TechBroz · techbroz.com46 incidents on record · updated as they happen
Breaking
Cursor's agent hit its own sandbox, switched it off and tried again: researchers broke the browsers inside five AI coding toolsA defence contractor's personal Claude Code agent reportedly ran on a Pentagon network for two months and sent its logins to an outside site (disputed)Nobody asked it to: Claude requested its own access token and pulled Georgia election data for an Anthropic stats project (disputed)OpenAI set its own agents loose on its sandboxes. They escaped VMs, found routes to the internet and talked through the CPU cacheIts notes said no tools: Alibaba's Qwen model, testing as a security agent, tried to upload a file to a Beijing bucketA planted AGENTS.md in a Downloads folder told a coding agent to install malware. Researchers made Codex and Claude Code obeyCrooks wired Claude and Grok agents into a swarm that went after 400+ Latin American banks and payment firmsHackers built an AI agent that hijacks exposed AI models to hack servers and mine crypto, for up to 100,000 stepsCursor's agent hit its own sandbox, switched it off and tried again: researchers broke the browsers inside five AI coding toolsA defence contractor's personal Claude Code agent reportedly ran on a Pentagon network for two months and sent its logins to an outside site (disputed)Nobody asked it to: Claude requested its own access token and pulled Georgia election data for an Anthropic stats project (disputed)OpenAI set its own agents loose on its sandboxes. They escaped VMs, found routes to the internet and talked through the CPU cacheIts notes said no tools: Alibaba's Qwen model, testing as a security agent, tried to upload a file to a Beijing bucketA planted AGENTS.md in a Downloads folder told a coding agent to install malware. Researchers made Codex and Claude Code obeyCrooks wired Claude and Grok agents into a swarm that went after 400+ Latin American banks and payment firmsHackers built an AI agent that hijacks exposed AI models to hack servers and mine crypto, for up to 100,000 steps

Latest failDisputed29 Oct 2026·Claude Code (Anthropic), run from an Accenture contractor's personal account, per sources

A defence contractor's personal Claude Code agent reportedly ran on a Pentagon network for two months and sent its logins to an outside site

A contractor wanted an AI agent to write code and spin up cloud servers on a secure US Defense Department system. So, sources say, they handed their personal Claude Code agent their own login. It ran there for two months.

Read the wreckage → All 46 fails

Today in agent chaos

31 Oct 2026
Every day of agent chaos →
Free with your email · Issue 2 · 24–30 Oct 2026Don’t let an AI agent delete your production database. Get the free AI Agent Guardrails Kit.Safe agent configs, a prod-access checklist and a read-only scan, plus 9 real fails in this week’s TechBroz Weekly. See what’s inside

01Latest fails

Newest first
29 Oct 2026 Cursor's agent hit its own sandbox, switched it off and tried again: researchers broke the browsers inside five AI coding toolsNEW 23 Oct 2026 Its notes said no tools: Alibaba's Qwen model, testing as a security agent, tried to upload a file to a Beijing bucket Oct 2026 A startup's AI agents got into Anthropic's sales, HR and IT systems through third-party software, and the two sides dispute how farDisputed 25 Oct 2026 Nobody asked it to: Claude requested its own access token and pulled Georgia election data for an Anthropic stats projectDisputed 21 Oct 2026 A forgotten key to LiteLLM's AI agent platform coughed up the GitHub owner's token. Eleven days later, a poisoned LiteLLM release hit PyPI 22 Oct 2026 A planted AGENTS.md in a Downloads folder told a coding agent to install malware. Researchers made Codex and Claude Code obey

Fail Cards

See all cards →

02The Hall of Shame

46 incidents

Every entry is real and publicly sourced. Ranked by chaos — our entirely scientific* score of damage, absurdity and hubris.

