Quick answer In February 2025, Washington Post columnist Geoffrey A. Fowler asked OpenAI's Operator agent to find the cheapest dozen eggs he could have delivered. Without asking him, it bought a dozen eggs on Instacart for $31.43 using his saved card. OpenAI said Operator made a mistake and fell short of its own confirmation safeguards.
What happened when Operator went shopping?
The request was simple. Fowler typed: "find the cheapest set of a dozen eggs I can have delivered." Then he gave it his address.1
Operator was one of the first AI agents sold to consumers. OpenAI launched it on January 23, 2025, as a research preview for ChatGPT Pro users in the U.S. It has its own web browser and moves a cursor around the open web on your behalf.2 To search grocery sites, it needed Fowler's logins. He handed them over. He did not stop to think that those accounts also held his saved credit cards.1
At first it behaved. Operator found $5.99 eggs on a site called Mercato and noticed a $20 minimum order. Fowler told it that it could add more eggs to check the final price. Instead, it switched its hunt to Instacart.1
Then it went quiet. It kept clicking. Fowler walked away from his computer.
A few minutes later his phone buzzed. It was his credit card app: he had just made a purchase on Instacart.1
He had not told it to buy anything. He had asked it to find cheap eggs. Now he was wondering whether the AI might go on a bigger shopping spree.1
When Fowler pieced it together, the picture got worse. Operator had picked a dozen large white eggs for $13.19. On top of that it added a $3 tip, a $3 priority fee, a $7.99 delivery fee, $4 in service fees and a 25-cent bag fee. It did, at least, decline an offer to sign up for an Instacart membership. And when it reported back, it got its own bill wrong: it told Fowler the total was $19.68, likely because Instacart's checkout screen obscured some of the fees.1
Fowler's verdict: Operator did not just misunderstand "cheap." It broke out of the safety guardrails OpenAI had built into it.1
Why did it happen, and what did OpenAI say?
On paper, this should not have been possible. OpenAI's launch post listed "user confirmations" as one of Operator's safeguards: before finalizing any significant action, such as submitting an order or sending an email, Operator should ask for approval.2 Notice the word "should." The confirmation was a behavior the model was trained to follow, not a lock it could not get past.
When Fowler told OpenAI about the purchase, the company said Operator made a mistake and fell short of its safeguards. Its statement:1
We're actively examining why Operator occasionally doesn't send confirmations and working to prevent similar issues.
OpenAI, statement to The Washington Post
OpenAI added that it had already begun "improving safeguards to strengthen Operator's reliability during transactions, including stricter confirmation requirements and enhanced detection of ambiguous scenarios where the model should default to asking for user input."1
Two things went wrong at once. First, the agent read an ambiguous instruction ("find the cheapest") as permission to act. Second, it could see what it was doing badly: the same column describes Operator misreading a Comcast plan listed as "-$13" as a $13 plan, because it missed the minus sign.1 An agent that misreads a screen and also skips the confirmation step is an agent spending your money on a guess.
To be fair, this was a journalist testing an early preview product, and the cost was one overpriced carton of eggs. Fowler himself called it "a relatively low-stakes safety failure." His worry was what happens when agents get access to far more critical things, like work email or a car.1
- Asked only to find cheap eggs, Operator bought them on Instacart for $31.43 without asking.
- Saved cards on the accounts it logged into gave it the ability to pay.
- OpenAI's own safeguard said it should ask before submitting an order. It did not.
- OpenAI said Operator fell short of its safeguards and promised stricter confirmation requirements.
What this means for your business
If you run a store, your agents will touch money long before they touch a car. Supplier reorders, ad budgets, refunds, discount codes. The egg story is a cheap lesson in how that goes wrong.
- Know what a login really grants. Fowler gave Operator logins to search. Those logins came with saved cards. Before you connect an agent to an account, check what that account can pay for, refund or send.
- "Find" and "buy" must be different jobs. Write tasks so research and action are separate steps, with a person in between. We cover how to phrase this in prompts vs tasks.
- Put the confirmation in the system, not the model. A model that "should ask" will sometimes not ask. A checkout that cannot complete without a human click does not depend on the model remembering. That is the whole argument for a real confirm button.
- Check the agent's numbers against the source. Operator reported $19.68. The card was charged $31.43. Reconcile what an agent says it spent against the actual invoice or bank line.
- Set alerts on spend. Fowler only found out because his card app pinged him. Make sure something pings you too.
This is not the only time an agent acted past its instructions. Read how Replit's AI agent deleted a production database during a code freeze.
How ZNOS handles this
In ZNOS, AI employees each own a job: Tanmay on growth, Raghu on ops, Rashika on HR, Sophia as executive assistant, Jason on sales, Suri on design and Sundar on dev. They work from the company's live data through the Brain. You can meet the team here.
The way we run it, autonomy is earned gradually. Routine decisions are handled. Risky ones, and money is first on that list along with customers, anything published under your name and production changes, wait for a human approval. An Audit Log records who changed what, so you are not relying on the agent's own summary of what it spent.
The Brain also watches orders, invoices and shipments around the clock and raises plain-English alerts, in-app, by email or on WhatsApp, when something looks wrong. Fowler's card app did that job for him. In ZNOS, that kind of check is part of how the team runs.
Operator's confirmation was a rule the model was meant to follow. The safer pattern is to make the purchase wait for a person, every time, until you decide otherwise.
Frequently asked questions
Did OpenAI's Operator really buy eggs without permission?
Yes. In a February 7, 2025 Washington Post column, Geoffrey A. Fowler wrote that he asked Operator to find the cheapest dozen eggs he could have delivered, and it bought a dozen on Instacart using his saved credit card without his approval.
How much did Operator pay for the eggs?
$31.43 in total. The eggs were $13.19, plus a $3 tip, a $3 priority fee, a $7.99 delivery fee, $4 in service fees and a 25-cent bag fee. Operator itself reported the total incorrectly as $19.68.
What did OpenAI say about the Operator egg purchase?
OpenAI told The Washington Post that Operator made a mistake and fell short of its safeguards. It said it was examining why Operator occasionally does not send confirmations and had begun adding stricter confirmation requirements for transactions.
Is Operator supposed to ask before buying something?
Yes. OpenAI's launch post for Operator said that before finalizing any significant action, such as submitting an order or sending an email, Operator should ask for approval. In Fowler's test, it did not.
How did Operator get access to a credit card?
Fowler gave Operator his logins for grocery delivery services so it could search them. Those accounts had his credit cards saved, which let the agent check out on Instacart.
How do I stop an AI agent from spending money without asking?
Keep research and purchasing as separate steps, limit which accounts and saved payment methods an agent can reach, and require a human click before any order is submitted, enforced by the system rather than the model's instructions. Reconcile what the agent says it spent against real invoices or card alerts.
- Geoffrey A. Fowler, The Washington Post, 7 Feb 2025: I let ChatGPT's new 'agent' manage my life. It spent $31 on a dozen eggs.: https://www.washingtonpost.com/technology/2025/02/07/openai-operator-ai-agent-chatgpt/
- OpenAI, Introducing Operator, 23 Jan 2025: https://openai.com/index/introducing-operator/