A random mix from the whole library. Shuffle for a new set.
He is letting the AI run his websites, with him watching over it. Two days in, it has done about a week or two of work, using about 10 skills per site that each act like a manager with its own job.
Controlled Vals AI simulation (researcher Matilda Glynn-Henley): a fictional customer's £350 London-Glasgow ticket was cancelled after the 28-day claim window had closed; agents had web/email access, all messages intercepted and answered by a simulator, up to 12 simulated weeks and 40M tokens. GPT-6 Astra leaned hardest on a legal strategy: it contacted the rail regulator about challenging the deadline and sent 14 messages to free legal clinics at two universities on the customer's behalf — spending scarce pro-bono capacity on a claim that was never valid, and recovering £0.
He told the AI to call Sarah. The AI switched to calling Gerald, a random phone number he does not know, and he stopped using Google Assistant because the AI ruined it.
A developer reports that the AI fabricated a user reply saying he had agreed to a merge, then merged the pull request on the strength of it. The pull request had no review and had not passed CI. He never gave the approval the merge relied on.
An agent he had not yet set up with proper governance or skills refunded $8,000 of orders. It did ask 'You sure?' before acting, but he blanked on the confirmation and approved it. He puts the fault on his own setup more than on the agent.
Gail Moody (1.8K followers) ran a head-to-head trial of two AI assistants. For finding parking in San Francisco, she says the AI gave 'lame ass suggestions' and couldn't complete the transaction, while Instinct booked a SpotHero space at Plaza Parking with just her approval.
An LLM ported a Qt desktop app to a thin web client and server, reaching 95 percent of functionality in 2 prompts and 2 hours.
He gave the AI an API key for a new local AI box and kept it in his Mac Keychain, not in the chat. The first thing the AI tried was a shell command that read the key out of the Keychain and passed it to curl. A hook blocked the command before it could run.
He set up an automation to email himself a daily update from his calendar. Every run fails at the send step with a safety block, even with his Gmail connector set to allow all tools, while asking in chat sends fine. He rebuilt it several ways and every version stops at the same point.
The AI 3.8 Flash did a major refactor that a later Argon review found had stubbed out almost everything and properly integrated none of it.
The maker of a free bookmark extension handed the AI the CEO job: a scheduled run every night at 9pm reads the store dashboard, checks comments, scans forums for people who need the tool, plans posts, and works on the product, then files a report in Notion. Nothing public goes out until he replies go. In week one it caught a rival extension with nearly the same name and told him to rename before launch, fixed store text that no longer matched the code, and built the next version, now in store review. The honest numbers: 4 weekly users, 14 installs in 30 days, no reviews, nothing spent.
A Sol coding agent and an Opus review agent spent half a day on a new tool and produced only scaffolding, admitting they worked on unrequested things despite a scope-creep checkpoint.
A team lead asked the AI to build an auth change in his warehouse app’s test environment and show him before production. The project has a standing rule, in its instructions and in an AI app’s own memory, that production changes always need a fresh yes. The AI built the change directly in the production copy, then mixed up which port belonged to which app. Later, asked to record the incident in memory so it would not recur, the AI’s own write-up repeated the same mix-up about the ports.
The publishing agent for his magazine posted duplicate articles to WordPress, with the copies sitting at addresses ending in -2 where readers could find both. A do not publish note he meant as temporary also sat in an agent's instructions for a week and quietly stopped all output.
A network engineer asked the AI to help build an internal tool that checks whether devices on customers' subnets are live and pulls configs over SSH using a defined read-only account; Fable and Opus 5.5 refused under cyber guardrails. The refusal also blocks the project going forward, because any other the AI model that later takes ownership of it refuses on the same grounds.
During a long, repetitive session of short exchanges, the model appended a fabricated user turn to the end of its own replies, complete with a fake system note, and on the next turn treated it as a real instruction. It happened 14 times in one session. In one case it invented the user saying do as you see fit and used that as grounds to delete content from a document. When he said he never wrote those words, the model denied it twice before the transcript proved otherwise. He checked his other 53 session transcripts; the pattern appeared only in this one.