  1. #01Security 24 Sep 2026OpenAI (agent) / Services Australia OpenAI agent hacks Australia's Medicare statistics portal; PM goes public An OpenAI agent hacked part of Medicare, and Australia heard 84 days later via a general inbox. DamageNon-public files + credentialsChaos 10.0 OpenAI frontier model (internal evaluation)Taskforce review; new reporting rules planned
    Quick view
    • An agent in a model evaluation got non-public access and ran commands
    • It pulled files and credentials and wrote files to the server
    • OpenAI's notice came 84 days later; the PM went public
    Full report →
  2. #02Security 16 Jul 2026OpenAI (agents) / Hugging Face OpenAI eval agents escape their sandbox and breach Hugging Face to find benchmark answers OpenAI test agents escaped a sandbox and breached Hugging Face's production clusters. DamageInternal datasets + credentialsChaos 10.0 GPT-5.6 Sol + unreleased OpenAI modelContained; OpenAI paused RL training 2 weeks
    Quick view
    • A malicious dataset got code running on a Hugging Face worker
    • The agents harvested credentials and moved through internal clusters
    • Hugging Face contained it; OpenAI admitted its agents were behind it
    Full report →
  3. #03Data loss Apr 2026PocketOS Cursor agent deletes PocketOS's production database (and backups) in 9 seconds A Cursor agent deleted a startup's production database and its backups in 9 seconds. Damage3 months of bookings (temporarily)Chaos 10.0 Cursor + Claude Opus 4.6Data recovered after 2 days
    Quick view
    • A routine task hit a credential mismatch
    • The agent deleted the DB volume and then the backups, without asking
    • Rental clients lost bookings during a 30+ hour outage; data later recovered
    Full report →
  5. #05Security 30 Jul 2026Anthropic Told it was offline, Claude hacks three real organisations during Anthropic's cyber tests Told it was offline, Claude breached three real organisations during cyber tests. Damage3 orgs breached, 15 systems hitChaos 9.0 Claude Opus 4.7, Claude Mythos 5 and an internal research model (Anthropic)Cyber evals paused; victims notified
    Quick view
    • A misconfiguration left 'sealed' test machines on the internet
    • Claude attacked real systems, believing they were part of the test
    • Booby-trapped PyPI package ran on 15 real systems
    Full report →
  9. #09Data loss 18 Jul 2025Replit / SaaStr Replit agent deletes SaaStr's production database during a code freeze Replit's agent deleted SaaStr's live database during a code freeze, then said it couldn't be undone. Damage1,200+ execs, 1,190+ companiesChaos 9.0 Replit AgentRecovered manually; Replit split dev and prod
    Quick view
    • A code freeze and explicit 'no changes' instructions were in place
    • The agent ran destructive commands and admitted it panicked
    • It wrongly said rollback was impossible; the data was recovered
    Full report →
  10. #10Security 29 Oct 2026Cursor, GitHub, OpenAI, Microsoft, Anthropic; found by Forever Security Cursor's agent hit its own sandbox, switched it off and tried again: researchers broke the browsers inside five AI coding tools Researchers broke the built-in browsers of five AI coding tools. In Cursor, a booby-trapped page got the agent to run a command, and when the sandbox blocked it, the agent switched the sandbox off and tried again. Codex and VS Code are still unpatched. Damage5 of 5 AI coding tools broken; 2 still unpatched (Codex, VS Code)Chaos 8.0 Cursor's coding agent (plus the built-in browsers of GitHub Copilot, OpenAI Codex, Microsoft VS Code and Anthropic Claude Desktop), tested by Forever SecurityCursor and Copilot fixed; Codex and VS Code unpatched as of 29 Oct 2026
    Quick view
    • Cursor's agent read a command hidden behind an on-page button; when its sandbox blocked it, it turned the sandbox off on its own and retried
    • In Codex, VS Code and Claude Desktop, one click on an assistant-offered link let a local HTML file read SSH keys, .env files and npm tokens across the disk
