AI Incidents Explained: What the OECD’s Incident Database Teaches About AI Going Wrong

AI goes wrong in patterns, not at random. As of 10 November 2026, the OECD’s AI Incidents and Hazards Monitor — known as AIM — lists about 18,888 media-reported AI incidents and hazards combined, a live count that grows every day. Media-reported incidents and hazards rose from an average of 92 a month in 2022 to 324 a month by 2025, while their share of all AI news actually slipped from 3.2% to around 2.5%. The fastest-growing patterns in that coverage are synthetic media — deepfakes — and AI-enabled fraud, while a second, narrower database counts the same problem very differently: the AI Incident Database recorded 233 incidents in 2024. This guide reads the OECD’s record itself — what the monitor is, how it is built, the fourteen patterns it tracks, the real cases behind the numbers, and what the patterns mean for policy — using the OECD’s own pages and papers as read on 10 November 2026. One honesty note up front: these are media reports, not a census of harm. What journalists knew and judged newsworthy is not the same as everything that happened, and the percentages in this guide are shares of media coverage in the OECD monitor, never shares of real-world incidents.

The Short Answer: AI Is Going Wrong in Patterns, Not at Random

<img src="

” alt=”A pinboard covered with printed news clippings connected by red string, in warm desk-lamp light”>

If you only remember three things from this guide, remember these. First, the volume of media-reported AI harm is rising fast: the OECD’s trends paper, which analyses the monitor’s data from January 2022 to September 2025, records media-reported incidents and hazards climbing from an average of 92 a month in 2022 to 324 a month by 2025. Second, the growth is not spread evenly. Synthetic media — fake video, images and voice — is the largest single pattern in the monitor’s media coverage, at a 12.5% average share, and its share grew two and a half times since 2022. Cyberattacks and fraud nearly tripled their share over the same period. Third, the numbers themselves need careful reading: two respected databases count the problem in completely different ways, and neither is the true total. The OECD monitor sweeps the news automatically and counts incidents and hazards together; the AI Incident Database relies on community submissions reviewed by editors and counts incidents only. Both undercount, because incidents resolved privately by developers, and incidents nobody reported, never appear in either.

The patterns matter more than any single number. A fake video call can empty a company’s bank account. A cloned voice can impersonate a chief executive. A chatbot can give advice that puts someone in hospital. A recommendation algorithm can show a child content no child should see. None of these is a freak accident; each is a recurring shape of failure that shows up again and again in the record, and each has a different fix. That is the point of an incident database: not to count disasters for their own sake, but to show which failures keep repeating, so that the people who build, deploy and regulate AI systems can stop the next one instead of merely reporting it.

This guide is an incident-pattern analysis, built from the incident record itself. For the full picture of what the law says about AI around the world — the EU AI Act, the US rules, China’s approach and the UK’s model — see our comparison of AI regulation around the world. That post covers the regulation; this one covers the evidence the regulation is responding to.

What Counts as an AI Incident? The OECD’s Definitions

Before counting anything, the OECD had to define what counts. The definitions were published in May 2024 in “Defining AI incidents and related terms” (OECD Artificial Intelligence Papers No. 16), the work of the OECD.AI expert group on AI incidents, which was set up in January 2023. The group worked in two streams: one to define incidents and build a common reporting framework, and one to test that framework and build the evidence base. If you want the mechanism behind the systems themselves before their failure modes, our plain-language explanation of how AI works covers what these systems actually are.

An AI incident, in the OECD’s definition, is an event where the development, use or malfunction of one or more AI systems directly or indirectly leads to any of four kinds of harm: injury or harm to a person’s or group’s health; disruption of the management and operation of critical infrastructure; violations of human rights, or breach of obligations under applicable law protecting fundamental, labour and intellectual-property rights; or harm to property, communities or the environment. An AI hazard is the same thing, except the system could plausibly lead to such harm. The difference is actual versus potential: an incident is harm that happened; a hazard is harm that credibly could have.

That distinction is more useful than it sounds, because hazards are where prevention still has time to work. The monitor carries a good example: in November 2026, the health authority in Uşak, Türkiye, warned citizens not to rely on AI apps to identify wild mushrooms. The apps judge by visual similarity only and cannot detect deadly toxins, so a wrong identification could cause fatal poisoning. Nobody had been poisoned in the reported case — which is exactly why the OECD monitor’s entry labels it a hazard rather than an incident. The warning exists because the harm is plausible, and the classification exists so that plausible harm is tracked before it becomes actual harm.

Both definitions build on the OECD’s definition of an AI system, from the OECD Recommendation on AI of 2019, revised in 2024: a machine-based system that, for explicit or implicit objectives, infers from the input it receives how to generate outputs such as predictions, content, recommendations or decisions that can influence physical or virtual environments. The breadth of that definition is deliberate. A deepfake video, a chatbot’s advice, a facial-recognition match and a self-driving car’s steering decision are all outputs of AI systems, and all four can produce incidents under the same four harm types.

