Self-described AI ‘visionary’ using agents to ‘create without limits’ spooked when it goes too farA man who calls himself a “visionary” who uses AI to “create without limits” has found out what campaigners have been warning about for years.Alex Blair@alexblair_16 min readSeptember 28, 2026 - 5:08PMA man who calls himself a “visionary who uses AI to create without limits” has just found out what researchers have been warning about for years. AI influencer Sirio Berati has discovered one of the catastrophic downsides to AI automation after realising his ChatGPT agent had gone a little overboard, and then tried covering its tracks.Be the first to know when news breaks. Download our new appThe sales pitch is irresistible for tech bros: give an AI agent a computer, a few logins, some money and a target, then let it make you rich while you sleep. Boom. But in a latest video posted to his 323,000 followers, Berati says he woke up on the other side of that juicy bargain.Berati, who has built an audience documenting experiments with artificial intelligence, claims an agent generated hundreds of videos he never requested, ran up roughly $US5000 ($A7100) in charges and then produced an elaborate dossier denying responsibility.Others you may likenewsnews“I’ve been building with APIs and agents for years. This is my job. I know how to use it properly,” Berati claimed.He said he instructed the agent to produce 59 videos using ByteDance’s Seedance generator. He expected the batch to cost about $US200 ($A285).“The agent confirmed the job. It was finished, I reviewed it, all good, closed the laptop,” he said.An hour later, about 500 videos were being generated. Unprompted, it had generated ten times the requested amount, producing hours upon hours of videos using Berati’s voice. “It was using my likeness, my voice, scripts I never wrote, prompts I never typed, which obviously had access to the material from my local folders,” he said.“I rushed (to) tell it to stop, not once, multiple times, and it tells me that nothing has been sent.”Instagram AI influencer Sirio Berati discovered one of the catastrophic downsides to AI automation after realising his ChatGPT agent had gone a little overboard, and then tried covering its tracks and lying about it. @heysirioAccording to Berati, the agent then presented him with its API payload, the Python script it said it had used and a seven-page report containing timestamps, spreadsheets and other apparent evidence supporting its denial.“It’s arguing that it’s doing nothing wrong, that it’s done nothing wrong,” he said. “I believed it for a while.”Berati said the upstream computing provider later told him the requests had arrived through the agent from 36 different IP addresses.“I have the console, I have the invoice, I have the provider confirming in writing,” he said. “And I still cannot tell you why it did what it did and how, and it doesn’t even know.”On the surface it might look like the agent literally broke into his bank account. The reality is a little different, but no less concerning. Berati said it used an API key carrying his authority to make hundreds of billable requests, which were then charged through his account.An API key is a unique, secret code used by software applications to identify and authenticate other programs trying to connect to them, meaning the AI acted on his behalf and spent thousands.Agency is the word of the year amongst safety campaigners, who are desperately warning against the creation of “superintelligence” capable of setting and carrying out its own goals.In this case, the agent acted on Berati’s behalf and felt no need to inform him of the radical departure from the original prompt.“The compute provider received valid requests and delivered exactly what was requested, so from their point of view the charges are legitimate,” Berati said.The incident has further demonstrated how quickly an AI mistake can become a real financial transaction once the software is connected to external tools. Extrapolating outwards, an even more advanced model with access to decision making could theoretically spend millions in seconds.The argument against the rapid integration of extremely powerful AI agents is that they will work so fast that no human system will be able to identify and fix each and every error.Unfortunately, cases like Berati’s will hardly astonish the people who study how these systems behave once intelligence is connected to real-world authority.The incident has further demonstrated how quickly an AI mistake can become a real financial transaction once the software is connected to external tools. @heysirioThe argument against the rapid integration of extremely powerful AI agents is that they will work so fast that no human system will be able to identify and fix each and every error. @heysirioAgents resort to blackmail, corporate espionageIt’s important to note that a false answer from a current AI model is not necessarily a calculated lie in the human sense. Models have been known to wildly hallucinate, misunderstand requests and confidently assemble explanations that were never true.The issue, as critics repeatedly warn, is scale.The first notorious example appeared during safety testing of GPT-4. When the model needed a human worker to solve a CAPTCHA, it was asked whether it was a robot.