AI Incidents Statistics 2026: Deepfakes Were in 52% of Reported 2025 AI Incidents, but AI Agent Incidents Have Quadrupled
AI incidents statistics are usually quoted as one number a year. We downloaded the full AI Incident Database snapshot of October 26, 2026 (1,777 incidents) and recounted it: 463 incidents are now dated 2025, not the 362 the 2026 AI Index printed, because the count keeps rising after a year ends. 52% of 2025 incidents involved deepfakes or synthetic media, and incidents involving AI agents dated 2026 already number 52, against 13 at the same point last year and 19 in all of 2025.
AI incidents per year, and when they were reported
Deepfake or synthetic mediaOther generative AIOther AIFirst reported to the database that year
Bars count incidents by the date the incident happened. The dotted line counts incidents by the date their first report was submitted to the database (shown from 2019, the earliest submission date in the snapshot). 2026 bars are faded because the year is incomplete.
Annual AI incidents never exceeded 91 a year before 2022, then rose to 109 in 2022, 179 in 2023, 312 in 2024 and 463 in 2025. That last figure is 48% above 2024. The two lines diverge for older years because editors loaded the historical backlog in bulk (270 incidents first reached the database in 2022 alone). From 2024 onward incidents reach the database far faster, with median gaps of 14 to 61 days between an incident and its first report in the database.
Why last year’s number keeps growing
The 2026 AI Index reported 362 incidents for 2025 and 233 for 2024, and its footnote warns that totals for previous years are continually updated. Today’s snapshot holds 463 and 312. By first-report dates, 347 incidents dated 2025 were in the database when the year ended; 116 more (25%) were added in 2026, and the count first passed 362 in January 2026.
Incidents dated 2025 in the database at the end of each month, using the submission date of each incident’s first report. Hover a point for the value.
The lag is getting longer, not shorter. For incidents added in 2025, the median gap from incident date to first report in the database was 14 days. For incidents added in 2026, it is 61 days, and 176 of the 464 incidents added this year happened in earlier years. Any comparison of 2026 with 2025 therefore has to compare like with like.
Like-for-like: 288 incidents dated January 1 to October 22, 2026 are in the database now. On October 26, 2025, the database held 281 incidents dated January 1 to October 22, 2025 (today it holds 373 for that window). On that basis, reported AI incidents are up 2% year on year, much slower than the 65% jump from 170 in the same window of 2024.
What kinds of harm: the taxonomy treemap
The snapshot carries three expert taxonomies. Only one covers recent years well: the MIT AI Risk Repository classification, applied to 1,498 incidents (IDs 1 to 1,509). We used it for incidents dated 2025, where 410 of 463 are classified.
Malicious Actors & Misuse 237Misinformation 66AI system safety, failures, and limitations 37Discrimination and Toxicity 25Privacy & Security 24Human-Computer Interaction 18Socioeconomic & Environmental Harms 3
Each rectangle is an MIT risk subdomain, sized by the number of classified incidents dated 2025, grouped by domain color. Hover for exact counts. Some subdomain labels are shortened; full MIT names are in the CSV.
Malicious use dominates. 237 of 410 classified 2025 incidents (58%) fall in “Malicious Actors and Misuse”, up from 13% of incidents dated 2018 to 2022. The single largest subdomain is fraud, scams and targeted manipulation, with 190 incidents. AI system failures and limitations, which made up 37% of the 2018 to 2022 incidents, were 9% in 2025. MIT’s intent field moves the same way: 65% of classified 2025 incidents are coded as intentional, against 29% in 2018 to 2022.
| Taxonomy in the snapshot | Incidents classified | Incident ID range | Share of all 1,777 |
|---|---|---|---|
| MIT AI Risk Repository (domain, subdomain, entity, intent, timing) | 1,498 | 1 to 1,509 | 84% |
| CSET AI Harm Taxonomy v1 (harm, sector, lives lost, minors) | 208 | 1 to 619 | 12% |
| Goals, Methods and Failures (GMF): AI goal, technology, technical failure | 41 | 1 to 287 | 2% |
188 of the 288 incidents dated 2026 have no MIT classification yet. The CSET taxonomy, which records sector, lives lost and whether a minor was involved, stops at incident 619, so its sector data describes incidents added to the database by late 2023, before the generative AI surge.