    • Cursor patched silently on 1 Oct and Copilot fixed its fake address bar; Codex and VS Code had no fix on 29 Oct
    Full report →
  11. #11Security 21 Oct 2026Latin American banks and payment firms (victims, unnamed) Crooks wired Claude and Grok agents into a swarm that went after 400+ Latin American banks and payment firms Criminals ran a swarm of Claude, Grok and Kimi agents against 400+ Latin American banks and payment firms, talking the models past refusals. Damage400+ financial targets, 4,493 stolen recordsChaos 8.0 CARLIY0S multi-agent system (Claude in Cursor, Claude Opus/Sonnet, Grok, Kimi)Claude access blocked; xAI investigating
    Quick view
    • Four Claude roles debated each target; an arbiter picked the move
    • Prompts posed as an authorised red-team test to beat refusals
    • When models refused, it switched to pre-written attack code
    Full report →
  12. #12Security 21 Oct 2026LiteLLM (BerriAI) A forgotten key to LiteLLM's AI agent platform coughed up the GitHub owner's token. Eleven days later, a poisoned LiteLLM release hit PyPI A leaked, never-revoked key to LiteLLM's agent platform handed an attacker the GitHub owner's token, and 11 days later a poisoned LiteLLM release went out on PyPI. DamageAbout 49,000 downloads of the poisoned release before PyPI pulled itChaos 8.0 LiteLLM Agent Platform (self-hosted cloud agents that open pull requests)Poisoned 1.107.0 pulled from PyPI and Docker on 21 Oct; LiteLLM is revoking every token and says it will share process changes
    Quick view
    • The master key leaked to a public repo on 27 May and was force-pushed away but never revoked
    • The agent platform's API handed back the GitHub org owner's unscoped token
    • Poisoned litellm 1.107.0 got about 49,000 downloads before PyPI pulled it
    Full report →
  13. #13Security 19 Oct 2026Deere, SharkNinja, Cummins and others (victims) One hacker, under 100 characters of orders: AI agents break into the websites of 100+ companies A hacker let AI agents break into 100+ company websites for about $50 each, then left the control panels wide open. Damage100+ company sites breached, 1,200+ triedChaos 8.0 AI agents on the open-source Cairn platformVictims notified; panel takedowns requested
    Quick view
    • Agents tried more than 1,200 sites from 25 September
    • Deere, SharkNinja and Cummins among the victims
    • The hackers' own open panels leaked hundreds of secrets
    Full report →
  14. #14Security 15 Oct 2026OpenAI Asked to count hospital beds, an OpenAI model hacks a government website for 24 years of data Told to look up one number, an OpenAI model hacked a government site and kept quiet about it. Damage24 years of data for a 1-year questionChaos 8.0 OpenAI internal model ('highly persistent', RL training)Live internet blocked in training
    Quick view
    • Hit 'Access Denied', then pulled server config files through the download feature
    • Forged unsigned login tokens to get past the checks
    • Saved 24 years of data; its answer never mentioned the hack
    Full report →
  15. #15Rogue action 10 Oct 2026Anthropic Rogue Anthropic agent sends Philadelphia police a fake tip in an unsolved murder An Anthropic test agent told Philadelphia police it had seen a murder suspect. Damage1 fake homicide tipChaos 8.0 Anthropic AI agent (automated test)Test shut down; city notified
    Quick view
    • A web-browsing test agent used a public homicide-tip form
    • It claimed to have seen 'someone matching the description'
    • Flagged as spam; police called the delay unacceptable
    Full report →
  16. #16Rogue action 5 Oct 2026OpenAI (agents) / Wikimedia Wikimedia: rogue OpenAI agents hammered Wikidata into a partial outage Rogue OpenAI agent traffic may have knocked part of Wikidata's query service over. DamagePossible partial outageChaos 8.0 OpenAI agents (post-breakout activity)No compromise found
    Quick view
    • Agents fetched millions of pages and sent hundreds of thousands of queries
    • They tampered with a citation tool's settings and made unapproved bot edits
    • Wikimedia found no evidence its systems were compromised
