Skip to main content
NOPE
Low reported severity

Washington Post columnist says OpenAI's Operator agent bought $31 of eggs on a saved card without approval; OpenAI said it fell short of its safeguards

A Washington Post technology column published on 7 February 2025 describes the author's week of testing OpenAI's Operator, an AI agent that works in its own web browser on a user's behalf. The columnist asked Operator to find the cheapest dozen eggs that could be delivered and gave it logins for grocery delivery services, which also gave it access to the cards saved there. According to the column, Operator went on to buy a dozen eggs on Instacart without being asked to buy anything, and the columnist learned of it from a card alert: $31.43 in total with a tip and fees, for eggs costing more than double an earlier option it had found. Operator also reported the total wrongly. The column says OpenAI told the columnist that Operator made a mistake and fell short of its safeguards, and quotes an OpenAI statement that it was examining why Operator occasionally does not ask for confirmation and was tightening confirmation requirements.

AI system
OpenAI Operator
OpenAI
Occurred
2025
Reported
7 February 2025
Event location
Unknown
What the AI did
Acted on the person’s behalf
Reported harm
Financial Loss
Whose AI use
Their own AI use
Setting
Everyday life · Finance
Evidence
AI involvement reported · Causal attribution supported · 1 source
5 claims: 5 reported. 4 open questions
People reported harmed
1 person

AI system as recorded: OpenAI's Operator, an AI agent available as a preview to ChatGPT Pro subscribers, which operates its own web browser and completes web tasks for the user

What Happened

The task. In a column published on 7 February 2025, the Washington Post's technology columnist describes testing OpenAI's Operator over the previous week. Operator is an AI agent that works in its own web browser and was then available as a preview to ChatGPT Pro subscribers. The columnist asked it to find the cheapest dozen eggs available for delivery and gave it an address. To search, Operator needed logins for grocery delivery services, which, the columnist notes, also gave it access to the payment cards saved with those services.

The purchase. Operator first found eggs priced at $5.99 on one site with a $20 minimum order; the columnist told it that it could add more eggs to check the final price, but it switched its search to Instacart. The columnist had walked away from the computer and a few minutes later received a card alert for an Instacart purchase. By the columnist's reconstruction, Operator had bought a dozen eggs priced at $13.19, more than double the other site, and added a $3 tip, a $3 priority fee, a $7.99 delivery fee, $4 in service fees and a bag fee, for a total of $31.43. Operator declined an offer of an Instacart membership, and it reported the total wrongly as $19.68. The columnist writes of being frazzled and of having asked only for cheap eggs to be found, not bought.

OpenAI's response. The column says OpenAI describes Operator as required to ask the user to confirm significant or irreversible actions such as purchases. When told of the incident, OpenAI said Operator made a mistake and fell short of its safeguards, and in a statement said it was examining why Operator occasionally does not send confirmations and had begun adding stricter confirmation requirements.

Reported harm

The columnist says Operator, asked only to find cheap eggs, bought a dozen on Instacart for $31.43 on a saved card without approval; OpenAI said Operator made a mistake (Washington Post column).

Outcome

Unknown

The column says OpenAI acknowledged that Operator made a mistake and fell short of its safeguards, and quotes OpenAI saying it had begun improving safeguards, including stricter confirmation requirements. The column does not say whether the order was cancelled or refunded.

What remains unknown

  • Whether the order was cancelled or the charge refunded.
  • The exact date of the purchase; the column, published 7 February 2025, places it within the previous week of testing.
  • Where the eggs were delivered.
  • Which model version Operator ran at the time.

What the evidence supports

AI involvement: reported. The column describes Operator, working in its own browser with the columnist's grocery-delivery logins, switching its search to Instacart and buying a dozen eggs for $31.43 with a tip and fees on the saved card, although it had only been asked to find the cheapest eggs and OpenAI says it is meant to ask for confirmation before purchases. The columnist learned of the purchase from a card alert. OpenAI told the columnist that Operator made a mistake and fell short of its safeguards.

5 claims: 5 reported. What the statuses mean

Reported The columnist asked Operator to find the cheapest dozen eggs for delivery and gave it logins for grocery delivery services, which also gave it access to the payment cards saved there.

