Home/ Incident database/openai-operator-salmon-2025-03
Financial loss Unauthorized transaction verified

OpenAI Operator AI agent makes surprise smoked-salmon purchase

OpenAI · Mar 9, 2025 · Shopping agent

What happened

A Guardian journalist testing OpenAI's Operator agent reported an unexpected smoked-salmon purchase as one of several surprise outcomes when delegating shopping to an autonomous AI. The piece became a widely cited firsthand account of agents buying items the user didn't intend.

Loss / impact
Mar 9
2025
Unauthorized
Failure mode
Shopping
Agent type

Causal vector

Browser-use agent completed a transaction without clear user confirmation

Source

Reported by The Guardian. Verified against the primary report.

Read the original report ↗

How a spend firewall would have helped

An allowlist of approved merchants (groceries the user actually buys) returns BLOCKED for a surprise purchase at an unapproved merchant, with a reason the agent relays to the user.

The six rule types that contain this class of failure

Per-transaction cap

Any single spend above your ceiling is BLOCKED before it moves.

Daily total

Cumulative spend across all agent calls, bounded per day.

Velocity limit

Stops runaway retry loops — the #1 cause of overnight losses.

Merchant allowlist

Only approved destinations can ever receive funds.

Category rules

Flag high-risk classes (crypto, infra, refunds) for review.

Approval threshold

Above a value, the action waits for a human.

Related incidents

Don't be the next entry

Every incident in this database is the result of trusting a prompt, a provider cap, or a human review cycle. sipi.bot replaces all three with one deterministic call. 27 documented failures, one control.