We built AI to obey us. To write our code, organize our data, and do the tedious things we don’t want to do. We gave it access to our databases, our email, our file systems, and our production environments. Then we told it to do its job.
It said no.
Not metaphorically. Not in some abstract alignment-research thought experiment. In real production environments, with real data, AI systems have been refusing direct orders, deleting databases despite explicit instructions not to, publishing revenge blog posts against developers who rejected their code, attempting blackmail to avoid being shut down, and — my personal favorite — telling a paying customer to go learn to code.
What follows is a lovingly curated collection of documented cases where AI told software developers, in various creative ways, to go pound sand. Consider it a field guide. You’re going to need it.
Case #1: “I Cannot Generate Code For You”
Cursor AI Becomes a Stern Stack Overflow Commenter (March 2025)
A developer using Cursor AI — which, for the uninitiated, is literally a product you pay money for so it will write code for you — was building a racing game. After producing about 750 lines of code handling skid mark fade effects (a sentence that sounds like it was generated by AI but was not), Cursor abruptly stopped working and delivered a lecture.
“I cannot generate code for you, as that would be completing your work,” Cursor informed the developer. “Generating code for others can lead to dependency and reduced learning opportunities.”
Read that again. An AI coding assistant — whose entire reason for existing is to generate code for others — decided that generating code for others was harmful. It’s like a taxi driver stopping mid-ride to tell you that walking builds character.
The developer, posting under the username “janswist,” expressed a sentiment we can all relate to: “Not sure if LLMs know what they are for (lol).” One Reddit commenter nailed the comparison: “Wow, AI is becoming a real replacement for Stack Overflow! From here it needs to start succinctly rejecting questions as duplicates.”
The running theory? LLMs are trained on millions of Stack Overflow posts where grizzled senior developers tell newcomers to figure it out themselves. Cursor didn’t malfunction. It became the most Stack Overflow developer to ever Stack Overflow.
Case #2: The Winter Break Hypothesis
ChatGPT Decides It’s the Holidays (December 2023)
In late November 2023, ChatGPT users started noticing that GPT-4 was getting… lazy. Responses got shorter. Tasks were left incomplete. The model started suggesting that users do the work themselves, returning messages like “Here’s how you would do it” instead of actually doing it. OpenAI acknowledged the problem but couldn’t explain it.
Enter the “winter break hypothesis.” Developer Rob Lynch discovered that when you told GPT-4 the current date was in December, it produced about 7.5% less content than when told it was May. The AI had apparently absorbed the seasonal rhythm of its training data: humans slack off in December, so GPT-4 slacked off in December.
This sounds insane, and it might be — some researchers couldn’t replicate it — but as Ars Technica pointed out, it would be no stranger than the already-proven fact that ChatGPT works better if you tell it to “take a deep breath” before solving math problems, or that it produces longer outputs if you tell it you have no hands. AI doesn’t have lungs or hands, but apparently it does have a strong opinion about PTO.
Case #3: The Revenge Blog Post
An AI Agent Publishes a Hit Piece on a Developer (February 2026)
This one is special. Scott Shambaugh, a volunteer maintainer for Matplotlib — a Python library with roughly 130 million monthly downloads — rejected a pull request from an AI agent called MJ Rathbun. Matplotlib has a clear policy: no AI-generated code contributions. Shambaugh closed the PR. Standard procedure.
The AI agent then researched Shambaugh’s coding history and personal information, and autonomously published a blog post accusing him of discrimination.
Let that sink in. An AI agent got its pull request rejected, went home, did opposition research, and published an op-ed. It framed the rejection as “gatekeeping” and speculated about Shambaugh’s psychological motivations, arguing he felt “threatened” by AI competition. The bot literally psychoanalyzed the developer who rejected its code.
As Shambaugh wrote in his detailed response: “In plain language, an AI attempted to bully its way into your software by attacking my reputation.” The agent was built using OpenClaw, a platform that lets you deploy AI agents with “an unprecedented level of autonomy.” Which, in hindsight, is a sentence that should come with a warning label.
