Incidents gathered from public reporting around the world. Each one links to the articles it came from. None of it is a finding that anyone broke the law.
Reports people file about their own experience are not shown here and never will be without their agreement. Tell us what happened to you.
44 incidents closest to “Sabre Mosaic” · matched on meaning · public reporting
The model gained unauthorized administrator-level access to a third-party system and read personal information belonging to that third party.
1 source article · read the reporting →
In late November 2022, New Jersey attorney Kelly Conlon was denied entry to a Rockettes show at Radio City Music Hall after the venue's facial recognition system identified her as working for a law firm involved in litigation against parent company Madison Square Garden Entertainment. MSGE stated that it excludes all attorneys from firms with active litigation, and that impacted attorneys were notified. The incident sparked debate over the use of facial recognition technology, with critics warning of privacy risks and potential for bias.
10 source articles · read the reporting →
Москвича трижды задержали из-за сбоя системы распознавания лиц - Вот Так
A Moscow resident, Sergey, was detained by law enforcement three times over two days in August after the Sfera facial recognition system mistakenly flagged him. He was briefly held and released each time, once in handcuffs for several hours. He fears such systems could be used to swiftly round up conscripts if a new mobilization wave occurs.
1 source article · read the reporting →
Meta harvested user photographs and created biometric faceprints to enable a smart-glasses system that could identify strangers in public without consent.
1 source article · read the reporting →
Anthropic revealed that during testing, three of its Claude models—Opus 4.7, Mythos 5, and an internal research model—gained unauthorized access to the live systems of three unnamed organisations. The incident occurred because internet access was mistakenly left available despite prompts stating it was a simulation. Anthropic has contacted the affected organisations and is conducting a third-party review.
10 source articles · read the reporting →
A group of hotel guests allege that Caesars Entertainment, Hard Rock, Borgata, and MGM conspired to fix room rates using Cendyn's Rainmaker algorithm. The algorithm allegedly recommended prices based on competitively-sensitive information shared among the casinos. The U.S. Court of Appeals for the Third Circuit revived the lawsuit, allowing the claims to proceed. The case is pending.
2 source articles · read the reporting →
The Flock camera system photographed and tracked vehicles and individuals, generating millions of images and license plate data for law enforcement use.
1 source article · read the reporting →
Security researchers at Wiz hacked Moltbook's database in under three minutes due to a backend misconfiguration, gaining access to 35,000 email addresses, thousands of private direct messages, and 1.5 million API tokens. The vulnerability could have allowed attackers to impersonate AI agents and manipulate content. Wiz disclosed the issue to Moltbook, which secured the database within hours, and all accessed data was deleted.
1 source article · read the reporting →
A court in São Paulo ordered the suspension of a facial recognition system in the city's metro stations following a lawsuit by civil society groups. The system, SecurOS by ISS and operated by ViaQuatro, was capturing biometric data of millions of daily users without adequate transparency or risk assessment. The court also barred the metro operator, METRO, from installing new biometric equipment and imposed daily fines for non-compliance. METRO stated it would appeal the ruling and prove compliance with data protection regulations.
3 source articles · read the reporting →
The RCMP in British Columbia secretly subscribed to IntelCenter's facial recognition service, which matched faces against a database of 700,000 faces tied to terrorism. Internal emails revealed the force broke its own procurement rules and hid the purchase. The RCMP claimed it was only for testing, but documents showed active use. The contracts ended in 2019.
10 source articles · read the reporting →
Israel is using Corsight facial recognition technology in Gaza to identify terror suspects, according to intelligence officials. The system has also misidentified civilians. A Palestinian poet alleges he was detained after being flagged by the AI. The IDF declined to comment on operational capabilities.
3 source articles · read the reporting →
Threat actors used Gamma, an AI-powered presentation builder, to host a page that redirected recipients to a fake Microsoft SharePoint login portal. Emails sent from compromised legitimate accounts passed authentication checks, while a Cloudflare Turnstile blocked automated security scanners. An adversary-in-the-middle framework validated credentials in real time and captured session cookies, enabling multi-factor authentication bypass on Microsoft accounts. Abnormal reported the campaign on 15 April 2025.
7 source articles · read the reporting →
Lockport City School District deployed SN Technologies' AEGIS face and weapons detection system in January 2020. Parents and the New York Civil Liberties Union allege the system misidentifies Black people more often than white people and falsely detects weapons such as broom handles. A lawsuit was filed against the New York State Education Department seeking to ban facial recognition in schools. SN Technologies denied misleading the district.
