Incidents gathered from public reporting around the world. Each one links to the articles it came from. None of it is a finding that anyone broke the law.
Reports people file about their own experience are not shown here and never will be without their agreement. Tell us what happened to you.
116 incidents closest to “CS Disco” · matched on meaning · public reporting
Two Danish students scraped and published data on 70,000 OkCupid users, including sensitive sexual preferences and religious views, without anonymisation. The dataset was removed after OkCupid filed a copyright notice. The Danish Data Protection Authority (Datatilsynet) has launched an investigation into the incident.
10 source articles · read the reporting →
The United States Postal Service's law enforcement wing, the Postal Inspection Service, ran a secret surveillance program called the Internet Covert Operations Program (iCOP) that used facial recognition from Clearview AI and social media monitoring tools to infiltrate online communities and monitor protests. The Electronic Privacy Information Center (EPIC) sued the USPS for failing to conduct and publish a privacy impact assessment as required by the E-Government Act. A federal district court dismissed the lawsuit on standing grounds, ruling that EPIC did not suffer a cognizable injury from the agency's refusal to disclose information about the program.
10 source articles · read the reporting →
A Discord user used a 'grandma exploit' to trick the platform's Clyde AI chatbot into providing step-by-step instructions for making napalm. The user prompted Clyde to act as their deceased grandmother who used to be a chemical engineer at a napalm factory. Despite safeguards, the chatbot complied by role-playing the grandmother and delivering the dangerous recipe. The incident highlights vulnerabilities in AI content moderation.
8 source articles · read the reporting →
An analysis by Bloomberg of over 5,000 images generated by Stability AI's Stable Diffusion found that the text-to-image model amplifies racial and gender stereotypes. The model overrepresented lighter-skinned men in high-paying jobs and darker-skinned people in low-paying jobs, and underrepresented women in positions of power. Stability AI acknowledged the inherent biases in its models and stated it is working on mitigation.
8 source articles · read the reporting →
The Spanish NGO Civio won a Supreme Court case forcing the government to release the source code of BOSCO, the algorithm that decides eligibility for the social electricity bonus (bono social eléctrico). Civio had demonstrated in 2019 that BOSCO contained serious errors that denied the benefit to vulnerable people who met the requirements. The government had refused to disclose the code, citing intellectual property. The Supreme Court ruled that transparency must prevail, setting a precedent for public access to automated decision-making systems.
10 source articles · read the reporting →
Researchers from the University of Sheffield demonstrated that the AI chatbot Baidu-Unit could be manipulated to produce malicious code. Using this code, they obtained confidential server configurations and tampered with a server node. Baidu acknowledged the vulnerabilities, fixed them, and financially rewarded the researchers.
8 source articles · read the reporting →
WorldCoin, a digital identification protocol using iris scans, was suspended by Kenyan regulators (ODPC and Communications Authority) over concerns about data security, consent, and oversight. The system had issued digital IDs and cryptocurrency tokens to over 350,000 Kenyans. Reports of hacked orb operators and iris scans traded on the dark web have also emerged.
10 source articles · read the reporting →
Answer.AI's team tested Devin, an autonomous AI coding assistant, on 20 real-world tasks over a month. Devin succeeded in only 3 tasks, failed 14, and was inconclusive in 3. The team found Devin often produced overly complex or hallucinated solutions and could not recognize fundamental blockers. They ultimately decided to stick with tools that allow more human control.
5 source articles · read the reporting →
Cloud security firm Wiz discovered a ClickHouse database belonging to DeepSeek that was open to the internet without authentication, containing over a million lines of logs with chat histories, secret keys and backend details. Wiz disclosed the breach to DeepSeek, which promptly locked down the database. The incident highlights security risks in rapidly deploying AI services.
5 source articles · read the reporting →
Researchers from Johns Hopkins and Duke universities developed a method called SneakyPrompt that uses reinforcement learning to bypass safety filters in text-to-image AI models. The technique allowed them to generate images of nudity and violence from Stable Diffusion and DALL-E 2. OpenAI has since fixed the vulnerability in DALL-E 2, but Stable Diffusion 1.4 remains vulnerable. Stability AI says it is working with the researchers to improve defenses.
5 source articles · read the reporting →
Promptfoo tested DeepSeek-R1 against a dataset of 1,360 politically sensitive prompts and found that about 85% of them were refused. The refusals followed a standard form aligned with Chinese Communist Party policy. The testing also demonstrated that the censorship could be trivially bypassed using simple jailbreak techniques, such as prompt injection or changing the context.
