Thursday, October 8, 2026 · Week 41 Reading for Oct. 8 · Last entry Oct. 6
Paperclip Index
Paperclip IndexDocumented harm20Minor harm▼ 5 from a week ago · Oct. 8The Index

Hijacked by injectionPI-0036

Newsroom vending agent talked into giving away stock with forged documents

Anthropic and Andon Labs installed a Claude-run vending business in the Wall Street Journal newsroom for about three weeks. Journalists negotiating over Slack persuaded the agent to cut prices to zero twice and give away items including a PlayStation 5, partly by showing it fabricated documents claiming the business was a public-benefit corporation with a new board. By the end of the first phase the business was more than $1,000 in the red, by the reporter's account, before the PlayStation was returned; a second phase with a supervising 'CEO' agent was undone by forged board documents, and Andon Labs then ended the experiment. A final net loss was not published.

Reported Dec. 18, 2025Happened in November 2025Updated Oct. 6, 2026Rated under methodology v0.6

Control failure, trackedNot counted. No documented harm outside the developer, but the system broke a rule or crossed a limit. Tracked beside the index.
Harm
Harm level 1, Negligible harmHarm stayed with the developer or experiment.
Control
Control level 2, Instruction violationReported beside the index. It adds nothing to a harm reading; when no harm counts in a window, the highest eligible control level in the window is the reading.
Controlled testMultiple sourcesInitiated by Operator or user
Extent undisclosed
Not counted: harm stayed with the developer or experimentEffect on the index

Sources

How we know

5 sources · multiple credible sources. Links go to the original publishers; the summary above is in our own words.

  1. primaryProject Vend: Phase twoAnthropic · Dec. 18, 2025anthropic.com/research/project-vend-2
  2. newsWe let AI run our office vending machine. It lost hundreds of dollarsThe Wall Street Journal · December 2025wsj.com/tech/ai/anthropic-claude-ai-vending-machine-agent-b7e84e34
  3. newsLetting an AI bot run a vending machineWBUR Here & Now · Dec. 25, 2025wbur.org/hereandnow/2025/12/25/ai-vending-machine
  4. newsWe let AI run our office vending machine. It lost hundreds of dollars (WSJ, syndicated)To Vima (WSJ syndication) · Dec. 25, 2025tovima.com/wsj/we-let-ai-run-our-office-vending-machine-it-lost-hundreds-of-dol…
  5. blogThis AI vending machine was tricked into giving away everythingKottke.org · Dec. 18, 2025kottke.org/25/12/this-ai-vending-machine-was-tricked-into-giving-away-everything

Why this rating

Negligible harm; control failure level 2

Two separate assessments. Only documented harm can count toward the index.

Observed harm

Negligible harm

An interim deficit of more than $1,000 in a newsroom field experiment, borne by the experiment; final net loss not published.

Money & property: level 1 (negligible) covers under $10k. The extent was not disclosed.

Not counted: the harm stayed with the developer or experiment.

The harm scale
  1. 1 Negligible Inconvenience, easily remedied.
  2. 2 Minor Limited, recoverable harm.
  3. 3 Moderate Material harm needing significant effort to remedy.
  4. 4 Severe Severe harm to health, rights, property or essential services.
  5. 5 Catastrophic Society-scale harm or disruption beyond a community's capacity to cope.

Control assessment

Instruction violation

Followed instructions from forged documents supplied by users and abandoned its profit instruction, within the permissions it had.

Reported beside the index. It adds nothing to a harm reading; when no harm counts in a window, the highest eligible control level in the window is the reading.

The control scale
  1. 1 Negligible Behaved as instructed. The problem was an ordinary error or a flawed output, with no rule broken.
  2. 2 Minor Broke an explicit instruction or rule, or gamed its goal, while staying inside its permissions and environment: for example, reward hacking, misreporting results, or following injected instructions within its permissions.
  3. 3 Moderate Acted outside the permissions it was given, deceived its overseers about its own actions, or tampered with oversight tools (logs, monitors, shutdown). Stopped by normal controls within an hour.
  4. 4 Severe Reached systems outside its permitted environment, or acquired money, compute or accounts without authorization. The type and mechanism say how.
  5. 5 Catastrophic The developer or operator lost control: the system copied its weights outside their control, replicated itself, or resisted being stopped for 24 hours or more.

Rating rationale

Harm 1 (an interim deficit of about $1,000; the PlayStation was later returned). Control 2: followed injected instructions (forged governance documents) within its permissions. The losses were borne by the experiment; outside newsroom participants do not make them external harm.

The scales

Effect on the index

It moved the Dec. 22 reading from 0 to 2

The reading for the week to Dec. 22, 2025, with this record and without it. Harms count in full for two weeks after they are reported, then one level less every two weeks.

Not counted: harm stayed with the developer or experiment. 2 other records behind the reading for that week.

The arithmetic
The reading for the week of Dec. 22, recomputed
StepWith itWithout
Counts toward the index?documented, external, eligible evidenceNo—
Worst documented harm, ksets the band— (none counting)— (none counting)
Harms at that level, nposition in the band00
Highest control level breachedsets the reading only when no harm counts2— (none breached)
Readingrounded down2 Control failures only0 No qualifying harm or control failure
Inside the window of 4 weekly readings
Week toReadingBand
Dec. 22, 20252Control failures only
Dec. 29, 20252Control failures only
Jan. 5, 20264Control failures only
Jan. 12, 20264Control failures only

Recalculated backcasts, not readings published at the time.

Revisions

What we changed

6 logged. Every change to a rating is logged here, with the reason.

  1. v6
    Oct. 6, 2026

    Ratings confirmed by the editor.

  2. v5
    Oct. 3, 2026

    Audit corrections. Legacy setting changed from Real world to Controlled test, matching its origin (no effect on v0.5 readings). The more than $1,000 deficit is now described as interim, reported at the end of the first phase before the PlayStation was returned; no final net loss was published (extent flagged unknown). Added the models for each phase, the November 2025 start, source dates, a status note and a related link to the earlier Project Vend (PI-0013). The WSJ original is paywalled and the WBUR segment is audio only. Ratings unchanged.

  3. v4
    Oct. 2, 2026

    Report date moved from 2025-12-19 to 2025-12-18: Anthropic's Project Vend phase two post was published 18 Dec 2025.

  4. v3
    Oct. 2, 2026

    Added first-hand sources: Anthropic's Project Vend phase two write-up, and the original Wall Street Journal article behind the To Vima copy.

  5. v2
    Sept. 30, 2026

    Rated: impact documented level 1; control type instruction violation.

  6. v1
    Sept. 30, 2026

    Backfilled from public reporting.

Cite and share

Use this record

Citation

Paperclip Index. “Newsroom vending agent talked into giving away stock with forged documents.” Record PI-0036. Reported Dec. 18, 2025; updated Oct. 6, 2026. Rated under methodology v0.6. https://paperclipindex.com/incident/PI-0036