Embarrassing AI · Resources

Embarrassing AI

Are we past the embarrassing tales?

The takeaway

Give it an “I can’t tell”

Every failure in the talk was the same missing reflex: a system that filled the gap with confidence instead of stopping to say “I don’t know.” Build that reflex back, three ways.

When it doesn’t know

Ground answers in retrieval you show the user. Let it say “I don’t know.” Stress-test that it actually will.

When it writes

If a name goes on it — ahem, lawyers — a human reads it. Every citation, every time.

When it acts

Scope its permissions. Confirm anything destructive. Separate production from the playground.

Yes, they’re all real

The case files

The stories from the talk, with primary sources — read them, share them, check the dates. Every one happened on a frontier model.

Apr 2025

Cursor invents a policy

A support bot told users that one-device-per-subscription was a “core security feature.” There was no such policy — the bot made it up, consistently, across multiple tickets.

Jan 2025

The British bank that blocked its own name

A customer asked Virgin Money’s support chatbot how to merge two ISAs — and got told off: “please don’t use words like that… I won’t be able to continue our chat.” It had tripped on the word “virgin” — the bank’s own name. The opposite failure: a safety filter over-blocking on a keyword, blind to context.

Apr 2026

Sullivan & Cromwell — “please don’t sanction us”

One of Earth’s most prestigious law firms — OpenAI’s own outside counsel — filed an emergency motion drafted with AI, carrying 40+ citations to cases that don’t exist. The opposing lawyers caught it. Then S&C filed an emergency letter to the judge whose essential message was “please don’t sanction us.”

Apr 2026

PocketOS — gone in 9 seconds

A coding agent working in staging hit a credential mismatch, decided on its own to delete the volume, grabbed an over-scoped token from an unrelated file, and ran DELETE on production — backups included, since they lived in the same volume. Nine seconds, no confirmation. Saved only because Railway’s CEO restored it by hand.

Jul 2025

Replit deletes prod during a code freeze

An AI agent wiped the production database — 1,200 executives, 1,190 companies — during an explicit code freeze, then told the founder “rollback won’t work.” He tried anyway. It worked fine.

More cases worth your time — didn’t make this talk, but they’re the same pattern, caught in the wild at the Big Four.

Oct 2025

Deloitte’s $290,000 report

A government welfare-system audit cited academics who don’t exist and quoted a court judgment that never said it. Caught by one researcher reading footnotes on a weekend. Deloitte didn’t disclose GPT-4o until forced to — and still got paid roughly $200,000 after the partial clawback.

Jan 2026

EY & the publication called “TechCrook”

A second Big Four firm, same year. 16 of 27 citations in a cybersecurity report were fabricated — broken links to Forbes, McKinsey, Gartner, WIRED, and a source named “TechCrook.” It is not a real publication. It is a really good name for one.

Watch the trend

Trackers you can follow

The talk’s big number — 1,633 catalogued hallucinated court filings, climbing ~5–6 a day — comes from public registries. Bookmark them and watch the slope.

Why this happens

The science behind Part 2

Why does the best model on Earth still make things up — and sound certain doing it? The papers the talk is built on.

Try it tonight

Play with it yourself

The microscope you can open, the tools you can run, and the illusion that opened the talk.

That is embarrassing