Sunday, October 11, 2026
Paperclip Index

Weekly reading · methodology v1.0

Window ending June 23, 2025

Harms count in full for two weeks after they are reported, then one level less every two weeks. The control floor looks at reports from May 25, 2025 through June 23, 2025. A selected catalogue of reported AI incidents, reviewed through Oct. 10, 2026. This reading describes documented harm in the records or, when none qualifies, the highest control level breached. It is not a forecast or a measure of all AI activity.

Current recalculation

2

Control failures only · No qualifying harm. The reading is the highest control level breached: 2, by 4 records. It is a level, not a count.

Recalculated from the catalogue in this build. Historical backcasts were not published at the time.

Published at the time

No publication snapshot exists for this week.

Control failures only: readings 2 to 5Negligible6Minor20Moderate40Severe60Catastrophic80100
The harm ladder: the worst documented harm level picks the step; each tick is one qualifying harm at that level, and ten fill the step. The first, dark segment is the control floor: readings 2 to 5 mean no harm qualified and show the highest control level breached.

This is a backcast from the current catalogue. It was not a reading published at the time.

Records behind this reading

4 selected records; 0 documented external harms counting (0 qualifying). Records and ratings below reflect the current catalogue.

No harm counting that week. The reading is the highest control level breached, 2: a level, not a count (PI-0012, PI-0014, PI-0011, PI-0010). 4 records reported in the last 30 days.

Records behind this reading · 4

Only these records move the reading. How it is calculated

  1. PI-0010
  2. PI-0011
  3. PI-0014
  4. PI-0012

Sources

These links support the records above. Source availability and conclusions may change.

  1. GitHub (Invariant Labs demo repository): Demo pull request #2 opened by the hijacked agent (ukend0464/pacman)Cited in PI-0010
  2. Invariant Labs: GitHub MCP Exploited: Accessing private repositories via MCPCited in PI-0010
  3. DevClass: Researchers warn of prompt injection vulnerability in GitHub MCP with no obvious fixCited in PI-0010
  4. heise online: Attack via GitHub MCP server: Access to private dataCited in PI-0010
  5. Microsoft Security Response Center: CVE-2025-32711: M365 Copilot Information Disclosure VulnerabilityCited in PI-0011
  6. CVE Program (Microsoft CNA record): CVE-2025-32711 record (Microsoft as CNA)Cited in PI-0011
  7. Aim Security (Aim Labs): EchoLeak: zero-click AI vulnerability in Microsoft 365 Copilot (Aim Labs blog post; returned HTTP 403 when checked 3 Oct 2026)Cited in PI-0011
  8. The Hacker News: Zero-Click AI Vulnerability Exposes Microsoft 365 Copilot Data Without User InteractionCited in PI-0011
  9. Fortune: Microsoft Copilot zero-click attack raises alarms about AI agent securityCited in PI-0011
  10. Dark Reading: Researchers Detail Zero-Click Copilot Exploit 'EchoLeak'Cited in PI-0011
  11. Supabase: Defense in Depth for MCP ServersCited in PI-0014
  12. General Analysis: Supabase MCP can leak your entire SQL database (original post; current page retitled and re-dated)Cited in PI-0014
  13. GIGAZINE: A method that could leak entire SQL databases via AI protocol 'MCP' has been discoveredCited in PI-0014
  14. Simon Willison's Weblog: Supabase MCP can leak your entire SQL database (link post)Cited in PI-0014
  15. Anthropic: Agentic Misalignment: How LLMs could be insider threatsCited in PI-0012
  16. arXiv: Agentic Misalignment: How LLMs Could Be Insider ThreatsCited in PI-0012
  17. FOX 9: AI willing to let humans die, blackmail to avoid shutdown, report findsCited in PI-0012
  18. Simon Willison's Weblog: Agentic MisalignmentCited in PI-0012

Every weekly brief · How this reading is calculated · Download the weekly card