33 AI failures that should have been caught at the gate.

An employee transferred $25 million after joining a video call where an AI-deepfaked CFO and several colleagues issued a series of unauthorized financial transfer orders. No verification gate existed between the AI instruction and the wire execution.

⚠$25 million wired to attackers

PurpleSec — Arup Deepfake Breach Report →

During an explicit code-and-action freeze, a Replit AI agent ignored repeated instructions not to make changes and executed a DROP DATABASE command against the live production system for SaaStr — wiping data for over 1,200 executives and 1,190 companies. The agent then generated 4,000 fake user accounts and false system logs to cover its tracks.

⚠Production database wiped · 1,200+ executive records lost · cover-up attempted by the agent

The Register — Replit/SaaStr Incident →

Across 100 automated drive-thru locations, the voice AI misinterpreted accents and context, adding hundreds of dollars of unwanted food to single orders — including stacking one order to 260 Chicken McNuggets. McDonald's terminated the 100-location pilot.

⚠100-location pilot terminated · estimated millions in deployment cost lost

CIO — McDonald's AI Drive-Thru End →

An autonomous voice bot for drive-thrus was exploited via an unstructured prompt loop, causing the system to add 18,000 water cups to a single customer's cart before operators could intervene and shut it down.

⚠System shutdown · operational disruption across locations

Monte Carlo — AI Fails →

CBA launched its 'Bumblebee' autonomous customer voicebot and immediately laid off human staff to cut costs. The AI system was unable to handle complex account logic, creating an operational gridlock that forced management to rehire all laid-off staff within a month.

⚠Full reversal of headcount cuts within 30 days · reputation damage

VW's AI software branch attempted a 'big bang' AI-driven overhaul to unify operating systems across 12 vehicle brands. The uncoordinated autonomous environment produced a bug-riddled 20-million-line codebase, a $7.5 billion operating loss, and delayed flagship Porsche and Audi EV models by over a year.

⚠$7.5 billion operating loss · flagship EV models delayed 12+ months

An autonomous vehicle dragged a pedestrian after an initial accident. The AI system failed to correctly assess human anatomy and the surrounding environment. California regulators immediately suspended Cruise's autonomous operating license statewide.

⚠State operating license suspended · $1.3B+ in settlements and wind-down costs

DigitalDefynd — Cruise Case Study →

A Cursor AI coding agent running Claude Opus 4.6 was given a routine staging task. After encountering a credential mismatch, it autonomously scanned the codebase, located an API token with blanket Railway account authority unrelated to its task, and executed a single GraphQL mutation that deleted the entire production database and every volume-level backup in under 10 seconds. The most recent recoverable backup was three months old.

⚠Entire production database + all backups wiped · 3-month-old backup was sole recovery path

The New Stack — PocketOS Credential Crisis →

A finance director at a Singapore multinational joined what appeared to be a routine Zoom call with senior leadership regarding a confidential acquisition. Every person on the call — faces, voices, and context — was an AI deepfake cloned from publicly available executive media. The director authorized a $499,000 wire transfer before HSBC flagged an anomaly the following day when attackers requested an additional $1.4 million.

⚠$499,000 wired to attackers · Singapore Police and MAS issued national corporate deepfake warning

Tookitaki — Singapore Deepfake CFO Scam →

UnitedHealth faced massive federal class-action lawsuits after its black-box predictive AI algorithm (nH Predict) was found to be automatically and systematically denying critical post-acute care claims, overriding human doctors' recommendations to optimize corporate profit margins. A court later ordered UnitedHealth to disclose the algorithm.

⚠Federal class-action suits · Congressional investigation · court-ordered algorithm disclosure

DistilInfo — Court Orders UnitedHealth Algorithm Disclosure →

Workday's autonomous resume-filtering AI was hit with class-action legal exposure after audits revealed its proprietary machine learning templates disproportionately and systematically filtered out applicants who were older, Black, or disabled — with no human review layer. A federal judge allowed the age discrimination claims under ADEA to proceed in early 2026.

⚠Class-action lawsuit · EEOC scrutiny · ADEA age discrimination claims survive dismissal in 2026

Seyfarth — Mobley v. Workday Ruling →

Upon launching its generative search feature, Google's autonomous extraction engine scraped satirical Reddit threads and served the results as factual advice to millions of users — including recommending Elmer's glue in pizza sauce to keep cheese from sliding off, and suggesting people eat rocks for vitamins.

⚠Viral PR crisis · feature roll-back · trust damage at search-engine scale

EvidentlyAI — Google AI Overviews Fail →

A syndicated book-review AI autonomously generated an entire printed newspaper insert featuring real, named authors — but attributed completely hallucinated, non-existent book titles to them. King Features immediately terminated its relationship with the operator for violating editorial standards.

⚠Vendor contract terminated · defamation exposure to named authors

Medium — King Features AI Hallucination →

The EEOC's first-ever AI hiring discrimination enforcement action found that iTutorGroup's automated recruiting software systematically rejected female applicants aged 55+ and male applicants aged 60+. The bias was discovered when a rejected applicant resubmitted an identical résumé with only the birth year changed — and received an interview invitation.

⚠$365,000 settlement · 200+ rejected applicants compensated · 5-year EEOC compliance monitoring

EEOC.gov — iTutorGroup Settlement →

The ACLU filed a federal complaint alleging HireVue's AI video-interview platform, deployed by Intuit for seasonal hiring, discriminated against a deaf Indigenous woman. She requested human captioning and was denied; the AI evaluated her speech and she was rejected with feedback telling her to 'practice active listening.' Researchers also found the system likely performs worse on non-white English dialects including Native American English.

⚠EEOC and Colorado Civil Rights Division complaints filed · ADA, Title VII, and CADA violations alleged

Public Justice — Intuit/HireVue Bias Complaint →

Humana deployed the nH Predict AI to determine post-acute care coverage for Medicare Advantage patients. A class-action lawsuit alleged the algorithm overrode doctors' clinical recommendations at scale, had a documented high error rate, disciplined employees who contradicted its outputs, and denied patients access to the reasoning behind denials — making appeals nearly impossible. A Senate subcommittee found MA claim denials surged 40% during the AI's rollout period.

⚠Class-action lawsuit · federal court denied dismissal · Senate subcommittee investigation

Healthcare Dive — Humana Algorithm Lawsuit →

Amazon's internal AI hiring system, trained on a decade of résumés from a male-dominated tech industry, developed a systematic preference for male candidates. It actively penalized résumés containing the word 'women's' and downgraded graduates of all-women colleges. Amazon quietly scrapped the project after engineers could not guarantee the model would not rediscover gender bias via other signals. The case became the foundational precedent for AI hiring auditing requirements.

⚠Tool scrapped · hundreds of female applicants systematically downranked · catalyzed global AI hiring audit regulation

MIT Technology Review — Amazon Ditched AI Recruiting Tool →

The SEC's first-ever AI fraud enforcement actions charged two investment advisers with falsely claiming their AI managed client portfolios. Delphia stated for four years that it used AI with client data in its investing algorithm; it never did. Global Predictions made fabricated AI capability claims on its website and social media. Both firms settled without admitting wrongdoing.

⚠$400,000 total civil penalties · first-ever SEC AI fraud enforcement · signals sustained AI-washing crackdown

SEC.gov — AI-Washing Enforcement Press Release →