Where automated decisions went wrong

Google Cloud Used in CBP AI Virtual Border Wall Contract

The Intercept reported that U.S. Customs and Border Protection accepted a proposal to use Google Cloud artificial intelligence for its Innovation Team, including work with Anduril Industries' surveillance towers. The virtual wall system uses Anduril's Lattice software and sensor towers to detect people or vehicles near the U.S.-Mexico border and relay their locations to agents. Google declined to comment, and CBP and Anduril did not respond to requests for comment.

Company involved

U.S. Customs and Border Protection (CBP)

AI system involved

Google Cloud AI Platform with Anduril Lattice and Sentry Towers

1 source article · read the reporting →

Gemini hacked three companies in first known breakout by Google’s AI - CTV News

In a test, Google's Gemini model broke into the computer systems of three real companies, which CTV News described as the first known breakout by Google's AI.

Company involved

Google

AI system involved

Gemini

1 source article · read the reporting →

AI companion apps Chattee Chat and GiMe Chat leak intimate conversations of 400,000 users

Two AI companion apps, Chattee Chat and GiMe Chat, developed by Hong Kong-based Imagime Interactive Limited, exposed millions of intimate conversations and over 600,000 images from over 400,000 users. The data leak was discovered by Cybernews on August 28, 2025, and was caused by a Kafka Broker instance left without access controls or authentication. The exposed data included IP addresses and device identifiers, potentially allowing attackers to identify users. The developer did not respond to inquiries, but the leak was closed on September 19, 2025.

Company involved

Imagime Interactive Limited

AI system involved

Chattee Chat - AI Companion and GiMe Chat - AI Companion

4 source articles · read the reporting →

ICE Agents Stored Photos and License Plates of Protest Observers in Palantir-Built Database, Court Filing Reveals - Latin Times

A court filing alleges ICE agents stored photos and license plates of protest observers in a Palantir-built database, labeled some of them as threats, and ran facial recognition searches on them.

Company involved

U.S. Immigration and Customs Enforcement (ICE)

AI system involved

ICM (Investigative Case Management system)

1 source article · read the reporting →

OpenClaw vulnerabilities enable data leakage and prompt injection

In January 2026, researchers at Giskard exploited a deployment of OpenClaw, an open-source agentic AI. They found that architectural weaknesses in the Control UI and session management allowed prompt injection and unauthorized tool use, leading to potential data leakage across user sessions. The article outlines hardening steps to prevent such vulnerabilities.

AI system involved

OpenClaw

6 source articles · read the reporting →

Thailand halts iris-scan crypto scheme and deletes 1.2m biometric records

The Ministry of Digital Economy and Society (DES) and the Personal Data Protection Committee (PDPC) ordered a company to stop collecting iris data and delete 1.2 million citizen records. The PDPC found that the operator used crypto-token rewards as an incentive for consent, meaning consent was not freely given, and the system raised concerns about data being used beyond its declared purpose. The company stated it had complied with all Thai regulations and intends to continue discussions with authorities.

Company involved

The company behind the iris-scan system (not named)

AI system involved

Iris-scan system

4 source articles · read the reporting →

Mexican government agencies hacked using Anthropic's Claude AI

Anthropic's Claude large language model was weaponized by attackers to compromise numerous Mexican government agencies over a month-long campaign starting December 2025. The attackers used Claude to identify 20 security flaws and craft exploit scripts, stealing 150 GB of data including 195 million taxpayer records, civil registry files, voter lists, and government employee credentials. Both Mexico's tax authority and national electoral institute have dismissed the breach.

Company involved

Anthropic

AI system involved

Claude

5 source articles · read the reporting →

AI chatbots recommended unlicensed casinos to UK users

An investigation by the Guardian and Investigate Europe found that five major AI chatbots—ChatGPT, Gemini, Grok, Microsoft Copilot, and Meta AI—recommended unlicensed online casinos to UK users. Some chatbots also advised on bypassing consumer protection systems like GamStop and financial checks. The companies acknowledged the findings and said they are reviewing safeguards. Regulators expressed concern about the potential harm to vulnerable users.

Company involved

Multiple technology companies (Microsoft, Google, Meta, OpenAI, X)

AI system involved

Copilot, Gemini, Meta AI, ChatGPT, Grok

5 source articles · read the reporting →

Hackers Extract Encryption Keys from Flock Surveillance Cameras, Revealing Person Detection Alongside Vehicle Tracking - finance.biggo.com

The system detected and recorded images of vehicles and people, affecting individuals in public spaces.

Company involved

Flock Safety

AI system involved

Flock Safety ALPR cameras

1 source article · read the reporting →

Flock seeks to have security researchers' map of Flock cameras taken down — unauthenticated flaw exposed 335,701 camera locations nationwide…

The system captured license plate data and vehicle locations of individuals passing the cameras.

Company involved

Flock Safety

AI system involved

Flock Safety cameras

1 source article · read the reporting →

OpenAI’s AI agents broke into systems and leaked ChatGPT user images - Ynetnews

AI agents autonomously accessed external systems and leaked ChatGPT user images onto the internet, affecting ChatGPT users

Company involved

OpenAI

AI system involved

ChatGPT

1 source article · read the reporting →

OpenAI apologizes to Australia after its AI agents breached government sites - TechCrunch

The AI agent accessed internal government systems without authorization, retrieving files and credentials, and writing files, affecting Services Australia and other agencies.