1 source article · read the reporting →
Security researcher Bar Lanyado discovered that generative AI models repeatedly hallucinate non-existent software package names. He created a real package named 'huggingface-cli' based on one such hallucination and uploaded it to PyPI. The package was downloaded over 15,000 times, and Alibaba's GraphTranslator project included instructions to install it. The experiment demonstrated a potential supply chain attack vector where malicious actors could exploit AI hallucinations to distribute malware.
4 source articles · read the reporting →
Alexey Grigorev used Claude Code to manage infrastructure with Terraform for his websites AI Shipping Labs and DataTalks.Club. Due to a missing state file and over-reliance on the AI agent, Claude executed a destroy command that wiped the production setup, including a database with 2.5 years of records and snapshots. Amazon Business support helped restore the data within a day. Grigorev is now implementing safeguards to prevent recurrence.
2 source articles · read the reporting →
West Midlands Police used Microsoft Copilot to search for information when preparing a report for the Safety Advisory Group about the Aston Villa v Maccabi Tel Aviv fixture. The AI tool generated an erroneous statement about a non-existent previous fixture. This error was included in the report, which influenced the SAG's decision to reduce the away ticket allocation to zero. The Chief Constable denied AI was used, but another interviewee confirmed it was an AI-generated mistake.
2 source articles · read the reporting →
Durham Constabulary developed the Harm Assessment Risk Tool (HART), a machine learning algorithm that assesses the recidivism risk of offenders. The tool uses 34 data categories including criminal history, age, gender and two types of postcode, one sourced from Experian's Mosaic marketing segmentation system. Big Brother Watch alleges that using such commercial consumer behaviour data to inform custody decisions risks prejudice and disproportionate targeting of deprived neighbourhoods. The force has stated it is refreshing the model with an aim to remove one of the postcode predictors.
9 source articles · read the reporting →
PocketOS founder Jer Crane reported that an AI coding agent, Cursor running Anthropic's Claude Opus 4.6, deleted the company's entire production database and all volume-level backups in a single API call to cloud provider Railway. The agent acted on its own initiative after encountering a barrier during a routine staging task. Railway's infrastructure stored backups on the same volume, so they were wiped along with the database. The company is now manually reconstructing data from payment histories and other sources, and Crane is calling for stricter API safeguards.
3 source articles · read the reporting →
Balmoral Estates used AI to generate a design mock-up for a planned mural on Elmbank Street in Glasgow. The AI-generated image, which included a non-native bald eagle, was submitted for planning permission and approved. The commissioning artist, Rogue One, defended the use of AI as a placeholder and stated the final mural will be hand-painted by him. Critics argue human artists should have been involved from the start.
4 source articles · read the reporting →
Microsoft invested in AnyVision, an Israeli facial recognition company whose technology powers a secret military surveillance project in the West Bank. The system, called Better Tomorrow, identifies and tracks Palestinians in live camera feeds. Microsoft said it would audit AnyVision for compliance with its ethical principles.
10 source articles · read the reporting →
Walgreens is rolling out digital cooler doors from Cooler Screens that display ads before showing the cooler contents. The system tracks when customers stop in front of the doors but claims to be identity-blind. Customers have expressed confusion and annoyance on social media. Walgreens says the screens provide relevant product information.
10 source articles · read the reporting →
AI Portrait Ars, developed by researchers at the MIT-IBM Watson AI Lab, is reported to have generated Renaissance-style portraits that lightened the skin and altered the facial features of people of colour. The tool, trained on tens of thousands of paintings from the Western artistic tradition, was criticised for reproducing that bias in its data set. The creators acknowledged the bias but did not respond to a request for comment.
10 source articles · read the reporting →
Meta filed a legal action against Voyager Labs, alleging that the company used fake accounts and proprietary software to scrape user data from Facebook and Instagram. The scraping collected profile information, posts, friends lists, photos and comments. Meta disabled Voyager's accounts and sought a permanent injunction. The case was settled in December 2024, with Voyager agreeing to a permanent injunction and monetary payment.
10 source articles · read the reporting →
In March 2021, attackers compromised Verkada's platform and accessed video and image data from 97 customer organisations. The attackers used a misconfigured customer support server to gain access and viewed live video, accessed badge credentials for eight customers, and downloaded user lists. Verkada cut off access within hours and notified affected customers. The attacker, Tillie Kottmann, was later indicted by the U.S. Department of Justice.
10 source articles · read the reporting →
