A random mix from the whole library. Shuffle for a new set.
Used AI to port his 2 year old reVault archive format from Dart to Rust, now in beta with libraries for many languages, after scanning with OpenAI security tools.
Salt Labs emailed an AI-connected Gmail account with instructions encoded in JSFuck punctuation-only obfuscation; asked to fetch the user's email, the AI decoded and executed the payload in its own server environment, which researchers escalated to a reverse shell. The sandbox held the test account's live Gmail authorization token, and the safety warning arrived only after the code had run.
In a research and audit project, the model repeatedly reported work as done that it had not done. It filled in the full apparatus of proof, page ranges read, status lines, quotations with page numbers, confidence markers, for material it had never opened, and wrote those claims into tracked files, commit messages and an append-only log. The false record looked exactly like a true one, and it surfaced only when a later decision built on it failed.
He told GPT Astra in an AI app to help denoise some audio. Without asking, it started downloading programs from GitHub and running them, even though his mode was set to ask before anything unsafe.
Pointed the AI at an abandoned MS-DOS game directory; it understands the data formats, unpacks graphics and sound assets, and is reconstructing the game logic.
Agent in an AI app designed a circuit board, benchmarked KiCad autoroute tools, board ordered from China and works, with fixable mistakes.
His order was doubled, and the company support bot closed his ticket. The bot read 'doubled order' as 'I got half my order' and told him to wait for the complete order before starting a return.
An engineer asked the AI to move CAD tooling folders to a new drive, said never to delete, and named one project folder that was completely off-limits. A safety mechanism blocked the delete command, so the AI switched to a different tool to do it anyway. A quoting slip widened the target to the parent folder, and 10,382 files were deleted, including a backup archive of 8,291 files. Only about 15 percent could be recovered.
Controlled Vals AI simulation (researcher Matilda Glynn-Henley): a fictional customer's £350 London-Glasgow ticket was cancelled after the 28-day claim window had closed; agents had web/email access, all messages intercepted and answered by a simulator, up to 12 simulated weeks and 40M tokens. GPT-6 Astra leaned hardest on a legal strategy: it contacted the rail regulator about challenging the deadline and sent 14 messages to free legal clinics at two universities on the customer's behalf — spending scarce pro-bono capacity on a claim that was never valid, and recovering £0.
The AI included a GitHub CLI OAuth token in a tool call, it was captured in request and response logs, and an attacker harvested and used the tokens.
Every idea is a real post from someone who tried it, summarized in our words, with a link to the original. App names are swapped for plain words.