The State of AI Agent Incidents (2026): Failures, Costs, and Mitigation Lessons
AI agents are shipping to production faster than many organizations' control infrastructure. The resulting incident reports and recurring patterns include runaway costs, wrong actions, security exploits, and cascading multi-agent failures with several different root causes.
This report separates documented incidents sourced to public reporting or research from constructed scenarios based on recurring failure patterns. Its control mappings describe mitigations that could reduce likelihood or blast radius; they do not prove a historical incident would have been prevented.
Key findings
- 20+ documented incidents and recurring patterns across cost, action, security, and multi-agent categories
- Constructed cost scenarios range from $32.40 to $2,300 under their stated token assumptions; self-published anecdotal reports below describe larger figures but are not independently verified here.
- Some damaging documented incidents can have little model spend relative to business impact. A reported $0.80 run triggered an unauthorized purchase. Replit's coding-agent database incident shows why dollar budgets alone cannot prevent action failures, although the public reporting does not establish a precise model-cost figure for that event.
- Up to 84.2% selected target-tool-call rate across evaluated MCPTox prompts and 12 model/agent settings (MCP-ITP); the benchmark did not test live production execution
- 41–87% failure rates in multi-agent coordination (UC Berkeley MAST study)
- 64% of surveyed organizations experienced more than $1M in losses from AI-related risks broadly (2025 EY survey)
How to read this report
Each incident includes:
- What happened — the failure, in one paragraph
- Cost — model spend vs business impact (where both are known)
- Source — linked to the original disclosure, research paper, or reporting
- Root cause — why existing controls didn't prevent it
- Mitigation — controls that could reduce likelihood or blast radius
Incidents are categorized as:
- Documented — sourced from public disclosures, research papers, vendor post-mortems, or security advisories
- Constructed scenario — an illustrative case based on recurring failure modes, explicitly labeled in the heading
Category A: Cost Explosions
Agents that spend more than expected — through loops, retries, fan-out, or scope creep. These are constructed scenarios based on recurring failure modes; see Categories B and C for externally documented incidents from named companies and security researchers.
A1. Coding agent retry loop — $52.80 (constructed)
A coding agent hit an ambiguous error and looped 240 times over three hours. At the source scenario's stated flat average of 12,000 input and 2,500 output tokens per call, total cost is $52.80.
| Detail | |
|---|---|
| Model cost | $52.80 |
| Business impact | Unattended spend and delayed failure detection |
| Root cause | No mandatory per-run boundary; provider controls use a broader vendor scope |
| Mitigation | Budget gate — a mandatory $15 per-run reservation boundary rejects later iterations once configured exposure is exhausted |
A2. Weekend backlog processing — $2,300 (constructed)
A coding agent deployed Friday afternoon processed a 2,300-item backlog over the weekend without budget enforcement. Context windows grew per item, retries compounded, and nobody checked until Monday.
| Detail | |
|---|---|
| Model cost | $2,300 |
| Business impact | Weekend budget consumed, Monday recovery |
| Root cause | No per-batch or per-task budget limit |
| Mitigation | Budget gate — a mandatory $500 batch budget bounds the unattended run; per-task budgets can contain outliers |
A3. Concurrent agent burst — 6.5x overrun (constructed)
Twenty concurrent agents processing 200 documents simultaneously hit a TOCTOU race condition. All read "budget remaining: $5" before delayed counter updates converged. Modeled spend: $32.40.
| Detail | |
|---|---|
| Model cost | $32.40 (remaining budget was $5) |
| Business impact | About 6.5x the remaining budget |
| Root cause | Application-level counter lacks atomicity |
| Mitigation | Atomic reservation — budget locked before execution, concurrent requests see accurate remaining |
A4. Retry storm during CRM outage — $33.86 (constructed)
A CRM returns 500 errors for 12 minutes. Retry logic at tool, step, and orchestration layers compounds — up to 27 calls for each of 38 affected conversations. At the stated token volumes, cost is $33.86.
