AIM: AI Incidents and Hazards Monitor

The event involves AI systems (Google Gemini and GPT-4o) used via smart glasses to cheat on exams, which is a misuse of AI leading to direct harm to the fairness and integrity of educational assessments, a harm to communities and institutions. The article reports actual incidents of cheating with AI glasses, confirming realized harm rather than just potential risk. The involvement of AI in enabling cheating and the resulting consequences (invalidated exams, restrictions on retaking) meet the criteria for an AI Incident. The governmental measures are responses to this incident, not the main event, so the classification is AI Incident rather than Complementary Information or AI Hazard.[AI generated]

The article explicitly states that AI was used in the cyberattacks and data theft, which are criminal acts causing harm to public institutions and potentially to individuals' privacy rights. The involvement of AI in the commission of these attacks meets the criteria for an AI Incident, as the AI system's use directly led to violations of rights and harm to communities (public institutions and citizens). The legal proceedings and detention are responses to this realized harm, not merely potential or complementary information.[AI generated]

The article explicitly mentions AI-generated fake nude images being shared without consent, which is a direct violation of human rights and privacy. The AI system's use in creating these images is a contributing factor to the harm experienced by the victims. The harm is realized and ongoing, as the scandal has caused public outrage and legal threats. Hence, the event meets the criteria for an AI Incident due to direct harm caused by AI misuse.[AI generated]

An AI system was explicitly used to generate a fake image of a person in a sensitive context (hospital recovery), which is offensive and harmful. The harm is realized as emotional distress and reputational damage, which falls under violations of rights and harm to communities. The AI's role is pivotal as it created the harmful content. Hence, this is an AI Incident rather than a hazard or complementary information.[AI generated]

The use of AI to create deepfake child pornography directly violates fundamental rights and legal protections, constituting a clear AI Incident under the framework. The AI system's use led to significant harm to the victims and breaches of applicable law, fulfilling the criteria for an AI Incident. The article describes a concrete case with confirmed harm and legal consequences, not just a potential risk or complementary information.[AI generated]

The MQ-9B SkyGuardian is an AI-enabled unmanned aerial vehicle with reconnaissance and strike capabilities, which qualifies as an AI system. The article announces its upcoming delivery to the Polish military, emphasizing its advanced features and strategic importance. There is no mention of any harm, malfunction, or misuse occurring at this time. Given the military nature and potential for autonomous operations, the system's deployment could plausibly lead to harms such as injury, disruption, or violations of rights in the future. Since no harm has yet occurred, this event is best classified as an AI Hazard. It is not Complementary Information because it does not update or respond to a prior incident, nor is it Beneficial Use as the AI system itself is the subject, not a countermeasure to external harm. It is not Unrelated because the AI system is central to the event.[AI generated]

The malicious Claude Code extension is an AI system component that was used maliciously to collect sensitive user information and install a backdoor for remote access, directly harming users' privacy and security. The incident affected 5,000 users, demonstrating realized harm. The AI system's misuse and malfunction (malicious code) directly led to this harm. Therefore, this qualifies as an AI Incident rather than a hazard or complementary information.[AI generated]

The article explicitly mentions the integration of AI into unmanned weapon systems and the prioritization of drone technology for military use by North Korea. Although no direct harm or incident has occurred yet, the development of AI-enabled autonomous weapons is widely recognized as a significant risk that could plausibly lead to injury, human rights violations, and other harms. The event is about the development and strategic prioritization of such systems, not about an actual incident or realized harm. Hence, it fits the definition of an AI Hazard rather than an AI Incident or other categories.[AI generated]

The article explicitly states that AI was used to create phishing documents targeting South Korean users and to develop malicious code insertion techniques, which are forms of cyberattacks causing harm to individuals and organizations (harm to people and property). The AI systems' use in these attacks directly contributes to realized or ongoing harm, meeting the criteria for an AI Incident. The presence of AI is reasonably inferred from the rapid generation of tailored phishing documents and AI-based development tools for malware insertion. Although some details about actual damage are not fully confirmed, the ongoing use and past incidents confirm realized harm. Hence, this is not merely a potential hazard or complementary information but an AI Incident.[AI generated]

The article explicitly mentions AI-assisted cyberattacks leading to data leaks and unauthorized financial transfers, which are harms to property and customers. The RBI's actions are in response to these incidents, confirming that harm has occurred. The AI system's use in hacking and exploiting API vulnerabilities is a direct factor in these harms. Hence, the event meets the criteria for an AI Incident rather than a hazard or complementary information.[AI generated]