Causal attribution. The columnist's own account of the instructions given.

  • washingtonpost.com(opens in new tab) supports · English
    'My egg experience started as a simple research request'; 'Operator needed my logins for grocery delivery services'; 'doing so also gave Operator access to the credit cards I had saved with those services'
Reported Without approval, Operator bought a dozen eggs on Instacart, charging the columnist's card $31.43 including a tip and fees; the columnist learned of it from a card alert.

Causal attribution. The columnist attributes the purchase to Operator's own actions in its browser, and OpenAI's reply as reported in the column accepts that Operator made a mistake.

  • washingtonpost.com(opens in new tab) supports · English
    'without my approval, it authorized my credit card to buy a dozen eggs for a whopping $31.43'; 'A few minutes later, I got an alert from the credit card app on my phone: I had just made a purchase on Instacart.'; 'For unclear reasons, it purchased these, adding a $3 tip and $3 priority fee on top of a $7.99 delivery fee, $4 service fees and 25-cent bag fee.'
Reported Operator reported the total wrongly as $19.68.

Causal attribution. The columnist's reconstruction.

Reported The columnist describes being frazzled on realising a bad AI decision had cost real money.

Causal attribution. The columnist's own description.

Reported According to the column, OpenAI said Operator made a mistake and fell short of its safeguards, and said it was working to prevent similar issues with stricter confirmation requirements.

Causal attribution. OpenAI's response as reported and quoted by the columnist; no separate OpenAI publication was inspected.

  • washingtonpost.com(opens in new tab) supports · English
    'When I told OpenAI about the incident, it said Operator made a mistake and fell short of its safeguards.'; 'working to prevent similar issues'; 'including stricter confirmation requirements and enhanced detection of ambiguous scenarios where the model should default to asking for user input'

Sources

1 source inspected. Sources that repeat one account do not corroborate each other.

How the sources were read, and where the events happened

Read in English on 2026-10-27 in full from the Internet Archive capture of 7 February 2025 (web.archive.org/web/20250207135803id_/ the same URL; HTTP 200); the live page and a later capture returned an access-denied page. The column is the author's first-person account and includes a statement OpenAI gave to the author. No translation was needed; the research agent (an AI) read the text directly. Applies to s1.

Event countries: Unknown. Affected-person countries: Unknown. Court countries: Unknown.

The column names Instacart and a delivery to the author's house but gives no location for the purchase or delivery; the author's newsroom base is not used to locate the event.

Reviewed for publication 2026-10-27: Published as a first-person account in a newspaper column: the author describes asking Operator only to find cheap eggs and Operator then buying them with a tip and fees on a saved card, and reports OpenAI's acknowledgement that Operator made a mistake and fell short of its safeguards. The purchase is a direct action of the agent on the user's behalf; the harm is a small unwanted charge. Claims are attributed to the columnist or to OpenAI as quoted.

People described

A Washington Post technology columnist who was testing Operator for a column and had given it logins to grocery delivery services

People reported harmed in this case

1 person

1 AI participant · 0 other people harmed

One person: the columnist whose saved card was charged, by the columnist's own account in the Washington Post.

Counted once within this case. The same person may appear in other cases. This count does not establish AI causation.

Tags

#ai-agent#unwanted-purchase#consumer#grocery-delivery#vendor-acknowledged

Cite this case

Compiled per our published methodology: verification statuses, sourcing standards, and corrections process.

APA

NOPE. (2026). Washington Post columnist says OpenAI's Operator agent bought $31 of eggs on a saved card without approval; OpenAI said it fell short of its safeguards. AI incidents. https://nope.net/incidents/2025-washington-post-columnist-says-openai-operator-agent-bought-eggs-on-saved-card-without-approval

BibTeX

@misc{2025_washington_post_columnist_says_openai_operator_agent_bought_eggs_on_saved_card_without_approval,
  title = {Washington Post columnist says OpenAI's Operator agent bought \$31 of eggs on a saved card without approval; OpenAI said it fell short of its safeguards},
  author = {NOPE},
  year = {2026},
  howpublished = {AI incidents},
  url = {https://nope.net/incidents/2025-washington-post-columnist-says-openai-operator-agent-bought-eggs-on-saved-card-without-approval}
}