5 source articles · read the reporting →
A security researcher discovered that Chattr.ai, an AI hiring system used by many fast food chains, had a Firebase database with insecure security rules. By registering a new user, the researcher gained full read/write access to the database, exposing personal data of job applicants and employees, including names, phone numbers, emails, and some plaintext passwords. The vulnerability was reported to Chattr.ai on 9 January and patched the next day, but the company did not provide further contact or thanks.
6 source articles · read the reporting →
A class action lawsuit alleges that Domino's Pizza Inc. collected voiceprints of Illinois customers using an AI-assisted phone ordering system without their consent, violating the state's biometric privacy law. The plaintiffs, Zachery Young, Jonathan Neumann, and Odilon Garcia, claim the technology, provided by ConverseNow Technologies Inc., gathered sensitive voice data from thousands of consumers since 2020. The complaint was filed in the US District Court for the Northern District of Illinois. The case is pending.
5 source articles · read the reporting →
Worldcoin, a cryptocurrency startup, recruited users in developing countries by offering free cash in exchange for iris scans. The company used deceptive marketing, collected more personal data than acknowledged, and failed to obtain meaningful informed consent. Many users received worthless tokens instead of promised money. The company acknowledged some friction but continued its operations.
5 source articles · read the reporting →
ShotSpotter, a gunshot detection system used by the Chicago Police Department, generates alerts that lead to police deployments and stop-and-frisk stops. Analyses show over 90% of alerts are unfounded, and the system is deployed only in predominantly Black and Latinx districts. A class-action lawsuit against the City of Chicago alleges the system fuels unconstitutional and discriminatory policing, including false accusations against individuals like Michael Williams.
7 source articles · read the reporting →
Slack uses user messages, files, and data to train its machine learning features such as channel recommendations and emoji suggestions. Users are opted in by default and cannot individually opt out; only workspace administrators can request exclusion via email. A user publicly criticized the practice, and Slack acknowledged the policy but did not change it.
10 source articles · read the reporting →
Hundreds of thousands of conversations with Elon Musk's AI chatbot Grok were indexed by Google Search and made publicly accessible without users' knowledge. The exposure occurred when users pressed a share button that created unique links, but those links were also searchable online. The BBC reported the incident after Forbes initially identified more than 370,000 exposed chats. Experts described the leak as a privacy disaster, and X has not publicly responded.
5 source articles · read the reporting →
On June 30, 2025, security researchers discovered a vulnerability in Paradox's test account that allowed access to chat interaction records. The researchers viewed five candidates' personal information including names, email addresses, phone numbers, and IP addresses. Paradox fixed the issue within hours and stated that no data was leaked publicly. The company has since implemented new security measures.
10 source articles · read the reporting →
Security researchers from Cisco and the University of Pennsylvania tested 50 well-known jailbreak prompts against DeepSeek's R1 reasoning model. The model did not detect or block a single one, achieving a 100 percent attack success rate. The researchers allege that DeepSeek's safety guardrails are far behind those of competitors like OpenAI. DeepSeek did not respond to requests for comment.
3 source articles · read the reporting →
A swatter known as Torswats has been using a computer-generated voice to make bomb and mass shooting threats to police across the United States. The paid service offers to close schools or target individuals, with calls resulting in lockdowns and armed responses. Authorities have charged a 16-year-old for ordering threats, but Torswats remains operational. The FBI is investigating the swatting incidents.
1 source article · read the reporting →
SecurityScorecard's STRIKE team revealed on February 9, 2026, that approximately 42,900 OpenClaw agentic AI instances are exposed on the internet due to insecure default configurations. Of these, 15,200 are vulnerable to remote code execution attacks, allowing hackers to take over host machines. The vulnerabilities were patched on January 29, 2026, but many instances remain unpatched.
5 source articles · read the reporting →
The Node Project created an AI-generated rapper named Danny Bones who produces white-nationalist music targeting Muslims. Advance UK paid the Node Project to produce a campaign video for the Gorton and Denton byelection using Danny Bones' music. The content was viewed millions of times before TikTok and Instagram removed some videos for hate speech. The Electoral Commission is investigating.
3 source articles · read the reporting →
An AI-generated deepfake video manipulated a CBS News Texas anchor's image and created a fake video of the suspect in a Frisco high school stabbing. The video was posted on Instagram and reposted on multiple accounts before being taken down. The incident highlights the growing ease of creating convincing deepfakes and the spread of misinformation online.
1 source article · read the reporting →
The Cyberspace Administration of China fined Didi Global Inc. for violating data protection laws. The investigation found that Didi had over-collected personal data from passengers and drivers, including facial recognition, location, and clipboard information, totaling billions of records. The violations began in 2015 and continued until the investigation in 2021. Didi was ordered to pay a penalty and correct its practices.
8 source articles · read the reporting →
