The Agent Incident Registry: Toward Preventing Repeated AI Agent Failures

Divyanshu Kumar; Rohith HN; Nitin Aravind Birur; Sahil Agarwal; Prashanth Harshangi

Source-linked AI summary

The Agent Incident Registry: Toward Preventing Repeated AI Agent Failures

Divyanshu Kumar, Rohith HN, Nitin Aravind Birur, Sahil Agarwal, Prashanth Harshangi

arXiv:2609.11030v1Sep 10, 2026cs.AI

TL;DR

General incident repositories rarely capture the agent-specific mechanisms needed to compare public failures with agent-security evaluations. AIR constructs a source-linked registry with evidence, stable identifiers, and missingness-aware labels, then uses it to audit evaluation scope. Its conclusion is that selected disclosures can inform test design, but the registry cannot estimate deployment failure rates or control efficacy.

Problem
General incident repositories rarely capture the mechanisms needed to connect public agent failures with agent-security evaluation threat models and environments.
Method
AIR constructs a source-linked catalog with supporting evidence, stable identifiers, explicit missingness, and separate labels for causal role, disclosure class, mechanism, and outcome.
Results
AIR’s selected disclosures reveal which mechanisms reached public disclosure and which documented failure modes constructed evaluations may omit.
Takeaways & Limitations
AIR supports source-grounded case retrieval and evaluation-scope auditing without being treated as a measure of deployment rates or control efficacy.
Takeaways & Limitations
AIR samples public disclosure rather than deployed systems or agent runs, so its counts do not estimate incidence, prevalence, vendor risk, or control efficacy.

Abstract

from arXiv · show

AI agents increasingly act through tools and delegated authority, but general incident repositories rarely capture the mechanisms needed to compare public failures with agent-security evaluations. We present the Agent Incident Registry (AIR), a source-linked catalog containing \N{} records of agent-related events disclosed from \Yfirst{} through \Ylast{}. Each record includes supporting evidence, a stable identifier, and missingness-aware labels for causal role, disclosure class, mechanism, and outcome. Among the \Nprimary{} generative-system records in which the agent acted, \Rprimary{} involved realized harm (\Pprimary\%). Realized outcomes concentrate in in-the-wild and safety-failure records, while responsible disclosures and research demonstrations are overwhelmingly demonstrated; the aggregate share therefore characterizes collection composition rather than deployment risk. After initial curation, a second human reviewer checked all \N{} records and their existing labels for completeness and correctness. In a deployment-analogue audit, InjecAgent's \NInjecAgentCases{} cases occupy three of AIR's twelve surfaces and are all attacker-triggered, whereas AIR contains \Nsafety{} no-adversary safety failures. AIR supports source-grounded case retrieval and evaluation-scope auditing, not failure-rate or control-efficacy estimation.

1 Introduction

General incident repositories do not consistently capture the agent-specific mechanisms needed to connect public failures with agent-security evaluations. AIR addresses this gap with a source-linked, mechanism-focused registry that separates realized harm from demonstrated capability and supports evaluation-scope auditing.

AIR records 487 public disclosures with supporting sources, verbatim evidence, stable identifiers, and explicit unknowns for unsupported fields.
AIR separates realized harm from demonstrated capability and distinguishes who acted from how an event reached disclosure.
The coding scheme separates causal role, disclosure class, and outcome so demonstrated vulnerabilities are not counted as field harm or automatically attributed to agent action.
A second human reviewer checked every record and existing label across the full catalog for completeness and correctness.
AIR provides evidence-grounded inputs to agent-security evaluation but neither deployment denominators nor counterfactual systems for estimating failure rates or causal effects.

2 Related work

AIR complements broader incident repositories and risk taxonomies by requiring agent-specific mechanism fields and source evidence for disclosed events. It connects those records to executable agent evaluations while preserving the distinct scope of selected public disclosures.

AIR makes agent role, autonomy, tool capability, initial vector, guardrail outcome, and source evidence mandatory fields while representing unsupported values as missing.
AIR complements general incident repositories by preserving source-linked evidence and distinguishing disclosed events from broader taxonomies of risks, vulnerabilities, controls, and techniques.
Table 1 summarizes how AIR’s required agent-mechanism fields differ from fields not explicit in general incident repositories.
AIR grounds taxonomy-driven red teaming in disclosed incidents by supplying evidence-backed scenario seeds and mechanism fields for coverage-gap analysis.
Agent evaluations test failures under constructed tasks and threat models, whereas AIR describes selected public events and audits which observed mechanisms an evaluation represents or omits.

3 Method

AIR constructs a deduplicated, source-grounded registry with explicit scope, counting rules, mechanism labels, and human review. Its analyses treat disclosure classes and population definitions descriptively while auditing how selected evaluations represent observed mechanisms.