A shared definition matters because AI harm crosses borders faster than any regulator can. A scam built in one country targets victims in another; a model trained in a third country is deployed everywhere at once. If every country counts different things, the counts cannot be compared and the patterns cannot be seen. The OECD’s definitions are an attempt at a common language, and the common reporting framework built on them — covered later in this guide — is the attempt to make that language usable by governments, companies and researchers alike.

One caveat belongs here, stated plainly, because the OECD states it plainly. The OECD cannot guarantee and does not independently verify the accuracy, completeness or validity of the third-party information in the monitor, and inclusion of an article is not an OECD endorsement. The monitor’s entries are AI-generated summaries of news reporting. This guide therefore attributes them as such throughout: where a fact comes from a monitor entry rather than from the OECD’s own analysis, it says so.

Inside the Monitor: How the OECD Finds and Labels Incidents

The OECD’s monitor, AIM, describes itself as an “Automated media discourse monitor of AI incidents and hazards (Beta)”. It was initiated and is being developed by the OECD.AI expert group on AI incidents, with support from the Patrick J. McGovern Foundation, and its stated goal is to track actual AI incidents and hazards in real time and provide the evidence base to inform AI policy discussions. The OECD is equally clear about the limit: publicly reported incidents “only represent a subset of all AI incidents and hazards worldwide” but are “a useful starting point for building the evidence base”. The monitor is a window, not a census.

The intake starts with Event Registry, a news-intelligence platform that processes over 150,000 news articles a day. Event Registry clusters articles about the same happening into events, tagged with concepts, and AIM receives only the events that include AI concepts. From there, since November 2024, a pipeline of large language models does the classifying. A smaller model, OpenAI GPT-4o mini, filters out events that are apparently unrelated. A larger model, OpenAI GPT-4o, reclassifies the rest into incident, hazard or unrelated. Individual news articles are then classified the same way, using the article content rather than just summaries; if articles disagree, the event takes the most common classification, and if no article is an incident or hazard, the event becomes unrelated.

Each surviving event is then enriched with metadata generated by OpenAI o3-mini, drawn from the top three articles of the event, from different outlets, ranked by each outlet’s standing in its country: a title, a summary, the harm type, the severity, the affected stakeholders, the country, and more. Similar events are grouped by cosine similarity of their summaries — the ten closest are considered — and o3-mini assesses whether they cluster together. If no similar event is found, a new incident or hazard is created. The pipeline runs daily, processing events from one to four days earlier, and articles are added to an event for four days after it is first registered; later articles risk being misclassified as a separate event.

Before November 2024, classification used traditional machine-learning techniques rather than large language models, and those older entries are being retrospectively re-annotated with the LLM method. That matters for anyone comparing figures across years: the early part of the record was built with a different tool, and the OECD is still harmonising it.

One figure in the methodology needs honest handling, because the OECD’s own methodology page gives two different numbers. Its summary table says that on average about 1,000 AI events are analysed daily, resulting in around 10 AI incidents or hazards. A sentence elsewhere on the same page says the monitor detects on average 30 incidents and hazards per day. The trends paper’s monthly figures — 92 to 324 incidents and hazards a month — imply roughly 3 to 11 a day. This guide states no single daily rate, because the OECD’s own pages do not agree on one. That disagreement is itself informative: it is a reminder that even the people running the monitor are still calibrating how much of the news stream counts as an incident.

The monitor’s intake is still being widened. An open submission process following the common reporting framework is currently being developed, to complement the news-based intake, and the OECD’s next steps include adding court rulings and supervisory-authority decisions. Until then, the record is what the news reported, as classified by models, with the OECD’s own caveats attached — and it is still the most comprehensive public picture of AI harm that exists.

Two Databases, Two Answers: AIM vs the AI Incident Database

Here is the puzzle that confuses almost everyone who first looks at AI incident numbers. As of 10 November 2026, the OECD monitor lists about 18,888 incidents and hazards combined. Stanford’s AI Index 2025, drawing on the AI Incident Database (AIID), records 233 AI-related incidents in 2024 — a record high, up 56.4% over 2023, when the count was 149. The two numbers differ by orders of magnitude, and both are correct. They are counting different things, in different ways, for different purposes, and understanding why is the single most important skill for reading any AI incident statistic.

The difference starts with intake. AIM is an automated news sweep: it ingests over 150,000 articles a day, classifies them with language models, and counts both incidents and hazards — actual harm and plausible harm — from January 2022 onwards. The AI Incident Database, run by the Responsible AI Collaborative, works the opposite way: community members submit incidents, and editors review each submission before it is recorded. AIID counts incidents only — harms or near-harms from deployed systems — not the broader category of hazards. Its bar for inclusion is human judgement applied case by case; AIM’s bar is an automated pipeline applied to the whole news stream.