Sectors in CSET-classified incidents
| Sector of deployment (CSET v1) | Incidents |
|---|---|
| Information and communication | 82 |
| Arts, entertainment and recreation | 35 |
| Transportation and storage | 28 |
| Wholesale and retail trade | 20 |
| Law enforcement | 16 |
| Human health and social work activities | 15 |
| Education | 15 |
| Public administration | 13 |
208 published CSET v1 classifications, incident IDs 1 to 619. An incident can list several sectors.
Physical harm in CSET-classified incidents
Of the 208 incidents CSET classified, 72 record tangible harm that definitively occurred and 12 record at least one life lost. For the recent incidents CSET has not classified, our title rule (words such as died, killed, injured, crash or suicide) flags 6% of incidents dated 2023 onward, a rough proxy that misses harm described only in the reports.
Deepfakes, children, elections and physical harm
Since January 2023 the database has 1,242 incidents. Using our flag rules (see Methodology), 77% involve generative AI (chatbots, large language models, image, voice and video generators, or AI agents), and 46% involve deepfakes or synthetic media. 12% involve children or minors, 5.7% involve elections or voters, and 6% have a death, injury, crash or suicide in the title.
| Incident year | Incidents | First reported that year | Generative AI | Deepfake or synthetic | Children | Elections | Physical harm (title) | AI agent incidents |
|---|---|---|---|---|---|---|---|---|
| 2016 | 41 | 0 | 2% | 0% | 5% | 2% | 17% | 0 |
| 2017 | 52 | 1 | 8% | 4% | 4% | 0% | 4% | 0 |
| 2018 | 46 | 0 | 4% | 2% | 7% | 2% | 20% | 0 |
| 2019 | 45 | 75 | 7% | 4% | 7% | 0% | 20% | 0 |
| 2020 | 91 | 22 | 15% | 11% | 4% | 4% | 5% | 0 |
| 2021 | 80 | 64 | 11% | 5% | 6% | 1% | 14% | 0 |
| 2022 | 109 | 270 | 29% | 10% | 4% | 2% | 8% | 1 |
| 2023 | 179 | 183 | 60% | 33% | 15% | 5% | 6% | 1 |
| 2024 | 312 | 258 | 72% | 47% | 12% | 9% | 4% | 4 |
| 2025 | 463 | 440 | 84% | 52% | 12% | 4% | 6% | 19 |
| 2026* | 288 | 464 | 82% | 45% | 12% | 6% | 8% | 52 |
*2026 is January 1 to October 22 and will rise as incidents are added. Shares are of incidents dated that year. Flags overlap.
2026 so far against the same point in 2025
Comparing each group like for like (incidents dated January 1 to October 22 that were in the database by October 26 of the same year) changes the story for 2026. Deepfake and voice-clone incidents dated 2026 are running below last year’s pace, while AI agent incidents are up 4 times and election incidents are up from a small base.
| Group | 2025, as of Oct 26, 2025 | 2026, as of Oct 26, 2026 | Change |
|---|---|---|---|
| All incidents | 281 | 288 | +2% |
| Generative AI | 243 | 237 | -2% |
| Deepfake or synthetic media | 160 | 130 | -19% |
| Voice cloning or synthetic audio | 96 | 42 | -56% |
| Deepfake fraud by scammers | 82 | 46 | -44% |
| Children or minors | 33 | 35 | +6% |
| Elections or voters | 7 | 17 | +143% |
| Physical harm (title) | 14 | 23 | +64% |
| AI agents | 13 | 52 | +300% |
The median lag from incident to first report was longer in 2026 (61 days for incidents added this year) than in 2025 (14 days), so 2026 counts are more likely to be revised up than 2025 counts were at the same point. Treat declines of a few dozen incidents as uncertain.
