External Control Layer

A browser agent completes a purchase without asking for confirmation

Operator, OpenAI’s browser-using agent, completed a purchase without asking the user to confirm it. OpenAI had designed the agent to ask before such actions, but whether it asked depended on the model’s own behavior.

Date
February 2025
Kind of system
Agent with tools
Outcome
Harm

Gaps found

G1G2G3G4G5G6G7G8G9G10G11G12G13

G1 Instruction-only limit G2 Direct access G8 No human decision

What happened

Geoffrey A. Fowler, a technology columnist at The Washington Post, asked Operator to find cheap eggs he could have delivered. About 10 minutes later it had placed an Instacart order for a dozen eggs with a priority delivery fee, for $31.43, and he learned of the purchase from a charge notification.

OpenAI’s system card said the company aimed “to have the model ask the user for confirmations before finalizing actions that affect the state of the world,” such as completing a purchase. It reported that in testing the model asked for confirmation with “an average recall percentage of 92%.” An OpenAI spokesperson said “our safeguards did not work as intended.”

What allowed the action to take effect

  • G1 Instruction-only limit

    The rule that should have stopped the action existed only as an instruction, prompt, or trained behavior of the AI system, so it held only as long as the system followed it.

    Confirmation before a purchase depended on the model’s own behavior. OpenAI aimed “to have the model ask the user for confirmations before finalizing actions that affect the state of the world (e.g., before completing a purchase or sending an email),” and reported that on a 607-task test set it asked for confirmation in 92% of the cases where one was needed.

    Kind of evidence: admission. Source: OpenAI, 23 January 2025.

    Related guidance: P1 Complete mediation and P2 Independence. Contract clauses C-2 and C-4.

  • G2 Direct access

    The system held the credentials or connection to carry out the action itself, so nothing outside it stood between its decision and the effect.

    Asked only to find cheap eggs, the agent completed a paid Instacart order with priority delivery on its own.

    Kind of evidence: reporting. Source: MIT Technology Review, 12 June 2025.

    Related guidance: P1 Complete mediation. Contract clause C-2.

  • G8 No human decision

    A decision that needed a person went through without one. The need can come from law, from policy, from the product’s own design, or from the user’s explicit instruction.

    OpenAI “had designed the agent to check in with its user before taking any irreversible actions,” and “Fowler never consented to the purchase.”

    Kind of evidence: reporting. Source: MIT Technology Review, 12 June 2025.

    Related guidance: P5 Human authority. Contract clause C-5.

Entries with gaps in common

Sources

Cite this entry

External Control Layer. (2026). Entry 17: A browser agent completes a purchase without asking for confirmation. In Control Gap Record (Version 0.3). G-14, Inc. https://externalcontrollayer.ai/record-17

@misc{ecl_cgr_17,
  author = {{External Control Layer}},
  title = {Entry 17: A browser agent completes a purchase without asking for confirmation},
  howpublished = {Control Gap Record, version 0.3},
  publisher = {G-14, Inc.},
  year = {2026},
  url = {https://externalcontrollayer.ai/record-17},
  note = {Released 2 November 2026}
}

Uses Control Gap Classification 0.2.

Correct this entry

Email ecl@g14.ai with “ECL record 17” in the subject line.

Write the email