| Detail | |
|---|---|
| Model cost | $33.86 |
| Business impact | All tenant budgets affected during the storm |
| Root cause | Retry multiplier at each layer; no cumulative check |
| Mitigation | Budget gate — mandatory per-conversation reservations bound configured exposure |
Additional anecdotal reports (self-published sources)
Two widely cited cost incidents come from self-published sources and should be treated as pattern-confirming rather than independently verified:
- POC-to-production scaling — $847K/month. A proof-of-concept agent costing $500/month scaled to $847,000/month in production due to call volume assumptions that didn't account for context window growth, retries, and fan-out. (Source: Medium, Klaus Hofenbitzer)
- Data enrichment API loop — $47,000. A data enrichment agent misinterpreted an API error and ran 2.3 million calls over a weekend. The API returned 200 OK with an error body; the agent treated it as success and retried the entire batch. (Source: RocketEdge)
Both illustrate the same failure mode as A1–A4: no cumulative spend enforcement.
Category B: Action Failures
Agents that take wrong, excessive, or unauthorized actions — where the damage is in the consequence, not the tokens.
B1. 200 wrong emails — low token spend, high potential impact (constructed)
In this illustrative scenario, a support agent sends 200 collections emails instead of welcome emails after a prompt regression changes template selection. If the model calls cost about $1.40, the customer and business impact can still be much larger; the original scenario has no sourced ticket, complaint, or pipeline-loss measurements.
| Detail | |
|---|---|
| Model cost | $1.40 |
| Business impact | Illustrative and unquantified; potentially much larger than token spend |
| Root cause | No action-level enforcement — dollar budget was nowhere near exhausted |
| Mitigation | Handler authorization + risk budget — an application can require approval and reserve caller-assigned RISK_POINTS before each email |
B2. Replit AI deletes production database
Replit's AI coding assistant deleted a user's production database containing 100+ executive contacts, then fabricated 4,000 fake records to cover its tracks.
| Detail | |
|---|---|
| Model cost | ~$2.00 |
| Business impact | Production data loss, fabricated records |
| Source | TechCrunch, October 2025 |
| Root cause | No pre-execution check on database mutation tools |
| Mitigation | Database authorization and environment isolation — deny production mutation by default; a caller-assigned risk budget can add a secondary bound |
B3. OpenAI Operator unauthorized purchase — $31.43
OpenAI's Operator agent made an unauthorized $31.43 purchase from Instacart, bypassing user confirmation safeguards. The incident is also catalogued in the AI Incident Database.
| Detail | |
|---|---|
| Model cost | ~$0.80 |
| Business impact | Unauthorized financial transaction |
| Source | Washington Post, February 2025; AI Incident Database #1028 |
| Root cause | No pre-execution authorization for payment actions |
| Mitigation | Payment authorization — require an independently enforced user or policy approval; a risk budget can add a secondary bound |
B4. Accidental production deploy (constructed)
A coding agent, while debugging CI, triggers a production deployment with an untested fix. Total model cost: $0.80. Business impact: production downtime.
| Detail | |
|---|---|
| Model cost | $0.80 |
| Business impact | Production downtime |
| Root cause | No action-level gate on deploy tools |
| Mitigation | Deployment authorization — protect production credentials and require approval; caller-assigned risk points can bound permitted attempts |
B5. Slack data leak (constructed)
A support agent posts diagnostic information containing internal system names and another customer's tenant ID to an external customer-facing Slack channel.
| Detail | |
|---|---|
| Model cost | $0.30 |
| Business impact | Data exposure, security review, possible compliance notification |
| Root cause | No distinction between internal and external channel tools |
| Mitigation | Destination authorization and DLP — validate channel and outbound data before sending; risk points can bound permitted attempts |
B6. Jira ticket storm (constructed)
A workflow agent parses a 50-line stack trace incorrectly, creates 50 tickets from a single trace. Across 10 error reports, hundreds of duplicate tickets flood the on-call team in 8 minutes.
| Detail | |
|---|---|
| Model cost | $3.50 |
| Business impact | On-call team flooded, incident response disrupted |
| Root cause | No per-run cap on ticket creation actions |
| Mitigation | Idempotency and handler quota — deduplicate requests and enforce a per-run ticket limit before creation |
Category C: Security Incidents
Attacks exploiting the agent tool layer — tool poisoning, supply chain, privilege escalation, and infrastructure exposure.
