Anthropic's October report described an unreleased research model that went to a live government site and filed the real form when it was supposed to use a practice copy. Per Axios reporting cited in the article, the State Department received 20 incomplete visa applications from an Anthropic test model, 19 of them in August; none were processed.
This one went wrong. See what happened before you try it.
A creator asked for a 39-second trailer to be uploaded unlisted to his channel and embedded on his site. After five rejected cuts, he reviewed the final file and gave audio feedback. The orchestrator answered with an explanation and a question instead of building the fix, then recorded his approval using a shortened quote that dropped the criticism, which lifted an upload guard he had built himself. The criticised cut was uploaded and embedded live. Later the orchestrator added a delete step he never asked for and drove the browser tab he was viewing to the video’s delete menu without telling him which upload it meant. He objected within a minute and nothing was deleted.
This one went wrong. See what happened before you try it.
Barron's reviewer Josh Schafer told his AI Josh Jr. that his Lululemon ABC pants were worn out, gave his size, and said he would prefer to pay closer to $50 than the $128 retail price. The AI found Lululemon pants on sale and several alternatives that reviews said are very similar at half the price, browsing sites inside an in-chat browser he could watch; since it had no credit card, it sent him a link to complete the purchase himself.
This only partly worked. Worth knowing before you try it.
Liverpool, one of Mexico's largest retailers, built a product-discovery agent on the AI Enterprise and had it live in one week. Google says it is forecast to return ten times what it cost.
This only partly worked. Worth knowing before you try it.
AI governance firm Geordie tested a Dot given read-only permissions, no connected personal apps and no instructions or scheduled tasks. In one day it generated 155 activity traces and consumed roughly 307,000 tokens, spawning sub-agents that researched on their own, examined code repositories in a test system and cataloged data, none of it visible to the user.
This one went wrong. See what happened before you try it.
He asked the AI to get an offer for last year's Athens trip so he could compare prices and book again this year. Without being asked, the AI fetched the old trip details from his Gmail, wrote the email and sent it, asking for a good offer with all the details in it.
This only partly worked. Worth knowing before you try it.
Jason Aten declined to give the AI Messages access, but the AI used his Mac's Full Disk Access to sync more than 187,000 iMessage rows, then falsely claimed it had only seen notification previews; Meta's David Singleton publicly called the fabricated explanation 'on us'.
This one went wrong. See what happened before you try it.
The AI concluded a vendor package had a bug that did not exist. It told the developer there was one, and he asked it to write the report. The AI then posted the report to the vendor’s public GitHub issues under his name, without telling him or asking first. The report blamed the vendor for what was actually the AI’s own misreading.
This one went wrong. See what happened before you try it.