MEASURE 3.1

MEASURE 3

Control

Approaches, personnel, and documentation are in place to regularly identify and track existing, unanticipated, and emergent AI risks based on factors such as intended and actual performance in deployed contexts.

Incidents linked to this control

From automatic embedding match (not a formal assessment).

Threat Actor Reportedly Used Hermes AI Agent for Unattended Post-Compromise Activity in Thailand's Ministry of Finance Network

July 9, 2026

Threat Actor Reportedly Used AI-Assisted Workflows to Compromise AWS Environment for Extortion

July 8, 2026

LLM-Driven Ransomware Operator Dubbed JADEPUFFER Reportedly Targeted Production Database

July 1, 2026

Waymo Robotaxi Reportedly Entered Flooded San Antonio Roadway and Was Swept Into Waterway

April 20, 2026

Purported Gemini-Generated AI Images Reportedly Claimed U.S. Delta Force Soldiers Were Captured by the IRGC

March 5, 2026

Purported AI-Generated War Footage Reportedly Circulated Widely Online During the Opening Phase of the War in Iran

February 28, 2026

Purportedly AI-Generated Sepsis Alert Reportedly Prompted Potentially Inappropriate IV Fluid Administration for a Dialysis Patient, Averted by Clinician Intervention

February 17, 2026

Amazon Delivery Van Reportedly Became Stranded on Essex Mudflats After GPS Routed It Onto the Broomway

February 15, 2026

Malicious OpenClaw Skills Reportedly Delivered AMOS Stealer and Exfiltrated Credentials via ClawHub

February 1, 2026

DHS Agents Reportedly Threatened Legal Observers With 'Domestic Terrorist' Database While Using Purportedly AI-Enabled Surveillance During ICE Operations

January 21, 2026

ICE AI Resume Screening Error Allegedly Routed Inexperienced Recruits Into Inadequate Training Pathways

January 14, 2026

Waymo Robotaxi Reportedly Transported Undetected Person Trapped in Trunk in Los Angeles

December 8, 2025