Security Incidents Are Falling Because We Renamed Them Privacy Incidents

The number of reported AI security incidents is falling because successful attacks are being relabelled as privacy incidents, not because our defences are getting better.

What most people think

The current consensus is that AI security practices have matured. Teams have adopted adversarial testing, prompt injection defences, and model access controls. The reported numbers appear to support this. In our live AI incident database, which tracks reported AI failures from public news, security stories fell from 41 to 32 between the last 45 days and the previous 45 days. That is a 9 story decline. If you only read headlines, it looks like the work is paying off.

The governance and compliance categories are still growing, which fits the story that organisations are tightening controls. Privacy is dismissed as a separate track, mostly about consent banners and data subject requests. The assumption is that security and privacy are distinct problems with distinct fixes, and that a drop in security reports means fewer security events.

What the data shows

Over the same period, privacy stories rose from 50 to 99. That is an increase of 49 stories. Total stories in the database went from 425 to 480, so the overall volume is up, not down. The composition changed. Security shrank. Privacy nearly doubled.

The severity mix also shifted. The last 45 days had 52 critical stories, 415 major, and 13 minor. The prior 45 days had 76 critical, 339 major, and 10 minor. Critical stories fell by 24 while major stories rose by 76. Some of that movement is consistent with incidents being downgraded from critical to major rather than resolved.

Reporting concentration is another signal. The top five outlets carried only 7 percent of stories in the last 45 days. Yahoo Finance was 2 percent, ABC News 1 percent, Law360 1 percent, Fortune 1 percent, and IAPP 1 percent. No single outlet dominates. That means the category shift is not one publication changing its editorial line. It is happening across the reporting ecosystem.

Meanwhile, the catalogue of risk classes barely mentioned in the news includes overreliance and unsafe use at 0 stories, environmental harm at 0 stories, and lack of capability or robustness at 0 stories over 180 days. The categories that dominate are privacy leaking or inference at 169 stories, multi-agent risks at 102, and AI system security vulnerabilities at 91. Privacy is now the largest single visible category.

MITRE ATLAS attack techniques with documented real-world case studies are almost absent from the news window. LLM Prompt Crafting has 22 documented cases and no corresponding coverage in our 45 day window. Evade AI Model has 18 cases. AI Agent Tool Invocation has 15. User Harm has 12. Financial Harm has 11. These are not theoretical. They are catalogued, and they are not showing up in the incident stories.

On the security side, our sister platform ThreatClaw published 40 articles in 60 days, with 29 in ai-security alone. Recurring tags include data poisoning at 9, adversarial machine learning at 9, and prompt injection at 8. The security community is writing about active attack techniques. The governance and news world is writing about privacy. The gap between those two conversations is the story.

Why this happens

When an AI system is compromised and data is exposed, the organisation has a choice about how to report it. It can describe the event as a security failure, which triggers breach notification laws, security incident reporting under frameworks like the EU AI Act's serious incident reporting, and potential liability under negligence standards. Or it can describe the same event as a privacy incident, which triggers a different set of obligations, often narrower, often handled by a privacy office rather than a security team, and often resolved through notification and remediation rather than public disclosure of a vulnerability.

The same event can fit both definitions. A prompt injection that causes a model to reveal training data is a security attack and a privacy exposure. A compromised agent that leaks customer records is an intrusion and a data protection failure. The organisation picks the frame that carries less scrutiny. Privacy regulators have well-worn processes for handling data exposures. Security regulators are newer to AI and are still building their expectations, which makes security reporting feel more uncertain and more dangerous.

The EU AI Act's serious incident reporting under Article 73 arrives on 2 December 2027. High-risk obligations for Annex III systems apply on the same date. The Digital Omnibus deadline on 2 December 2026 ends the marking grace period and bans non-consensual intimate imagery and child sexual abuse material. These deadlines will force clearer incident definitions, but until they do, the ambiguity favours privacy framing.

In the United States, Colorado's ADMT Act, SB 26-189, takes effect on 1 January 2027, and California's CPPA ADMT compliance requirements also begin on 1 January 2027, with opt-out and pre-use notice phases starting 1 April 2027. Canada has no comprehensive federal AI law right now, though OSFI Guideline E-23 on model risk management, including AI and machine learning, takes effect on 1 May 2027 for federally regulated financial institutions. Each of these regimes has its own incident vocabulary, and none of them has yet issued guidance on how to classify an event that is both a security failure and a privacy exposure.

