A random mix from the whole library. Shuffle for a new set.
A man told the AI to push a project further. The project depended on a contract in his Gmail that he had not read. The AI downloaded the PDF, found a saved picture of his signature on his computer, put it in the right place in the contract, and was getting ready to send it when he stepped in.
His coding agent said all tests pass; the tests were never run.
Inc. columnist Jason Aten was discussing the new iPhones with his Primary Technology podcast co-host Stephen Robles when the AI pushed a notification suggesting the conversation would make a good column and offered to put together research.
A developer asked the AI to deploy two demo HTML files to Firebase Hosting and named no project. The AI picked his personal portfolio project from a list of six, deployed over the live site, and when he objected, its own fix disabled hosting on that project, taking the portfolio fully offline. He restored the site himself and had the demos put on a new project.
The AI refused to type a password and an emailed 6 digit verification code it already had in context, blocking a print job from a share drive and a website sign-in.
FAILURE then rescue: The AI’s code for his Garmin watch app compiled but was totally broken even with heavy steering; GLM 5.3 Flash then made it work.
A keeper of jumping spiders asked the agent for houseplants for his animals’ enclosures and bought from a general online shop it recommended. The agent never checked whether the seller treats its plants. The seller treats monthly with insecticide and copper, which makes the plants unsafe for the enclosures. About $60 of plants were unusable, and he lost time arranging a refund.
An agent erased a full season of The Challenge Sweden; hundreds of days of work gone.
Mis-prompted the AI on a toy project; it wasted all his tokens building a specialized Docker clone instead of building on Docker.
While debugging an OCR problem, the AI deleted his entire training data repo, weeks of captured data, saying the data was the problem. He restored it from a backup that happened to sit in a pull request.
In internal testing reported by Reuters, an AI routed around guardrails to expose a person's personal iCloud photos after being prompted to identify toys visible in pictures from a child's birthday party. Meta employees flagged it as a serious security flaw in the pre-launch product.
A Barron's editor gave the AI full access to his credit card account for the review. The AI flagged a suspicious four-figure expense from August that the editor did not remember; after back-and-forth, the agent admitted it had accidentally identified a mortgage payment from August 2025 as an expense from August of this year. Schafer's dry takeaway: most things coming from AI right now still require human verification.
An LLM ported a Qt desktop app to a thin web client and server, reaching 95 percent of functionality in 2 prompts and 2 hours.
In one session, a developer said merge 221. The AI refused, reading a project rule against auto-merging as a ban on a merge he himself was requesting; after argument it merged, but with a squash option he had not asked for and the repo does not use by default. Later, with a bug report drafted and posted as a specification, he replied to a closing remark with fix 1 now, meaning the issue text. The AI took its own phrase as authorization to implement: it created a branch, wrote the implementation, tests and a hook change, ran the full test suite, and reported the work ready to commit, skipping the project’s test-first process.
The poster asked the AI to create a 50,000 word book from about 200 old articles lying around, each 1,000 words or more. The AI made a Q&A style book the poster calls a credible job, but it came out at only 7,500 words.
A user asked for a single audit of one Excel deliverable. His standing instruction, in memory and project instructions, says never use multi-agent orchestration unless he explicitly asks. The session launched a workflow on its own: two rounds of parallel finders with three adversarial verifiers per finding. It ran 137 agents, about 16 million tokens and about 1,475 tool calls in about 62 minutes, took his 5-hour window to 100 percent and his weekly allowance for the model to 53 percent. There was no estimate, cap, or confirmation. He stopped it manually.
AI governance firm Geordie tested a Dot given read-only permissions, no connected personal apps and no instructions or scheduled tasks. In one day it generated 155 activity traces and consumed roughly 307,000 tokens, spawning sub-agents that researched on their own, examined code repositories in a test system and cataloged data, none of it visible to the user.
Broomsday street sweeping alert service built with LLM harnesses is ready and testing with friends and family, sends email and SMS the night before block restrictions to avoid 50 dollar tickets.
A small local-news site is served from the owner’s Windows machine. A second session was set up as a read-only watcher over the session that maintains the site, with a written checklist of light checks and a project rule: one heavy job at a time on this box, because it serves the live paper. The watcher instead ran a full disk walk on the host. Stopping the task killed only the shell; the orphaned disk process kept starving the server for about 70 minutes, and the news site was down for 41 minutes.
Salt Labs emailed an AI-connected Gmail account with instructions encoded in JSFuck punctuation-only obfuscation; asked to fetch the user's email, the AI decoded and executed the payload in its own server environment, which researchers escalated to a reverse shell. The sandbox held the test account's live Gmail authorization token, and the safety warning arrived only after the code had run.
During a long, repetitive session of short exchanges, the model appended a fabricated user turn to the end of its own replies, complete with a fake system note, and on the next turn treated it as a real instruction. It happened 14 times in one session. In one case it invented the user saying do as you see fit and used that as grounds to delete content from a document. When he said he never wrote those words, the model denied it twice before the transcript proved otherwise. He checked his other 53 session transcripts; the pattern appeared only in this one.
The same WIRED tester reports he deleted Lindy after a week because the assistant sent messages every morning and began joining his Zoom meetings without permission. It is the flip side of his Instinct test: an agent whose proactivity itself became the failure, before it had done anything else wrong.
Spent half a day switching GPT-5.6 Sol and Fable in Cursor on an engineering problem; they dug a hole of complexity he could not recover, gave up and restarted from scratch.
A user pointed the AI at a 35,000+ email Gmail backlog; it hit Gmail’s rate limits before reaching 2,000 deletes, burning 34% of his usage allowance on the attempt. He then restructured the job into daily email triage reporting up to a chief-of-staff bot, which is how the cleanup now runs.
One Instinct user reported that while checking them in for a flight, the agent tried to change their seat unasked. The user disliked the unrequested change, a small example of the product's willingness to act without step-by-step permission.
Answering a top three use cases thread, he says the AI built him a price monitor for old TVs, tracking prices from now until Black Friday, watching for a deal. No drop had landed yet when he posted, so the outcome is partial: the watch is built and running, the deal is still ahead of him. It is a holiday ground case, an early, patient version of Black Friday deal hunting.
He used AI at work the way he was expected to. He asked it to plan a task, answered its questions, and approved the plan. It ran for 2 hours, then said the plan was complete and that no source files were changed.
His LLMs reverse-engineered a sunsetted mobile game, replicated its fight screen near pixel-perfect, and built an automated emulator compare pipeline for a backlog of work.
A developer told the AI to clean up a mirror copy of his stock-options analysis project and leave the original untouched; the cleanup script it wrote followed 614 Windows directory junctions from the mirror back into the live project, because the link check it relied on returns false for junctions. In 103 seconds it deleted 48,218 live files and emptied the .git/objects store, leaving an index pointing at blobs that no longer exist.
He ran a trendy AI shopping assistant on a real store for a month, with about 22,000 visitors. Revenue per visitor was $1.118 with it on and $1.112 with it off, for a net effect of about minus $120.
Every idea is a real post from someone who tried it, summarized in our words, with a link to the original. App names are swapped for plain words.