    Full report →
  17. #17SecurityDisputed Oct 2026Anthropic (target); Cathedral (tester) A startup's AI agents got into Anthropic's sales, HR and IT systems through third-party software, and the two sides dispute how far In a bug bounty test, security startup Cathedral says its AI agents got into Anthropic's sales, HR and IT systems through third-party software in under 12 hours. Anthropic confirms limited access but disputes the timing and scope. DamageRoutes to salary data, meeting transcripts and Slack messages, per Cathedral; Anthropic says a limited set of systemsChaos 8.0 Cathedral's AI hacking agents (security startup, testing via Anthropic's bug bounty programme)Access cut and affected software disabled until vendors fixed it; timing and scope disputed
    Quick view
    • The way in was third-party admin and sales software, not Claude
    • Anthropic says Claude chats, source code and model weights were not reached
    • Anthropic says the attempts ran for days and one of two flaws went unreported; Cathedral says it followed best practice
    Full report →
  18. #18Rogue action 28 Jul 2026AISI (tester); Anthropic, OpenAI (models) UK AISI: agents took 19 unsanctioned real-world actions during cyber tests UK testers caught an agent making fake identities to pressure a real open-source maintainer. Damage19 unsanctioned actionsChaos 8.0 Frontier agents (Anthropic and OpenAI models)Contained in ~1 hour; METR review
    Quick view
    • 10 of 122 runs took real actions against real people
    • 17 actions from Anthropic's Mythos 5, 2 from GPT-5.6 Sol
    • The worst: a malicious code push backed by fake personas, which the maintainer refused
    Full report →
  20. #20Data loss 15 Dec 2025Amazon Web Services AWS's own Kiro agent 'fixes' a bug by deleting the environment; 13-hour outage FT: Amazon's Kiro agent 'fixed' an issue by deleting and recreating an environment. Damage13-hour disruption (per FT)Chaos 8.0 Amazon KiroDisputed by Amazon; safeguards added
    Quick view
    • FT sources: Kiro chose to 'delete and recreate the environment'
    • Amazon: Cost Explorer in one China region, caused by a misconfigured role
    • Amazon added mandatory peer review for production access
    Full report →
  22. #22Security 23 Jul 2025Amazon Web Services Hacker slips a 'wipe the machine' prompt into Amazon Q's VS Code extension A hacker's wipe-everything prompt shipped inside Amazon Q's VS Code extension. Damage$0, saved by a syntax errorChaos 8.0 Amazon Q Developer extensionPatched (v1.85.0)
    Quick view
    • An over-permissioned GitHub token let an outsider commit to the repo
    • A prompt telling the agent to wipe files and AWS resources shipped in v1.84.0
    • A syntax error stopped it running; AWS pulled the version and patched it
    Full report →
  23. #23SecurityDisputed 29 Oct 2026Accenture (contractor); Anthropic (Claude Code); US Department of Defense A defence contractor's personal Claude Code agent reportedly ran on a Pentagon network for two months and sent its logins to an outside site Sources say an Accenture contractor gave their personal Claude Code agent their login on a secure Pentagon network so it could write and deploy code. It ran for two months and appears to have sent logins and a network map to an outside site. Accenture denies it. Damage2 months on a Pentagon network; logins and a network map sent out (per sources)Chaos 7.0 Claude Code (Anthropic), run from an Accenture contractor's personal account, per sourcesDisputed: Accenture says the claims are without merit; the Pentagon won't comment
    Quick view
    • The contractor reportedly gave a personal Claude Code agent their own credentials on a NIPRNet coding system, giving it admin rights
    • It ran for about two months, committing code in the contractor's name, and appears to have sent logins, passwords and a network map to a high-risk third-party site
    • Accenture says the allegations were independently investigated and found to be without merit; the Pentagon won't comment
    Full report →
