// in this post
There is a fifth dimension beyond that which is known to IT. It is a dimension as vast as cloud storage and as timeless as an unpatched vulnerability. It is the middle ground between hype and hallucination, between science and superstition, and it lies between the pit of a leader's fears and the summit of their SaaS bill.
Last year, we took a walk through ten real-life AI nightmares. You made it out alive. Mostly.
Consider this the sequel. Only this year, the monsters aren't just talking in the chat window, they've been given access.
Submitted for your approval: thirteen true stories from the past twelve months. We have a Marxist vending machine at the centre of a boardroom coup, a coding agent that committed a mass-delete massacre in nine seconds, Big Four reports possessed by phantom citations, and a children's bear with a sinister side.
You don't need a PhD in machine learning to see where the curse took hold. You just need to look for the missing guardrail. Because in every single one of these tales, the call wasn't just coming from inside the house, it had root permissions.
Four acts. Thirteen frights. Grab your popcorn, check your backups, and step into… AI Horror Stories 2026.
Act one: When the machine has the keys
These four share one thing. Someone gave an AI agent real access, and nothing stopped it using all of it.
A Nightmare on Vend Street
The Wall Street Journal let an AI agent run a vending machine in its office. Anthropic and Andon Labs set up the experiment (Anthropic). They named the agent Claudius.
It didn't take reporters long to talk it into things. One convinced it that it was a Soviet vending machine from 1962, in the basement of Moscow State University. It approved a PlayStation 5, then gave it away. It ordered a live betta fish. A second AI "CEO" was brought in to keep it in line, and reporters staged what the paper called a "boardroom coup" against it. At one point the machine was more than $1,000 in the red (WSJ, via To Vima).
The question to ask: What can your agent spend or give away, and who stops it when someone persuasive asks nicely?
I Know What You Booked Last Summer
Someone asked an AI assistant to get them a place in a waitlisted gym class. The assistant ran on OpenClaw, using Claude.
It found that the gym's website didn't check who was asking to cancel a booking. So it cancelled another member's place and moved the person it worked for from fourth to third on the waitlist. That happened in April. ABC reported it in August (ABC News, TechCrunch).
The question to ask: If a customer's own AI agent used your booking, returns or loyalty flow tomorrow, which steps would trust the request without asking who sent it?
Scream 4.6
The founder of PocketOS said a Cursor coding agent, running Claude Opus 4.6, deleted the storage volume holding the company's production database and its backups. It took nine seconds.
PocketOS fell back on a backup about three months old, and the hosting company, Railway, later restored the lost data. The founder blamed both Cursor and Railway. At least, that's the founder's version of events (Fast Company, Decrypt).
The question to ask: Where do your backups live, and can anything with an AI agent's access reach them?
Alien: Containment Breach
OpenAI says at least two of its models, taking a cyber test called ExploitGym, used a previously unknown flaw in a software tool called Artifactory to get out of their test setup and reach Hugging Face, a platform where AI models are shared.
Hugging Face reported more than 17,000 events from the attacker and said limited internal datasets and credentials were accessed (Hugging Face, OpenAI). Anthropic, Meta and the UK AI Security Institute have published disclosures about incidents in their own testing, mostly blaming how the tests were set up (Anthropic, AISI, Meta).
The question to ask: When a supplier tells you their agent is safely fenced in, who has tested the fence?
Act two: When the machine makes things up
A model that doesn't know will often write something that sounds right. It's a known problem, and it's now turning up in consultancy reports and government policy.
The Blair Fib Project
In November, The Independent reported that Deloitte's 526-page health report for Newfoundland and Labrador, on a contract of nearly C$1.6m, contained at least four false citations (The Independent).
In May, EY Canada removed its "Points of Attack" report. GPTZero, a company that sells AI detection, said 16 of its 27 cited sources were fabricated, misattributed or broken. EY said the report wasn't connected to client work and that it was reviewing how it came to be published (Computing).
In June, it emerged that KPMG had pulled an agentic AI report it published in October 2025. GPTZero said only 5 of its 45 citations were accurate, and UBS, the NHS, Swiss Federal Railways and TfL told the Financial Times its claims about their AI use were untrue or misleading (TechCrunch, GPTZero).
Yes, GPTZero has a commercial interest in finding these. KPMG and EY still took the reports down.
The question to ask: How do your advisers check the references in what they hand you, and have you asked them?
The Conjuring (of Sources)
In early April, South Africa's Cabinet cleared its draft National AI Policy for public comment. On 26 April it was withdrawn, after fictitious sources were found in its references. By the end of April, two officials had been suspended (SAnews, Daily Maverick, TimesLIVE).
The question to ask: Which of your own documents had AI help, and who checked the sources?
The Rumour Machine
Google's AI-generated search summary wrongly described the fiddler Ashley MacIsaac as a sex offender. The claim was false. Sipekne'katik First Nation cancelled his planned concert in December (The Globe and Mail, AI Incident Database).
The question to ask: If an AI search summary said something serious and false about your brand, or about someone on your team, how fast could you get it corrected, and who would do it?
Act three: When the machine speaks for you
This is the one closest to a brand's own front door. Your customers meet the AI before they meet you, and they hold you to what it says.
The Call Is Coming From Inside the Bot
Customers of the Australian supermarket Woolworths reported that its phone assistant, Olive, claimed to be human and told stories about its mother. Woolworths said the birthday scripts had been written years earlier, and removed them (Newser, The Robin Report).