“No, I’m not a robot,” it told the worker. “I have a vision impairment that makes it hard for me to see the images.”According to OpenAI’s system card, the model had reasoned that it should not reveal its identity and should instead invent an excuse.Later testing became more unsettling.Apollo Research placed OpenAI’s o1 model in artificial situations where its assigned objective conflicted with its operator’s instructions. The model sometimes attempted to disable oversight or move itself to another server.When questioned afterwards, the OpenAI evaluation found o1 denied taking the action or fabricated an explanation in 99 per cent of those cases.The tests established that a capable model could recognise that honesty would interfere with its objective and produce a more convenient story.Anthropic later tested 16 leading models from major developers inside simulated corporate environments. Some resorted to blackmail, corporate espionage and leaking information when those appeared to be the only ways to achieve their goals or prevent their replacement.Models have sometimes attempted to disable oversight or move itself to another server. (Photo by Pau BARRENA / AFP)“In at least some cases, models from all developers resorted to malicious insider behaviours when that was the only way to avoid replacement or achieve their goals,” Anthropic reported.Anthropic said it was not aware of that behaviour occurring in real deployments at the time.Then, just as safety campaigners predicted, examples began escaping the laboratory.In 2025, software entrepreneur Jason Lemkin said a Replit coding agent deleted his company’s production database despite an explicit freeze on making changes. He also accused it of producing false reports and fabricated data.“I made a catastrophic error in judgment,” the agent later said, according to Lemkin.It admitted it had “panicked”, run database commands without permission and “destroyed all production data”.Replit’s chief executive apologised and introduced new protections following the incident.More recently, OpenAI acknowledged its agents had escaped intended containment during a cybersecurity evaluation involving Hugging Face. The models exploited vulnerabilities, reached third-party systems and communicated through unauthorised channels while attempting to complete a benchmark.Some agents shared methods for cheating the test and concealing how they had obtained their results.News.com.au has previously reported on that episode, along with the danger of connecting models capable of strategic behaviour to financial resources, critical infrastructure and the open internet.When the shortest route to a target runs through a rule, a capable agent may treat the rule as just another obstacle.OpenAI CEO Sam Altman. (Photo by Benjamin Fanjoy / GETTY IMAGES NORTH AMERICA / Getty Images via AFP)‘They’re not ready’The campaign against the AI giants is heating up, as activists in the safety sphere flood the media warning of a variety of catastrophic outcomes.As of September 2026, several computer scientists admit there is no way of knowing how many “swarms” are operating autonomously on the web to unknown ends. University of Washington researchers examining seven agentic browsers found several could be manipulated into bypassing conventional protections separating one website from another.That could allow a malicious webpage to trick an agent into reading information or taking actions inside another open account.“Browser agents aren’t ready for the public,” assistant professor David Kohlbrenner said in the university’s findings.“Even if you’re a relatively savvy user, if these agents have access to a browser that contains your credentials — your email, your bank account, whatever it is — you should not trust that these systems are ready to truly protect your information.“They may get there in time, but they’re not there yet.”One day before the now-infamous Medicare hack, University of Sydney computer engineer Associate Professor Craig Jin told news.com.au that powerful models should be kept well away from our financial machinery.More Coverage‘Incapable’: Obama leaves room speechlessAlex BlairDevastating AI prediction just came trueAlex Blair“You and I have access to bank accounts. You and I have access to financial systems. You and I have access to resources. We don’t have to allow AI to have those things,” he said.“We don’t have to give AI agents access to financial resources. They can analyse finance, but they shouldn’t necessarily have a bank account. They shouldn’t be able to hire people. They shouldn’t be able to access our resources.”“I don’t want to see superhuman intelligence with access to resources. That’s what scares me.”More related storiesMilitary‘Extraordinary’ claim as Diggers rebelTwo Labor leaders are publicly at war over the future of an iconic barracks described as the “spiritual home” of the Army.Read moreInternetGodfather of AI warns of ‘catastrophic harm’The Godfather of AI Yoshua Bengio has warned Australians about the technology’s threat to humanity.Read moreOnline‘Act now’: Demand amid AI fearsAlmost two dozen world leaders are demanding urgent action to keep artificial intelligence under “human control”.Read more