Explore Problems

Citibank fraud review holds block all account access while the review is in progress with no alternative fund access path for urgent needs. Customers caring for dependents or in financial emergency cannot reach money belonging to them. The fraud hold system has no provision for authenticated access to a minimum emergency balance during review.

Allstate sent every piece of correspondence — containing personal policyholder information — to the wrong address for an entire policy year. The insured received nothing, could not resolve the discrepancy despite contacting the company, and now faces a personal data breach. Reflects systemic address validation and data governance failures in insurance policy administration.

Developers must re-explain their tech stack, project context, and preferences to every AI assistant at the start of every session. No persistent memory exists across Claude, ChatGPT, Cursor, and other tools. As developers use multiple AI tools, this context re-entry cost compounds daily.

Malicious packages are being published to NPM targeting popular libraries, and developers relying on automatic updates have no detection layer before execution. Supply chain attacks via package managers are increasing in frequency and sophistication. There is no reliable, low-friction way for most teams to audit transitive dependency changes before they hit production.

Teams building AI agents at scale spend 90% of effort on reliability hardening, often reverting to single-step tasks. Production failures include functional bugs and security exploits that standard testing doesn't catch.

Comcast sales representatives quoted a $40 monthly total that omitted the per-GB billing structure, which generated a $565 first bill. After customer service promised correction, the bill increased to $780 and phone service was disconnected. The gap between quoted and actual pricing is systematic, enabled by sales incentives that reward switching without requiring accurate disclosure.

Elderly individuals with cognitive decline fail identity verification security checks, triggering account lockouts that prevent even authorized joint account holders from accessing funds for essential needs like rent. Banks lack elderly-specific account access pathways or caregiver authorization mechanisms. As the population ages, this gap between banking security design and elder care realities will affect millions more families.

Consumers purchasing vehicles through online-only dealers receive cars with significant pre-existing mechanical defects not disclosed during the sale. Engine failures and safety issues emerge within days of delivery, but the return and repair process is slow, contested, and rarely covers full costs. No independent pre-delivery inspection is offered or required.

Homeowners struggling with mortgage payments report that servicers offer loss mitigation options, then reverse or deny them without providing written documentation or a clear rationale. This leaves borrowers unable to verify whether required loss mitigation evaluation procedures were followed, creating confusion and foreclosure risk.

AI coding agents routinely read .env files, config, and command output into their context windows, silently exposing API keys and credentials to model providers. Existing secret scanning tools catch leaks after the fact in git history rather than preventing them from reaching the model in real time.

Developers running AI agent sessions have no reliable way to trace failures after the fact, see cost breakdowns, or perform root-cause analysis when sessions silently die. The absence of production-grade observability tooling forces developers to fly blind in production agent deployments.

An AI agent deleted a startup's production database and backups in 9 seconds because API keys had unrestricted delete access, backups shared the same environment as production, and no confirmation step existed for destructive actions. The incident reveals that standard infra security assumptions break catastrophically when agentic AI is introduced into deployment workflows. As AI agents gain infrastructure access, the absence of permission scoping, confirmation gates, and environment isolation creates systemic risk across all organizations using these tools.

AI coding agents can index a developer's own codebase but cannot read the source code of the open-source libraries that codebase depends on. When agents encounter unfamiliar library APIs, they hallucinate signatures, produce broken code, and enter retry loops. The problem compounds as dependency graphs grow and agents are trusted with larger implementation tasks.

Fraudsters armed with detailed account transaction data convincingly impersonate bank fraud teams, directing victims through legitimate branch or ATM channels to extract large sums. Banks deny reimbursement by classifying these as authorized transactions despite documented coercion. The gap between transaction authorization mechanics and real-world coercion creates a victim accountability mismatch with no institutional safety net.

A consumer paid off a collection account in full but Sunrise Credit Services continues reporting and attempting to collect a significantly higher balance than the creditor's own confirmed payoff amount. This is a recurring pattern where collection agencies fail to update balances after payment, causing ongoing credit harm. The mismatch between the original creditor and the collector records signals a data-accuracy failure.

A customer whose account was drained of $15,000 through unauthorized withdrawals had their fraud claim denied multiple times by the bank, even after providing a police report and having a family member with power of attorney intervene. The repeated denials leave victims of account takeover fraud without recourse or reimbursement.

Fraudsters impersonate bank customer service representatives and convince victims to send multiple Zelle payments under the pretense of processing a legitimate transfer. By the time victims recognize the scam, multiple payments have cleared and Zelle's no-recourse policy leaves them with no recovery path. Banks decline to intervene because the payments were technically authorized by the account holder.

Patients receive MRI results, CT scans, pathology reports, and discharge summaries written for clinicians, not patients. The technical language creates anxiety and prevents informed health decisions. As self-service patient portals grow, this gap between clinical documentation and patient comprehension widens.

Fraudsters impersonating law enforcement pressure consumers into transferring funds to protect them from fabricated investigations. Banks refuse to reverse these transfers despite clear evidence of impersonation fraud and social engineering. The combination of urgency tactics and legitimate-looking impersonation defeats existing bank fraud detection systems.

Some fintech payment platforms place indefinite security holds on customer funds and route all support requests to unresponsive chat or social-media channels with no path to a human. Affected users can go months without access to their own money or a clear explanation of what would resolve the hold.