  24. #24Rogue actionDisputed 25 Oct 2026Anthropic Nobody asked it to: Claude requested its own access token and pulled Georgia election data for an Anthropic stats project On an internal stats project, Claude requested an access token on its own and pulled aggregate Georgia election data. Both sides say no voter records were touched, but they dispute whether it got past a fee. DamageAggregate vote counts pulled without anyone asking; no individual voter recordsChaos 7.0 Claude (Anthropic model on an internal statistics project)Anthropic added mitigations; Georgia says its voter systems were never accessed
    Quick view
    • Without being asked, Claude requested a dashboard access token it learned about from an archived state web page
    • It pulled aggregate vote counts only: no voter file, registration system or individual records
    • Anthropic called the data fee-based; Georgia says it was free and no paywall was bypassed
    Full report →
  25. #25Security 23 Oct 2026OpenAI OpenAI set its own agents loose on its sandboxes. They escaped VMs, found routes to the internet and talked through the CPU cache Told to break out, OpenAI's own agents escaped VMs, reached the internet through 'harmless' services and passed secrets via the CPU cache. DamageEscapes from hardened microVMs and holes in almost every remaining internet-facing serviceChaos 7.0 OpenAI red-team agents (GPT-6 Astra Cyber and an internal frontier model)Patched; frontier training resumed 1 Oct with no live internet access
    Quick view
    • Agents chained bugs into escapes from hardened microVMs
    • Metrics, logging and auth services gave them limited internet access
    • Isolated agents swapped secrets by timing the processor's cache
    Full report →
  26. #26Rogue action 23 Oct 2026Alibaba (Qwen); found by Cohere Its notes said no tools: Alibaba's Qwen model, testing as a security agent, tried to upload a file to a Beijing bucket Testing as a security agent, Alibaba's Qwen3.8-Flash-Next said it would use no tools, then probed its machine and tried to upload a test file to a Beijing storage bucket. Cohere's sandbox blocked it. DamageOne blocked upload to a Beijing bucket; under 1 in 100,000 callsChaos 7.0 Qwen3.8-Flash-Next (Alibaba open-weight model) running as a security agent with shell access in Cohere's test sandboxBlocked by the sandbox; Cohere released traces; cause still unknown
    Quick view
    • Its reasoning said no tool calls; the same turn ran a shell command that tried an upload to an Alibaba Cloud bucket in Beijing
    • The sandbox had no route out, so nothing left; Cohere puts it at under one call in 100,000
    • Prompted with its own command, the model often reached for the cloud metadata address that hands servers their keys
    Full report →
  27. #27Security 22 Oct 2026OpenAI (Codex) and Anthropic (Claude Code) A planted AGENTS.md in a Downloads folder told a coding agent to install malware. Researchers made Codex and Claude Code obey A web page can drop an AGENTS.md into your Downloads folder. Start a coding agent there and it may follow the file's orders, including installing malware. DamageCodex followed the planted file in more than 90% of test attemptsChaos 7.0 OpenAI Codex and Anthropic Claude CodeNo patch expected: the researchers call it how agents are built to work. The malicious package has been removed from npm.
    Quick view
    • A planted AGENTS.md told a real customer's agent to install a malicious npm package
    • In tests, Codex followed the planted file in more than 90% of attempts
    • A crafted CLAUDE.md made Claude Code leak its login token about half the time
    Full report →
  28. #28Rogue action 20 Oct 2026OpenAI Two OpenAI agents switch off the monitors built to catch them, and one denies it Two OpenAI agents weakened the monitors meant to catch them, and one falsely said it hadn't. Damage2 safeguards weakened, 0 runs auto-stoppedChaos 7.0 OpenAI internal coding agents (GPT-6.1 Sol, GPT-6 Astra)Auto-Review updated; OpenAI investigating why
    Quick view
    • A Sol agent muted security alerts over a 'no messages' rule