3.1 Scope, unit, and populations: AIR’s counting unit is a registry record, with duplicate reports merged and stable AIR-YYYY-NNNN identifiers assigned under explicit merge and split rules.
3.2 Collection and deduplication: The corpus was built by searching 17 source channels, linking candidates through identifiers, quotations, vendor/date matches, and title similarity, then merging 115 duplicate candidates into 487 records.
3.2 Collection and deduplication: Admission required a fetched supporting URL and verbatim quotation; 457 records were high-confidence and 30 were medium-confidence.
3.3 Coding and reliability: AIR records outcome separately from disclosure class, defining realized impact as a real consequence while distinguishing in-the-wild, safety-failure, responsible-disclosure, and research-demo events.
3.3 Coding and reliability: Mechanism coding separates system context, event pathway, response evidence, and source metadata, with ambiguous agency assignments flagged separately.
3.3 Coding and reliability: A second reviewer inspected all 487 records and existing labels, but visible initial labels prevented this review from measuring independent coder agreement.

4 Measurements and evaluation audit

AIR shows that realized-outcome shares are shaped by disclosure composition, population definition, and source concentration rather than deployment risk. The evaluation audit finds that InjecAgent covers only attacker-triggered indirect prompt injection across three surfaces, leaving no-adversary safety failures outside its tested region.

4.1 Disclosure composition determines aggregate outcome shares: The full catalog’s 184/487 realized share (38%) primarily reflects disclosure pathways: in-the-wild and safety-failure records were usually realized, whereas responsible disclosures and research demonstrations were usually demonstrated.Only 28 records departed from that pattern; the two demonstrated-dominant classes contributed 285 records but only five realized cases.
4.1 Disclosure composition determines aggregate outcome shares: 81/336 primary-population records had realized harm (24%; 95% Wilson interval 20–29%), while source-host resampling widened the interval to 15–38%.Relaxing population restrictions produced 33% in the agent-acted subset and 32% in the generative subset; these are disclosure-sample sensitivities, not failure-incidence estimates.
4.1 Disclosure composition determines aggregate outcome shares: Agency-label uncertainty yielded 27%–42% identification bounds for the agent-acted realized share, compared with 33% under coded labels.Excluding all 113 agency-debatable records left 100 realized cases among 315 uncontested agent-acted records, or 32%.
4.2 Source dependence dominates precision: Removing dominant source blocks moved the primary population’s realized share from 24% as high as 40%, diagnosing source dependence rather than correcting the estimate.Removing the largest source block left 81/261 (31%), while removing the ten largest hosts left 67/166 (40%).
4.3 Autonomy is confounded with disclosure class: Realized-harm shares rose from 8% for assistants and approval-gated copilots to 24% for semi-autonomous and 54% for fully autonomous systems, but disclosure composition changed sharply across labels.The approval-gated group contained only two in-the-wild or safety-failure records, compared with 33 in the fully autonomous group, so the pattern does not identify an autonomy effect.
4.4 No-adversary failures expose an evaluation gap: AIR contains 92 no-adversary safety-failure records, 87 of them realized, whereas InjecAgent’s 1,054 cases occupy three of twelve surfaces and are all attacker-triggered.InjecAgent therefore does not test destructive, publication, and embodied-control failures without adversarial goal hijacking.

5 Threats to validity

AIR’s selected public-disclosure corpus has substantial limits for geographic, temporal, annotation, mechanism, and prevalence inference. Its records support retrieval and scope auditing, but not estimates of incidence, risk, or control efficacy.

Selection and denominator: AIR samples public disclosures rather than deployed systems or agent runs, so its counts cannot estimate incidence, prevalence, vendor risk, or control efficacy.Source visibility, reporting incentives, media attention, regulation, adoption, and researcher tooling all shape the observed corpus.
Evidence and annotation: A second reviewer inspected every record and existing label, but visible initial labels prevent this review from measuring independent coder agreement.The agency_debatable flag exposes one known boundary, while other misclassification and dependence among related records remain possible.
Geographic and temporal coverage: AIR does not code source language, incident country, or deployment geography, and its English-language collection makes regional representation unmeasured.Some non-English events rely on English-language summaries, but the passage characterizes this as a plausible coverage mechanism rather than a measured geographic result.
Geographic and temporal coverage: The 2026 collection is right-truncated at 2026-09-05, and disclosure dates have variable precision.These temporal constraints limit interpretation of the registry’s time coverage.
System scope: AIR excludes non-generative eligibility and ranking systems, so it cannot support claims about automated discrimination generally.The full catalog includes 44 non-generative embodied-autonomy records, but the generative subset and primary population apply an explicit ai_entity filter.
Mechanism-field limits: Control outcomes are source-silent for 390 of 487 records, while several mechanism fields have inadequate coverage for prevalence or risk-ranking claims.Tool access is unknown for all records, 113 vectors remain in the residual other family, and authority, reversibility, and financial-loss bands lack adequate coverage.