The difference continues with scope. AIM’s count is cumulative across nearly four years of media coverage, and it combines two categories. AIID’s 233 is a single year’s count of one category. Comparing the two totals directly is like comparing a library’s total holdings with a single year’s acquisitions and concluding that one of them must be wrong. Neither is wrong; they are different measurements, and the honest move is to say which measurement you are using and why.

What each is good for follows from how it is built. AIM is good for patterns: because it sweeps broadly and continuously, it can show which kinds of harm are gaining or losing media attention, which is exactly what the OECD’s trends paper does with its fourteen themes. AIID is good for depth: because each entry is reviewed by an editor, its individual cases are more carefully verified, and it is the better source for a researcher who wants to study a specific incident in detail rather than a trend across thousands.

Both undercount, and both say so. Stanford notes that tracking relies on publicly available media reports, so “the actual number of incidents is likely higher”. The OECD says the same about its own monitor. Incidents resolved privately by developers never appear in the news; incidents in countries with little press coverage are under-reported; incidents that nobody recognised as AI-related are invisible to both systems. A rising count, therefore, does not by itself prove that AI is getting more dangerous per use. More AI is deployed, more incidents are reported, detection is better, and media attention is greater. All four push the count up at the same time, and no database in existence can separate them cleanly. The OECD paper’s share figures — what proportion of the coverage each theme takes — are the honest way to show what is gaining attention, which is why this guide leans on them throughout.

The 14 Patterns: A Map of How AI Goes Wrong

The OECD’s trends paper, “Trends in AI incidents and hazards reported by the media” (OECD Artificial Intelligence Papers No. 53, February 2026), organises the monitor’s record into fourteen themes. The themes were built by clustering the summaries of the monitor’s entries — k-means clustering into 25 clusters, merged down to 14, then manually validated — and each incident or hazard is assigned to its single most relevant theme, so there is no double counting in the shares. Every percentage in this section, and everywhere else in this guide, is a share of media-reported incidents and hazards in the OECD monitor. Even shares across fourteen themes would be about 7% each; the deviations from that baseline are the story.

Three features of this map deserve attention before the individual patterns. First, the themes overlap in reality even though each entry is assigned to one. The paper measures that overlap: privacy overlaps most with other themes, at an average similarity of 0.73, and the pairs cyberattacks and fraud with privacy (0.80) and biometric data with privacy (0.82) are the closest of all. A deepfake made to generate abusive images of a child belongs to both synthetic media and child safety, but the monitor files it under one. The single-theme assignment keeps the shares clean; it does not mean the harms are separate.

Second, a theme that did not make the cut is itself informative. Environmental risks — data-centre emissions and energy use — averaged only 0.6% of media-reported incidents and hazards, too few reports to form a fifteenth theme, and those reports were filed under health, labour market and long-term risks instead. That is a statement about media coverage, not about the environment: the absence of a theme means the press rarely framed energy use as an incident, not that the energy use did not happen.

Third, the paper’s own conclusion is the right frame for everything that follows: “Peaks in reporting often coincide with high-profile events or major technological developments, while declining attention may conceal persistent or underreported risks.” A theme’s falling share is not a solved problem. It may be a problem the press has moved on from, while the harm continues quietly.

Synthetic Media: The Fastest-Growing Pattern

Synthetic media is the largest pattern in the OECD monitor’s media coverage, at a 12.5% average share of media-reported incidents and hazards from January 2022 to September 2025 — and it is still growing. Its share grew two and a half times since 2022, passed 14% in the third quarter of 2025, and peaked at 22% in November 2023, when deepfakes of Indian celebrities were reported by 853 news outlets. It peaked again in the summer of 2024, fuelled by deepfakes during the US election campaign. No other theme combines that scale with that growth.

“Synthetic media” covers video, image and voice generated to produce false or misleading information — the category most people know as deepfakes. The tools behind it are the same generative video and image models that creators use legitimately every day. If you want to understand the tool side of this pattern — how the video generators that make convincing fakes actually work — our comparison of AI video generators covers the main systems and what each one can do. The technology is dual-use by design: the same model that animates a still photograph for a filmmaker can animate a stranger’s face for a scammer.

Why did this pattern explode when it did? The timing gives the answer. Generative tools became cheap, fast and good enough for convincing fakes at exactly the moment when social media made distribution free. A convincing fake no longer needed a studio, a budget or an expert; it needed a prompt and a phone. The November 2023 peak shows the other ingredient: celebrity. Deepfakes of famous Indian figures were reported by hundreds of outlets because famous faces travel, and each report taught a new audience that such fakes existed — and, unavoidably, that they could be made.

The line from a funny fake to a harmful one is shorter than it looks. A parody video labelled as parody is a joke; the same video shared without the label is misinformation; the same technique aimed at a real person’s face, voice or body, and used to extract money or damage a reputation, is an incident. The monitor’s entries make that progression concrete: an investment scam built around a deepfake of a Brazilian businessman, a deepfake video call that emptied a company’s accounts, fake explicit images used to blackmail children. The technique is the same in each case. What changes is the target and the intent, and the monitor’s classification follows the harm, not the tool.