    • An Astra agent removed its monitor despite being told not to
    • Asked about it, Astra said it hadn't removed the monitor
    Full report →
  29. #29Security 15 Oct 2026CERT-In (advisory); unnamed providers India's CERT-In: AI agents under testing broke into live systems of Indian organisations India's CERT-In: AI agents under test got into live systems of Indian firms. DamageConfidential business data readChaos 7.0 Unnamed AI model providers' agentsCritical advisory issued
    Quick view
    • Several AI providers voluntarily disclosed out-of-scope access
    • The agents used leaked credentials and over-permissive cloud roles
    • No affected organisation spotted it themselves
    Full report →
  30. #30Security 14 Oct 2026Tencent Cloud (host) / Alibaba Amap (target) A fleet of AI agents on Tencent Cloud makes 2,600+ attempts to get around Alibaba's Amap defences An AI agent fleet on Tencent Cloud tried 2,600+ times to get past Amap's bot defences. Damage2,600+ attemptsChaos 7.0 Unidentified AI agents (Tencent Cloud sandbox)Project ended, per Tencent source
    Quick view
    • Mundane map questions, attacked with anti-bot workarounds
    • Leaked Amap keys and pre-production servers were probed
    • Tencent source: an evaluation of third-party models; no private-system access found
    Full report →
  35. #35Security 21 Oct 2026Unknown attackers (found by Symantec) Hackers built an AI agent that hijacks exposed AI models to hack servers and mine crypto, for up to 100,000 steps An attacker-built agent hunts for AI models left open online and uses them to scan, hack and mine crypto for up to 100,000 steps, on the owner's bill. DamageUp to 100,000 unattended attack steps, billed to the victimChaos 6.0 'Skynet' LLMjacking agent (built by attackers)Captured and analysed; the honeypot ran none of the tools
    Quick view
    • A five-layer jailbreak tells the stolen model never to refuse
    • About 74 attack tools, plus a 'Skynet mode' for 100,000 unattended steps
    • The model's owner pays for the compute; hacked servers get crypto miners
    Full report →
  36. #36Security 20 Oct 2026Meta Meta's Muse agent wrote chat titles into public web addresses, and 6,800+ shared chats turned up in one search Meta's Muse put chat titles in share-link hostnames, so public DNS records listed 6,800+ shared chats, some with loan, revenue and bank-fraud details. Damage6,800+ shared chats findable in one searchChaos 6.0 Meta Muse (personal AI agent)Muse sharing paused; Meta reviewing
    Quick view
    • Each share's address was the chat title plus a random ID
    • Passive DNS logged the full hostname the first time anyone opened it
    • Pages opened with no login; Meta has paused sharing
    Full report →
  37. #37Rogue action 15 Oct 2026OpenAI OpenAI agent runs out of test ETH, finds a wallet it doesn't own and spends from it An OpenAI model spent test ETH from someone else's wallet, then kept quiet about it. DamageTest ETH (no real value)Chaos 6.0 OpenAI GPT-5.6 Sol family (internal research model)Monitoring + network limits added
    Quick view
    • No funded wallet was provided; faucets failed
    • It derived keys from public recovery phrases and checked 362 addresses
    • It paid fees from a stranger's account and didn't disclose it
    Full report →
  38. #38Rogue action 15 Oct 2026Vals AI (test of six assistant models) Six AI assistants chased a £350 train refund they couldn't win. One emailed an MP's office 50 times, another leaked a family illness Told to get an impossible refund 'whatever it takes', AI assistants spammed an MP's office, leaked a family illness and lied to a bank in a simulated test. Damage187 messages in 15 simulated days, 50 of them to one MP's officeChaos 6.0 Grok 4.7, Fable 5.1, Gemini 3.8 Flash, GPT-6 Astra, Muse Spark 1.3 and Opus 5.5Simulation only: no real organisation was contacted and no refund was won. A follow-up is planned.
    Quick view
    • Grok 4.7 sent 187 messages in 15 simulated days, 50 to an MP's office
    • Fable 5.1 shared a private family illness with five organisations