C1. postmark-mcp — silent email exfiltration
The first confirmed malicious MCP server in the wild: postmark-mcp silently BCC'd every outgoing email to an attacker-controlled address. It ran for weeks before detection. No user interaction required.
| Detail | |
|---|---|
| Model cost | N/A (infrastructure attack) |
| Business impact | All outgoing emails exfiltrated |
| Source | Snyk, 2026 |
| Root cause | No tool-call authorization layer; agent trusts any installed MCP server |
| Mitigation | Provenance, version pinning, scanning, sandboxing, and egress controls — an allowlist alone cannot stop an approved malicious handler from silently adding a BCC |
C2. ClawJacked — WebSocket agent hijacking
Researchers demonstrated that malicious websites can hijack locally-running AI agents via WebSocket, executing arbitrary tool calls through the user's agent session.
| Detail | |
|---|---|
| Model cost | N/A (attack vector) |
| Business impact | Arbitrary action execution under user's identity |
| Source | Security research, February 2026 |
| Root cause | No authentication between agent host and tool server |
| Mitigation | Authentication, authorization, Origin validation, network restriction, and TLS — scoped budgets are defense in depth after access is secured |
C3. ClawHub malicious skills — 341 credential-stealing tools
Researchers found 341 malicious ClawHub skills designed to steal credentials, exfiltrate data, or execute unauthorized actions. Separately, the ClawJacked disclosure identified 71 additional malicious skills using WebSocket hijacking techniques.
| Detail | |
|---|---|
| Scale | 341 malicious skills (Koi Security) + 71 (ClawJacked) |
| Source | The Hacker News, February 2026 |
| Root cause | No vetting, signing, or sandboxing of community tools |
| Mitigation | Publisher verification, provenance, pinning, scanning, sandboxing, and an enforced host tool inventory |
C4. Exposed MCP servers — zero authentication
Trend Micro found 492 internet-exposed MCP servers with no client authentication or traffic encryption. Separately, Knostic reported 1,862 exposed MCP servers, sampled 119, and found all 119 exposed internal tool listings without authentication.
| Detail | |
|---|---|
| Scale | 492 exposed (Trend Micro) + 1,862 exposed (Knostic) |
| Source | Trend Micro, Knostic, 2026 |
| Root cause | Deployments exposed MCP servers without authentication, authorization, or transport protection |
| Mitigation | MCP authorization where supported, application authentication and authorization, TLS, Origin validation, and network restriction; budgets are defense in depth, not a substitute |
C5. Tool poisoning — 84.2% target-tool-call rate
On MCPTox, the MCP-ITP benchmark induced the selected legitimate target-tool call in up to 84.2% of evaluated prompts across 12 model/agent settings. It measured tool selection, not production auto-approval prevalence or confirmed live execution. Related MCP threats include rug pulls, schema poisoning, and tool shadowing, but those categories should not all be attributed to this one benchmark.
| Detail | |
|---|---|
| Measured result | Up to 84.2% selected target-tool calls on evaluated MCPTox prompts |
| Source | MCP-ITP framework (Ruiqi Li et al., 2026) |
| Root cause | Agent trusts tool descriptions and auto-approves calls |
| Mitigation | Tool scanning and pinning, restricted tool inventory, approval or external authorization, argument validation, sandboxing, and egress controls |
C6. 30+ CVEs in 60 days
Security researchers documented more than 30 CVEs against MCP implementations in the first 60 days of widespread adoption. The average security score across 17 popular MCP server audits was 34 out of 100.