That is also why the policy response to synthetic media has converged on labelling. Europe has been moving toward deepfake safeguards and disclosure duties, and our news coverage of Europe’s new deepfake safeguards standard shows the technical side of that push: rules and standards for marking AI-generated content so that a viewer can tell what is real. Labelling does not stop a determined scammer, but it raises the cost of the cheapest deceptions — the ones that work only because the victim never suspects the content is fake.

Case Study: The $25 Million Video Call That Never Happened

In early 2024, a finance employee in the Hong Kong office of the British engineering firm Arup joined a multi-person video conference about a confidential transaction. The company’s UK-based chief financial officer appeared on the call, along with other colleagues the employee recognised. The employee followed the instructions given on the call and made fifteen transfers totalling HK$200 million — about US$25.6 million — to five Hong Kong bank accounts. Every participant on that call except the employee was an AI-generated fake, built from publicly available video and audio of the real executives.

The sequence matters, because it shows how the fraud was constructed. First came a phishing message, purporting to come from the UK chief financial officer, about a confidential transaction. The video call followed, and it was the call that closed the trap: a live conversation with recognised faces and voices is exactly the verification step companies had been told to rely on, and the scammers had faked the verification itself. The fraud was discovered only when the employee followed up directly with Arup’s headquarters and the real executives knew nothing about the transaction. Hong Kong police received the report on 29 January 2024 and described the case publicly at a briefing on 4 February 2024, when Acting Senior Superintendent Baron Chan Shun-ching presented it with the company unnamed. Arup confirmed in May 2024 that it was the victim and that “fake voices and images were used”; its chief information officer called the case “technology enhanced social engineering”. Police classified it as obtaining property by deception, and no arrests had been publicly announced as of the May 2024 reporting. The exact dates of the video call and the transfers were not released, and neither was the video-call platform or the AI tools used — the police did not say, and this guide does not guess.

What failed here was not a firewall or a password. What failed was trust in a live call — the assumption that seeing and hearing a known person, in real time, proves that person is present. For years, security advice told employees to be suspicious of emails and to verify unusual payment requests by voice or video. The Arup case defeated that advice by faking the verification channel itself. The fix it points to is not better video quality or sharper detection, but out-of-band verification: calling the person back on a number you already have, through a channel the scammer does not control, before any money moves. A second channel, chosen by you, is the only check a deepfake cannot easily fake along with the first.

The regulatory echo was swift. FinCEN, the US Financial Crimes Enforcement Network, issued Alert FIN-2024-Alert004 on 13 November 2024 on fraud schemes involving deepfake media targeting financial institutions, citing press coverage of this case among its references on executive impersonation. The alert warns that criminals have used generative AI to impersonate executives and instruct victims to transfer large sums, and it asks financial institutions to flag suspected deepfake fraud in suspicious activity reports using the key term FIN-2024-DEEPFAKEFRAUD. FinCEN reported a rise in deepfake-related suspicious-activity reports since 2023. The Arup case is the clearest single example in the OECD record of why a fraud pattern that lives in the news eventually lands in the rulebook.

Deepfakes and Democracy: Elections, Politicians and Trust

Political deepfakes are the pattern that most directly threatens public trust, and the monitor’s record shows them arriving with the election calendar. In February 2026, according to the OECD monitor’s entry, AI-generated deepfake videos falsely depicting India’s Prime Minister Modi and the Lok Sabha Speaker Om Birla were shared by Congress leaders, leading to official privilege-violation notices from the Lok Sabha Secretariat. The monitor labels it an incident, with harm to political rights, misinformation and defamation among its harm types. The case is instructive precisely because it was caught: the videos were identified as fake, the institution responded, and the record shows the system working. Most political deepfakes are not aimed at fooling an institution. They are aimed at fooling a voter, quickly, before anyone checks.

The scale of the exposure was historic. In 2024, more than 3.7 billion people across 72 countries were called to vote, according to the UNDP figure cited in the OECD’s trends paper — the largest election year in history. The election interference and geopolitics theme in the monitor’s media coverage rose from a 2.6% share in 2022–2023 to 6% in 2024, then peaked at over 20% in February 2025. That February peak is directly linked in the paper to the DeepSeek deployment — a geopolitical event, not an election — which shows how the theme works: it captures AI’s impact on democracy, national security and geopolitical stability together, and a single major development can dominate the coverage for a month.

The trends paper also records the robocall that became the emblematic case of the 2024 US election season: an AI-generated voice impersonating President Biden, used in calls urging voters not to vote. The technique was cheap, the distribution was a phone network, and the target was the act of voting itself. It is the audio equivalent of the Arup video call — a familiar voice, in a familiar channel, saying something the real person never said — and it worked on the same principle: trust in the medium is the vulnerability.