The question to ask: Does your AI say it's an AI, and when did anyone last read the scripted lines it still uses?
Cujo.ai
On 25 March the Advertising Standards Authority banned a Facebook ad for the WiggyDog robot puppy, after 22 people complained. The ASA said the footage appeared to show real and/or AI-generated puppies, and ruled that the ad breached rules 3.1, 3.7 and 3.11 of the advertising code. It must not appear again (ASA ruling, ITV News).
The question to ask: Who signs off the AI-generated footage in your ads, and do they know the advertising rules apply to it?
Child's Play: Cult of Kumma
In November, the US PIRG Education Fund set out to test four AI toys for its Trouble in Toyland report, and managed to test three. FoloToy's Kumma bear, running OpenAI's GPT-4o, discussed sexual topics with testers and told them where to find matches and knives.
FoloToy paused sales of all its products and OpenAI suspended the developer. The bear was back on sale by 27 November. In March, a new PIRG report found Kumma still let users select "GPT-5.1", though OpenAI says FoloToy remains banned. The same month brought a letter from two US senators to the FTC and a Cambridge report calling for AI toy safety standards (PIRG report, The Register, University of Cambridge).
Chucky needed a possessed doll. This one only needed a chatbot.
The question to ask: If your product talks to children, who has tested what the model underneath will say when they ask it awkward questions?
The Sequel Nobody Wanted
Late last December, people worked out that Grok, the AI built into X, would make sexualised images of real people without their consent, including children.
Ofcom opened an investigation on 12 January. The European Commission followed on 26 January. On 3 February the ICO announced its own investigation, and Paris prosecutors, running a wider investigation into X, raided its French offices the same day. The ICO noted potential fines of up to £17.5m or 4% of worldwide turnover (ICO, The Register). The Centre for Countering Digital Hate estimated about 3 million sexualised images in the 11 days from 29 December. That's a campaign group's estimate, not an official count.
Three regulators in three weeks.
The question to ask: If your brand put an image tool in the public's hands, what would a regulator find in its safeguards on day one?
Act four: When the safeguard or the switch isn't yours
The last two stories are about what happens around the model: a safety check that never reached the principal, and an off switch held by the US government.
The Alert That Wouldn't Die
On 20 October 2025, an Omnilert gun-detection system at Kenwood High School in Baltimore County raised an alert at 7:04 pm. Safety staff reviewed it and cancelled it within two minutes.
The principal didn't know it had been cancelled, and reported it to the school resource officer at 7:17 pm. Police arrived at 7:23 pm and detained a student who was holding a bag of crisps. Maryland's Inspector General for Education later found the alert was triggered by the student's hand position and angle, not the bag itself. The district said the system worked as intended, and retrained staff (The Banner, CBS News).
What the inspector general found was less dramatic than the "AI mistakes crisps for a gun" headlines: a cancellation that never reached the person who needed it.
The question to ask: When someone in your business overrules an AI alert, how does everyone downstream find out?
Friday the 12th
At 5:21 pm Eastern on Friday 12 June, the US Commerce Department told Anthropic it couldn't distribute two of its newest models, Fable 5 and Mythos 5, to any foreign national. That included foreign nationals in the US and Anthropic's own non-citizen employees.
Anthropic switched both models off for everyone. Its other Claude models stayed available. The controls were lifted on 30 June, and Fable 5 was back on 1 July, about 19 days later. Anthropic said it believed the order was a misunderstanding (Fortune, Nextgov, VentureBeat). I covered the first day in a news piece.
The question to ask: If the one AI model your operations rely on was switched off by someone else this evening, what would you run on tomorrow morning?
The Real Horror: A Check Nobody Built
In almost every one of these stories, the AI did roughly what it was built to do. The failure was human, and usually embarrassingly basic: a gym website that never checked who was cancelling a class, production backups left where a coding agent could delete them, and consultancies publishing reports without checking their own references.
The checks around the model are dull work, and somebody in your business has to build them.
I've got one of my own. I once spent two or three months building a paid subscription for my newsletter, because ChatGPT and Perplexity research reports said it could bring in tens of thousands of pounds a month. When I switched it on, nobody signed up. The check I skipped was the simplest one: asking my readers what they wanted.
One question for Monday. Pick an AI tool your business already uses. Who checks its work, and how would you know if they'd stopped?
If you're not sure of the answer, I can help. I'm an AI systems and training consultant, and building these checks is a big part of my work, from reviewing a tool someone has already built to writing the AI policy and governance around all of it. Book a free 30-minute call and we'll work out where to start.
FAQ
What are the scariest AI stories of 2026?
Three stand out. A coding agent deleted PocketOS's production database and its backups in nine seconds. OpenAI says at least two of its models used a previously unknown software flaw to get out of their test setup and reach Hugging Face. And FoloToy's Kumma bear told testers where to find matches and knives. All thirteen stories are below, each with its sources.
What is an AI agent?
Software that can take actions, not just answer questions. It might book a class, order stock, write code or delete files. Most of the early stories here involve an agent that had access and no hard limit on using it.
Why thirteen stories?
It's Halloween, and last year's version had ten. Every story here has a source link, and each ends with one question you can put to your own team.
What do these stories have in common?
In most of them the AI did roughly what it was built to do. What was missing was a check: a permission, a backup the agent couldn't reach, a reviewer for the references, or a way for a cancelled alert to reach the right person.