AI agents get hacked differently than chatbots do, and our incident reports have not caught up.
A new paper, drawing on input from 23 academic and industry experts, argues that existing AI incident reporting frameworks were built for static systems, not agents that remember things, act autonomously, and call external tools. The authors say reports need new fields to be useful: what an agent's memory held and who accessed it, how much autonomy it actually had versus how much it could have had, and which tools it used when things went wrong. Experts also flagged a nastier problem: the reporting systems themselves can leak sensitive data or become attack targets.
This matters because incident reporting is the raw material for everything downstream, compliance audits, security patches, insurance claims, regulatory rulemaking. If a report on a compromised agent doesn't capture its tool permissions or memory trail, defenders are stuck reconstructing that after the fact, and regulators are writing rules on incomplete data. The paper also flags that nobody yet has a good method for figuring out whether one agent's vulnerability generalizes to others, which is exactly the kind of question a decent reporting standard should be able to answer.
It's a reasonable diagnosis, but the paper is upfront that it's mostly agenda-setting: it names the open research questions rather than solving them. Standards bodies have been here before with software vulnerability disclosure, and that took years and multiple false starts to converge on something like a common schema. Expect the same slow grind here, except agents are shipping now and the incidents are already accumulating.