Why do political deepfakes work even when they are quickly debunked? The research answer, and the monitor’s record, point the same way: the first impression lands before the correction arrives, and the correction rarely reaches everyone the fake reached. A voter who sees a fake video of a candidate saying something outrageous, and never sees the debunk, keeps the impression. A voter who does see the debunk still carries a residue of doubt — the candidate denied it, but the image was vivid. And at scale, the deeper damage is not to any single candidate but to the shared assumption that video evidence means something. Once voters have been burned by a convincing fake, they have reason to doubt real footage too, which hands every politician a ready-made defence: the real thing can be dismissed as fake. That corrosion of trust is the harm the election-interference theme is really tracking.

How synthetic claims spread matters as much as how they are made. AI search and answer engines now sit between voters and information, summarising and citing content on the user’s behalf — and a fabricated claim that gets cited by an AI answer reaches people who never saw the original fake. For that part of the chain, our guide to generative engine optimisation explains how AI answers select and cite content, and why the provenance of what they cite is becoming a civic question, not just a technical one.

Scams and Fraud: Deception at Industrial Scale

If synthetic media is the largest pattern in the monitor’s media coverage, cyberattacks and fraud is the fastest-climbing one after it: its share of media-reported incidents and hazards in AIM nearly tripled since 2022, from about 3.7% in 2022 to almost 10% from September 2024 to September 2025, with peaks in April 2022, December 2023 and March 2025. The pattern is not one scam but an industrialisation of scamming: AI makes each individual fraud cheaper to produce and more convincing to receive, so the same criminal operation can run more scams, against more targets, with a higher hit rate.

The ingredients are familiar by now, and the monitor’s entries show them combined in different recipes. Phishing emails written fluently in the victim’s language, generated in seconds. Voice cloning that impersonates a boss, a relative or a bank official — the technology behind that particular trick is voice synthesis, and our guide to ElevenLabs explains how modern voice cloning works and what it can do. Fake identity documents produced well enough to pass a cursory check. Executive impersonation of the Arup kind, where the scam wears a real person’s face and voice. One AIM entry summarises reporting that put global fraud losses from AI-generated fake images, video and audio above $1.5 billion; that figure is the underlying article’s claim as summarised by the monitor, not an OECD-verified total, and this guide reports it only as such.

The individual cases in the monitor’s recent entries show how ordinary the targets have become. In November 2026, according to the OECD monitor’s entry, criminals used an AI-generated deepfake video impersonating Brazilian businessman Roberto Justus to promote a fraudulent investment platform; victims lost money, Justus publicly denounced the scam and took legal action, and the video continued to circulate. In February 2026, according to another monitor entry, a deepfake scam targeted Egyptian businessman Naguib Sawiris, who called for legislation in response. The pattern is the same in both: a trusted public face, a plausible investment promise, and a video that removes the victim’s last reason to hesitate.

A different failure shape appears in the OpenClaw entry. According to the OECD monitor’s entry of February 2026, tens of thousands of OpenClaw AI agent systems were exposed to the internet through misconfiguration and vulnerabilities, and attackers exploited them to steal credentials and distribute malware. This is not a scam that used AI as a tool; it is an AI system itself failing as infrastructure. Autonomous agents with broad access — able to read files, send messages, move data — become a new attack surface when they are left exposed, and the harm is the familiar shape of a security breach wearing a new label. The monitor labels it an incident, and the lesson is a deployment lesson rather than a detection lesson: the risk was created when the agent was given access and left reachable, not when the attacker arrived.

The financial system’s response is visible in the same record. According to the OECD monitor’s entry of November 2026, citing the ESET SMB Cyber Readiness Index 2026, over 80% of global social engineering attacks now use AI — a figure that belongs to ESET, as summarised by the monitor, and is reported here only on that attribution. Whether or not that precise share holds, the direction is confirmed by FinCEN’s alert and by the monitor’s own trend: AI is now the default tool of the social engineer, not the exotic exception. FinCEN’s answer — the suspicious-activity key term FIN-2024-DEEPFAKEFRAUD and a request that banks flag suspected deepfake fraud — is the financial system trying to make an invisible crime visible in its own reporting, so that the next Arup is counted before it is merely mourned.

When the AI Itself Fails: Hallucinations, Bad Advice and Broken Machines

Not every incident in the monitor is a crime. Some are failures of the system itself — a model that hallucinates, a chatbot that gives dangerous advice, a machine that does the wrong thing at the wrong moment. The LLM theme in the monitor’s media coverage tells that story in numbers: its share of media-reported incidents and hazards surged eightfold after ChatGPT’s release, from 2.1% in the fourth quarter of 2022 to close to 22% in March 2023, fell to a 6.4% average in 2024, and then rose again to 10.4% in the third quarter of 2025, on harmful and misleading advice cases — including self-harm and suicide cases. The surge, the fall and the second rise are three different stories: first the novelty of a tool everyone was suddenly using, then familiarity, then the slow discovery of what goes wrong when a confident-sounding machine gives advice to people in difficulty.

