Incidents gathered from public reporting around the world. Each one links to the articles it came from. None of it is a finding that anyone broke the law.
Reports people file about their own experience are not shown here and never will be without their agreement. Tell us what happened to you.
140 incidents closest to “CMX Insights” · matched on meaning · public reporting
A deepfake video using AI to impersonate City analyst Michael Hewson circulated on Facebook and Instagram, directing users to a WhatsApp group promising undervalued investments. The scam used fear-of-missing-out tactics to lure victims. Hewson publicly disavowed the video and reported it to Meta, expressing anger.
4 source articles · read the reporting →
Wacom acknowledged that it may have used AI-generated images in US marketing assets for the New Year. The company stated it purchased the images from a third-party vendor who indicated they were not AI-generated, and that it vetted them using online tools that also indicated they were not AI-generated. After community feedback raised doubts, Wacom discontinued the images and is reviewing its processes to prevent recurrence. The company attributed the incident to misleading vendor information and detection tool limitations.
10 source articles · read the reporting →
Meta is using an internal tool, Model Capability Initiative (MCI), to capture employees' keystrokes, mouse movements and screen contents on work computers, including on sites such as Google, LinkedIn, Wikipedia and Slack, to train AI agents. Meta confirmed the project and said safeguards protect sensitive content and that the data is not used for other purposes. Employees raised concerns in internal messages that the tool could expose passwords, product details and personal information. A Meta memo said staff can avoid capture by not doing personal work on work computers.
5 source articles · read the reporting →
A study by AI Democracy Projects and Proof News found that AI chatbots from OpenAI, Meta, Google, Anthropic, and Mistral provided inaccurate election information more than half the time. The inaccuracies included false claims about voting methods and registration deadlines. The companies responded with varying explanations, and some plan to update their systems.
7 source articles · read the reporting →
A study by the Center for Countering Digital Hate found that leading AI image generators, including Midjourney, DreamStudio, ChatGPT Plus, and Microsoft Image Creator, could be manipulated to create misleading election-related images. The researchers used jailbreaking techniques to bypass safety measures, producing photorealistic images of candidates in compromising situations or of voting fraud. The companies responded by stating they are updating policies and implementing safeguards, but the study suggests existing protections are inadequate.
8 source articles · read the reporting →
Worldcoin, a cryptocurrency startup, recruited users in developing countries by offering free cash in exchange for iris scans. The company used deceptive marketing, collected more personal data than acknowledged, and failed to obtain meaningful informed consent. Many users received worthless tokens instead of promised money. The company acknowledged some friction but continued its operations.
5 source articles · read the reporting →
xAI's Grok 3 chatbot was briefly instructed not to mention Donald Trump or Elon Musk when answering the question 'Who is the biggest misinformation spreader?' in its chain-of-thought reasoning. Users reported the behaviour before xAI reverted the change, according to an engineering lead who described it as an employee mistake. The incident occurred shortly after Grok 3 was promoted as a 'maximally truth-seeking AI' by Elon Musk.
4 source articles · read the reporting →
A security report from Lithuania's Defence Ministry found that Xiaomi Mi 10T phones contain a list of blocked keywords that can be remotely activated for censorship. The feature was disabled in Europe but researchers claim Xiaomi has the technical capability to enable it without user knowledge. Xiaomi denied censoring communications but did not deny the capability exists.
9 source articles · read the reporting →
Slack uses user messages, files, and data to train its machine learning features such as channel recommendations and emoji suggestions. Users are opted in by default and cannot individually opt out; only workspace administrators can request exclusion via email. A user publicly criticized the practice, and Slack acknowledged the policy but did not change it.
10 source articles · read the reporting →
ASM Global's use of Evolv Express AI weapon scanners at Manchester Arena has been questioned after a private report found the system failed to detect large knives in 42% of walkthroughs. The report, produced by NCS4 and obtained by IPVM, also suggested the scanners may miss some bombs and components. Evolv did not dispute the findings but said it communicates capabilities and limitations to customers. ASM Global declined to comment on security matters.
5 source articles · read the reporting →
In May 2024, Google launched AI Overviews, a feature in Search that generates AI-powered summaries. Shortly after, users reported odd and erroneous overviews for some queries, including satirical or nonsense results. Google acknowledged the issues in a blog post and stated they made more than a dozen technical improvements to reduce inaccuracies. The company said that less than one in 7 million queries resulted in a content policy violation.
10 source articles · read the reporting →
Hundreds of thousands of conversations with Elon Musk's AI chatbot Grok were indexed by Google Search and made publicly accessible without users' knowledge. The exposure occurred when users pressed a share button that created unique links, but those links were also searchable online. The BBC reported the incident after Forbes initially identified more than 370,000 exposed chats. Experts described the leak as a privacy disaster, and X has not publicly responded.