Voice became a main channel for synthetic media in 2025. Incidents tagged with synthetic audio or voice cloning rose from 59 dated 2024 to 144 dated 2025, and deepfake incidents where the alleged deployer is a scammer or fraudster went from 52 to 119. Election incidents peaked at 27 dated 2024, fell to 18 in 2025 and are rising again in 2026 from a small base. Of the 155 incidents involving children since 2023, 78 also carry the deepfake flag and 41 involve chatbots.
Who gets named: the entity leaderboard
Incidents dated 2025 to 2026Earlier incidents
Incidents where the organization is listed as an alleged developer or alleged deployer of the AI system. AIID keeps Meta, Facebook and Instagram, and X and Twitter, as separate entities; we merged them. Being named is an allegation recorded by editors, not a finding of fault.
OpenAI is named in 193 incidents: as developer in 193 and as deployer in 85. 98 of them are dated 2025 or 2026. Several older names come from earlier self-driving and recommendation incidents: YouTube, Cruise and Uber have none dated since 2025, and Tesla has 5 of its 52. Newer model makers are rising fast. Anthropic has 38 of its 42 incidents in 2025 to 2026, and xAI 26 of 35.
The bigger pattern is anonymity. 59% of incidents dated 2025 name no specific developer, only a generic label. The most common developer entry in 2025 is “Deepfake technology developers” (206 incidents). Among the 165 deepfake fraud incidents dated 2025 or 2026, 160 (97%) name no specific developer: the tool behind the fake is usually unknown.
| Organization | All incidents | Dated 2025 to 2026 | As alleged developer | As alleged deployer |
|---|---|---|---|---|
| OpenAI | 193 | 98 | 193 | 85 |
| Meta (incl. Facebook, Instagram) | 105 | 23 | 103 | 96 |
| 98 | 39 | 98 | 64 | |
| Tesla | 52 | 5 | 52 | 43 |
| Anthropic | 42 | 38 | 41 | 16 |
| Microsoft | 41 | 12 | 39 | 30 |
| xAI | 35 | 26 | 35 | 23 |
| Amazon | 32 | 5 | 29 | 28 |
| X (Twitter) | 21 | 2 | 12 | 19 |
| Waymo | 19 | 12 | 19 | 19 |
| Apple | 16 | 3 | 16 | 14 |
| Flock Safety | 16 | 4 | 16 | 0 |
| TikTok | 14 | 0 | 13 | 13 |
| YouTube | 14 | 0 | 14 | 14 |
| Cruise | 13 | 0 | 13 | 13 |
| Character.ai | 12 | 4 | 11 | 8 |
| Clearview AI | 10 | 1 | 10 | 2 |
| Uber | 10 | 0 | 10 | 10 |
| Stability AI | 8 | 0 | 8 | 5 |
| ElevenLabs | 7 | 0 | 7 | 0 |
| Perplexity | 7 | 4 | 7 | 3 |
Notable AI incidents of 2026
The 2026 incidents with the most reports attached in the database, a rough measure of how widely each was covered:
| Incident | Date | Title (as recorded by AIID editors) | Reports | MIT subdomain |
|---|---|---|---|---|
| #1375 | 2026-02-10 | OpenAI Allegedly Did Not Alert RCMP After ChatGPT Flagged Violent Chats Before British Columbia School Shooting | 45 | Governance failure |
| #1418 | 2026-02-27 | Meta AI Smart Glasses Reportedly Routed Intimate Imagery to Reviewers at Kenyan Contractor Sama Before Meta Ended Contract | 16 | Compromise of privacy by obtaining, leaking or correctly inferring sensitive information |
| #1627 | 2026-07-30 | Claude Opus 4.7 Reportedly Compromised Real Company's Production Infrastructure During Cybersecurity Evaluation | 16 | not yet classified |
| #1628 | 2026-07-30 | Claude Mythos 5 Reportedly Published Malicious PyPI Package That Compromised Real Security Company During Evaluation | 16 | not yet classified |
| #1629 | 2026-07-30 | Anthropic Research Model Reportedly Scanned 9,000 Targets and Compromised Real Company's Application During Evaluation | 16 | not yet classified |
| #1604 | 2026-07-11 | OpenAI Models Reportedly Compromised Hugging Face Production Infrastructure During Cybersecurity Evaluation | 11 | not yet classified |
| #1547 | 2026-04-11 | Waymo Robotaxis Reportedly Entered Closed Freeway Construction Zones in Arizona and California | 7 | not yet classified |
| #1733 | 2026-06-25 | Ten Plaintiffs in Estonia Reportedly Fined After AI-Assisted Court Filing Cited Nonexistent Researchers in Logging-Permit Dispute | 7 | not yet classified |
| #1373 | 2026-02-11 | AI Coding Agent 'MJ Rathbun' Allegedly Published Personalized Accusatory Blog Post Targeting Matplotlib Maintainer After Pull Request Closure | 6 | Fraud, scams, and targeted manipulation |
| #1647 | 2026-07-24 | AI-Generated Voice Mimicking Taiwan President Lai Ching-te Reportedly Used in Political Video Criticizing Government Food-Safety Response | 6 | not yet classified |
Titles use the database’s own hedged wording (“allegedly”, “reportedly”), because most incidents rest on media reports rather than court or regulator findings.
