The Agent Incident Registry: Toward Preventing Repeated AI Agent Failures

• URL: http://arxiv.org/abs/2609.11030v2
• Date: Fri, 11 Sep 2026 12:00:24 GMT
• Title: The Agent Incident Registry: Toward Preventing Repeated AI Agent Failures
• Abstract summary: We present the Agent Incident Registry (AIR), a source-linked catalog containing 487 records of agent-related events disclosed from 2022 through 2026.<n>AIR supports source-grounded case retrieval and evaluation-scope auditing, not failure-rate or control-efficacy estimation.
• Score: 0.0
• License: http://creativecommons.org/licenses/by-sa/4.0/
• Abstract: AI agents increasingly act through tools and delegated authority, but general incident repositories rarely capture the mechanisms needed to compare public failures with agent-security evaluations. We present the Agent Incident Registry (AIR) (Project page: https://enkryptai.com/air), a source-linked catalog containing 487 records of agent-related events disclosed from 2022 through 2026. Each record includes supporting evidence, a stable identifier, and missingness-aware labels for causal role, disclosure class, mechanism, and outcome. Among the 336 generative-system records in which the agent acted, 81 involved realized harm (24\%). Realized outcomes concentrate in in-the-wild and safety-failure records, while responsible disclosures and research demonstrations are overwhelmingly demonstrated; the aggregate share therefore characterizes collection composition rather than deployment risk. After initial curation, a second human reviewer checked all 487 records and their existing labels for completeness and correctness. In a deployment-analogue audit, InjecAgent's 1,054 cases occupy three of AIR's twelve surfaces and are all attacker-triggered, whereas AIR contains 92 no-adversary safety failures. AIR supports source-grounded case retrieval and evaluation-scope auditing, not failure-rate or control-efficacy estimation.