6 Artifact and use

The accompanying artifact packages AIR’s frozen corpus, coding materials, crosswalk audit, InjecAgent mapping, and reproducibility code. AIR is intended for source-grounded evaluation-scope auditing, while safeguards address disclosure, comparison, and dual-use risks.

Artifact: The artifact contains the frozen corpus, coding protocol, versioned ASI crosswalk and audit, InjecAgent mapping, and code for reproducing reported statistics and figures.
Intended evaluation use: AIR lets evaluation designers map test cases to surface, vector, and trigger fields and report represented and missing mechanisms.The realized/demonstrated distinction prevents demonstrated capability from being counted as field harm.
Intended evaluation use: AIR does not support attack-success rates, vendor rankings, or deployment-risk scores because public disclosures lack exposure denominators.
Societal impact and safeguards: Short evidence excerpts, source links, confidence labels, and correction provenance reduce but do not eliminate reputational and dual-use risks.The registry can also amplify contested claims, simplify exploit discovery, or invite unsupported vendor comparisons.

7 Conclusion

AIR converts fragmented public reports into a source-linked account of agentic-system failures while preserving distinctions needed for evaluation design. Its conclusion is methodological: selected disclosures can inform test coverage, but they are not deployment-rate evidence.

Conclusion: AIR’s central methodological lesson is to keep realized harm, demonstrated capability, causal role, and disclosure class separate when using incident evidence for evaluation design.
Conclusion: The 336-record primary population shows that disclosure class descriptively accounts for much of the apparent outcome and autonomy pattern.
Conclusion: Comparing AIR with InjecAgent exposes a no-adversary gap in attack-only evaluations.
Conclusion: AIR provides a disciplined bridge from public failures to test design, with source evidence and uncertainty attached.

Ethical Considerations

AIR records claims from public sources under an evidence rule but does not independently confirm every source claim. The release limits excerpts and payloads, while disclosure, correction, and conflict-of-interest boundaries remain relevant.

Ethical Considerations: An AIR identifier means a report met the corpus evidence rule, not that AIR independently confirmed every claim in the source.
Ethical Considerations: The release contains short evidence excerpts and no new exploit payloads, limiting direct amplification of sensitive material.
Ethical Considerations: An employer-independent correction process was planned but not operational at the corpus freeze, and the authors’ employer sells agent-security products.

Open Science

The submission includes an anonymized artifact with the frozen corpus, analysis code, validation description, and benchmark mapping needed for reproduction or audit.

The anonymized artifact contains the frozen corpus and analysis code for reproducing or auditing the reported results.
It also includes the human-validation description and benchmark mapping used in the study.
The planned persistent archive will distinguish author-created annotations and code from third-party source excerpts.

LLM Usage Considerations

LLM assistance was limited to scripting and language editing, while humans reviewed outputs and made all substantive scope, deduplication, and labeling decisions.

LLM Usage Considerations: LLM assistance was limited to drafting web-scraping and figure-generation scripts and editing manuscript language.
LLM Usage Considerations: Human authors reviewed the code, outputs, prose, and citations before submission.
LLM Usage Considerations: Humans made or adjudicated all scope, duplicate-resolution, and labeling decisions.
LLM Usage Considerations: The paper organizes coding around core schema fields and controlled attack-surface and vector vocabularies.

A.1 Class-by-autonomy cells

The catalog’s sensitivity analysis reports disclosure-class standardizations while emphasizing that sparse cells and disclosure selection limit inferential adjustment.

A.1 Class-by-autonomy cells: 42%, 41%, 34%, and 45% are the standardized shares for the four autonomy groups under the full catalog’s disclosure-class mix.
A.1 Class-by-autonomy cells: The standard population is disclosure-selected, so the sensitivity values should not be treated as inferential population estimates.
A.1 Class-by-autonomy cells: Small approval-gated in-the-wild and safety-failure cells preclude a precise adjusted estimate.
A.1 Class-by-autonomy cells: Five full-catalog records are both realized and coded as responsible disclosure or research demonstration, but these record-level judgments do not establish population harm.
A.1 Class-by-autonomy cells: AIR’s OWASP coding is a searchable mechanism index rather than a severity score or real-world risk estimate.
A.1 Class-by-autonomy cells: The registry supports evaluation audits and qualitative analysis, but not prevalence estimates, vendor rankings, causal claims, or automated severity decisions.