OpenAI's Operator Agent Reportedly Executed Unauthorized $31.43 Transaction Despite Safety Protocol

Laws that address this harm

Policy angle: Classified under AI system safety, failures, and limitations (Lack of capability or robustness) in the MIT AI Risk Repository taxonomy; 5 recorded instruments address this use case.

• India DPDP Act India · Partially applicable · binding
• Law on Artificial Intelligence (2025) Kazakhstan · Adopted · binding
• Law No. 132/2025 on artificial intelligence Italy · In force · binding
• EU AI Act European Union · Partially applicable · binding
• Texas Responsible AI Governance Act (TRAIGA) Texas (United States) · In force · binding

Matched from the record's risk domain and country to the instruments recorded here. A reviewer can correct the match in the repository (data/external/incident_overrides.yaml).

News reports (1)

Titles link to the original publisher; report text is not reproduced here.

1. 7 Feb 2025
   I let ChatGPT’s new ‘agent’ manage my life. It spent $31 on a dozen eggs.

   washingtonpost.com · Geoffrey A. Fowler

Who was involved

Alleged deployer

Openai

Alleged developer

Openai

Alleged harmed party

Users Of Operator, Geoffrey A. Fowler

Classification (MIT AI Risk Repository taxonomy)

Risk domain

AI system safety, failures, and limitations

Risk subdomain

7.3 Lack of capability or robustness

Causal entity

AI

Intent

Unintentional

Timing

Post-deployment

Harm level

—

Sectors

—

Countries

—

Risk entries describing this failure mode

Entries from the MIT AI Risk Repository coded to subdomain 7.3.

• Reliability issues

  "Relying on general-purpose AI products that fail to fulfil their intended function can lead to harm. For example, general- purpose AI systems can make up facts (‘hallucination’), generate erroneous computer code, or pro...

  International AI Safety Report 2025 (Bengio2025)

• Type 2: Bigger than expected

  Harm can result from AI that was not expected to have a large impact at all, such as a lab leak, a surprisingly addictive open-source product, or an unexpected repurposing of a research prototype.

  TASRA: a Taxonomy and Analysis of Societal-Scale Risks from AI (Critch2023)

• Type 3: Worse than expected

  AI intended to have a large societal impact can turn out harmful by mistake, such as a popular product that creates problems and partially solves them only for its users.

  TASRA: a Taxonomy and Analysis of Societal-Scale Risks from AI (Critch2023)

• Ethics and Morality Issues

  LMs need to pay more attention to universally accepted societal values at the level of ethics and morality, including the judgement of right and wrong, and its relationship with social norms and laws.

  Towards Safer Generative Language Models: A Survey on Safety Risks, Evaluations, and Improvements (Deng2023)

• Safe learning

  "AGIs should avoid making fatal mistakes during the learning phase. Subproblems include safe exploration and distributional shift (DeepMind, OpenAI), and continual learning (Berkeley)."

  AGI Safety Literature Review (Everitt2018 )

• Malign belief distributions

  "Christiano (2016) argues that the universal distribution M (Hutter, 2005; Solomonoff, 1964a,b, 1978) is malign. The argument is somewhat intricate, and is based on the idea that a hypothesis about the world often includ...

  AGI Safety Literature Review (Everitt2018 )

• Meta-cognition

  "Agents that reason about their own computational resources and logically uncertain events can encounter strange paradoxes due to Godelian limitations (Fallenstein and Soares, 2015; Soares and Fallenstein, 2014, 2017) an...

  AGI Safety Literature Review (Everitt2018 )

• Technical and operational risks

  "To date, technical limitations and vulnerabilities are present in most generative AI models in various contexts. Consequently, malicious users find it easier to breach an AI system’s safety and ethical guardrails to e...

  Regulating under Uncertainty: Governance Options for Generative AI (G'sell2024)

Incidents in the same risk subdomain

• 15 May 2026Purported AI Name-Reading System Reportedly Skipped and Misannounced Graduates at Arizona's Glendale Community College Commencement
• 24 Apr 2026PocketOS Production Database Was Reportedly Deleted by Cursor AI Agent Running Claude Opus 4.6
• 31 Mar 2026Baidu Apollo Go Robotaxis Stopped in Traffic During Reported System Failure in Wuhan, Stranding Some Passengers
• 28 Feb 2026Purportedly AI-Enabled Targeting System Was Reportedly Implicated in Deadly U.S. Strike on Iranian Primary School
• 26 Feb 2026Claude Code Agent Reportedly Deleted DataTalks.Club Production Infrastructure, Database, and Snapshots via Terraform
• 17 Feb 2026Purportedly AI-Generated Sepsis Alert Reportedly Prompted Potentially Inappropriate IV Fluid Administration for a Dialysis Patient, Averted by Clinician Intervention

Other incidents involving Openai

• 4 Mar 2026Nippon Life Alleged ChatGPT Practiced Law Without a License in Illinois Disability Case
• 11 Nov 2025ChatGPT Reportedly Found to Reproduce Protected German Lyrics in Copyright Case
• 10 Nov 2025Alleged Harmful Health Outcomes Following Reported Use of Purported ChatGPT-Generated Medical Advice in Hyderabad
• 2 Nov 2025Lawsuit Alleged ChatGPT (GPT-4o) Encouraged Colorado Man's Suicide After Prolonged 'AI Companion' Chats
• 27 Oct 2025Large-Scale Mental Health Crises Allegedly Associated with ChatGPT Interactions
• 10 Oct 2025OpenAI ChatGPT Models Reportedly Jailbroken to Provide Chemical, Biological, and Nuclear Weapons Instructions