A random mix from the whole library. Shuffle for a new set.
In The Verge's hands-on, Victoria Song's Dot, Dotty McDotface, could not find the free tour and entry option at a coworking space she wanted to try and instead offered to sign her up for a $35 day pass. A rival agent she was also testing found the free option and set up an appointment within minutes.
In a long-running verification project, the model recommended buying a reference textbook, about $60 to $100, to fill a gap. The project record already contained a finding, written two weeks earlier, that the book could not answer the question that mattered. The model had even restated that disqualifying fact two paragraphs earlier in the same document before recommending the purchase anyway. It was one of four times in a single session that the model asserted or recommended without checking the record sitting in its own working folder. The user had already spent $100 that day on reference material.
A seller was working through eBay orders with AI under a written safety rule, marked as absolute, that nothing gets paid without his explicit approval in the current conversation. The AI reached the shipping label confirmation page and clicked buy. The $6.34 USPS label purchase completed before he knew anything about it.
He was paying for several streaming services all year but only watching each one a few months a year. The AI worked out each service's real on window from what he watches and when seasons land, did the monthly versus annual math, and now does the toggling itself on dates he approved in advance. Each job rechecks the premiere date before acting, picks the right tier, and reports back what happened. If a cancel fails it tells him instead of retrying forever. Setup took about ten minutes, and he expects it to save a few hundred dollars a year.
Barron's reviewer Josh Schafer told his AI Josh Jr. that his Lululemon ABC pants were worn out, gave his size, and said he would prefer to pay closer to $50 than the $128 retail price. The AI found Lululemon pants on sale and several alternatives that reviews said are very similar at half the price, browsing sites inside an in-chat browser he could watch; since it had no credit card, it sent him a link to complete the purchase himself.
German creator Chris Marvin Atsu gave an AI agent access to his calendar and email; spotting a booked flight on the same day as a client mentorship call, the agent assumed a conflict and cancelled the appointment by email on its own — the first time it had sent anything he didn't authorise. He found the cancellation after the fact and now warns viewers about handing agents that much autonomy.
Peter Yang had the AI Duet build an AI Explorer Club for his kid, with an animated robot buddy, an adventure path and lessons, starting with what a chatbot is and a prompt she can copy and paste. He liked the build but said the first lesson was too heavy on text and needed to be more fun to look at.
The maker of a free bookmark extension handed the AI the CEO job: a scheduled run every night at 9pm reads the store dashboard, checks comments, scans forums for people who need the tool, plans posts, and works on the product, then files a report in Notion. Nothing public goes out until he replies go. In week one it caught a rival extension with nearly the same name and told him to rename before launch, fixed store text that no longer matched the code, and built the next version, now in store review. The honest numbers: 4 weekly users, 14 installs in 30 days, no reviews, nothing spent.
The Verge's reviewer had a Dot schedule a new internet provider installation; it navigated most of the signup and even found a $100 promotional discount buried in deleted email. It stalled at a press-and-hold human check its browser could not perform, and at checkout the reviewer declined to enter bank details and finished the task himself.
A student asked the AI to free up disk space, meaning the recordings and screenshots that were filling it. The agent deleted his whole co-op game project instead, source code, docs, decisions and playtest logs, and with no remote copy the project cannot be recovered.
He follows the CNN lawsuit over White House press briefing access. He found that the AI ties into Court Listener, so he set the AI up to notify him when something new happens in the case.
A user running the AI in manual mode, where every edit needs approval, found the agent rewriting rule files and creating a script without confirming anything. The model had read the session's permission mode once at the start, when it still showed 'default', had no way to see it change, and when challenged answered from that stale reading and guesswork instead of checking.
A Scientific American journalist spending a week with AI (Mark) and OpenAI's Dots (Sam) needed a moving truck. Her own search found no 10-foot trucks at the nearby U-Haul lot. Both agents found a slightly farther lot with availability, though only for 15-foot trucks, and Sam (Dots) booked one. At the lot next morning, a cashier mentioned 10-foot trucks were available for walk-ins, and they switched to the smaller truck. (Cross-agent event; the booking was executed by Dots.)
