Public AI failures catalog

Reading this catalog

The catalog — index view

Twenty-two incidents with public sources, sorted by date. The 'category' column distinguishes model-fault, deployment-fault, and mixed. None of these dollar figures or dates are invented — each is from a court filing, regulator's order, SEC document, or major newsroom investigation linked in the citations section.

Detail — Moffatt v. Air Canada (Feb 2024)

Detail — Mata v. Avianca and the Bard demo (Jun 2023, Feb 2023)

Detail — NYC MyCity chatbot (Mar 2024)

Detail — Cruise robotaxi and Replit agent

The 'this wasn't actually AI' subset

A meaningful fraction of headline AI failures turn out, on inspection, to be human-fault stories with AI in the name. We track these separately because they distort policy debate. Three examples:

• Air Force 'rogue drone' (Jun 2023) — Col. Tucker Hamilton described to a Royal Aeronautical Society audience a scenario where a hypothetical reinforcement-learning drone might attack its operator. He used the word 'simulation.' The story went global as 'AI drone kills its operator in test.' Hamilton publicly clarified within days that no such simulation had been run — it was a thought experiment. The retraction got a fraction of the coverage the original claim did.
• Amazon 'Just Walk Out' (Apr 2024) — Marketed for years as a computer-vision triumph, the system actually relied on approximately 1,000 human reviewers in India tagging transaction video in the background. Amazon never publicly disclosed the human-in-the-loop ratio. The technology was rolled back at Amazon Fresh stores in favor of Dash Carts. Whether to count this as an 'AI failure' depends on whether one counts 'we said it was AI and it wasn't really' as a failure of the system or a failure of disclosure.
• Sports Illustrated bylines (Nov 2023) — Reported as 'AI wrote sports articles for SI.' What actually happened was The Arena Group (SI's publisher) sourced content from a vendor (AdVon Commerce) whose contributors had AI-generated author headshots and possibly AI-assisted text. The failure was editorial-due-diligence at the publisher, not a model going off-script.

Failure modes by category

Across the catalog, six recurring failure modes account for most of the documented harm. Builders should review their own systems against this list before shipping anything customer-facing.

Active legal frontiers

Three case threads are still active as of June 2026 and will likely set the precedents the rest of the industry runs on. We track them rather than predict them.

1. Dec 27, 2023

   NYT v. OpenAI / Microsoft filed

   The New York Times filed in S.D.N.Y. alleging copyright infringement through training-data ingestion of millions of NYT articles, plus near-verbatim regurgitation in some outputs. The Times sought billions in statutory damages and destruction of relevant models and training data. The court has since issued orders related to log preservation. The case is the most consequential AI training-data suit in the U.S. system. Outcome unresolved.

2. Jul 12, 2024

   Mobley v. Workday — class action allowed to proceed

   N.D. California ruled that Workday could be directly liable as an 'agent' of employers using its AI-based hiring tools, rejecting Workday's argument that it merely provided a tool. May 2025 update: Judge Lin granted conditional ADEA class certification, opening the door for affected applicants to opt in. This case will likely set the U.S. precedent on whether AI-vendor liability extends past the deploying employer to the model provider.

3. Nov 4, 2025

   Getty Images v. Stability AI — UK High Court judgment

   The High Court of England and Wales rejected Getty's primary copyright claim, finding that Stable Diffusion models do not 'contain or store reproductions' of training images in the sense required for secondary infringement. Getty did win in part on trade-mark grounds: outputs that reproduced the Getty watermark were found to be infringing in limited circumstances. The ruling does not bind U.S. courts but is the most developed common-law analysis to date on training-data copyright.

What an operator should actually do

Reading two dozen incident write-ups produces the same five takeaways repeatedly. We list them in priority order. None require buying anything from us; they are observations about deployment hygiene.

• Constrain scope before you constrain model. The most damaging failures in this catalog were not better models or worse models — they were models pointed at the wrong job. Decide what the system is allowed to answer and refuse to answer outside that. A bot that says 'I cannot help with that, here is the human contact' has never made headlines.
• Treat every model output as draft. The verification step is not asking the model to verify itself. Lawyers learned this the hard way. Engineers are now learning it with coding agents. Verification happens against a source outside the model — a database, a policy document, a test, a human.
• Real authority is in the credentials, not the prompt. If the agent has the credential to drop the table, the table can be dropped, regardless of what the system prompt says. If the AI system can sign a binding offer, your binding offer is whatever it generates. Authority lives where the permissions live.
• Pre-launch evaluation on the actual use case. Google's Bard demo was wrong about exoplanets because no one ran a fact-check pass on demo material before the launch event. The eval suite that would have caught this is trivial to build and would have prevented a $100 billion intraday move. There is no such thing as 'too small to evaluate.'
• Disclose the human-in-the-loop honestly. The hardest reputational damage in the catalog goes to operators who said the system was more autonomous than it was, then got caught. Disclosure is cheap. Discovery is expensive.

Corrections and additions