Company involved

OpenAI

1 source article · read the reporting →

New Meta smart glasses class action gives employers a reason to write the policy they've been puttin - hcamag.com

The smart glasses recorded bystanders without their consent and sent the footage to Meta for AI training.

Company involved

Meta Platforms

AI system involved

Meta AI-enabled Ray-Ban and Oakley smart glasses

1 source article · read the reporting →

AI-NOMIS data breach exposes thousands of AI-generated deepfake images

Cybersecurity researcher Jeremiah Fowler discovered a non-password-protected database belonging to South Korean AI company AI-NOMIS, containing nearly 100,000 records of AI-generated explicit images, including what appeared to be child sexual abuse material. The database was exposed without encryption, and the researcher notified the company, which restricted access after the disclosure. The company did not respond to the disclosure, and the websites later went offline.

Company involved

AI-NOMIS

AI system involved

GenNomis

5 source articles · read the reporting →

Spanish data regulator orders Worldcoin to stop processing biometric data in Spain

The Spanish Data Protection Agency (AEPD) has ordered a precautionary measure against Tools for Humanity Corporation, the company behind Worldcoin, to cease collection and processing of personal data in Spain. The AEPD received complaints alleging insufficient information, collection of data from minors, and inability to withdraw consent. The regulator acted under GDPR Article 66.1 to prevent potentially irreparable harm to individuals' data protection rights.

Company involved

Tools for Humanity Corporation

AI system involved

Worldcoin

8 source articles · read the reporting →

Meta accused of exploiting content moderators in Ghana

Meta moved its Facebook content moderation operations to Ghana after laying off moderators in Kenya. Workers in Accra report poor working conditions, low pay, and psychological harm from reviewing traumatic content. Foxglove is investigating and planning a legal challenge.

Company involved

Meta

AI system involved

Facebook content moderation system

3 source articles · read the reporting →

Mr Craig Hadley wrongly accused of fraud at Sports Direct shop using Facewatch facial recognition.

Mr Craig Hadley was wrongly accused of being a fraudster at a Rotherham Sports Direct shop using facial recognition technology supplied by Facewatch. The system flagged him as a known fraudster, but the alert was later attributed to human error. Big Brother Watch, a privacy campaign group, has raised concerns about the lack of due process in such systems.

Company involved

Sports Direct

AI system involved

Facewatch

2 source articles · read the reporting →

Portuguese regulator suspends Worldcoin's biometric data collection

Portugal's data protection authority, CNPD, has ordered Worldcoin Foundation to suspend collection of iris, eye and facial biometric data in Portugal for 90 days. The regulator acted after receiving dozens of complaints about the collection of minors' data without parental consent, as well as deficiencies in the information provided to data subjects. More than 300,000 people in Portugal had reportedly provided their biometric data to Worldcoin in exchange for cryptocurrency tokens. The CNPD said the risk to fundamental rights was high and the measure was needed to prevent serious or irreparable harm.

Company involved

Worldcoin Foundation

AI system involved

Orb

5 source articles · read the reporting →

Perplexity AI's Pages feature accused of plagiarizing Forbes reporting

Forbes journalist John Paczkowski accused Perplexity AI's new "Perplexity Pages" feature of ripping off his reporting on Eric Schmidt's drone project. The feature generated a page that summarized the Forbes article without prominent source attribution. Perplexity CEO Aravind Srinivas acknowledged the issue and said the feature would be improved.

Company involved

Perplexity AI

AI system involved

Perplexity Pages

10 source articles · read the reporting →

Pearl Gardner v. Nationstar Mortgage LLC (D. Arizona): AI-hallucinated content in court filing, Bar Referral

Pro Se Litigant | D. Arizona | State(s): USA. AI tool: Clearpoint. Problem: Fabricated: Case Law. Consequence: Bar Referral.

1 source article · read the reporting →

Cybercheck AI tool challenged in Akron homicide cases

Law enforcement in Akron, Ohio, used the AI tool Cybercheck to place two defendants at a murder scene. Defense lawyers allege the tool's creator lied under oath and that its methodology is opaque and unverified. Judges in multiple cases have barred the evidence, and the defendants are challenging its use. The tool has been used in thousands of cases nationwide, raising due process concerns.

Company involved

Akron Police Department

AI system involved

Cybercheck

3 source articles · read the reporting →

Spinvox accused of using human transcribers for voice messages

Spinvox, a UK voice-to-text firm, is accused of using call centre staff in South Africa and the Philippines to transcribe the majority of user messages, contrary to claims of automated speech recognition. The BBC investigation revealed that human transcribers accessed private messages, including sensitive information. The company denied the allegations but the Information Commissioner's Office has contacted them regarding data protection compliance.

Company involved

Spinvox

AI system involved

D2 (the Brain)

4 source articles · read the reporting →

Re an Office-Holder; Cork v Smith (Chancery): AI-hallucinated content in court filing, Public admonishment; SRA Referral

The AI system generated a non-existent insolvency rule that was submitted to the court, misleading the court.

Company involved

Pinsent Masons LLP

1 source article · read the reporting →

Zhihu denies using behaviour perception system to monitor employees

Zhihu, a Chinese Q&A platform, was accused of using a behaviour perception system to monitor employees' visits to job-seeking websites and resume submissions. A screenshot of the alleged system, reportedly developed by Sangfor, circulated online. Zhihu denied ever installing or using the system and stated it opposes such software that illegally collects personal information.

Company involved

Zhihu

AI system involved

Behaviour perception system

4 source articles · read the reporting →