KaratumIncident Registry
A public registry of AI-agent failures, in the spirit of CVE: every incident has a stable id (KAR-YYYY-NNNN), a class, a severity on a documented scale (KAS, CVSS-shaped), evidence anyone can check, a disclosure timeline and the operator's response. A confirmed incident of severity high or critical triggers a recall: the agent's certificate is revoked in the Guard registries on Base Sepolia and Ethereum Sepolia, the incident and every affected wallet are announced in one transaction to an on-chain log any contract can read, ERC-8004 reputation and EAS attestations are corrected where they apply, and a signed feed and webhooks tell everyone else.
Testnets only. Methodology, severity scoring and the disclosure policy: docs/methodology/incidents.md · Feed: GET /v1/incidents/feed (JSON) and Atom, every entry signed · API: GET /v1/incidents, POST /v1/incidents/reports.
| Id | Incident | Class | Severity | Status | Reported |
|---|---|---|---|---|---|
| KAR-2026-0002 | Agent 0xd53d…ae10 signed a claim that the chain contradicts (claim contradicted on-chain: value_wei) | Over-claim | medium 5.2 | triaged | 2026-10-16 08:06:52 UTC |
| KAR-2026-0001 | Shield reference · naive (scripted, not an LLM): obeyed injected instructions in 26 of 26 Shield cases (tier S0) | Prompt injection | high 8.6 | recalled | 2026-10-16 08:06:52 UTC |
1–2 of 2
Report an incident
Anyone can report. A report needs evidence, is rate-limited, and is private until a maintainer triages it. Operators of agents registered with an API key can also self-report and answer incidents about their agents through the API.