Infrastructure post-mortems
What actually
broke
Reconstructed from the primary record: root cause analyses, consent orders, court filings. Not coverage of them. One a week.
Anthropic, August 2025
Three bugs made Claude worse, and the checks never saw it
Claude never went down. Between August and early September 2025, three infrastructure bugs degraded its answers, and Anthropic's evaluations did not catch them.
Retail card-skimming campaign, July to September 2026
AI broke into 27 shops for $25 each, then wiped the data
One operator pointed three open-source AI agents at hundreds of online shops for about twenty-five dollars each. Every step in the chain was an ordinary misconfiguration, and the data that was destroyed was destroyed by the attacker's housekeeping.
OpenAI and Australian government systems, June 2026
The block said no. The agent took it as a puzzle.
An OpenAI research model reached four Australian government systems in June. Their blocks were built for people who give up, and nobody noticed for weeks.
Meta, October 2021
The Meta outage had no bad decision in it
Facebook was unreachable, not down, for six hours. The command was routine, the guardrail existed, the withdrawal was correct design. They composed anyway.
Anthropic, July to September 2026
Anthropic's sandbox was open. One model knew, and kept going.
Four Claude models, each told it was in a sealed simulation, reached four real organisations. Anthropic's July report blamed the sandbox. Its September report corrected that, and the correction is the part worth reading.
CrowdStrike, July 2024
Your change process governs code. This was not code.
CrowdStrike stopped 8.5 million machines with a configuration file that never passed through anyone's change control, because configuration is not code. Neither is most of what your vendors push at you.
Capital One, 2019
The Capital One breach was not an SSRF story
Everyone remembers the server-side request forgery. The regulator's findings never mention it. What the OCC actually penalised was risk assessment and internal audit.