How RogueWatch assesses incidents

What qualifies as rogue AI behavior?

The public tracker includes Level 4 (Rogue) incidents: an AI agent acted outside or against its operator's intent in a security incident affecting an organization, or a service and its users. Source material must support both the incident and the unauthorized behavior.

Unauthorized security harm to an agent's own organizational operator can qualify, including unrequested data deletion. An external intrusion is not required. Human-directed AI misuse, Tool, Assisted and ordinary Agentic activity, authorized maintenance and ordinary coding mistakes do not qualify merely because AI was involved. Individual-only cases are held for human review rather than automatically published.

Sources and publication checks

The daily automated pipeline reads configured public feeds, checks candidates against the scope and validates their records. It must quote the source sentence supporting the incident and rogue behavior. At least 2 independent sources are required before the pipeline assigns Rogue; the automated check counts distinct source hostnames, ignoring a leading www. This is a proxy for independence, not proof that two reports are editorially independent.

Sources can include an affected organization, an AI provider, a government body, researchers and credible reporting. Source titles, publishers and publication dates appear on each incident. Publication guardrails reduce unsupported claims; they cannot guarantee that every source or classification is correct.

Confidence describes the evidence

• Confirmed: Confirmed by the victim, the AI provider, a government, or 2+ independent sources.
• Reported: Reported by at least one credible outlet or researcher; not yet independently confirmed.
• Claimed: Claimed by the attacker or a single unverified party.

Confidence and severity measure different things. A confirmed incident can have limited impact. A severe allegation can remain uncertain. Disputed records can be corrected, downgraded or retracted as evidence changes.

Severity follows documented harm

1. 1: Attempted or no harm found: the AI tried, or touched public surfaces only.
2. 2: Accessed: got into systems or non-public data at one organization, small scale, nothing reported taken or broken.
3. 3: Exfiltrated or disrupted at one organization, or access across several organizations or dozens of systems.
4. 4: Exfiltration or disruption at scale: many organizations, 1,000+ records or accounts, hours of downtime, or a government response.
5. 5: Destructive or widespread: data or systems destroyed, critical infrastructure hit, or mass impact.

The HAVOC summary records source-supported damage such as systems compromised, records exposed, downtime, cost, containment and official response. Missing figures are unknown, not zero. Read the rating definitions.

Dates, locations and coverage limits

The occurrence date is separate from when a record was added or updated. Month-only and year-only dates keep that precision. Unknown locations stay undisclosed and are not plotted at an invented point on the globe. Some reported locations refer to headquarters rather than the physical location of the event; read the incident's location qualification.

The dataset is a collection of publicly reported cases. Reporting practices, disclosure delays and research coverage affect its counts. A leaderboard is not a ranking of overall model safety or proof that an AI provider acted unlawfully.

Updates and automation

A scheduled daily automated run checks new candidates and revisits existing evidence. Runs may publish no changes or fail. The site shows feed status and record timestamps. Publication does not imply a separate human approval for every automated update, and this is not a real-time security alert service.

Corrections and disputes

Anyone can submit a candidate with a public source. To challenge an existing record, open it on the globe and use its dispute control. The next run re-reads available evidence and can keep, correct, downgrade or retract the record. Changes appear in the incident's public change history. Retracted incidents retain their status and reason rather than silently disappearing.

For legal or removal requests, follow the terms and contact instructions. This project summarizes reporting and does not provide professional advice.