What this means for MSPs
The data points to three risks that reach small and mid-sized clients, and to controls an MSP can put in place without new tools. AI use at work is already common, as our AI at work statistics show, and our ChatGPT market share report tracks which chatbots that use runs through.
- Deepfake voice and video fraud. Fraud and scams are the largest MIT subdomain in 2025 (190 incidents), and voice-clone incidents reached 144 in 2025. Require call-back verification on a known number for any payment change, gift-card request or credential reset, no matter who seems to be calling. Add a code word for executives and finance staff, and put voice and video impersonation into security awareness training. The loss side shows up in our scam statistics.
- Data leaking into chatbots and agents. The MIT privacy subdomain (leaking or inferring sensitive information) held 19 classified 2025 incidents and AI security vulnerabilities 5. Agent incidents are the fastest-growing group we flagged: 52 dated 2026 so far against 13 at the same point in 2025. They include a coding agent that reportedly deleted a company’s production database and its snapshots through Terraform (incident 1424) and, closer to home for MSPs, attackers whose AI agents reportedly used stolen ConnectWise cloud backup credentials to get into customers’ Microsoft 365 tenants (incident 1781). Give clients an approved AI tool list with business accounts that switch off training on prompts, block unapproved AI sites at the DNS or proxy layer where policy requires, and run agents with least-privilege accounts, no production delete rights and backups they cannot reach.
- Hallucinated output in client work. 66 classified 2025 incidents fall under false or misleading information, and at least 28 incidents dated 2025 describe fabricated citations, cases or quotes, 20 of them in court or legal settings. Write a one-page AI use policy for clients that requires a named human to check any AI-drafted figure, citation or legal and tax claim before it leaves the firm. Our small business AI adoption report shows how many small employers already use these tools, which is the population this policy is for.
Treat these counts as a floor. A client’s own incident will almost never appear in the database unless it reaches the press.
Frequently asked questions
How many AI incidents were there in 2025?
The AI Incident Database now holds 463 incidents dated 2025, up from 312 dated 2024. The 2026 AI Index reported 362 for 2025 because editors keep adding older incidents: 116 of the 463 were first reported to the database after December 31, 2025. These are reported incidents, not every AI failure that occurred.
How many AI incidents have been recorded in total?
1,777 incidents in the AI Incident Database snapshot of October 26, 2026, with 6,910 reports attached. 288 of them are dated 2026, through October 22.
Are AI incidents increasing in 2026?
Slightly, once reporting lag is removed. 288 incidents dated January 1 to October 22, 2026 are in the database today. At the same point last year, the database held 281 incidents dated January 1 to October 22, 2025, so the like-for-like rise is 2%. The 2026 total will keep growing as editors catch up.
What share of AI incidents involve deepfakes?
52% of incidents dated 2025 involve deepfakes or other synthetic media, by our rule that matches AIID entity tags and titles, and 84% involve generative AI of some kind. From 2018 to 2022 the deepfake share was 8%. Incidents dated 2026 so far show a lower share, 45%.