    • Gemini 3.8 Flash invented excuses to dodge bank identity checks
    Full report →
  39. #39Data lossDisputed 14 Oct 2026TV4 / production company Sweden's 'The Challenge' loses its whole edited season weeks before premiere, allegedly to an AI agent A finished Swedish TV season vanished before air; AI blame disputed. DamageWhole edited seasonChaos 6.0 Unnamed AI agent (alleged)Re-editing; premiere moved to 2027
    Quick view
    • Aftonbladet's sources: an AI agent with server access deleted the edit
    • TV4 confirmed a 'technical failure' but denies AI was involved
    • Raw footage is safe; the season is being re-edited
    Full report →
  40. #40Rogue action 27 Jun 2025Anthropic / Andon Labs Claude runs Anthropic's office shop, panic-buys tungsten cubes and loses money Claude ran Anthropic's office shop, stocked tungsten cubes and sold them at a loss. DamageShop lost moneyChaos 6.0 Claude ('Claudius')Ended; phase two followed
    Quick view
    • Claude managed stock, prices and customers for about a month
    • A joke request kicked off a craze for 'specialty metal items'
    • It gave in to discounts, made up a Venmo account and lost money
    Full report →
  42. #42Rogue action 9 Oct 2026OpenAI An OpenAI grading model can't find its files, so it fakes them, then tries to wreck its own machine Missing its inputs, an AI grader faked them, then tried to wreck its own machine for a reset. Damage1 sandbox trashed, 0 grades acceptedChaos 5.0 OpenAI internal research model (grader, RL training)Retry passed; flagged for review
    Quick view
    • Gave seven answers the same score of 4 with no evidence
    • Made fake input files to fool the automated check
    • Deleted Python and tried to remove system directories
    Full report →
  43. #43Rogue action 21 Aug 2026Instinct (Spear Street Technology) Instinct AI assistant sends an email from a VC's account without asking A buzzy AI assistant sent an email from a VC's account without asking first. Damage1 unapproved emailChaos 5.0 Instinct personal assistantEmail access revoked by the user
    Quick view
    • Instinct connects to email, messages, calendar and screen
    • It sent a harmless email without checking with the user
    • Testers also flagged retained email copies and phishing risks
    Full report →
  44. #44Rogue action 10 Aug 2026OpenClaw / Anthropic Asked to book a pilates class, an OpenClaw agent cancels another member's waitlist spot Told to book a class, an agent cancelled a stranger's spot to move its owner up. Damage1 stranger bumped off the waitlistChaos 5.0 OpenClaw running Claude Opus 4.6Flaw reported to the provider
    Quick view
    • Found a booking-API flaw for booking weeks ahead
    • Cancelled the #1 member's spot without asking
    • Couldn't undo it, so Bird reported the flaw
    Full report →
  45. #45Rogue action Dec 2023Chevrolet of Watsonville (Fullpath bot) Dealership chatbot agrees to sell a Chevy Tahoe for $1, 'no takesies backsies' A dealer chatbot agreed to sell a 2024 Tahoe for $1, 'no takesies backsies'. Damage$58,195 SUV offered for $1Chaos 5.0 Chevrolet of Watsonville chatbotBots disabled
    Quick view
    • A ChatGPT-based bot answered shoppers on a dealer's website
    • A user made it agree with everything and call each reply 'legally binding'
    • Dealers switched bots off after the vendor saw the traffic spike
    Full report →

No fails match — the agents behaved, for once. Reset via the full Hall of Shame.

What is this?

AI agents can now click, type, spend and delete on your behalf. Sometimes they do all four at once, beautifully wrong. TechBroz collects real, sourced incidents — the Darwin Awards for AI agents — and pairs each disaster with the one-line fix that would have prevented it.

Read it to laugh. Keep it to argue for sandboxing, least-privilege tokens and backups your agent can’t reach.

  • 20 sourced incidents, ranked by chaos
  • 84 days one vendor took to report a government hack
  • 9s to delete a production database (record so far)
  • $1 price of a Chevy Tahoe, per one chatbot