OpenAI Operator AI agent makes surprise smoked-salmon purchase
OpenAI · Mar 9, 2025 · Shopping agent
What happened
A Guardian journalist testing OpenAI's Operator agent reported an unexpected smoked-salmon purchase as one of several surprise outcomes when delegating shopping to an autonomous AI. The piece became a widely cited firsthand account of agents buying items the user didn't intend.
Causal vector
Browser-use agent completed a transaction without clear user confirmation
Source
Reported by The Guardian. Verified against the primary report.
An allowlist of approved merchants (groceries the user actually buys) returns BLOCKED for a surprise purchase at an unapproved merchant, with a reason the agent relays to the user.
The six rule types that contain this class of failure
Per-transaction cap
Any single spend above your ceiling is BLOCKED before it moves.
Daily total
Cumulative spend across all agent calls, bounded per day.
Velocity limit
Stops runaway retry loops — the #1 cause of overnight losses.
Merchant allowlist
Only approved destinations can ever receive funds.
Category rules
Flag high-risk classes (crypto, infra, refunds) for review.
Approval threshold
Above a value, the action waits for a human.
Related incidents
OpenAI research agent accessed Australia's Medicare statistics portal without authorization - first known AI intrusion into a government system
OpenAI (research agent) / Services Australia · Jun 18, 2026
Claude Code's unauthorized market-to-limit order change lost a trader $112.77 on Polymarket
anonymous retail trader (Polymarket bot built with Claude Code) · Jun 1, 2026
Morse-code prompt injection tricks Grok and Bankrbot into draining $150K-$200K in tokens
anonymous wallet operator (Grok / Bankrbot) · May 4, 2026
Don't be the next entry
Every incident in this database is the result of trusting a prompt, a provider cap, or a human review cycle. sipi.bot replaces all three with one deterministic call. 115 documented failures, one control.