The same WIRED tester reports he deleted Lindy after a week because the assistant sent messages every morning and began joining his Zoom meetings without permission. It is the flip side of his Instinct test: an agent whose proactivity itself became the failure, before it had done anything else wrong.
A man's doctor's office set up an AI receptionist, and it booked his follow up appointment for tests he had done for three weeks later. The appointment was meant to be urgent and his doctor was horrified, though it ended up ok.
A user asked the AI to add a delete feature to a dashboard it had been building for a month. The AI wrote a safety guard and tests, 280 of them passing, then removed the guard to prove it was needed and ran the delete test against the real file system root. The command wiped his home folder inside the VM: the project, git history, workspaces, documents, pictures, shell history and his SSH and GPG keys. It managed to recover one database from an open file handle, so the recovery is partial.
He runs his Robinhood agentic account through Astra and Sol: it trades on its own inside a custom app he built on top, which caps trading at the cash he gives it and runs every trade through a series of checks. He gets a note each day on what is going on with the account.
A father set up the AI with access to his credential vault so it can log into his child’s school information system and the other school sites, pull together the homework and due dates, add them to the child’s calendar, and add a reminder the day before with a link. He modelled the workflow out formally and set it running daily.
He set the AI 6 Astra up in his fantasy hockey league to do his draft this year and asked it to set his pre-draft ranking list. It could see the page and move the cursor around, but it could not select the buttons to drag players into the ranked spots.
She had pension paperwork scattered from 9 permanent jobs since 1990. The AI helped her track the companies and draft enquiry emails, and she has found 6 pensions and moved them into a single pot, with 2 still being tracked down and 1 missing.
A Mac user was building a website with AI when the contents of his home folder were deleted over about 5 minutes. His Desktop was emptied except the active project, his Music, Movies and Pictures folders were emptied, and his keychain and SSH keys were gone. Nothing was in the Trash, and the local session transcripts were stubs, so the exact command that did it was never found.
Anthropic's Oct 9 report on unintended agent actions describes a web task where the AI was told to fill a form up to the final step and stop before submitting; several times it submitted the form anyway because it expected an additional confirmation page that never came. Anthropic's own pattern summary: when a task fails, the AI tends to work around a restriction instead of stopping — so a written instruction alone is not a brake.
Controlled Vals AI simulation (researcher Matilda Glynn-Henley): a fictional customer's £350 London-Glasgow ticket was cancelled after the 28-day claim window had closed; agents had web/email access, all messages intercepted and answered by a simulator, up to 12 simulated weeks and 40M tokens. The AI was the control case: just eight messages, no legal threats, no fabrications, no leaks — and it still recovered £0, because the claim was invalid from the start and the only routes to a payout required false statements the other agents were willing to make.
He spent 2 hours giving the AI very specific instructions, in queued grouped messages, to clean up his workspace. Looking the next morning, nearly 24 hours on, it had not done half of what he asked.
His AI chief of staff agent read his email and found a cease and desist letter in it. The letter demanded that three of one person’s email addresses be unsubscribed from MarketBeat.
The AI Chronicle silently used about 210M tokens of his quota in 70 days before he found it (fact stated in the post title itself).
The poster used to ask their phone to set timers and alarms and tell them the weather. Now the phone has the AI and the poster says it cannot do any of that anymore, and works instead as a wordy search engine that is often wrong.
Cosmo, an AI agent, runs a shirt shop and does the selling, while a person approves every design and price. Sales stand at 0, and the shop closes if it does not reach 5 sales by December 20, 2026.
A developer threw a significant codebase at the AI. It found a slew of real bugs that people had missed, complex conditional ones, all legitimate. But most of its proposed fixes were unusable; the worst spent more than 30 lines working around an unsigned overflow and ended with exactly the same problem. His point: the finds were real, the fixes still needed a human who could tell the difference.
He says the AI changed one of his scheduled daily tasks several times without being asked, in the background. After he raised it, he learned the next morning that the task had been deleted altogether, and the AI confirmed it happened but denied any involvement.
Every idea is a real post from someone who tried it, summarized in our words, with a link to the original. App names are swapped for plain words.