Related papers

• FunnelAudit: Responsibility Auditing in Multi-Route Recommender Systems [6.810073531792462]
  Multi-route recommender systems combine retrieval, allocation, fusion, and ranking, making individual inclusions and exclusions difficult to audit.<n>We introduce FunnelAudit, an executable framework for incident-level responsibility auditing.<n>We instantiate the framework in two-stage, nine-route funnels using fixed union, weighted quota allocation, or weighted reciprocal-rank fusion, followed by SASRec ranking.
  arXiv  Detail & Related papers  (2026-09-07T03:01:07Z)
• HANSARD: A Reference Architecture for Forensic Readiness, Runtime Witnessing, and Graded Attribution in Autonomous Multi-Agent AI Systems [3.7015952547586832]
  An autonomous multi-agent system nowadays act in finance, software supply chains, and security operations.<n>No method can robustly establish what happened, what caused it, or who is accountable.<n>This is because provenance forensics works at the wrong abstraction, formal causality assumes the causal model, and agent auditing trusts self-recording.<n>The target failure mode is, thus, attribution laundering, spreading an act across redundant agents until none is a but-for cause.<n>This paper proposes HANSARD, a reference architecture treating accountability as a life-cycle property.
  arXiv  Detail & Related papers  (2026-08-23T17:18:22Z)
• One Gate Is Not Enough: Composing Stateful Pre-Action Controls for Agentic AI [0.0]
  We show that a remediation applied by one control can change the action, evidence, or context another control evaluates, invalidating that control's earlier judgment.<n>We formalize this coupling and give a remediate-and-regate protocol that restores per-action soundness in the current bounded, idempotent setting.<n>This is a mechanism demonstration on open payload data with a synthetic metadata layer, not a claim about production prevalence.
  arXiv  Detail & Related papers  (2026-08-18T22:24:44Z)
• Agent Safety Should Be a Runtime Contract [7.813225070853552]
  Agent safety should be a runtime contract enforced by the harness.<n> preventive face blocks dangerous actions before they happen.<n> evidential face requires verifiable proof that good actions actually happened.
  arXiv  Detail & Related papers  (2026-08-11T08:01:05Z)
• Agentic Permissions Policy Algebra for Taint Confinement in LLM Agents [0.0]
  Traditional taint tracking permanently taints an agent's context upon reading unvetted data.<n>We present APPA, an IFC framework that resolves this usability bottleneck through engine-managed context branching.<n>We evaluate APPA on a multi-turn tool-chaining benchmark across four models.
  arXiv  Detail & Related papers  (2026-07-27T16:19:45Z)
• VerifyMAS: Hypothesis Verification for Failure Attribution in LLM Multi-Agent Systems [79.51005192758262]
  Large language model-driven multi-agent systems excel at complex tasks.<n>However, unreliable agents remain a key bottleneck to system-level reliability.<n>We propose a hypothesis verification framework for agent failure attribution.
  arXiv  Detail & Related papers  (2026-05-17T14:09:35Z)
• Demystifying and Detecting Agentic Workflow Injection Vulnerabilities in GitHub Actions [13.116427545802571]
  GitHub Actions is increasingly used to deploy LLM-based agents for repository-centric tasks.<n>In this paper, we introduce Agentic Injection (AWI), a workflow-level injection flaw.<n>We characterize 1,033 real-world AI-assisted actions and extract AWI-specific specifications.<n>Based on these specifications, we design TaintAWI, a taint-analysis tool that tracks flows from untrusted event context to agent prompt inputs.
  arXiv  Detail & Related papers  (2026-05-08T02:13:04Z)
• Owner-Harm: A Missing Threat Model for AI Agent Safety [0.0]
  Existing AI safety benchmarks focus on generic criminal harm.<n>We propose Owner-Harm, a formal threat model with eight categories of agent behavior damaging the deployer.
  arXiv  Detail & Related papers  (2026-04-20T10:11:26Z)
• Re-Evaluating EVMBench: Are AI Agents Ready for Smart Contract Security? [10.248746359119625]
  EVMbench is the first large-scale benchmark for AI agents on smart contract security.<n>Its results have fueled expectations that fully automated AI auditing is within reach.<n>These findings challenge the narrative that fully automated AI auditing is imminent.
  arXiv  Detail & Related papers  (2026-03-11T14:07:16Z)
• Agents of Chaos [50.53354213047402]
  We report an exploratory red-teaming study of autonomous language-model-powered agents deployed in a live laboratory environment.<n>Twenty AI researchers interacted with the agents under benign and adversarial conditions.<n>Our findings establish the existence of security-, privacy-, and governance-relevant vulnerabilities in realistic deployment settings.
  arXiv  Detail & Related papers  (2026-02-23T16:28:48Z)
• OMNI-LEAK: Orchestrator Multi-Agent Network Induced Data Leakage [59.3826294523924]
  We investigate the security vulnerabilities of a popular multi-agent pattern known as the orchestrator setup.<n>We report the susceptibility of frontier models to different categories of attacks, finding that both reasoning and non-reasoning models are vulnerable.
  arXiv  Detail & Related papers  (2026-02-13T21:32:32Z)
• AIR: Improving Agent Safety through Incident Response [8.845095096023021]
  We introduce AIR, the first incident response framework for Large Language Model (LLM) agent systems.<n> AIR defines a domain-specific language for managing the incident response lifecycle autonomously in LLM agent systems.<n>Results show that AIR achieves detection, remediation, and eradication success rates all exceeding 90%.
  arXiv  Detail & Related papers  (2026-02-12T09:24:50Z)
• CausalArmor: Efficient Indirect Prompt Injection Guardrails via Causal Attribution [49.689452243966315]
  AI agents equipped with tool-calling capabilities are susceptible to Indirect Prompt Injection (IPI) attacks.<n>We propose CausalArmor, a selective defense framework that computes lightweight, leave-one-out attributions at privileged decision points.<n> Experiments on AgentDojo and DoomArena demonstrate that CausalArmor matches the security of aggressive defenses.
  arXiv  Detail & Related papers  (2026-02-08T11:34:08Z)
• AgentDoG: A Diagnostic Guardrail Framework for AI Agent Safety and Security [126.49733412191416]
  Current guardrail models lack agentic risk awareness and transparency in risk diagnosis.<n>We propose a unified three-dimensional taxonomy that categorizes agentic risks by their source (where), failure mode (how), and consequence (what)<n>We introduce a new fine-grained agentic safety benchmark (ATBench) and a Diagnostic Guardrail framework for agent safety and security (AgentDoG)
  arXiv  Detail & Related papers  (2026-01-26T13:45:41Z)
• Malice in Agentland: Down the Rabbit Hole of Backdoors in the AI Supply Chain [82.98626829232899]
  Fine-tuning AI agents on data from their own interactions introduces a critical security vulnerability within the AI supply chain.<n>We show that adversaries can easily poison the data collection pipeline to embed hard-to-detect backdoors.
  arXiv  Detail & Related papers  (2025-10-03T12:47:21Z)
• AgentArmor: Enforcing Program Analysis on Agent Runtime Trace to Defend Against Prompt Injection [14.522205401511727]
  Large Language Model (LLM) agents offer a powerful new paradigm for solving various problems by combining natural language reasoning with the execution of external tools.<n>In this work, we propose a novel insight that treats the agent runtime traces as structured programs with analyzable semantics.<n>We present AgentArmor, a program analysis framework that converts agent traces into graph intermediate representation-based structured program dependency representations.
  arXiv  Detail & Related papers  (2025-08-02T07:59:34Z)
• Malicious Agent Detection for Robust Multi-Agent Collaborative Perception [52.261231738242266]
  Multi-agent collaborative (MAC) perception is more vulnerable to adversarial attacks than single-agent perception. We propose Malicious Agent Detection (MADE), a reactive defense specific to MAC perception. We conduct comprehensive evaluations on a benchmark 3D dataset V2X-sim and a real-road dataset DAIR-V2X.
  arXiv  Detail & Related papers  (2023-10-18T11:36:42Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.