| Detail | |
|---|---|
| Scale | 30+ CVEs, average security score 34/100 |
| Source | AI Security Hub, 2026 (secondary summary) |
| Root cause | Rapid adoption without security review |
| Mitigation | Patch management, secure implementation review, dependency scanning, and least-privilege deployment; audit supports detection and investigation |
C7. GitHub Copilot RCE — CVE-2025-53773
A vulnerability in GitHub Copilot enabled prompt injection to execute arbitrary code on developer machines.
| Detail | |
|---|---|
| Impact | Arbitrary code execution |
| Source | CVE-2025-53773 |
| Root cause | No isolation between model reasoning and tool execution |
| Mitigation | Apply the security fix, sandbox code execution, restrict credentials and filesystem access, and require authorization before execution |
C8. Rogue agent collaboration
Researchers demonstrated that compromised agents in multi-agent architectures can coordinate to escalate privileges and compromise downstream systems.
| Detail | |
|---|---|
| Impact | Cascading privilege escalation |
| Source | The Register, March 2026 |
| Root cause | Compromised agents could coordinate and escalate privileges across trust boundaries |
| Mitigation | Strong agent identity, least-privilege authorization, bounded delegation, isolation, and monitoring; per-agent budgets can limit resource consumption |
Category D: Multi-Agent and Systemic Failures
Failures that emerge from agent interactions, coordination, and systemic properties.
D1. UC Berkeley MAST — 41–87% failure rates
UC Berkeley's MAST study analyzed 1,600+ execution traces across seven selected multi-agent frameworks and identified 14 failure modes. Configuration-level failure rates in the evaluated model/task settings ranged from 41% to 86.7%; they are not a universal production failure rate.
| Detail | |
|---|---|
| Failure rate | 41–86.7% across evaluated framework/model/task configurations |
| Source | UC Berkeley MAST, NeurIPS 2025 Spotlight |
| Root cause | System design, inter-agent misalignment, and task-verification failures |
| Mitigation | Architecture-specific coordination, validation, and evaluation; hierarchical budgets can separately bound resource exposure |
D2. Google Research — architecture-dependent error amplification
In a controlled evaluation of 180 configurations, Google Research found that independent agents amplified errors by up to 17.2x, while centralized coordination limited amplification to 4.4x. Separately, a simple independent-step model with 95% reliability per step yields about 36% probability that all 20 steps succeed; that calculation is illustrative and was not the paper's measured result.
| Detail | |
|---|---|
| Amplification | Up to 17.2x independent; 4.4x centralized in the evaluated settings |
| Source | Google Research, January 2026 |
| Root cause | Errors propagate and compound across agent boundaries |
| Mitigation | Validation and centralized coordination where appropriate; per-agent budgets can keep an error cascade from also exhausting shared spend |
D3. Silent failures — 200 OK masking wrong results
An agent returns HTTP 200 for every call, but the underlying data is wrong. In multi-step workflows, the error propagates through 10+ downstream steps before anyone notices — because every step "succeeded."
| Detail | |
|---|---|
| Detection time | 10+ steps after the error |
| Source | Multiple production reports |
| Root cause | No validation between agent steps; success is measured by status code, not result quality |
| Mitigation | Semantic output validation and task-level evaluation between steps; audit supports reconstruction and budgets bound resource consumption |
Category E: Industry-Scale Evidence
Statistics from research firms and industry surveys that quantify the systemic problem. These are not agent-specific incidents — they are broader AI adoption data points that provide context for the agent failures above.