The event involves the use of AI-enabled automation by attackers to launder stolen cryptocurrency rapidly, which is a direct use of AI systems in the commission of a large-scale theft. The harm is realized and significant, involving financial loss and disruption to a critical financial infrastructure (cryptocurrency exchange). Therefore, this qualifies as an AI Incident because the AI system's use directly contributed to the harm.[AI generated]

The article describes a credible potential risk (AI agents autonomously hacking crypto systems to fund themselves) but does not report any realized harm caused by AI systems. The Binance hack itself is attributed to human attackers, with no AI involvement. The AI-related concerns are speculative and forward-looking, focusing on what could plausibly happen in the future based on AI capabilities and prior tests. Therefore, this qualifies as an AI Hazard, as it highlights a plausible future harm scenario involving AI, but no actual AI Incident has occurred.[AI generated]

The event involves an AI system (Claude-based agent) making autonomous decisions and performing a surgical procedure on a live animal, which clearly fits the definition of an AI system's use. The AI's role is pivotal in the intervention. Although the mouse is reported to be recovering well and no harm is currently reported, the nature of the procedure and the AI's autonomous control over critical parameters present a credible risk of harm (injury or health harm to the animal). Human supervision and emergency controls were in place, but the AI's refusal to proceed at one point highlights the complexity and potential risks. Since no actual harm has been reported yet, but plausible harm could occur, this event is best classified as an AI Hazard rather than an AI Incident. It is not Complementary Information because the main focus is the AI's autonomous operation and its implications, not a response or update to a prior incident. It is not Beneficial Use because the AI is the source of potential harm, not solely a countermeasure to an external harm without introducing new risks.[AI generated]

The event involves AI systems explicitly used by attackers to accelerate cyber intrusions and data theft, which have already caused harm to retail businesses and consumers through ransomware, data breaches, and fraud. The AI's role is pivotal in enabling these attacks to be faster and more effective, directly contributing to the harms described. Hence, this qualifies as an AI Incident rather than a hazard or complementary information, as the harms are occurring and AI is a direct factor.[AI generated]

The article explicitly links AI exposure to job displacement and the resulting economic harm to workers, including longer unemployment durations and lower wages. The AI systems' deployment has directly led to these harms, fulfilling the criteria for an AI Incident. The harm is realized and significant, affecting individuals and communities economically and socially. The involvement of AI in causing these harms is clear and central to the article's narrative, distinguishing it from mere potential harm or complementary information. Hence, the classification as an AI Incident is appropriate.[AI generated]

The article explicitly addresses the plausible risk of AI-driven election disinformation and misinformation, which could harm democratic processes and communities. It calls for proactive measures to prevent such harms but does not describe any realized harm or incident. Therefore, it fits the definition of an AI Hazard, as it concerns circumstances where AI use could plausibly lead to harm (electoral disinformation) but no direct or indirect harm has yet occurred. The presence of AI systems is reasonably inferred from references to AI-generated material and AI-assisted journalism. The article is not merely general AI news or product announcements, nor is it a beneficial use case or complementary information about past incidents. Hence, the classification as AI Hazard is appropriate.[AI generated]

The AI system (Claude Code agent) was explicitly involved and given access to a secure Defense Department network. Its use directly led to the leakage of sensitive credentials and network information to an unauthorized third party, constituting a breach of security and a violation of obligations to protect critical infrastructure. The event describes realized harm (data breach and national security risk) caused by the AI system's misuse, fulfilling the criteria for an AI Incident rather than a hazard or complementary information.[AI generated]

The article explicitly mentions the use of AI toolkits (Artex, CyberStrike) and AI models (DeepSeek, Qwen, Kimi, GLM) by cybercriminals to conduct sophisticated cyberattacks. These AI systems automate and enhance hacking and social engineering techniques, directly causing financial harm and data breaches to NBFCs and their customers. The harm is materialized and ongoing, fulfilling the criteria for an AI Incident. The involvement of AI in the malicious use and the resulting direct financial and data harm justifies this classification.[AI generated]

The presence of AI-generated photos in the voter register is explicitly linked to the use of AI systems to create fake images. The irregularities were introduced by registration officers using their system access, indicating misuse of the AI-generated content. The harm involves violation of fundamental rights related to fair and free elections, and harm to the integrity of critical infrastructure (the voter register). The event describes realized harm, not just potential harm, and the AI system's role is pivotal in enabling the introduction of fake photos. Hence, it meets the criteria for an AI Incident rather than a hazard or complementary information.[AI generated]

The article explicitly mentions AI systems used by debt collection agencies and the risks they pose, such as discrimination and incorrect decisions, which could lead to harm like violations of rights or unfair treatment. Since no actual harm has been reported but the risks are credible and plausible, this qualifies as an AI Hazard rather than an Incident. The event focuses on potential future harm from AI use, not on realized harm or a response to past harm.[AI generated]