A breach casebook: 20 incidents from 2025–26 and the checks that catch them
Comments
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Summary
Bansat, an open framework for building apps with AI tools, published a casebook of 20 incidents and regulator decisions from January 2025 to October 2026. Each maps to checks for recurring failures: missing database access rules, agents holding production credentials, supply-chain compromise and consent errors. Cases rest on primary sources and note disputes, such as Lovable contesting its CVE. Two figures, the Hugging Face agent review and the 23andMe fine, couldn't be verified. The mapping covers classes of failure, not proof the checks would have prevented them.