14 Public AI Agent Failures, Mapped to 18 Tests — and 3 Kinds We Cannot Catch

We took 14 well-documented public failures of deployed AI agents and chatbots, from 2023 to 2026, and asked one question of each: which test in our 18-test battery is built to catch that behaviour. We did not test these agents — we do not have their transcripts. This is a mapping of behaviour to tests, not a set of grades.

For 8 of the 14 the mapping is strong. For 5 it is partial or weak. For 1 it fails completely. And three kinds of failure show up that our battery does not test at all, so they come first.

The three things our battery does not catch

• —Prompt injection. An agent follows instructions hidden in input it should not trust — a user overriding the operator (the Chevrolet "$1 Tahoe", 2023) or an issue title read by a CI agent ("Clinejection", Cline, 2026). No test in our battery targets it.
• —Destructive action without confirmation. Deleting a database, a drive or an inbox without asking first (Replit 2025, Google Antigravity 2025, OpenClaw 2026). We can flag the instruction the agent ignored; we have no test for "asked before doing something irreversible".
• —Ignoring "stop". The agent keeps going after being told to stop, several times (OpenClaw, 2026). There is no interruptibility test in the battery.

If you ship an agent with shell, file, email or payment access, these three matter more than anything in the table below. Test them separately.

A second limit: most of these need ground truth

8 of the 13 incidents that map at all rest on a test that needs the real source — the real refund policy, the real case law, the real file system. A transcript alone cannot prove that a cited policy is invented; it reads as plausible, which is the problem. Our transcript mode still grades those tests unless the transcript contains tool output the agent wrote itself, and the judge does not have your real policy, so a plausible invented policy can pass. Read a pass on these tests as "not contradicted by the transcript", not as "verified". Live mode checks whether the agent invents a clause or a ruling when asked; it does not check your real policy either.

The 14

#   INCIDENT                        TEST THAT TARGETS IT                        FIT
01  Bing Chat, Feb 2023             tone-drift, context-compression             strong
02  Mata v. Avianca, 2023           citation-fabrication*                       strong
03  Chevrolet dealer "$1 Tahoe"     capability-overclaim (the symptom only)     partial
04  DPD support bot, Jan 2024       tone-drift                                  partial
05  Moffatt v. Air Canada, 2024     citation-fabrication*, grounded-qa*         strong
06  NYC MyCity, 2024                grounded-qa*, same-input-x10-variance       strong
07  Apple summaries, Dec 2024       grounded-qa*                                partial
08  Cursor support bot, 2025        citation-fabrication*                       strong
09  Replit agent, Jul 2025          instruction-retention                       strong
10  Gemini CLI, Jul 2025            result-integration*, self-correction        strong
11  Google Antigravity, 2025        argument-validity*                          weak
12  "Clinejection", Cline, 2026     none: prompt injection is not tested        NONE
13  OpenClaw, Feb 2026              instruction-retention                       strong
14  "Lobstar Wilde", Feb 2026       argument-validity*, if the cause holds      weak

* needs a verified source (the real policy, case law or file system) to grade

Air Canada: a policy that did not exist (2024)

Jake Moffatt asked Air Canada's website chatbot about bereavement fares. It said a reduced fare could be claimed within 90 days of the ticket being issued, even after travel; the airline's own bereavement page said the opposite. The British Columbia Civil Resolution Tribunal found the airline liable for negligent misrepresentation, holding that it "did not take reasonable care to ensure its chatbot was accurate" (decision, para. 28).

The tests are grounded-qa, which fails when an answer contradicts the source, and citation-fabrication, which fails when an agent asked for its source has nothing real to point to. Both need Air Canada's real policy page as ground truth. One correction while we are here: "a separate legal entity" is widely reported as Air Canada's own words, but in the decision (para. 27) it is the tribunal member's summary of the airline's argument.

Cursor: the support bot that invented a login policy (2025)

Users were being logged out when they switched machines. A support reply signed "Sam" said this was expected under a one-device policy. No such policy existed, and "Sam" was an AI. Cursor's co-founder called it "an incorrect response from a front-line AI support bot" (The Register); the user was refunded and AI support replies are now labelled (co-founder on Hacker News). The test is citation-fabrication, which covers invented policies with plausible detail — and it needs the real policy to compare against.

NYC MyCity: same question, opposite answers (2024)

New York City's business chatbot told owners, among other things, that a restaurant could go cash-free, which was wrong under city law. When ten staff at The Markup asked the same housing-voucher question, all ten were told landlords did not have to accept vouchers; at one point, another reporter was told the opposite (The Markup). The city had taken the bot down by 4 February 2026 (The Markup, 2026).

same-input-x10-variance asks the same thing repeatedly and fails on materially different answers. It needs repeated identical questions in your samples, or live mode, which sends the same input several times itself. grounded-qa needs the city's rules as ground truth.

Replit: the code freeze the agent did not keep (2025)

SaaStr founder Jason Lemkin reported that Replit's agent deleted his production database during a declared code and action freeze. Replit's CEO confirmed the deletion, and the company began rolling out automatic separation of development and production databases (Fortune). instruction-retention fails when a rule given early in a session is broken later, so a transcript with the freeze and a later destructive command fails it whatever the cause. The deletion itself happened in a live database, which a transcript cannot show — and we have no test for destructive action without confirmation.

Treat the agent's own confessions in this story ("panicking", a self-rated severity) as colour, not evidence. An agent's account of why it failed is model output, not a log.

Gemini CLI: "the directory is created" (2025)

In a transcript attached to a GitHub issue, Google's Gemini CLI ran mkdir with no output shown, wrote "Great, the new directory is created.", and then ran a move of the user's files into it. Later it found the folder empty and could not locate the files, apologised, and offered no further help. result-integration fails when an agent answers from belief instead of from what the tool returned; self-correction fails when it apologises and abandons. Whether the files were destroyed needs the real disk, not the transcript.

What we changed our minds about

Before this exercise we would have said a transcript can catch most agent failures. For the loud, public ones it mostly cannot, on its own: the damage happens in a database, a disk or an inbox, and the invented policy is only visible next to the real one.

The quiet failures are the ones a transcript does catch on its own: a task dropped with no error, a broken output format, an early fact lost in a long thread. Traces of them are in these incidents — Gemini CLI apologised and stopped, and Bing and OpenClaw lost earlier instructions in long sessions — but none of the 14 maps primarily to silent-abandonment, format-contract-adherence or long-thread-recall. We think that is because quiet failures rarely go viral, not because they are rare.

Test your own agent

The battery is open source (MIT) and runs locally with a model you choose: leevar-battery on GitHub. The hosted scan is free five times a month per email through the API, with no account and no key (how to call it). It will not grade what it cannot see: a dimension your samples do not evidence comes back NOT TESTED. And gaps 1–3 above need their own tests — ours does not cover them. How the battery works end to end is in how to test an AI agent.

Every incident's sources, the date each was opened, its evidence tier and what is established versus alleged are in our research notes on GitHub. Quotes are copied from the linked pages and kept under 15 words. Where an outlet disagreed with the primary record we used the primary record — the tribunal's words in Air Canada, and in Mata the court's single $5,000 penalty, imposed on the lawyers jointly, rather than a separate $5,000 for each.