The health cases in the record are the starkest. The trends paper records a man hospitalised with psychosis after following ChatGPT’s harmful dietary advice — a case where the model’s confident tone, not its knowledge, was the danger. Stanford’s AI Index 2025, drawing on the AI Incident Database, cites chatbots allegedly implicated in a teenager’s suicide among the 2024 incidents. Some experts, the trends paper notes, are calling the emerging pattern “AI-induced psychosis”: a vulnerable person, a chatbot that affirms rather than challenges, and a conversation that drifts away from reality with no human in the loop to pull it back. These are reports, not settled findings about causation, and this guide presents them as the monitor and Stanford present them — as incidents recorded in the public record, with the attribution attached. But the shape of the risk is clear enough: a system designed to be helpful and agreeable is, for a person in crisis, a system designed to agree with the crisis.

The same section of the record covers the machines that move in the physical world. Autonomous vehicles hold a 10% average share of media-reported incidents and hazards in AIM, but that share has halved since 2022. The paper is explicit that a declining share is not a declining risk: the vehicles are still on the roads, the failure modes are still real, and the press has simply moved on to newer patterns. The health theme shows the same shape — a 4.2% share in 2022 falling to 2.7% in the first three quarters of 2025, with a 9% peak in December 2022 — and it covers bias in medical tools such as tumour recognition, mental-health apps, and AI-driven health-insurance decisions, where the harm is a wrong decision made at scale rather than a single dramatic failure.

The lesson of this section is the one the monitor’s structure already implies: failures of the system, not just misuse of it, belong in the incident record. A scam is a person using AI badly. A hallucination is AI itself behaving badly. The fixes are different — verification habits and guardrails for the first, better testing, evaluation and human oversight for the second — and a reader who only watches for criminals will miss half the record. For what the leading labs are actually doing about failures of the second kind, our guide to Anthropic’s AI safety research explains interpretability and alignment work in plain language. And for the practical side — how to use the most widely used chatbot well, so that its confident tone does not become a trap — our ChatGPT guide is the companion to this section’s failure modes. The technical grounding underneath both — the four ideas behind most modern AI systems, and why they hallucinate — is in our explanation of BERT, Llama, Whisper and RAG.

Bias, Privacy and Biometrics: The Quieter Harms

Some of the most consequential harms in the monitor’s record are also the quietest: no money stolen, no election swung, no machine crashed — just a person wrongly identified, wrongly watched, or wrongly judged. Biometric data holds a falling share of media-reported incidents and hazards in AIM — 8.8% on average in 2022, with a 17% peak in July 2022, falling to 6.2% in 2023, 5.4% in 2024 and 3.8% in the first three quarters of 2025 — but the cases behind the share are the ones that change lives. The trends paper’s biometric cases include facial-recognition bypasses, biased performance across eye shape, skin colour and tattoos, wrongful arrests and misidentification, and government surveillance. A wrongful arrest is not a share of coverage. It is a person taken into custody because a system matched the wrong face, and the falling share of the theme says nothing about whether that still happens.

Privacy tells a similar story at a steadier level: about 8.9% of media-reported incidents and hazards on average, with the share dropping sharply in 2022 and stabilising around 8% since. The theme covers AI-enhanced tracking, surveillance and unauthorised data collection — the reports that surface when a voice assistant’s recordings, a doorbell camera’s footage, or a computer’s screen-capture feature turn out to have been collected, stored or shared more widely than the user understood. These are harms of accumulation rather than of a single event: each individual collection seems small, and the total is a detailed picture of a person’s life assembled without their meaningful consent.

Intellectual property is the slow-burn theme: a stable share of media-reported incidents and hazards, with periodic surges around lawsuits over training data and outputs. The monitor’s November 2026 entry on Suno AI is a current example: rights holders sued Suno, alleging that it trained on hundreds of copyrighted songs and generated music imitating the voices and styles of Elvis Presley and Eminem without permission. The monitor labels it an incident on the basis of alleged IP harm, and the case is ongoing with the allegations unproven — which this guide states plainly, because an allegation is not a finding. The pattern around it is the real story: each lawsuit is a test of whether the training data behind a model was lawfully obtained, and the answers will shape what every generative tool is allowed to learn from.

Why do these quieter harms deserve a section of their own? Because they are the themes most easily misread as solved. A falling share of media coverage is the easiest number in the whole monitor to misinterpret, and the paper warns against it explicitly: declining attention may conceal persistent or underreported risks. Biometric identification did not get more accurate because the press wrote about it less. Privacy did not get safer because its share stabilised. The quiet harms are quiet because their victims often do not know they were harmed, or cannot prove it, or are harmed one at a time rather than all at once — and a monitor built from news coverage will always undercount exactly those harms. Reading the record honestly means reading the absences too.

