The public registry and open standard for cataloging AI code failures.
When AI generated code causes a production failure, security breach, or compliance violation, the lessons are usually buried in private postmortems. The same patterns repeat across thousands of organizations because nobody shares what went wrong.
AI Incident Registry changes that. It is the CVE equivalent for AI authored code failures.
npx @korext/incident-report draftAnonymous submissions welcome.
AICI-YYYY-NNNN
Example: AICI-2026-0047
AICI covers incidents where AI generated code caused a measurable negative outcome. Examples:
- SQL injection that shipped after AI suggestion
- Hallucinated API that passed review and failed in production
- Missing authentication in AI generated admin endpoint
- Off-by-one error in AI generated loop logic
- Deprecated dependency introduced by AI suggestion
- General software vulnerabilities not tied to AI authorship (use CVE)
- Harms caused by AI models to end users (use AI Incident Database)
- Attacks on AI systems (use MITRE ATLAS)
Regulatory pressure is mounting. The EU AI Act, SOX auditors, and insurance questionnaires are all asking about AI generated code. Without public incident data, risk assessment is guesswork.
Engineering teams need to know which AI code patterns have caused real incidents. This registry provides that knowledge.
- No victim blaming. Reports describe patterns, not shame organizations.
- Anonymization by default. Reporter identity is optional.
- Responsible disclosure. Active vulnerabilities follow 90 day disclosure.
- No AI tool shaming. We document what happened, not which tool is "bad."
- Verification before publication. Every report is reviewed.
- Right to redact. Corrections preserved for research integrity.
See ETHICS.md.
Every incident links to detection rules that would have caught it. This is the operational difference from traditional vulnerability databases. CVE tells you what broke. AICI tells you what would have prevented it.
Subscribe to the RSS or Atom feed:
Filter by severity, tool, or language via query parameters.
Full API documentation at oss.korext.com/incidents/api.
Endpoints:
GET /api/incidents/[id]- Retrieve incidentGET /api/incidents/search- Full text searchGET /api/incidents/export- Bulk data export (CC BY 4.0)POST /api/incidents/submit- Submit incidentPOST /api/incidents/notifications/subscribe- Subscribe to alerts
See SPEC.md. Released under CC0 1.0.
All published incident data is released under CC BY 4.0. Attribution to the registry and reporter is required.
See PRIOR_ART.md. AI Incident Registry complements CVE, OSV, AVID, AI Incident Database, and MITRE ATLAS.
See CONTRIBUTING.md.
To propose a new pattern type, submit a PR to SPEC.md.
To become a registry reviewer, contact maintainers@korext.com.
| Project | Description |
|---|---|
| AI Attestation | Track AI generated code in your repository |
| AI License Notice | Declare AI provenance in open source projects |
| Supply Chain Attestation | AI provenance across your dependency tree |
| AI Regression Database | Patterns AI tools consistently get wrong |
| AI Code Radar | Live AI code adoption data across open source |
| Commit Carbon | Carbon footprint of AI assisted commits |
Korext builds AI code governance tools. AI Incident Registry is an open community resource maintained by the Korext team.