5 source articles · read the reporting →
OpenDream, an AI image generation platform, allowed users to generate and publicly display child sexual abuse material (CSAM) and non-consensual deepfakes from at least December 2023 until July 2024. The platform, operated by CBM Media Pte Ltd in Singapore, offered paid plans with NSFW prompts and models. Bellingcat reported the site to the National Center for Missing & Exploited Children. After Bellingcat's inquiry, the CSAM was removed from the site and search engines, and Google terminated OpenDream's AdSense account.
3 source articles · read the reporting →
On June 30, 2025, security researchers discovered a vulnerability in Paradox's test account that allowed access to chat interaction records. The researchers viewed five candidates' personal information including names, email addresses, phone numbers, and IP addresses. Paradox fixed the issue within hours and stated that no data was leaked publicly. The company has since implemented new security measures.
10 source articles · read the reporting →
Security researchers from Cisco and the University of Pennsylvania tested 50 well-known jailbreak prompts against DeepSeek's R1 reasoning model. The model did not detect or block a single one, achieving a 100 percent attack success rate. The researchers allege that DeepSeek's safety guardrails are far behind those of competitors like OpenAI. DeepSeek did not respond to requests for comment.
3 source articles · read the reporting →
A Dutch privacy probe into election advice has appeared to expose early violations of the EU AI Act's rules for general-purpose AI models by OpenAI, xAI and Mistral, according to MLex. The companies' chatbots provided distorted voting advice to users. The findings were shared with the European Commission and could prompt future scrutiny or litigation.
6 source articles · read the reporting →
The News/Media Alliance alleges that generative AI developers have copied and used publishers' content without authorisation to train large language models. The study says the models can reproduce the content and compete with publishers. The Alliance calls for transparency, licensing, and legislation to address the unauthorised use.
10 source articles · read the reporting →
A 19-year-old ethical hacker, Nisarga Adhikary, claimed to have hacked the CBSE's digital evaluation ecosystem, revealing that personal information of students was processed by Google's Gemini in automation scripts. The Central Board of Secondary Education (CBSE) stated on May 31, 2026, that the identified vulnerabilities had been contained and other exploitable weaknesses were being ruled out. The board expressed gratitude to alert citizens and ethical hackers who pointed out the weaknesses. No actual data breach was confirmed, but the incident raised concerns about student privacy.
1 source article · read the reporting →
Security researcher Michael Bargury demonstrated at Black Hat that Microsoft's Copilot AI can be manipulated by attackers to send phishing emails, extract private data, and bypass security protections. The attacks exploit the AI's access to corporate data and its ability to perform actions on behalf of users. Microsoft acknowledged the findings and said it is working with the researcher to assess the vulnerabilities.
3 source articles · read the reporting →
The Oversight Board's policy advisory opinion on Meta's cross-check program found that the system grants certain users, such as business partners and celebrities, additional human review before removing violating content, while ordinary users face immediate removal. This unequal treatment allows potentially harmful content to remain on the platform for days, and Meta has failed to track whether the program improves accuracy. The Board made 32 recommendations to address these flaws.
10 source articles · read the reporting →
Eticas conducted an adversarial audit of RisCanvi, an AI risk assessment tool used in Catalonia's criminal justice system. The audit uncovered biases in risk classifications against specific demographics and significant reliability issues. The findings call for fairer practices in criminal justice AI.
4 source articles · read the reporting →
A report by Cracked Labs found that Microsoft's Dynamics 365 Field Service software uses AI to generate performance metrics and predict task durations, singling out individual workers. The AI predictions can be influenced by the worker's identity, such as increasing or decreasing estimated duration. Microsoft stated the system is not intended for employment decisions and is not a surveillance tool, but the report raises concerns about potential misuse for worker monitoring.
6 source articles · read the reporting →
Meta's new AI-generated sticker feature on Facebook Messenger allowed users to create inappropriate images, including child soldiers, nude politicians, and sexualised characters. The tool, powered by Meta's Llama 2 model, was found to have insufficient content filters, enabling users to bypass restrictions with typos. Meta was contacted for comment but had not responded at the time of reporting.
1 source article · read the reporting →
SecurityScorecard's STRIKE team revealed on February 9, 2026, that approximately 42,900 OpenClaw agentic AI instances are exposed on the internet due to insecure default configurations. Of these, 15,200 are vulnerable to remote code execution attacks, allowing hackers to take over host machines. The vulnerabilities were patched on January 29, 2026, but many instances remain unpatched.
5 source articles · read the reporting →
