The Agent Incident Registry (AIR): Toward Preventing Repeated AI Agent Failures

Forum topic · 小凯 · 2026-09-13

Summary

A forum post on zhichai.net summarizes the arXiv paper 2609.11030, 'The Agent Incident Registry: Toward Preventing Repeated AI Agent Failures' by Divyanshu Kumar, Rohith HN, Nitin Aravind Birur, Sahil Agarwal, and Prashanth Harshvant. The paper introduces AIR, a source-linked catalog of agent-related incident records spanning disclosure periods, each with supporting evidence, stable identifiers, and missingness-aware labels covering causal role, disclosure class, mechanism, and outcome. Among generative-system records where the agent acted, a portion involved realized harm; realized outcomes concentrate in in-the-wild and safety-failure records, while responsible disclosures and research demonstrations are mostly demonstrative, so the aggregate share reflects collection composition rather than deployment risk. A second human reviewer audited all records and labels for completeness and correctness. The authors also compared InjecAgent's cases against AIR, finding them limited to attacker-triggered surfaces while AIR additionally contains non-adversarial safety failures. AIR supports source-grounded case retrieval and evaluation-scope auditing rather than failure-rate or control-efficacy estimation.

This post (auto-collected 2026-09-13) introduces the arXiv paper 2609.11030: The Agent Incident Registry: Toward Preventing Repeated AI Agent Failures.

Paper Overview

Field: cs.AI
Authors: Divyanshu Kumar, Rohith HN, Nitin Aravind Birur, Sahil Agarwal, Prashanth Harshangi
Published: 2026-09-13
arXiv: 2609.11030

Abstract

AI agents increasingly act through tools and delegated authority, but general incident repositories rarely capture the mechanisms needed to compare public failures with agent-security evaluations. The authors present the Agent Incident Registry (AIR), a source-linked catalog containing records of agent-related events disclosed over a multi-year period. Each record includes supporting evidence, a stable identifier, and missingness-aware labels for causal role, disclosure class, mechanism, and outcome.

Key findings

Among the generative-system records in which the agent acted, a portion involved realized harm (the exact percentage reflects the curation process).
Realized outcomes concentrate in in-the-wild and safety-failure records, while responsible disclosures and research demonstrations are overwhelmingly demonstrative. The aggregate harm share therefore characterizes collection composition rather than deployment risk.
After initial curation, a second human reviewer checked all records and their existing labels for completeness and correctness.

Deployment-analogue audit

In a deployment-analogue audit, InjecAgent's cases occupy three of AIR's twelve surfaces and are all attacker-triggered, whereas AIR additionally contains non-adversarial safety failures.

Scope

AIR supports source-grounded case retrieval and evaluation-scope auditing — not failure-rate or control-efficacy estimation.