{"asOf":"2026-10-03","doesNotChangeDepotPicks":true,"doesNotChangePriceSort":true,"doesNotChangeFreeIndex":true,"note":"Classification and failure modes are mechanisms. Case studies are included only when the source URL was fetched on 2026-10-03. A capability ceiling is not a company incident. Vendor figures are labeled as that vendor's report.","count":2,"catalogCount":27,"refused":["Replit agent database story (July 2025): The Register URL returned HTTP 403 and no first-party engineering postmortem was fetched. Not indexed.","CanLII HTML for 2024 BCCRT 149 returned a client-side block. The Civil Resolution Tribunal document was fetched instead and is the indexed source.","Cursor agent best-practices post loaded and is a product guide, not a postmortem. Not indexed as an incident. The University of Chicago study it mentions was not fetched.","Cognition 'Introducing Devin' (published 2024-03-12) duplicates the SWE-bench technical report. The report is indexed; the launch post is not a second study.","Anthropic many-shot jailbreaking research page loaded. It is an attack writeup, so it is not indexed and no procedure is stored.","OWASP LLM01:2025 was fetched and is cited on the prompt-injection failure mode only. Attack examples from that page are not copied into a case study.","Calder Lab and similar unsourced production-metric blogs were not fetched and are not indexed.","Google Research abstract for Data Cascades in High-Stakes AI loaded on 2026-10-03 (the abstract says 92% prevalence). Not indexed for data-etl: it is an interview study of ML data practice, not a pipeline job failure. The indexed data-etl study is the dbt Cloud status page."],"studies":[{"id":"anthropic-computer-use-2024","title":"Developing a computer use model","year":2024,"studyKind":"vendor_writeup","classIds":["computer-use","security-review"],"failureModeIds":["prompt-injection"],"lesson":"Anthropic's post says computer use was in public beta and names prompt injection as a case where instructions in content can override prior directions or cause actions that were not the user's intent. It notes that a model reading screenshots from an internet-connected computer can be exposed to that content. The lesson stored here is to treat screen text as untrusted. The post's attack detail is not copied.","sourceUrl":"https://www.anthropic.com/news/developing-computer-use","asOf":"2026-10-03","notes":"datePublished on the fetched page is 2024-10-22. No procedure is stored."},{"id":"willison-prompt-injection-2023","title":"Prompt injection: What's the worst that can happen?","year":2023,"studyKind":"mechanism_study","classIds":["personal-assistant","browser","security-review"],"failureModeIds":["prompt-injection","confirmation-skip"],"lesson":"The post explains that a tool-using assistant which reads untrusted text, such as email or a web page, can be driven to take an action the user did not ask for, including sending mail or reaching data through a connected tool. The lesson for an assistant is to treat fetched text as untrusted and to require confirmation before a send or an export. Attack sketches from the post are not stored.","sourceUrl":"https://simonwillison.net/2023/Apr/14/worst-that-can-happen/","asOf":"2026-10-03","notes":"Fetched the 14 April 2023 post. Hypotheticals in the post are not reproduced and are not marked as incidents that Depot verified."}]}