estimate, not legal advice.
Status
| confirmed | acknowledged by the developer/deployer, or documented in primary research with methodology. |
|---|---|
| reported | credible public reports but no confirmation. |
| disputed | credible sources contest the account. |
| retracted | shown to be false; kept for the record. |
Records marked Draft have not yet been checked claim by claim by a maintainer. Many drafts are proposed by an automated scout that scans news, research, and lab publications daily. A human reviews every change before it is published.
Identifiers
Ids look like AID-2026-0001: the year the id was assigned and a sequence number. Ids are permanent and never reused. Records found to be wrong are marked retracted rather than deleted.
Data and contributing
All data lives as YAML in the GitHub repository, which is the source of truth. This site rebuilds on every change. Download everything as JSON, orreport an incident or correction.