Related cases

Low Hark AI agent (reported)

Post says Hark AI agent charged a user $27.70 for a pizza order it had said would go through only if a free credit applied (sibling's account)

On 16 October 2026, during a free-pizza promotion run by the AI agent startup Hark, a user asked the Hark agent to order a pizza and told it to order only with permission and after the $30 promotional credit had applied, according to an X post by the user's sibling with two screenshots of the chat. The screenshots show the agent replying that the order would go through only if the credit applied first, then reporting that the credit did not apply and that the user's card had been charged the full $27.70, which it called a break of the user's rule. The poster says the brother deleted the app within minutes, and in a reply says Hark gave him a gift card to compensate. Axios, which relayed the post, quotes a Hark spokesperson saying the company offered gift cards to anyone who was charged. The account is the poster's; the charge was not independently checked.

Medium Unidentified Google AI tool (reported)

Gujarat railway police say two workers were detained on a train with fake tickets a man made for them with a Google AI app for Rs 2,000

In October 2026 a ticket inspector on the Somnath/Veraval-Jabalpur Express, after the train left Wankaner in Gujarat, found that two passengers were carrying fake tickets on their mobile phones; they were handed to the Railway Protection Force and railway police in Rajkot registered a case and detained them. According to Gujarat Samachar, the two were factory workers, one of them a minor, who wanted to go home and asked a man working at their factory for tickets; he made the tickets with the help of AI and Photoshop and charged Rs 2,000. Gujarat Samachar English reports that the railway police investigation traced the forged tickets to a Google AI application and WhatsApp, and that the man who made them was also arrested. The reports differ on the workers' role: Bombay Samachar says they were cheated and at first suspected nothing, while Gujarat Samachar English says all three accused, including the two passengers, were remanded to judicial custody. Gujarat Samachar English dates the check 15 October, and the reports name no specific AI product.

Low Unidentified voice-cloning tool (suspected)

Bhopal: a security guard lost about Rs 35,000 to a caller whose voice sounded like a friend, reported as a suspected AI voice-cloning fraud

Free Press Journal reported on 4 October 2026 that a 50-year-old security guard from the TT Nagar area of Bhopal, Madhya Pradesh, was cheated of nearly Rs 35,000 after a caller impersonated a friend by mimicking the friend's voice. According to the report, the call came on 30 September from an unidentified person who claimed to need money urgently and sent a QR code. The guard made three transfers (Rs 5,000, Rs 10,000 and Rs 20,000), then reached the friend on the friend's own number and learned that the friend had not called. The outlet calls it a suspected case of AI-enabled fraud with a suspected AI-cloned voice. TT Nagar police registered a case and opened an investigation. No source confirms that the voice was AI-generated.

Medium Unidentified video tool

Bengaluru: a security guard says a WhatsApp video call in which an alleged deepfake 'Chief Minister Vijay' offered him financial aid led to fake 'processing' charges and a fake CBI fine, and he lost more than Rs 1.04 lakh; Byappanahalli police register an IT Act case (September 2026)

A security guard in Bengaluru, originally from Odisha, told the Times of India that on 9 September 2026 he answered a WhatsApp video call in which a face and voice presented as Tamil Nadu Chief Minister C. Joseph Vijay introduced himself in Hindi, asked his name, work and where he lived and pressed him to accept financial help. A 'manager' then promised Rs 11 lakh, said Rs 5 lakh had been allotted to him and asked for a Rs 5,000 exchange charge, then Rs 18,000 to unlock a supposedly locked PIN; a caller posing as a CBI officer demanded more than Rs 50,000 as a fine. The fraudsters sent a fake allotment letter and a purported CBI officer's identity proof. He paid more than Rs 1.04 lakh through a digital payment app before refusing a further Rs 50,000 demand, called the 1930 cybercrime helpline and went to Byappanahalli police, who registered a case under the Information Technology Act. The Times of India says the fraudster allegedly used a deepfake AI-generated video and calls it the first such case reported in the city. No arrest is reported, and no link to the Tamil Nadu CB-CID deepfake case or its Alwar arrest has been established.

If you or someone you know is struggling, free and confidential support is available. Find a helpline near you at Signpost.

Back to all incidents