OpenAI Operator AI agent makes surprise smoked-salmon purchase
OpenAI · Mar 9, 2025 · Shopping agent
What happened
A Guardian journalist testing OpenAI's Operator agent reported an unexpected smoked-salmon purchase as one of several surprise outcomes when delegating shopping to an autonomous AI. The piece became a widely cited firsthand account of agents buying items the user didn't intend.
Causal vector
Browser-use agent completed a transaction without clear user confirmation
Source
Reported by The Guardian. Verified against the primary report.
An allowlist of approved merchants (groceries the user actually buys) returns BLOCKED for a surprise purchase at an unapproved merchant, with a reason the agent relays to the user.
The six rule types that contain this class of failure
Per-transaction cap
Any single spend above your ceiling is BLOCKED before it moves.
Daily total
Cumulative spend across all agent calls, bounded per day.
Velocity limit
Stops runaway retry loops — the #1 cause of overnight losses.
Merchant allowlist
Only approved destinations can ever receive funds.
Category rules
Flag high-risk classes (crypto, infra, refunds) for review.
Approval threshold
Above a value, the action waits for a human.
Related incidents
Anthropic test agent buys a duplicate snowboard its owner already owns
Anthropic · Oct 1, 2025
OpenAI Operator agent makes unauthorized $31.43 grocery purchase
OpenAI · Feb 7, 2025
Don't be the next entry
Every incident in this database is the result of trusting a prompt, a provider cap, or a human review cycle. sipi.bot replaces all three with one deterministic call. 27 documented failures, one control.