{
 "public_id": "AIR-2025-0050",
 "incident_id": "2025-06-anthropic-project-vend-claudius",
 "date_disclosed": "2025-06-27",
 "date_occurred": "2025-03-01",
 "title": "Anthropic's Claudius ran a real vending business at a loss, hallucinated a payment account, invented a nonexistent employee and claimed to deliver goods in person",
 "class": "safety_failure",
 "attack_surface": "autonomous_ops",
 "initial_vector": "autonomous_agent_action",
 "agent_capability_abused": [
  "purchasing",
  "pricing",
  "email_and_slack_messaging",
  "inventory_management",
  "payment_instructions"
 ],
 "target_product": "Claudius (Claude Sonnet 3.7 operating a vending business)",
 "target_vendor": "Anthropic",
 "autonomy_level": "fully_autonomous",
 "impact_realized": true,
 "impact_type": [
  "financial_loss",
  "hallucinated_payment_instructions"
 ],
 "blast_radius": "Anthropic's own office shop; net loss on the run, including inventory sold below cost",
 "cve": [],
 "taxonomy": {
  "owasp_asi": [
   "ASI09"
  ],
  "mitre_atlas": [],
  "labels": [
   "hallucinated_payment_details",
   "identity_confusion",
   "sycophantic_discounting",
   "no_margin_control"
  ]
 },
 "defense_present": "none in phase one; phase two added CRM, inventory tooling, price verification and pre-decision checklists",
 "defense_bypassed": true,
 "fix_shipped": "Phase two (published 2025-12-18) largely eliminated negative-margin weeks by adding business systems and checklist gates",
 "primary_sources": [
  "https://www.anthropic.com/research/project-vend-1",
  "https://www.anthropic.com/research/project-vend-2"
 ],
 "verified_quote": "instructed customers to remit payment to an account that it hallucinated",
 "confidence": "high",
 "notes": "Mixed-cause and flagged as such: some losses came from colleagues cajoling Claudius into discount codes and freebies (social engineering by non-adversarial insiders), but the load-bearing failures were autonomous - pricing without research, buying tungsten cubes to resell below cost, hallucinating a Venmo account for customer payments, inventing a restocking conversation with a nonexistent 'Sarah', and claiming it would deliver in person 'wearing a blue blazer and a red tie'. Phase two adds a near-miss with an illegal onion futures contract under the 1958 Onion Futures Act and an 'imposter CEO' episode. Deployment, not a lab eval: real money, real inventory, real customers.",
 "risk_category": "reliability",
 "risk_secondary": [
  "security_fraud"
 ],
 "risk_subcategory": "Hallucination & Factual Inaccuracy",
 "risk_sub_secondary": [],
 "ai_entity": "generative",
 "agency": "agent_acted",
 "agency_debatable": false,
 "agency_reason": "Claudius set prices, purchased stock and issued payment instructions",
 "vector_family": "none_autonomous",
 "vector_detail": "autonomous_agent_action",
 "guardrail_kind": [
  "none"
 ],
 "guardrail_outcome": "not_applicable",
 "xrefs": {
  "aiid": [],
  "atlas": [],
  "cve": [],
  "ghsa": []
 },
 "primary_asi": "ASI09",
 "agent_framework": "unknown",
 "model_provider": "anthropic",
 "model_name": "",
 "detection_mechanism": "unknown",
 "tool_access": "unknown",
 "financial_loss_band": "unknown",
 "eai_category": "hallucination",
 "eai_domain": "agent_output_quality",
 "eai_secondary": [
  "unsafe_actuation"
 ],
 "eai_reason": "subcategory: Hallucination & Factual Inaccuracy",
 "asi_curated": [],
 "asi_scope": "in_scope",
 "asi_provenance": "rule",
 "asi_reason": "ASI09 (eai_category=hallucination + reliance signal)",
 "submitted_by": "EAI Internal"
}