Key figure: 63% of organizations in IBM's 2025 breach study had no AI governance policy, and 97% of AI-breach victims had no proper AI access controls (IBM, Cost of a Data Breach Report 2025).
Fantasy sports, but the draft picks are AI vendors and the points come from publicly reported incidents — outages, data exposures, rogue-agent episodes. It's funny until you realize you're memorizing the actual incident history of AI agents 2026. Every score in this league is a real event with real lessons about what breaks when agents meet production.
That the failure modes repeat: prompt injection, permission overreach, hallucinated actions, and data leakage show up in incident after incident, across vendors of every size. Builders who study the history stop treating these as theoretical risks and start designing for them — approval gates, audit logs, and least-privilege defaults. The fantasy league format works because pattern recognition is the skill; once you've seen ten incidents, you can predict the eleventh.
An AI incident is a real-world event where an AI system caused harm, nearly caused harm, or behaved in a way its operators did not intend — from data leaks to autonomous actions nobody approved. Public incident trackers exist so the whole industry can learn from each one.
The most depressing fantasy sport ever invented. Draft a team of AI vendors — then score points when they suffer publicly-reported incidents, breaches and outages. Every incident below is real reporting: publication, date and source link, nothing invented.
Points count for the 2026 season only (incidents dated 2025–2026 in the seeded list). An incident scores for every vendor tagged on it. Disputed classifications are labeled on the incident card.
| # | Team | Vendors | Pts |
|---|
Leaderboard: this device only. It's your personal season, not a global ranking — no accounts, no tracking, no cookies.
Spotted a documented vendor incident we missed? We add entries only when the incident is covered by verifiable public reporting — the same bar as our tracker.
It's funny because it's true: the vendors with the most users are the vendors with the biggest blast radius. Every incident above was someone's bad quarter. BreachHunter exists so you're the one who finds the exposure before it's a headline — external attack-surface monitoring that watches your vendors, your code and your cloud the way attackers do.
A fantasy game where you draft teams of AI vendors and score points when they suffer publicly-reported incidents, breaches, and outages.
Each publicly-reported incident earns points by severity class — all incidents are cited with their source.
Breaches, outages, safety failures, and major policy reversals at AI companies — anything the public record documents.