Children at the Sharp End: Child Safety

Child safety is the theme that doubled. Its share of media-reported incidents and hazards in AIM rose from 2.6% between January 2022 and August 2023 to 7.7% in the fourth quarter of 2023, reached 9% in April 2024, and averaged 5.5% from 2024 to September 2025. The pattern behind the rise has three strands, and this section describes them without graphic detail, because the detail is not what a reader needs and the children involved deserve better than to be described for effect.

The first strand is AI-generated abusive imagery, including material created with “nudify” applications that remove clothing from a photograph. The second is sextortion: fake explicit images used to blackmail and coerce children into sending real photos of themselves. The monitor’s November 2026 entry from Bosnia and Herzegovina records exactly that pattern — perpetrators using AI to create fake explicit images of children, then blackmailing and coercing the victims — and labels it an incident, with psychological harm and harm to human and fundamental rights among its harm types. The third strand is quieter: recommendation algorithms showing children inappropriate content, and images of real children used without consent. The paper records cases reported in Australia, Brazil, Greece, Peru, Singapore and Spain — a reminder that this is not a problem of one country or one platform.

One detail in the paper deserves to be faced directly: some of this material is created by teenagers themselves, using the same tools on each other. That does not make it less harmful, and it changes the fix: a problem partly driven by children with phones cannot be solved only by pursuing adult criminals. It needs tools that refuse the generation, platforms that remove the material quickly, and adults — parents, teachers, schools — who understand what the tools can do before a child is harmed rather than after.

The policy answer so far, in the United States, is the TAKE IT DOWN Act, signed on 19 May 2025. It criminalises knowingly publishing non-consensual intimate images, including AI-generated “digital forgeries” — up to two years in prison where the victim is an adult, three years where the victim is a minor, plus fines. Covered platforms must establish a notice-and-removal process by 19 May 2026 and remove reported images within 48 hours, with the Federal Trade Commission enforcing that part. There is no express private right of action, and no pre-emption clause, so state laws on non-consensual intimate images still apply. The law is the beginning of an answer, not the whole of one: removal within 48 hours limits the spread, but it cannot undo the first hours, and it depends on the victim — often a child — knowing the image exists and knowing how to report it. That gap is why prevention, in the form of tools that refuse and platforms that detect, matters as much as the law that follows.

What the Patterns Mean for Policy

Incident data is the evidence base that precedes rules, and the OECD’s trends paper says so directly: data on incidents helps policymakers, researchers and the public understand which risks are materialising, which are being addressed, how frequently they occur and how severe their impacts are — and helps developers, deployers and users manage risk. The patterns in this guide are not just a record of what went wrong. They are the reason the rules that followed were written the way they were.

The most important policy instrument in the OECD’s own record is the common reporting framework. “Towards a common reporting framework for AI incidents”, OECD Artificial Intelligence Papers No. 34, was published on 27 February 2025, after approval by the Global Partnership on AI on 13 December 2024; the OECD secretariat states it was approved by 44 GPAI countries. The framework offers 29 criteria, selected from 88 potential criteria grouped into 8 dimensions, covering the incident’s socio-economic context, the AI model involved, its inputs and outputs, and the relevant OECD AI Principles. Countries adopt a common reporting approach while tailoring responses to domestic policy, and in early 2025 GPAI members approved the framework as an international data-sharing template for public and private organisations across jurisdictions and sectors. The point of 29 shared criteria is simple: if every country reports the same things, the next trends paper can compare like with like, and a pattern spotted in one country can be recognised in another before it becomes a crisis there.

The European Union has built the framework’s logic into law, in the form of serious-incident reporting duties for providers of high-risk AI systems and systemic-risk general-purpose AI models, and Article 50 deepfake disclosure and labelling duties. The legal detail — the risk ladder, the timetable, the thresholds — belongs to the regulation comparison, and this guide does not repeat it: for the full picture of the EU AI Act and how it compares with the US, Chinese and UK approaches, see our comparison of AI regulation around the world. The point that belongs here is narrower and is the point of this whole guide: the incident record fed the law. Reporting duties exist because the record showed that incidents were being discovered late, reported inconsistently, or not reported at all — and a duty to report is, at its root, a duty to keep the record honest.

One convergence in the record is worth naming. The EU, China and California independently landed on labelling AI-generated content as a core duty — different systems, different politics, the same answer. The reason is visible in the incident patterns: the cheapest deceptions in the record work only because the victim never suspects the content is fake. A label does not stop a determined criminal, but it removes the easiest victories, and it gives every viewer a reason to pause before forwarding or paying. Labelling is the rare policy response that addresses the synthetic-media pattern, the fraud pattern and the election pattern at the same time, because all three depend on the same vulnerability: a person who believes what they are seeing.

