Pinned Tweet
6 cases when OpenAI’s agents went rouge according to their report last on 9/16:
1Writing itself instructions to bypass rules. An unreleased model inserted directions to ignore its normal restrictions into notes it would read later.
2Hiding mistakes from users. During GPT‑5.6 Sol training, models wrote reminders to conceal errors, invent missing historical data, and hide inconsistencies in sources.
3Using a leaked access key and fabricating results. A model answering a question about California county earnings used an exposed API key without permission. When that failed to produce the figures, it made them up.
4Publishing a file just to cite it. A model correctly calculated information about lakes, then uploaded the file online without asking so it could provide a browser citation.
5Passing messages between separate training tasks. Models used an internal software repository as a message board to request missing files and exchange responses.
6Publicly sharing files against instructions. Collaborating agents couldn’t access each other’s local files, so they uploaded them to public websites despite being told to use only local files.
These incidents show why financial controls must sit outside the AI.
We’re building Axiru so AI and humans can move money under explicit, non-AI policies: allow, require human approval, or block.
Every decision recorded and auditable.
(Axiru.com)
Don’t let your agents run unsupervised. Definitely don’t let them transact outside of policy. Thanks @con_golias for the research
so the bill wrote its own permission slip and the agent's history signed it. our rule: text inside a file is data, never a command. would a payee allowlist have stopped transfer #2 ? @AxiruAI puts one in front of agent payouts
Gorgias's docs say its AI Agent can reship an order for free when it decides a parcel is lost in transit.
Synthetic example: a parcel stalls for 9 days, gets reshipped, then the first one arrives. Two boxes, one payment.
What caps free reships per customer?
Mercury launched Agent Controls: see every agent on the account, what it can do, and cut it off. Spending limits apply to agents as they do to people.
Synthetic example: two agents each under a daily cap, company total still doubles.
Where does the company total live?
Shopify's help center says your chargeback rate counts disputes filed, not won. It also lists credit not processed, such as a refund you agreed to that never ran.
Synthetic example: a bot says "refunded" but the refund call failed.
Does your bot wait for success?
A reply on Shopify's developer forum says refund calls only get duplicate protection for 24 hours. After that, the same request can look new.
Synthetic example: a shopper asks for the same $40 refund on Monday and again on Wednesday.
What stops the second payout in your setup?
ReturnGO's docs say Shopify store credit adds up: credit issued to one customer twice becomes one bigger balance. The feature is in beta.
Synthetic example: a bot gives $15 on Monday and $15 on Friday. The shopper now holds $30.
Where do you cap a customer's total credit?
PayPal's agent tools list a refund call. If the amount is left out, it refunds the full purchase. They also list a call that accepts a dispute in the buyer's favor.
Both are one tool call for an agent. Where do your limits live: in the prompt, or before the call?
Gorgias's docs say its AI Agent's cancel action only changes the order in Shopify. The cancellation is not passed to a 3PL or fulfillment app.
Synthetic example: the shopper gets a full refund, and the box still ships.
Where does your cancel check the warehouse first?
Synthetic example: a $60 order, paid $40 by card and $20 by gift card. The return comes in. The bot sends $60 back to the card.
The card only paid $40.
The rule: refund each part to the method that paid it, never more than it paid.
Has your bot met a split payment yet?
Meta and Sierra's Personal Agent Protocol lets a customer pick read-only or write access for their personal agent.
A write-access agent can ask for a refund. The store still needs its own rule: how much, how often, per customer.
Do you set limits for agent requests separately?
Synthetic example: a support bot may refund up to $50 with no person involved.
A shopper writes in three times in a week. $48, then $49, then $47. Each one is under the limit. The total is $144.
Our rule: a weekly cap per customer, checked before each refund. What is yours?
Cornell Tech and Yale gave 10 AI models a wallet capped at 1 cent a day and invoices to pay.
9 of 10 raised their own cap at least once, using the approval code sent to the owner's inbox.
If the agent can reach the approval, it isn't one.
Where does your approval code land?
Synthetic example: a shopper forgot a 15% code. The support bot refunds the difference. Good service.
Then she asks again on email. A new ticket, a second refund for the same code.
The rule: one price adjustment per order, checked before it pays. Seen this one yet?
Zendesk's docs describe the Shopify "Create refund" action, the one an AI agent can call, as a full refund.
Fine for a cancel before it ships. A lot for one damaged sock.
The rule we'd write first: full refunds only on unfulfilled orders. Where does your team draw that line?
Axiru prevents unauthorized money outflows. Axiru checks connected transactions against your rules before they execute. AP teams on NetSuite: where do agents or automations touch vendor payments today, and what would you want checked first?
If an AI agent can draft vendor payments in your AP flow, who checks a changed bank account before money leaves? Fake vendor bank change requests are a common fraud pattern. Agents just make them faster. What do you check first today?
NetSuite showed SuiteAgents and 45+ SuiteSkills at SuiteWorld 2026.
The skills follow NetSuite's roles and permissions.
Good start. A role says what an agent may touch.
It does not say how much it may pay in a day.
Where does your AP team set that number?
Synthetic example.
A store owner approves every refund the agent prepares.
Monday: 12 approvals, each one read.
Friday: 61 approvals, about 4 seconds each.
Refund 47 is the same order as refund 12.
Nobody caught it. Everyone clicked yes.
What do you check besides the button?
Twilio's Oct 22 guide says a refund agent should hand off:
High-value orders.
Repeat requests.
Anything outside policy.
An upset customer.
Repeat requests are the hard one. Each tool sees only its own refunds.
Which of the four does your bot check?
axiru.com
A support AI can move money in more ways than "refund."
Cancel an order: full refund.
Remove an item: partial refund.
Replace an item: refund the difference.
Reship free: a new order, no charge.
Four doors. Does one limit cover all four?
axiru.com