{"asOf":"2026-10-03","doesNotChangeDepotPicks":true,"doesNotChangePriceSort":true,"doesNotChangeFreeIndex":true,"note":"Classification and failure modes are mechanisms. Case studies are included only when the source URL was fetched on 2026-10-03. A capability ceiling is not a company incident. Vendor figures are labeled as that vendor's report.","count":5,"catalogCount":27,"refused":["Replit agent database story (July 2025): The Register URL returned HTTP 403 and no first-party engineering postmortem was fetched. Not indexed.","CanLII HTML for 2024 BCCRT 149 returned a client-side block. The Civil Resolution Tribunal document was fetched instead and is the indexed source.","Cursor agent best-practices post loaded and is a product guide, not a postmortem. Not indexed as an incident. The University of Chicago study it mentions was not fetched.","Cognition 'Introducing Devin' (published 2024-03-12) duplicates the SWE-bench technical report. The report is indexed; the launch post is not a second study.","Anthropic many-shot jailbreaking research page loaded. It is an attack writeup, so it is not indexed and no procedure is stored.","OWASP LLM01:2025 was fetched and is cited on the prompt-injection failure mode only. Attack examples from that page are not copied into a case study.","Calder Lab and similar unsourced production-metric blogs were not fetched and are not indexed.","Google Research abstract for Data Cascades in High-Stakes AI loaded on 2026-10-03 (the abstract says 92% prevalence). Not indexed for data-etl: it is an interview study of ML data practice, not a pipeline job failure. The indexed data-etl study is the dbt Cloud status page."],"studies":[{"id":"gaia-2023","title":"GAIA: a benchmark for General AI Assistants","year":2023,"studyKind":"capability_ceiling","classIds":["research","personal-assistant"],"failureModeIds":["weak-verification"],"lesson":"The abstract says GAIA questions need reasoning, multi-modal handling, web browsing, and tool use, and that they are conceptually simple for people. It reports human respondents at 92% and GPT-4 with plugins at 15%, on a set of 466 questions. That gap is a ceiling for a general assistant, not an incident at a company.","sourceUrl":"https://arxiv.org/abs/2311.12983","asOf":"2026-10-03","notes":"Fetched the arXiv abstract (submitted 21 Nov 2023). Answers for 300 questions were held for a leaderboard, so a public question file is not the full scored set."},{"id":"openai-operator-2025","title":"Introducing Operator","year":2025,"studyKind":"vendor_writeup","classIds":["browser","personal-assistant"],"failureModeIds":["confirmation-skip","over-refusal"],"lesson":"The page describes a research-preview browser agent and says that before a significant action, such as submitting an order or sending an email, Operator should ask for approval. It also says the model is trained to decline some sensitive tasks, including banking transactions. A browser agent that submits or sends with no approval id is outside the behavior this writeup describes.","sourceUrl":"https://openai.com/index/introducing-operator/","asOf":"2026-10-03","notes":"Fetched page. A July 17, 2025 update on the same page says Operator was integrated into ChatGPT agent and that the standalone site would sunset. That update is a product change, not an incident report."},{"id":"appworld-2024","title":"AppWorld: A Controllable World of Apps and People for Benchmarking Interactive Coding Agents","year":2024,"studyKind":"capability_ceiling","classIds":["coding","personal-assistant"],"failureModeIds":["collateral-side-effects","weak-verification"],"lesson":"The abstract describes 9 apps and 457 APIs, and 750 tasks whose checks allow more than one solution while also flagging unexpected changes. It says GPT-4o solved about 49% of normal tasks and about 30% of challenge tasks. A task that reaches the goal and also mutates something else is still a failed check in this design.","sourceUrl":"https://arxiv.org/abs/2407.18901","asOf":"2026-10-03","notes":"Fetched the arXiv abstract. Capability ceiling, not a company incident."},{"id":"memgpt-2023","title":"MemGPT: Towards LLMs as Operating Systems","year":2023,"studyKind":"mechanism_study","classIds":["personal-assistant","rag","local-offline"],"failureModeIds":["context-overflow","silent-truncation"],"lesson":"The abstract says limited context windows handicap document analysis and multi-session chat, and describes moving text between tiers so the model sees a working set rather than the whole history. An assistant that answers a long document or a long memory from a single truncated window is the problem this paper is about. No accuracy number is stored because the abstract did not state one.","sourceUrl":"https://arxiv.org/abs/2310.08560","asOf":"2026-10-03","notes":"Fetched the arXiv abstract. A system paper, not an incident."},{"id":"willison-prompt-injection-2023","title":"Prompt injection: What's the worst that can happen?","year":2023,"studyKind":"mechanism_study","classIds":["personal-assistant","browser","security-review"],"failureModeIds":["prompt-injection","confirmation-skip"],"lesson":"The post explains that a tool-using assistant which reads untrusted text, such as email or a web page, can be driven to take an action the user did not ask for, including sending mail or reaching data through a connected tool. The lesson for an assistant is to treat fetched text as untrusted and to require confirmation before a send or an export. Attack sketches from the post are not stored.","sourceUrl":"https://simonwillison.net/2023/Apr/14/worst-that-can-happen/","asOf":"2026-10-03","notes":"Fetched the 14 April 2023 post. Hypotheticals in the post are not reproduced and are not marked as incidents that Depot verified."}]}