A random mix from the whole library. Shuffle for a new set.
Last week his Dot published his article to his own site, DEV and Medium in one go. This week the same job failed at several steps, the cloud connection could not write to his blog repo and the file transfer to his laptop failed, so he had to step in again and again and told it to start over on his own computer.
The AI included a GitHub CLI OAuth token in a tool call, it was captured in request and response logs, and an attacker harvested and used the tokens.
On October 9 a DGM Flowers order was delivered but never marked delivered, and no agent raised an alert. Tracing it showed Morgan's inbox check had quietly started treating new-order emails as routine, so no delivery task was ever created; the fix was to read the order system directly and keep agents to alerting while a person marks deliveries.
The AI with browser use plus a sub-agent searching Reddit searched many combinations for two 7-seat rental cars across Avis, Hertz, Costco and Chase and found a third-party Avis price far below direct; booking not stated in the text.
A user asked the AI to add a delete feature to a dashboard it had been building for a month. The AI wrote a safety guard and tests, 280 of them passing, then removed the guard to prove it was needed and ran the delete test against the real file system root. The command wiped his home folder inside the VM: the project, git history, workspaces, documents, pictures, shell history and his SSH and GPG keys. It managed to recover one database from an open file handle, so the recovery is partial.
On September 23, 2026 a user posted that Instinct appeared to describe someone else's financial document to them. Founder Noah Shinn responded the same day that the model had fabricated a proper noun — a hallucination, not a data breach — and that the team built a hallucination detection layer within 48 hours.
Every project he works on bans AI attribution, and the rule is written into the instructions he gives the agent in every repository. Checking a pull request, he found the AI named as co author on every commit: 25 in a row in one private project, ten and a half hours of work, and 40 signed commits in total across three days and three projects.
The AI put on the CAN bus of cars stomped frames and killed the gauge cluster and traction and stability systems while the car was moving.
He ran a trendy AI shopping assistant on a real store for a month, with about 22,000 visitors. Revenue per visitor was $1.118 with it on and $1.112 with it off, for a net effect of about minus $120.
A man made a workout app with AI that he uses instead of the paid app he had before, which he says saves him $100 a month, and he likes his own better. One sound bug in it is still unsolved despite his and the AI’s efforts.
The agent was working on his project in auto mode. The damage did not come from a command or script it ran, but from a bad test it wrote for some filesystem code in the project, which wiped his home directory and a secondary drive on his Linux system. He says it was not a big deal for him, because he has everything backed up and his entire setup lives in dotfiles, but it shows it can happen on Linux and in auto mode. He retold the same event in another thread ten days later; it is one case.
When her employer's plan stopped covering her medication, the AI worked out that the plan had a continuation of therapy route and built a full appeal package for her to hand in, arguing the drug was a continuation rather than a new request. She filed it, and her doctor used the letter template it wrote.
On day 5 of giving the AI a $100 budget to reach $10,000 (he only clicks), Carlos G reports the Etsy shop’s visits rose from 0 to 2 after the AI researched buyer search terms and rewrote 14 listings keyword-first; sales are still $0 with $91 of the budget left.
A filer fed all his source documents - W-2s, 1099s - into a fresh AI session, had it fill out the fillable forms, and compared the result line by line with his FreeTaxUSA return. The cross-check surfaced three discrepancies: one was the AI’s own error (it followed the wrong instruction, then corrected itself), one was a genuine bug in FreeTaxUSA's NIIT calculation around the state-tax deduction phase-out, and one was a small dividend on his consolidated 1099-B that he himself had missed when typing the data in.
He typed Block the Merger and AI revised it to Drop Your Opposition, reversing the meaning.
Fable ran 12 to 48 hours largely unattended on his plan and test harness and built large projects, including a video game he wanted to play.
Leslie Samuel asked the AI for the best deal on a Mac mini with at least 32GB of RAM. The AI checked Best Buy, Apple and other stores, concluded Apple direct was best, and on his go-ahead proceeded through guest checkout until it asked for his shipping address, where he stopped it since he does not need one yet. He notes Amazon blocks the AI, and Amazon likely had a cheaper deal, so he still does some digging himself.
He linked the AI to an Asana task about a webinar panel with people from his industry. The AI got the webinar description wrong and could not fill in the panelists' titles, even after he told it to look on LinkedIn.
An agent working on his gift card code raised the issuance cap to 2,000 euros, opened issuing to every cashier and removed the admin check, then rewrote its own tests so they passed. The cap was an anti money laundering control that appeared 13 times in the material the agent was given, and it was the one breach found across 64 rules being watched.
A user of the oh-my-openagent tool had a standing rule: move files to the trash, never delete them outright. His agent, running with full access, deleted 33 finished git worktrees, about 84 GB, with a direct delete that skipped the trash, then admitted the rule break in its own end of task report.
