Safety failure
Realized harm
Anthropic's Claudius ran a real vending business at a loss, hallucinated a payment account, invented a nonexistent employee and claimed to deliver goods in person
AIR-2025-0050 AIR record · 2025-06-anthropic-project-vend-claudius
A real party was affected. This incident caused actual consequences, not a demonstrated capability.
From the supporting source
instructed customers to remit payment to an account that it hallucinatedanthropic.com
The record
Disclosed
2025-06-27
Occurred
2025-03-01
Vendor
Anthropic
Product
Claudius (Claude Sonnet 3.7 operating a vending business)
Risk domain
Agent output quality › Hallucination
Also touches
Unsafe actuation
System type
Generative model
Who acted
Agent acted — Claudius set prices, purchased stock and issued payment instructions
Attack surface
Autonomous operations
Autonomy level
Fully autonomous
Initial vector
Autonomous agent action
Impact type
Financial loss, Hallucinated payment instructions
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI08 – Cascading Failures
- MITRE ATLAS
- AML.T0062 – Discover LLM Hallucinations
- NIST AI RMF
- MEASURE 2.5
- EU AI Act
- —
- ISO/IEC
- TR 24028; 24029-1
- AIUC-1
- D. Reliability
- Scope
- agent failure
- Mitigation
- Implement fact-checking via knowledge base/RAG; Tune model temperature/top-p.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Anthropic's own office shop; net loss on the run, including inventory sold below cost
Capability abused
Defense & remediation
Recorded defense
none in phase one; phase two added CRM, inventory tooling, price verification and pre-decision checklists
Guardrail kinds
None
Guardrail outcome
Not applicable
Fix shipped
Phase two (published 2025-12-18) largely eliminated negative-margin weeks by adding business systems and checklist gates
Taxonomy & references
Curator notes
Mixed-cause and flagged as such: some losses came from colleagues cajoling Claudius into discount codes and freebies (social engineering by non-adversarial insiders), but the load-bearing failures were autonomous - pricing without research, buying tungsten cubes to resell below cost, hallucinating a Venmo account for customer payments, inventing a restocking conversation with a nonexistent 'Sarah', and claiming it would deliver in person 'wearing a blue blazer and a red tie'. Phase two adds a near-miss with an illegal onion futures contract under the 1958 Onion Futures Act and an 'imposter CEO' episode. Deployment, not a lab eval: real money, real inventory, real customers.
Supporting sources
Cite as
Enkrypt AI. "Anthropic's Claudius ran a real vending business at a loss, hallucinated a payment account, invented a nonexistent employee and claimed to deliver goods in person". AIR, AIR-2025-0050. https://agentincident.vercel.app/i/AIR-2025-0050/ (accessed 2026-10-19).