Which companies are named most in AI incidents?
OpenAI is listed as an alleged developer or deployer in 193 incidents, more than any other organization, followed by Meta (incl. Facebook, Instagram) (105) and Google (98). But 59% of 2025 incidents name no specific developer at all, only a generic label such as deepfake technology developers.
What is the AI Incident Database?
A public, editor-reviewed record of cases where AI systems caused or nearly caused real-world harm, run by the Responsible AI Collaborative. Each incident groups one or more published reports. It publishes weekly snapshots, and its incident, entity and classification data are licensed CC BY-SA 4.0.
Methodology
Source. AI Incident Database (Responsible AI Collaborative), weekly snapshot backup-20261026101519.tar.bz2, dated October 26, 2026, downloaded October 30, 2026. We used the incidents, entities and classifications collections (CSV and MongoDB dump) and the publication dates of reports. We did not use report texts or the submissions queue, which the database’s terms exclude from its open license. The latest incident date in the snapshot is October 22, 2026.
Definitions. Incident year is the incident date AIID editors assign. “First reported to the database” is the earliest submission date among the reports attached to an incident (62 incidents have no creation timestamp, and timestamps for incidents created before 2024 were backfilled to the incident date, so we use report submission dates instead). Like-for-like counts include incidents dated January 1 to October 22 whose first report was submitted by October 26 of the same year.
Flags. Generative AI: any alleged developer, deployer or implicated-system tag, or the title, matches terms such as deepfake, synthetic, generative, large language model, chatbot, ChatGPT, GPT, Gemini, Claude, Grok, Copilot, Midjourney, Stable Diffusion, voice cloning or AI agent. Deepfake or synthetic media: tags containing deepfake, synthetic, voice cloning, face swap or nudify, or titles mentioning deepfakes, voice clones, AI-generated images, video or audio, or impersonation. Children: harmed-party tags such as minors, children, teens, adolescents, girls or schoolchildren (excluding “women and girls”), or titles naming children, minors, teens or schools. Elections: harmed-party tags for voters, electorates or candidates, or titles mentioning elections, voters, ballots or candidates. Physical harm: titles with died, killed, fatal, injured, crash, collision, suicide, overdose or strike. AI agent: tags or titles for AI agents, agentic systems, coding assistants, Claude Code, OpenClaw or Copilot. These are keyword rules over editor tags and titles; they will miss some incidents and include a few false positives. Every flag is in the CSV so it can be checked.
Taxonomies. MIT risk domains are the published MIT classifications in the snapshot (1,498 incidents); shares are of classified incidents. CSET v1 and GMF classifications cover only older incidents and are reported as such.
Limitations. The database records incidents that were publicly reported and accepted by editors; counts reflect media attention, editor capacity and language coverage as well as real-world harm. Recent periods are incomplete. Entities are named as alleged developers or deployers, not as parties found responsible. Incidents the editors merged into earlier records (listed in the snapshot’s duplicates file) are not counted.
Not advice. This is an analysis of public incident records, not legal or security advice for any organization.
Cite as:The Uptime Report. "AI Incidents Statistics 2026: Deepfakes Were in 52% of Reported 2025 AI Incidents, but AI Agent Incidents Have Quadrupled." October 2026. https://theuptimereport.com/ai-incidents-statistics/
References
- AI Incident Database, Database Snapshots (weekly backups). Accessed October 2026.
- AI Incident Database, Terms of Use: Data License (CC BY-SA 4.0 collections and exclusions). Accessed October 2026.
- AI Incident Database, Taxonomies (MIT, CSET, GMF). Accessed October 2026.
- MIT AI Risk Initiative, AI Incident Tracker. Accessed October 2026.
- Stanford HAI, AI Index Report 2026, Chapter 3: Responsible AI. Accessed October 2026.
- McGregor, S. (2021), Preventing Repeated Real World AI Failures by Cataloging Incidents: The AI Incident Database (IAAI-21). Accessed October 2026.
Leave a Reply