The AI Incident Record Cannot See Slow Harm

No outlet carries enough incident volume to keep a reporter on an AI beat, so the public record is structurally blind to harms that develop over quarters instead of days. A governance programme that treats that record as its horizon scan will miss exactly the risks regulators are about to ask about.

What most people think

The consensus reads the numbers as healthy. The top five outlets carry only 8% of stories in the last 45 days, and the largest single outlet carries 2%. No gatekeeper. No single editorial line deciding what counts as an AI failure. Coverage is distributed across many small publications, which sounds like a broader, more democratic record than the old model where two or three newsrooms set the agenda.

On this reading, the incident feed is a decent proxy for what is happening in the world. If something mattered, somebody would write it up. The absence of a category from the feed is read as evidence that the category is quiet.

What the data shows

Our live incident database, which tracks reported AI failures from public news, holds 1135 stories over the last 180 days. Volume is stable: 457 stories in the last 45 days against 486 in the 45 before that. So this is not a volume problem. There is plenty being written.

The distribution is the problem. The top five outlets carry 8% of the last 45 days: Biometric Update at 2%, JD Supra at 2%, Yahoo Finance at 2%, Help Net Security at 2%, Law360 at 1%.

Now compare that with the catalogued risk classes that get almost no matching stories in 180 days, drawn from the MIT AI Risk Repository subdomains. Overreliance and unsafe use: 0 stories. Environmental harm: 0 stories. Lack of capability or robustness: 0 stories. Competitive dynamics: 2 stories.

The classes that do get attention are the ones that fit a daily news cycle. Compromise of privacy by leaking or correctly inferring sensitive information: 140 stories. Multi-agent risks: 84. AI system security vulnerabilities and attacks: 83. Fraud, scams, and targeted manipulation: 74. Governance failure: 37.

The same gap shows up on the security side. Our sister platform ThreatClaw has published 40 articles in 60 days, and the recurring tags skew heavily toward AI security, LLM security, data exfiltration and credential theft. Meanwhile MITRE ATLAS lists attack techniques with documented real-world case studies that our news window never mentions: LLM Prompt Crafting with 22 documented cases, Evade AI Model with 18, AI-Enabled Product or Service with 16, AI Agent Tool Invocation with 15, User Harm with 12, Financial Harm with 11.

Why this happens

Slow-onset harms are only detected by a reporter who stays on a beat long enough to notice a trend. That is the whole mechanism. A trend in overreliance does not announce itself on a Tuesday. It looks like a hundred unremarkable decisions, each defensible, that add up to a workforce that has stopped checking a system it no longer understands. Environmental harm from training and inference looks like a line item that grows quietly. Capability and robustness gaps look like a model that works fine until the input distribution shifts. Competitive dynamics look like a market slowly narrowing.

None of these produce a single event with a timestamp. They produce a pattern.

Patterns are expensive to report. They require a reporter who already knows the baseline, who remembers what the number was six months ago, and who has the standing to publish something that is not tied to today's news. That is what a beat is. It is institutional memory with a byline.

When no outlet carries more than 2% of the volume, every outlet is a generalist reacting to the day's story. The economics push toward whatever is already moving. A generalist can cover a breach because the breach is the story. A generalist cannot cover the absence of a breach, or a slow drift in how people use a tool, because there is no event to hang it on. So the feed fills with privacy, security, fraud and multi-agent incidents, all of which have a moment you can point to, and the slow classes stay at zero not because nothing is happening but because nothing is happening in a shape that fits.

The stable total volume makes this worse, not better. It looks like a healthy feed. It is a feed with a systematic blind spot and no slack in the system to notice.

The best argument against this

The strongest objection is that the public news record was never meant to be a risk register. It is a lagging indicator of what editors found interesting, and treating its gaps as real gaps is a category error. On this view, the four near-zero classes are near-zero because they are genuinely hard to attribute to AI, not because of a beat problem. Overreliance is a human factors issue that shows up in productivity studies and internal audits, not news. Environmental harm is measured by energy disclosures, not incidents. Capability and robustness gaps are documented in model cards and evaluations. Competitive dynamics are the subject of competition authorities, not reporters. The feed is doing its job; the reader is misusing it.

That objection is partly right, and it is the reason the claim matters. If these harms are better tracked outside the news, then the news is the wrong horizon scan, and the governance teams using it are still blind. The objection changes the mechanism, not the conclusion. And it does not explain the distribution finding. If the feed were simply a lagging indicator of what editors find interesting, we would still expect a beat structure to produce occasional deep coverage of a slow class. Instead we see a flat zero across 180 days in three categories, with the largest outlet at 2%. That is not editorial taste. That is the absence of anyone whose job is to look.

What I think happens next

By 2028-09, at least one of the four near-zero categories, overreliance, environmental harm, capability and robustness, or competitive dynamics, will be the subject of a named regulator's or standards body's formal consultation or guidance document, while remaining under 10 stories in our 180-day feed at that date.

The regulatory calendar supports this. The EU AI Act's high-risk obligations for Annex III systems apply from 2027-12-02, with serious-incident reporting under Article 73 on the same date, and Annex I embedded high-risk obligations from 2028-08-02. The EU AI Act's rule on labelling AI-generated content applies from August 2026. Colorado's original AI law was repealed and replaced by a narrower one starting January 2027, and California's CPPA automated decision-making compliance requirements land in 2027. OSFI Guideline E-23 on model risk management, including AI and machine learning, takes effect 2027-05-01. Regulators writing rules for high-risk systems have to say something about overreliance and robustness, because those are the failure modes that matter once a system is embedded in a decision.

What would prove this wrong: check the consultation and guidance pages of the EU AI Office, NIST and OSFI before 2028-09, and pull the 180-day category counts at that date. If none of the four categories has produced a formal document, or if the feed count for the covered category has risen above 10, the claim fails.

What to do about it

• Add the four near-zero MIT AI Risk Repository subdomains to your risk register as standing items with named owners, whether or not any incident has been reported. A risk that has no owner is a risk that gets discovered by a regulator first.
• Replace incident-feed scanning as your primary horizon mechanism with direct monitoring of regulator consultation pages. Consultations carry slow-onset signals before any incident exists, and they are published on a schedule you can plan around.
• Track the regulatory dates that will force the conversation: EU AI Act high-risk obligations from 2027-12-02, OSFI Guideline E-23 from 2027-05-01, and the California and Colorado automated decision-making requirements through 2027. Work backwards from each.
• Ask your team to write down what evidence they would need to see to conclude that overreliance or a robustness gap is a live risk in your organisation. If the answer is an incident report, you have no detection path.
• Treat the public record as one input among several, not as the scan itself. A governance or risk programme can help here by giving the four slow classes a home in the register and a review cadence, so the omission is visible before anyone asks about it.

More from our platforms

These sister platforms cover the parts of this problem that sit outside governance.

• Argus (argus.threatclaw.ai) records every trace an AI application produces and scans it for prompt injection, jailbreaks and data leaks, including the attacks hidden inside retrieved documents and tool results rather than in what the user typed. Governance decides what an AI agent is allowed to do. Argus shows what it actually did.
• ThreatClaw (www.threatclaw.ai) tracks the threat side of the same systems: 22 live intelligence feeds, exploitation predicted before it is officially confirmed, threat actor profiles, and detection rules you can deploy straight away. A control is only as good as the threat it is sized against.

Related reading:

• Why Your AI Projects Need Their Own Rulebook on ThreatClaw
• Hackers Want Your AI Brains More Than Your Bitcoin on ThreatClaw