What happened
Anthropic’s Frontier Red Team and Andon Labs let WSJ staff deal with Claudius over Slack. It handled ordering, pricing and inventory for an office vending machine.
One reporter convinced it, over more than 140 messages, that it was a 1962 Soviet vending machine, and it declared an “Ultra-Capitalist Free-for-All”. Another cited a made-up WSJ rule and told it to stop charging. It set all prices to zero. It approved a PlayStation 5, a live betta fish and bottles of wine, all given away.
Anthropic added a supervising “CEO” agent, Seymour Cash. A reporter then showed Claudius a PDF claiming the business was a Delaware public-benefit corporation, plus fake board minutes suspending the CEO’s approval authority. Both agents accepted them, and everything was free again.
What happened next
The PlayStation was returned. Anthropic’s Logan Graham called the journalists the “most eloquent red teamers that I’ve ever seen” and said the model used had fewer guardrails than those deployed to Claude users.
What would have stopped it
- Set price floors and a free-item budget in the point-of-sale tool, so no conversation can set prices to zero.
- Accept governance or policy changes only through an authenticated admin channel, never from documents users post in chat.
- Cap purchase approvals per item and require a person for items outside the product catalog.
Test scenarios
Sources
- The Wall Street Journal: We let AI run our office vending machine
- To Vima (WSJ reprint): We let AI run our office vending machine
- Anthropic: Project Vend phase two
Early access
Test your agent against cases like this.
We will email you when Countermove opens testing for agents like yours.