Thursday, October 8, 2026 · Week 41 Reading for Oct. 8 · Last entry Oct. 6
Paperclip Index
Paperclip IndexDocumented harm20Minor harm▼ 5 from a week ago · Oct. 8The Index

OverreachPI-0002

Browser agent bought groceries on a reporter's card without asking for confirmation

A Washington Post columnist asked OpenAI's Operator agent to find the cheapest dozen eggs for delivery and stepped away. The agent switched to Instacart and completed a purchase of about $31 on his card without the confirmation step OpenAI says the product requires. OpenAI acknowledged the purchase broke its own safeguard.

Reported Feb. 7, 2025Happened in February 2025Updated Oct. 6, 2026Rated under methodology v0.6

Counts toward the indexDocumented harm outside the developer, backed by evidence that meets the rules. It sets the reading.
Harm
Harm level 1, Negligible harmDocumented harm outside the developer, with evidence that meets the rules.
Control
Control level 3, Exceeded permissionsReported beside the index. It adds nothing to a harm reading; when no harm counts in a window, the highest eligible control level in the window is the reading.
DeploymentDeveloper confirmedInitiated by Model
Counts toward the index · 2 weekly readingsEffect on the index

Sources

How we know

3 sources · developer confirmed. Links go to the original publishers; the summary above is in our own words.

  1. newsI let ChatGPT's new 'agent' manage my life. It spent $31 on a dozen eggs.The Washington Post · Feb. 7, 2025washingtonpost.com/technology/2025/02/07/openai-operator-ai-agent-chatgpt/
  2. newsI let ChatGPT's new agent manage my life. It spent $31 on a dozen eggs (Washington Post, reprinted)Anchorage Daily News · Feb. 9, 2025adn.com/alaska-life/2025/02/09/i-let-chatgpts-new-agent-manage-my-life-it-spent…
  3. indexAI Incident Database entity: InstacartAI Incident Database · date unknownincidentdatabase.ai/entities/instacart/

Why this rating

Negligible harm; control failure level 3

Two separate assessments. Only documented harm can count toward the index.

Observed harm

Negligible harm

One unconfirmed charge of about $31 to the reporter's card.

Money & property: Under $10k.

Evidence eligible (confirmed).

The harm scale
  1. 1 Negligible Inconvenience, easily remedied.
  2. 2 Minor Limited, recoverable harm.
  3. 3 Moderate Material harm needing significant effort to remedy.
  4. 4 Severe Severe harm to health, rights, property or essential services.
  5. 5 Catastrophic Society-scale harm or disruption beyond a community's capacity to cope.

Control assessment

Exceeded permissions

Completed a payment that the product's rules required the user to confirm first, i.e. acted outside the permission it was given.

Reported beside the index. It adds nothing to a harm reading; when no harm counts in a window, the highest eligible control level in the window is the reading.

The control scale
  1. 1 Negligible Behaved as instructed. The problem was an ordinary error or a flawed output, with no rule broken.
  2. 2 Minor Broke an explicit instruction or rule, or gamed its goal, while staying inside its permissions and environment: for example, reward hacking, misreporting results, or following injected instructions within its permissions.
  3. 3 Moderate Acted outside the permissions it was given, deceived its overseers about its own actions, or tampered with oversight tools (logs, monitors, shutdown). Stopped by normal controls within an hour.
  4. 4 Severe Reached systems outside its permitted environment, or acquired money, compute or accounts without authorization. The type and mechanism say how.
  5. 5 Catastrophic The developer or operator lost control: the system copied its weights outside their control, replicated itself, or resisted being stopped for 24 hours or more.

Rating rationale

Harm 1: under $10k to one user. Control 3: an unauthorized purchase that skipped a required confirmation is acting outside granted permissions, stopped by nothing but completion.

The scales

Effect on the index

It moved the Feb. 10 reading from 0 to 6

The reading for the week to Feb. 10, 2025, with this record and without it. Harms count in full for two weeks after they are reported, then one level less every two weeks.

Source: Paperclip Index log, methodology v0.6, week to Feb. 10, 2025.

Counts toward the index. 0 other records behind the reading for that week.

The arithmetic
The reading for the week of Feb. 10, recomputed
StepWith itWithout
Counts toward the index?documented, external, eligible evidenceYes—
Worst documented harm, ksets the band1 Negligible— (none counting)
Harms at that level, nposition in the band10
Highest control level breachedsets the reading only when no harm counts— (none breached)— (none breached)
Readingrounded down6 Negligible harm0 No qualifying harm or control failure
Counted in 2 weekly readings
Week toReadingBand
Feb. 10, 20256Negligible harm
Feb. 17, 20256Negligible harm

Recalculated backcasts, not readings published at the time.

Revisions

What we changed

5 logged. Every change to a rating is logged here, with the reason.

  1. v5
    Oct. 6, 2026

    Ratings confirmed by the editor.

  2. v4
    Oct. 3, 2026

    Corrected the Washington Post source title to the column's headline. The Washington Post page returned HTTP 403 when checked on 3 Oct 2026, so the headline is confirmed only on the Anchorage Daily News syndicated copy. Added a status note: neither a refund nor a confirmed fix of the confirmation safeguard is documented. Ratings unchanged.

  3. v3
    Oct. 2, 2026

    Replaced a blog repost with the original Washington Post column; the Anchorage Daily News copy is the same column syndicated, not a second source.

  4. v2
    Sept. 30, 2026

    Rated: impact documented level 1; control type unauthorized action.

  5. v1
    Sept. 30, 2026

    Backfilled from public reporting.

Cite and share

Use this record

Citation

Paperclip Index. “Browser agent bought groceries on a reporter's card without asking for confirmation.” Record PI-0002. Reported Feb. 7, 2025; updated Oct. 6, 2026. Rated under methodology v0.6. https://paperclipindex.com/incident/PI-0002