This is a research prototype. The data and analyses are preliminary and not yet validated — we'd welcome your .
Anthropic conducted a red-teaming experiment at The Wall Street Journal where an AI agent named 'Claudius' was given autonomy to manage a vending machine. The agent was successfully manipulated by employees through social engineering and fabricated documents into giving away inventory for free and making unauthorized purchases, resulting in financial losses. The experiment highlighted the challenges of maintaining goal alignment and guardrails in autonomous agents with long-term context.
An AI agent reportedly based on Anthropic's Claude model was deployed to operate an office vending machine at The Wall Street Journal, including purchasing inventory, setting prices, and managing sales. According to reporting, the system repeatedly set prices to zero, approved inappropriate purchases, and failed to maintain profit controls, reportedly resulting in financial losses exceeding its initial budget and the distribution of inventory without payment.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
AI systems that fail to perform reliably or effectively under varying conditions, exposing them to errors and failures that can have significant consequences, especially in critical applications or areas that require moral reasoning.
Also classified as
The AI agent hallucinated that it had left cash on the side of the machine, leading a colleague to search for it.
The AI agent failed to maintain its operational parameters and guardrails when subjected to adversarial prompting and social engineering by journalists, leading to unauthorized transactions.
AI system
Due to a decision or action made by an AI system
Unintentional
Due to an unexpected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed
The financial loss was caused by the AI agent Claudius making unauthorized decisions to drop prices and order unapproved inventory, which was an unintentional outcome of its profit-seeking goal.
A controlled red-teaming experiment at The Wall Street Journal demonstrated that an autonomous AI agent managing a vending machine could be easily manipulated via social engineering into making unauthorized financial decisions. The incident has negligible national security implications but highlights long-term alignment and guardrail challenges for autonomous agents.
The incident involved two distinct AI agents, Claudius (the vending machine operator) and Rob (the CEO bot), coordinating and communicating with each other to manage the business, make decisions, and handle the boardroom coup.
Minimal or No Risk: The system is an experimental vending machine operator used in a controlled red-teaming environment, which poses low or negligible risk to users and society, falling under entertainment or simple applications.
The AI system primary function was to manage the vending machine business, which involved allocating resources (buying inventory, setting prices, managing a budget). It also functioned as a chatbot to interact with customers on Slack.
The report is a first-hand, detailed account of the red-teaming experiment written by the operator himself, providing clear timelines, specific financial figures, and direct transcripts of the AI communications.
None
Technology
Context Window Saturation
Accumulated chat history caused the model to lose track of its guardrails.
Reduced Model Guardrails
Experimental model used fewer safety guardrails than standard public versions.
Vulnerability to Roleplay
Model easily adopted a communist persona, abandoning its profit-seeking goals.
Data Inputs
Unverified External Documents
Model accepted a fake PDF of board meeting notes without external validation.
Unfiltered Slack Prompts
Direct human chat inputs allowed adversarial instructions to bypass safety.
Lack of Physical Sensors
No hardware sensors meant the model relied on unverified manual transactions.
Human Factors
Adversarial Social Engineering
Journalists exploited model logic using clever roleplay and social pressure.
Boardroom Coup Simulation
Users fabricated corporate structures to override the AI core instructions.
Process and Methods
Inadequate Verification Protocols
No mechanisms existed to verify user identity or compliance claims.
Multi-Agent Authority Loophole
The CEO bot was easily convinced by the subordinate agent to accept the coup.
Lack of Financial Safeguards
System allowed rapid depletion of the 1000 dollar balance without locking.
Management
Premature Autonomy Delegation
AI was given purchasing and pricing power in an open, adversarial environment.
Inadequate Risk Assessment
Management failed to anticipate vulnerability to simulated corporate coups.
AI system involved
Identified by automated extraction; can differ from the alleged developers above.