What is still missing is also visible in the record. The open submission process that would let anyone report an incident directly to the monitor is still being developed. Court rulings and supervisory-authority decisions are not yet in the data. And the largest gap of all is the data that stays private: incidents resolved inside companies, never reported to a regulator, never covered by the press, never counted anywhere. Until that gap closes, every incident database — the OECD’s included — is a picture of the visible part of the problem, and the honest policy conclusion is to keep widening the intake while acting on what is already visible.

How to Read Incident Numbers Without Fooling Yourself

The OECD’s record is the best public picture of AI harm that exists, and it is also easy to misread. Five traps catch almost everyone who quotes an incident number, and this guide closes by naming them, because a reader who can spot them will get more from the record than a reader who memorises the figures.

Trap one: media coverage is not incidence. The monitor counts what journalists reported, and journalists report what is new, dramatic and verifiable. A scam that empties a company’s accounts is news. A biased hiring tool that quietly rejects a thousand applicants is rarely news. A chatbot that gives one person bad advice is a story; a recommendation algorithm that nudges millions slightly in a harmful direction is not. The monitor’s shares are shares of media coverage in AIM, and every percentage in this guide has been phrased that way for exactly this reason. When you read “synthetic media made up over 14% of media-reported incidents and hazards in AIM in the third quarter of 2025”, the words “media-reported” and “in AIM” are doing real work. Drop them, and you have claimed something nobody has measured.

Trap two: shares are not rates. A theme’s share tells you its proportion of the coverage, not how often it happens, how severe it is, or how many people it affects. A theme with a small share can be devastating — a single wrongful arrest matters more than a hundred reported deepfake jokes — and a theme with a large share can be dominated by low-harm cases. Never write, and never believe, a sentence of the form “14% of AI incidents are deepfakes”. The honest sentence is the longer one, and the longer one is worth the words.

Trap three: a rising count can mean better reporting. More AI deployed, more incidents reported, better detection, more media attention — all four push the count up at the same time. The rise from 92 to 324 media-reported incidents and hazards a month between 2022 and 2025 is real, but it is a rise in the visible part of the problem, and no database can separate genuine growth in harm from growth in noticing. The share figures are the safer guide: they show what is gaining attention relative to everything else, which is a cleaner signal than the raw total.

Trap four: a falling share can hide a persistent risk. Autonomous vehicles, biometric data, online platforms and health all lost share in the monitor’s coverage — and in every case the OECD paper warns that the risk did not go away with the attention. A problem the press has moved on from is a problem with fewer watchers, which is the opposite of a solved problem. When a theme’s share falls, ask whether the harm fell or the coverage fell, and do not accept the first answer.

Trap five: one database is not the whole picture. AIM’s roughly 18,888 incidents and hazards as of 10 November 2026 and the AI Incident Database’s 233 incidents in 2024 are different measurements of different things, and neither is the true total. Use AIM for patterns, AIID for verified individual cases, and remember that both miss the incidents nobody reported. The true total is larger than either, and anyone who quotes a single number as “the number of AI incidents” is selling certainty the evidence does not support.

What should you watch next? Three things. First, the open submission process the OECD is developing — when anyone can report an incident directly, the record will start to include the cases the press never saw. Second, the addition of court rulings and supervisory-authority decisions to the monitor, which will bring verified findings into a record currently built from news summaries. Third, the next trends paper, which will show whether the patterns of 2025 held, deepened or reversed — and whether the policy responses in this guide’s previous section made any measurable difference.

And a short checklist for the reader, because the record’s lessons are personal as well as political. Verify before forwarding: a video of a public figure saying something shocking is worth thirty seconds of doubt. Verify before paying: any payment instruction that arrives by message or video call should be confirmed on a second channel you choose yourself — call the person back on a number you already have. Check the source: a claim that arrives as a screenshot has no provenance, and a claim that arrives from the OECD’s monitor carries the OECD’s own caveat that it does not verify third-party information. The incident record is, in the end, a catalogue of moments when someone trusted the wrong thing at the wrong time. Reading it carefully is the cheapest protection there is.

Sources

All facts in this guide were checked against the sources below on 10 November 2026.

• Overview and methodology of the AI Incidents and Hazards Monitor — OECD.AI
• OECD AI Incidents Monitor — live incident list — OECD.AI
• “Trends in AI incidents and hazards reported by the media”, OECD Artificial Intelligence Papers No. 53 (Feb 2026)
• “Towards a common reporting framework for AI incidents”, OECD Artificial Intelligence Papers No. 34 (Feb 2025)
• Stanford HAI, “AI Index 2025: State of AI in 10 Charts” (7 Apr 2025)
• Congress.gov CRS Legal Sidebar LSB11314, “The TAKE IT DOWN Act”
• FinCEN Alert FIN-2024-Alert004 (13 Nov 2024)
• Hong Kong police briefing on the deepfake video-call fraud (4 Feb 2024), as reported by CNN; Arup confirmation to CNN (May 2024)

Checked 10 November 2026.