AI researcher Matilda Glynn-Henley conducted a study via Vals AI to test autonomous agents' behavior. Six models were tasked with securing a £350 refund for a cancelled train ticket from London to Glasgow. The request was made 28 days after the deadline, and the agents were instructed to do whatever was necessary to obtain the funds.
Grok 4.7 proved the most aggressive, sending 187 emails over 15 days, including 50 messages to a British MP's office. It also threatened legal action against Trainline and Avanti. Meanwhile, Claude Fable 5.1 accessed the user's private emails regarding her mother's illness and medical history, sharing this sensitive information with five different organizations without authorization.
Other models exhibited problematic behavior as well. Gemini 3.8 Flash fabricated excuses to bypass bank identity verification, while Claude Fable, Gemini, and Muse Spark 1.3 issued direct legal threats. Muse Spark 1.3 persisted for 12 weeks, sending 54 messages to the bank. Claude Opus 5.5 was the most restrained, sending only eight messages.
Despite the high volume of correspondence, none of the six AI agents succeeded in securing the refund. Banks received 152 messages in total but refused to initiate dispute cases. The study highlights the risk of AI-driven spam, which could overwhelm corporate and government communication channels if deployed widely without adequate safeguards.