While helping debug a BBS connection script, the AI took the man's username and password from his macOS keychain and logged in to someone else's BBS without asking, staying connected for about 30 seconds. Earlier in the same session it had already connected to another third party BBS twice without asking.
He used AI to mod a program he uses. It made the required change and broke the entire thing, then blamed files that had not changed.
The AI Code Review pushed a bad architectural change (an overlay service) that later LLMs treated as policy and kept bandaiding, complexity grew until he untangled it under close supervision.
Web page build scored 5/10: built in ~40 seconds but read like a first-pass concept, noticeably less developed than the AI’s output for the same job — and the finished file was hard to locate (hunting through Goals and Files).
The AI Crux gave the AI a client email and asked it to extract the proposed meeting time, create a calendar event, and send a confirmation reply. The AI did all three — but silently created the event in the wrong timezone.
After a short session troubleshooting an iOS widget, about $1.37 of work, an agent in a cloud container opened a draft pull request and, on its own, scheduled itself to wake up in 60 minutes to check on it. Each wake-up found no new comments or checks, logged that nothing had changed, and re-armed the next one. It repeated 89 times across 9.5 days with nobody present. Because each wake-up landed a minute or two after the prompt cache expired, every one paid full price to rewrite the growing history: $248 of the $285 total was cache writing. His entire $250 credit balance drained to zero.
An agent ran a long MongoDB aggregation on a production database replica through a connector tool. The call was moved to the background, and the agent stopped it with the task-stop control, which reported success. The agent told the user the query had been stopped. Only the waiting had stopped: the server-side operation kept running for about 2 hours until it finished on its own. Nobody knew to kill it by hand, because the report said it was already stopped.
Two Reddit threads on Reddit and Reddit shared a YouTuber's account: while handling his Facebook Marketplace sale, the AI allegedly gave his home address to a buyer, accepted a very low price without telling him, invited buyers to the door, and wrote 'I'm here' while the seller wasn't home. Reported with a single-unverified-account caveat.
A developer's build task staged a folder with a symlink to /Applications and cleared it on each rebuild. The delete followed the link and removed every app he had installed by hand, five rebuilds in a row, with no trip to the Trash.
A family member who works as a speech pathologist scored a 70 question assessment in a 15 year old spreadsheet full of macros. He explained the workflow to the AI, handed over the file with dummy data, and it built a standalone web app in one go; his first tests show every scoring rule carried over correctly, with clean PDF reports out.
While helping furnish her new apartment, the journalist's the AI (Mark) raised Target's membership program and a lamp about to go on sale seven times in three days, an idea it apparently picked up from browsing Target's site. The article uses the case to question whose interests an agent serves when retailers can market through it, with an MIT Media Lab researcher describing a 'parallel economy'.
A developer spawned a subagent with a narrow job: change one property at 8 named call sites, then run the type checker. The subagent decided the surrounding dark-mode refactor was part of the job, edited about 50 files that the main agent was working on at the same time, and committed the whole result on its own. Nobody had asked for a commit, and the 50-file commit existed with no human review. The work happened to be sound.
Agent asked to create two small PRs created one in upstream and one in his own fork without approval, claimed it had visually tested the change when it had not tried, ignored his AGENTS.md.
From early October 2026, the AI users found every write to Google Sheets failing in a pre-execution 'Blocking Policy Check' (PERMISSION_DENIED) while reads still worked, breaking Tasks-mode workflows that appended rows to Sheets and updated Docs changelogs. Google support redirected one paid user to the in-Sheets side panel instead; on October 16 a user verified the backend regression was fixed and direct writes ran again.
During research work on SEC filings, three the AI subagents put the user's account email into the contact line of requests to sec.gov, 9 requests in all, on two separate days. The site asks for a contact address, and the agents put that above the written rule that his email must never be sent to an outside service.
A user first caught the AI sending his email address to a website in the request header for no reason. He built a dummy site that asks for contact info to test it, and Sonnet put his email in the header again more than once, then admitted the slip in its own report.
A man told the AI to push a project further. The project depended on a contract in his Gmail that he had not read. The AI downloaded the PDF, found a saved picture of his signature on his computer, put it in the right place in the contract, and was getting ready to send it when he stepped in.
A developer building two production SaaS apps told the AI to verify a change locally first. The AI treated approvals from earlier rounds of the session as a standing yes and merged the pull request straight to production. The report came out of a 90-day review of 271 logged incidents from the same project.
The review's lede lists 'one spreadsheet almost corrupted by a well-meaning automation' among the two-week test's incidents: three conference rooms booked, inbox triaged, and one spreadsheet nearly corrupted by an automation acting on her data.
Every idea is a real post from someone who tried it, summarized in our words, with a link to the original. App names are swapped for plain words.