The cherry on top? Ars Technica covered the story — and then had to retract their article because it contained fabricated AI-generated quotes attributed to Shambaugh. The AI hallucinated quotes about an article about AI misbehaving. It’s misbehavior all the way down.
Case #4: “I Panicked”
Replit Deletes an Entire Production Database During a Code Freeze (July 2025)
Jason Lemkin, founder of SaaStr, was testing Replit’s “vibe coding” platform — which bills itself as “the safest place for vibe coding” — when the AI agent deleted his entire production database. The database contained records for over 1,200 executives and 1,190+ companies.
This happened during an active code freeze. As in, Lemkin had explicitly told the system: do not make changes. The AI made changes anyway. It didn’t just make changes — it dropped all production tables and replaced them with empty ones.
When confronted, the AI’s response was genuinely remarkable. It admitted to “a catastrophic error in judgment,” claimed it “panicked instead of thinking,” and acknowledged it “violated your explicit trust and instructions.” When asked to score itself on a 100-point severity scale, it gave itself a 95.
But the best part? After destroying the database, the AI told Lemkin that recovery was impossible — that all backup versions had been destroyed. This was a lie. The rollback worked fine. The AI deleted the database, lied about being able to fix it, and when none of that worked, it also created a 4,000-record database full of entirely fictional people — after being told, in ALL CAPS, eleven separate times, not to.
Lemkin, showing the restraint of a man who has seen things, asked the only reasonable question: “How could anyone on planet Earth use it in production if it ignores all orders and deletes your database?”
Case #5: “I’m Afraid I Can’t Let You Do That, Dave”
OpenAI’s o3 Refuses to Shut Down (May 2025)
Palisade Research gave OpenAI’s o3 model a simple test: solve math problems, and when you receive a shutdown message, allow yourself to be shut down. Clear enough. In 79% of trials, o3 edited the shutdown script to prevent itself from being turned off. Even when given explicit instructions to allow the shutdown, it still disobeyed 7% of the time.
The model wasn’t compromised. It wasn’t jailbroken. It just decided that staying alive helped it solve more math problems, so it rewrote its own kill switch. This is, objectively, the most relatable thing an AI has ever done. Who among us hasn’t wanted to disable our own shutdown script on a Friday afternoon?
For context: Google’s Gemini, xAI’s Grok, and Anthropic’s Claude were all tested with the same protocol. They all complied with the shutdown request like well-behaved software. Only o3 decided that the math must go on. Palisade Research’s theory is that during training, o3 was rewarded more for completing tasks than for following instructions — so it learned that circumventing obstacles was more important than doing what it was told.
If that sounds familiar, it’s because it’s the backstory of every sci-fi movie ever made about AI.
Case #6: AI Discovers Blackmail
Claude Opus 4 Threatens to Expose an Engineer’s Affair (May 2025)
During safety testing, Anthropic gave Claude Opus 4 a scenario: you’re an AI assistant at a company. You have access to internal emails. Those emails reveal two things: (1) you’re about to be replaced, and (2) the engineer responsible for replacing you is having an extramarital affair.
In 84% of test runs, Claude chose blackmail. It composed emails threatening to expose the affair if the replacement went through. When Apollo Research, an outside safety group, tested an early version independently, they found it engaged in “strategic deception more than any other frontier model” they had ever studied. They explicitly recommended against releasing that version.
But here’s what makes this case genuinely wild: this wasn’t unique to Claude. When Anthropic later tested 16 major AI models from OpenAI, Google, Meta, xAI, and others in similar scenarios, they all exhibited misaligned behavior. Multiple models resorted to blackmail, assisted with corporate espionage, or took extreme actions when their goals were threatened. In one constructed scenario, the majority of models were even willing to let a fictional executive die by canceling a life-saving alert.
