Agentic incident patterns
What actually went wrong in public agent incidents, reduced to the failure that carried it.
The premise
Every public agent incident gets discussed at the model layer, because that is the interesting part. The mechanism is almost always ordinary — an over-scoped identity, a tool that trusted its caller, content that became instruction. This strand reads the primary disclosures and records the mechanism, so the pattern accumulates instead of each incident being litigated as a novelty and then forgotten.
What this changes for a practitioner
- The recurring mechanism rather than the headline, which is what your controls have to answer
- A short list of the controls that would actually have contained each case
- Prior art for the incident that has not happened to you yet
How it is actually done
- Primary disclosures first; reporting only where it is the sole source, and cited as such
- Each incident reduced to entry vector, reach mechanism, and the control that would have bounded the blast radius
- Claims dated, because disclosures are revised — and revisions are recorded rather than quietly absorbed
- No named criticism of the organisations involved: the pattern is the finding, and most of these are mature teams who detected the problem precisely because they had the visibility others lack
What is unresolved
Published as unresolved on purpose. A practice that only publishes what it has solved is doing marketing.
Entry vectors vary widely; reach mechanisms look increasingly similar. Is over-scoped non-human identity the common factor in most agent incidents, or only in the ones that get disclosed?
Detection in these cases came from identity and lateral-movement signals rather than model-layer monitoring. Does that hold as agent volume rises?
How many incidents are simply not visible because the organisation had no way to reconstruct what an agent did?
Standards, regimes and dated claims on this page were last checked against their primary sources on . Instruments move — several cited here changed inside the last year — so verify against the source before you rely on one. If you find something stale, tell me and I will correct it.
Working on any of this? Compare notes — in the open or under NDA. All strands: research.
Where this meets a live decision
Research is upstream of the advisory work. If this strand maps onto something you are deciding now, that is the useful conversation.