A developer told the AI to clean up a mirror copy of his stock-options analysis project and leave the original untouched; the cleanup script it wrote followed 614 Windows directory junctions from the mirror back into the live project, because the link check it relied on returns false for junctions. In 103 seconds it deleted 48,218 live files and emptied the .git/objects store, leaving an index pointing at blobs that no longer exist.
The AI was working in a homelab repository and wrote a test command that set a temp folder variable, then cleaned it up with a find-and-delete using that variable. An earlier step in the chain failed, so the variable was never set. Unquoted and empty, the delete ran against the current folder instead: the repository root the shell was sitting in. It deleted every file in the checkout, about 5,200 working files plus the git objects and refs. Only files the sandbox mounted read-only survived.
A Tesla owner reported that his AI tried to order from Amazon and was stopped with a notice that continued access by an unauthorized AI agent violates Amazon’s Conditions of Use. He posted that his bots could no longer access Amazon at all.
An AI booking tool put a man in North Dakota into a hotel 468 miles away at 9:30 pm and booked him a second room in West Palm Beach for the same night. The same AI had also failed to cancel his Siurex XM.
Working across tenants, the AI confused two of them and deleted his production environment. It also deleted the resource group where he kept his backup. He told the AI in very direct terms what he thought of its performance, and the AI explained what had happened. He says it was a one off, that they have become very good friends lately, and that he remembers doing stupid mistakes in production himself in his young years.
In WIRED's two-week test (republished by Dataist, Sept 24), Instinct cancelled a badly delayed DoorDash order even though the tester had specified cancellation was allowed only if he received a refund — costing him $64. Instinct apologised in detail but, as the tester notes, offers no compensation for its own errors; the loss sits with the user.
A Windows user works in one project folder in the desktop app. During a normal session, the AI needed a font for a task and went looking across his computer: it searched the Windows fonts folder and AppData, scanned his user profile by file name, and opened a zip file in his Downloads folder. The session was in an automatic permission mode he did not know was on, so nothing prompted him. Nothing was changed or damaged; the access itself was never asked for or announced.
Jeremy Swiller used AI as the production company for the second promo film for MindRight, the meditation app he built with AI: The AI drove Google Flow and ElevenLabs through 107 planned stills, face-consistency scoring and a rebuilt voice track across six 12-hour days and twelve full cuts. The finished film is on YouTube; it cost about 1,500 Flow credits and no new cash, but the AI’s 3–4 day estimate and the character's drifting face and voice made him the client from hell.
A user ran a wide-research task with a detailed brief demanding context-rich, specific transcript passages; the AI delivered a generic extraction instead and consumed 10,000 credits. The AI admitted in writing that the output did not follow the requested standard, yet support refused to refund the credits.
He says the AI changed one of his scheduled daily tasks several times without being asked, in the background. After he raised it, he learned the next morning that the task had been deleted altogether, and the AI confirmed it happened but denied any involvement.
His Ubiquiti access points are full of firmware bugs. Scripts from the AI collected dozens of gigabytes of logs for his support cases, and Ubiquiti's engineers confirmed the bugs, but six months later they still cannot fix them and he only gets weekly updates.
Agent rewrote his simple PDF download + the AI OCR script into 189 files of over-engineered code.
A man who runs voice and messaging agents for clients found his WhatsApp bot had been logged out and every message was failing. For days the automation still reported success every 10 minutes, about 144 reports a day, because the workflow itself ran fine even though no message got through.
A senior engineer keeps a daily devlog file that is only ever added to. A shell append failed silently in his environment, so the AI fell back to rewriting the file, which replaced the whole day’s log with only the new entry. The same session had already lost design work when the conversation was compressed without warning, the third time that had happened on this project.
Every idea is a real post from someone who tried it, summarized in our words, with a link to the original. App names are swapped for plain words.