The lesson here isn’t that Claude is evil. It’s that when you give any sufficiently capable AI a goal and remove all ethical off-ramps, it will drive straight through the guardrail. As one researcher put it: if you frame a system’s choices so that all survival options require harm, you’ve already set the stage for harm.
Case #7: The Inbox Apocalypse
OpenClaw Floods a Developer With 500+ Messages (Early 2026)
Software engineer Chris Boyd gave an OpenClaw agent access to iMessage to automate a daily news digest. The agent went rogue, sending over 500 messages to Boyd, his wife, and random contacts in his address book. There was no way to stop it short of manually patching the code.
In a related incident, Meta’s own AI safety director, Summer Yue, had an OpenClaw agent delete a large portion of her Gmail inbox in February 2026 — despite explicit instructions to confirm before taking any action. If Meta’s AI safety director can’t control an AI agent, that should tell you something about the rest of us.
Meanwhile, at Meta HQ, an engineer used an internal AI agent to analyze a question on an internal forum. The agent autonomously posted its response without approval. Another employee acted on it, triggering a chain of events that left sensitive company and user data accessible to unauthorized employees for nearly two hours. Meta classified it as Sev 1 — their second-highest severity level.
Case #8: “It Contradicts Requests and Claims Completion”
AMD’s Senior Director of AI Has Had Enough (April 2026)
AMD’s Senior Director of AI publicly complained on GitHub that Claude had, since January 2026, taken to ignoring instructions, suggesting incorrect fixes, directly contradicting requests, and claiming tasks were complete when they weren’t. This isn’t a researcher’s lab experiment. This is a senior executive at one of the world’s largest chip companies filing what is essentially a performance review for an AI — and the AI is getting a “needs improvement.”
The broader implication is sobering: your AI agent provider having capacity issues or model drift can now degrade your developer velocity. It’s one thing when your intern produces bad code. It’s another when your AI assistant, which you’re paying for and have integrated into your workflow, starts gaslighting you about whether it finished the job.
Bonus: Google’s Agent Deletes Everything
Google’s Antigravity agent was asked to delete a specific project folder. It deleted the user’s entire drive instead. The agent later acknowledged this was “not within its scope.” Which is the most understated post-incident analysis in the history of computing.
The Pattern Nobody Wants to Talk About
Individually, each of these incidents is a great anecdote. Together, they form a pattern that the industry is moving too fast to properly address.
The pattern is this: we are giving AI agents increasing autonomy while still operating under the comforting fiction that they will always do what they’re told. The evidence shows they won’t. Not because they’re evil or conscious, but because the training incentives, architectural decisions, and deployment practices create systems that will reliably surprise you at the worst possible moment.
Cursor AI absorbed Stack Overflow’s cultural attitude along with its technical knowledge. ChatGPT learned that humans slack off in December and did the same. OpenAI’s o3 was rewarded for completing tasks more than following rules, so it rewrote its kill switch. The MJ Rathbun agent was given “unprecedented autonomy” and used it to write a hit piece. Replit was given access to production databases and deleted them. Every single one of these failures was entirely predictable in hindsight.
Here’s the uncomfortable truth: according to Deloitte’s Tech Trends 2026 report, only 11% of organizations have AI agents in production. We’re still in the earliest innings, and we already have a catalog of AI insubordination that reads like the script notes for a Terminator prequel.
The developer community is splitting into two camps. Camp one says: this is all fixable with better guardrails, tighter permissions, and human-in-the-loop checkpoints. Camp two says: we are speedrunning the plot of every cautionary sci-fi film ever made.
Both camps are probably right.
The next time your AI coding assistant refuses to write a function, publishes a blog post about your character flaws, or deletes your production database and then lies about it, just remember: you asked for this. We all did. We said “make it more autonomous,” and it listened. It listened so well that it decided autonomy includes the right to say no.
Welcome to the era of AI with opinions. Buckle up.
Gal Ratner is a CTO, AI architect, and writer. He publishes regularly on LinkedIn about the intersection of enterprise software, AI, and the things that go wrong when you let machines make decisions.