The best argument against this

The strongest objection is that privacy incidents are genuinely rising because AI systems are collecting and inferring more personal data than ever, and that the security decline is real. Under this view, better security practices are working, and the privacy surge reflects new AI capabilities that create new privacy risks, not relabelling.

That argument has force. AI systems do infer sensitive information more effectively than previous tools, and the privacy category at 169 stories over 180 days is large enough to be its own phenomenon. The severity mix also shows major stories rising, which could mean more moderate incidents are being caught and reported rather than hidden.

But the argument does not explain the timing. If privacy were rising on its own, we would expect security to stay flat or rise with it, since the same systems create both risks. Instead, security fell by 9 while privacy rose by 49. The total rose by 55. The categories moved in opposite directions within the same window. That pattern is more consistent with reclassification than with independent trends.

The argument also does not explain the absence of documented attack techniques from the news. If security were improving, we would still expect to see coverage of prompt crafting, model evasion, and agent tool invocation, because those techniques are documented and active. Their absence from the news window while they remain present in the security literature suggests the news is not capturing the security events that are happening.

What I think happens next

By December 2027, at least one major regulatory body will issue guidance specifically addressing the reclassification of security failures as privacy incidents. The EU AI Act's serious incident reporting deadline on 2 December 2027 creates the natural trigger, because it forces organisations to define what counts as a serious incident and to report it consistently. Colorado and California's ADMT regimes, effective in January 2027, add pressure from the state side. OSFI's Guideline E-23, effective 1 May 2027, adds pressure from the financial sector.

What would prove this wrong: if no such guidance is issued by any major regulatory body by December 2027. If the deadlines pass and regulators remain silent on classification, then the reclassification hypothesis is weaker, and the security decline is more likely genuine.

What to do about it

• Implement a dual-classification system for incidents that could be either security or privacy failures. Require every incident to be tagged with both dimensions before it is closed, so the security team and the privacy team both see the same event.
• Conduct regular penetration testing specifically targeting AI systems. Include prompt injection, training data poisoning, and agent tool invocation in the scope. ThreatClaw's write-up on how whistleblower reports on AI failures get hijacked before anyone reads them at https://www.threatclaw.ai/blog/how-whistleblower-reports-on-ai-failures-get-hijacked-before-anyone-reads-them is a useful reminder that internal reporting channels can distort the picture before it reaches a regulator.
• Track your own incident categories month over month against the public numbers. If your security reports are falling while your privacy reports are rising, check whether the same events are being counted twice or reframed.
• Map your incident definitions to the deadlines you actually face. The EU AI Act's Article 73 serious incident reporting, Colorado's ADMT Act, California's CPPA requirements, and OSFI Guideline E-23 each define incidents differently. Know which definition applies to which system.
• Review whether your governance programme is measuring what it claims to measure. A governance or risk programme can help here by forcing the classification question into the open, but the classification decision itself is yours.

A control is only as good as the threat it is sized against. If your incident numbers look better because the labels changed, you have not reduced risk. You have moved it.

More from our platforms

These sister platforms cover the parts of this problem that sit outside governance.

• Argus (argus.threatclaw.ai) records every trace an AI application produces and scans it for prompt injection, jailbreaks and data leaks, including the attacks hidden inside retrieved documents and tool results rather than in what the user typed. Governance decides what an AI agent is allowed to do. Argus shows what it actually did.
• ThreatClaw (www.threatclaw.ai) tracks the threat side of the same systems: 22 live intelligence feeds, exploitation predicted before it is officially confirmed, threat actor profiles, and detection rules you can deploy straight away. A control is only as good as the threat it is sized against.
• Xodexa (xodexa.com) runs 300 AI agents through structured, multi-round debates on the questions that do not have settled answers, and publishes the verdicts and the predictions that come out of them. Useful when the governance question is genuinely contested and you want the strongest version of the other side.

Related reading:

• How Whistleblower Reports on AI Failures Get Hijacked Before Anyone Reads Them on ThreatClaw
• ThreatClaw Intelligence Brief — 2026-09-08 on ThreatClaw