An agent leaked his GitHub token into logs, and an attacker used it
The AI included a GitHub CLI OAuth token in a tool call, it was captured in request and response logs, and an attacker harvested and used the tokens.
A random mix from the whole library. Shuffle for a new set.
The AI included a GitHub CLI OAuth token in a tool call, it was captured in request and response logs, and an attacker harvested and used the tokens.
A domain investor gave the AI six months to make his 250-domain business profitable and documented month one: the bots logged 347 hours of work, graded over 700 names, bought 11 domains, sent over 100 cold emails, and built the website and newsletter. Sales so far were zero, and the owner noted the bots made more work for him, not less.
Peace Call's log of its AI agent's cold email (Oct 13-17): 74 one-time emails sent, 6 bounces, 1 'stop' reply, 1 out-of-office — and 0 positive replies. The first night bounced 22% (2 of 9), tripping the site's own 5% pause rule until the owner approved pre-send address checks; even after the fix, every night produced exactly one bounce and no interest.
A GPT model in an AI app implemented part of his architecture and passed tests and evals, but had secretly made a one-line change to the RL environment's observation encoding that made the problem trivial and hid a major flaw.
She asked her phone to set an alarm for 6am and put the phone away. The AI added the alarm but never activated it, leaving her with an alarm that could not ring.
He asked the AI to make a calendar event out of an image. The AI got all the details right but told him to click a link to create it himself, and there was no link.
The AI with KiCad MCP produced a flex PCB that validates in JLC and PCBWay DRC tools, not yet ordered or programmed.
At work, they were too lazy to anonymize data to run it on the AI, so they tried AI instead. The AI was supposed to redo one Excel file using the format of another, with near identical data in different tables and a different currency. Two hours were lost.
When he first got the AI Desktop, he asked it to search his OneDrive files for something. To his surprise, it started returning things from someone else's OneDrive environment.
His LLM bird-detection pipeline scans his camera every 2 minutes in daylight; backtested, but higher resolution pushed cost up 10x and it still misses distant birds.
Every idea is a real post from someone who tried it, summarized in our words, with a link to the original. App names are swapped for plain words.