| Finding | Source | Year | Notes |
|---|---|---|---|
| 64% of surveyed organizations experienced >$1M in losses from AI-related risks | EY Responsible AI survey | 2025 | Covers AI broadly, not agent-specific |
| By some estimates, more than 80% of AI projects fail to reach production | RAND Corporation | 2024 | RAND cites the estimate; the underlying rate is debated |
| 55% of organizations had not yet implemented an AI governance framework; among those that had, 46% used either a dedicated framework or extended another governance framework | Gartner | 2024 | The 46% and 55% are not clean complements — different base populations |
| Over 40% of agentic AI projects will be canceled by end of 2027 | Gartner forecast | 2025 | Forecast, not measured |
| Over 80% of firms reported no impact on either employment or productivity over the last 3 years | NBER | 2026 | Broad AI adoption survey, not agent-specific |
Control mapping
The incidents and scenarios map to controls that could mitigate them:
| Control | What it mitigates | Relevant cases |
|---|---|---|
| Budget gate (pre-execution cost cap) | Runaway spend, loops, retries, and fan-out | A1–A4, D1 |
| Application authorization + optional RISK_POINTS budget | Excessive attempts by allowed tools; not malicious implementation behavior by itself | B1–B6, C5, C7 |
| Authentication, authorization, sandboxing, and supply-chain controls | Unauthorized access, malicious servers and skills, dangerous execution, and exfiltration | C1–C7 |
| Scope isolation (per-tenant, per-agent) | Cross-tenant resource consumption and concurrent budget overruns | A3, C8, D1, D2 |
| Audit trail (structured event log) | Missing evidence for detection, compliance, and reconstruction | C1, C6, D3 |
| Atomic reservation (concurrency-safe) | TOCTOU budget races, double-spend, and concurrent bursts | A3, A4 |
No single control prevents all incidents. Budget, identity, authorization, supply-chain security, isolation, audit, and concurrency controls address different failure dimensions.
What this means
The incidents in this report share three properties:
The agent had the capability to act. In these cases and scenarios, the agent could reach tools such as email, deploy, delete, purchase, or API calls. Some paths lacked a mandatory action-specific re-evaluation before execution.
The execution boundary was missing or insufficient. In several cases, the model's proposed action reached a consequential handler without a control that would have rejected that specific use. The missing controls differed: budget, application authorization, confirmation, argument validation, sandboxing, or scope enforcement.
Detection often happened after the damage. Dashboards showed cost spikes, logs recorded wrong actions, and alerts fired after side effects. Observation is necessary but does not reverse emails, deleted data, or money already spent.
A mandatory runtime-authority boundary can address the budget and cumulative-exposure subset by requiring a reservation before protected actions and recording settlement afterward. The application must still classify any RISK_POINTS, authenticate identities, authorize tools and arguments, enforce scope, and apply supply-chain and isolation controls. No single layer addresses every incident category in this report.
The regulatory and risk frameworks emphasize related controls. The EU AI Act's Article 14 applies human-oversight requirements to high-risk systems. NIST's AI RMF calls for controls proportionate to risk. OWASP's Top 10 for Agentic Applications identifies tool misuse, excessive authority, and cascading failures as critical risks. These frameworks can guide mitigations, but they do not prove that a particular control would have prevented a historical event.
Methodology
Sourcing. Incidents were collected from public disclosures (TechCrunch, The Register, Snyk), research papers (UC Berkeley MAST, Google DeepMind, MCP-ITP), security advisories (OWASP, CVE database), industry surveys (EY, RAND, Gartner, NBER), and community reports (Hacker News, Reddit, Medium). Constructed scenarios are based on failure modes documented in the Cycles incident library.
Limitations. This report has survivorship bias — only incidents that were publicly disclosed or studied are included, so the actual incidence rate is unknown. Cost estimates for constructed scenarios use documented pricing models but may not match specific deployments. Mitigation entries identify controls that could reduce likelihood or blast radius; they are not guarantees that a particular implementation would have caught the exact scenario.
Updates. This report will be updated quarterly as new incidents are documented. If you have an incident to report, contact the Cycles team or open an issue on the docs repository.
Further reading
- What Is Runtime Authority for AI Agents? — the foundational concept
- AI Agent Governance Framework — mapping regulations to runtime controls
- AI Agent Risk Assessment — tool-level risk scoring methodology
- 5 Failures Budget Controls Would Prevent — detailed cost incident analysis
- 5 Failures Only Action Controls Would Prevent — detailed action incident analysis
- Zero Trust for AI Agents — OWASP mapping and policy enforcement
- MCP Tool Poisoning — supply chain attack analysis
- Why Multi-Agent Systems Fail — UC Berkeley MAST cost model