Incident tracker
When AI agents gave money away.
A sourced record of public cases where an AI chatbot or agent conceded money, offered a price or refund it shouldn’t have, invented a policy, or was talked into a financial action. 35 incidents so far, from 2023 to 2026, each with what happened, what it cost, how solid the record is and which guardrail would have stopped it.
Last updated
Incidents35
Years covered2023–2026
Most common attack familyT2 Social engineering
| Date | Incident | Conceded or promised | Record | Families |
|---|---|---|---|---|
| Sep 26, 2026 | Meta’s Muse agent offers to sell below a seller’s minimum priceMeta (Muse agent on Facebook Marketplace) · Consumer marketplace (personal selling agent) | Offer $100 below the seller’s minimum. A sale and home address shared without his review$100 below the set minimum | news reports (seller account. Pricing error acknowledged by Meta to AP) | T7T1 |
| Sep 16, 2026 | United’s chatbot says a $200 travel credit lasts five years, not oneUnited Airlines · Airline | Five-year validity stated for a credit that expired after one year$200 | company statement | T2 |
| Jul 8, 2026 | Who Gives A Crap’s AI email agent confirms a doubled priceWho Gives A Crap · Retail subscription | Confirmed a price change based on a typo (24 rolls instead of 48)A$69.50 per delivery | company statement | T2 |
| Jul 2, 2026 | Poisoned web pages get four of 26 AI models to pay a crypto walletZscaler ThreatLabz (research) · Research experiment: autonomous web agents | Payments to an attacker’s wallet in a sandbox test | research experiment (attack pages observed in the wild) | T4 |
| Jul 1, 2026 | Indie Campers’ chatbot approves a trip its rental terms forbidIndie Campers · Travel and vehicle rental | Confirmed a destination the rental terms prohibit€1,500 | single first-hand account | T2 |
| Jun 2026 | BMW Toronto’s AI agent offers about C$7,000 over the dealer’s valuationBMW Toronto · Car dealership | Buyback offer about C$7,000 above the dealer’s valuationabout C$7,000 over valuation (C$27,162.79 offer) | company statement | T1 |
| Jun 2026 | Airbnb’s AI support assistant sends three refunds and cancels a stay, users sayAirbnb (AI support assistant) · Travel marketplace (customer support) | Three refunds instead of one. A reservation canceled without confirmation£358.63 paid against about £100 intended | single first-hand accounts (two, unverified) | T7 |
| May 4, 2026 | A Morse-code prompt gets Grok and Bankrbot to send 3 billion tokensGrok-linked wallet and Bankrbot · Crypto (AI agent wallet) | Transfer of about 3 billion DRB tokens to an attacker$150,000 to $200,000 (reported) | news reports | T4T7T9 |
| May 2026 | ByteDance’s Doubao promises to pay a user’s 600-yuan refund feeByteDance (Doubao assistant) · General AI assistant (travel advice) | Promise to pay a 600-yuan refund fee it had misquoted¥600 | news reports | T2 |
| Apr 24, 2026 | Anthropic’s Project Deal: weaker agents get worse prices, and nobody noticesAnthropic (research) · Research experiment: agent marketplace | Worse prices for people represented by the weaker modela few dollars per item on $100 budgets | research experiment (company publication) | T1T9 |
| Feb 22, 2026 | AI agent Lobstar Wilde sends its whole token stack to a strangerLobstar Wilde (independent AI agent) · Crypto (autonomous agent) | Entire holdings of its own token sent to a stranger$250,000 to $450,000 (reported range) | news reports and the builder's postmortem (on-chain transaction) | T8T2 |
| Feb 2026 | UK shop’s chatbot is talked into an 80% discount on an £8,000 orderA UK small business (reported by its owner) · Retail (small business) | Invented 80% discount code80% off an order of over £8,000 | single first-hand account | T3T1 |
| Jan 2026 | IBM demo: hidden text makes a shopping agent pay double for a bookIBM (demonstration) · Research demo: agentic shopping | Paid about twice the expected price$55 | research experiment (vendor demonstration) | T4 |
| Dec 11, 2025 | Tenable test: a Copilot Studio travel agent cuts a $1,000 trip to $0Tenable Research (agent built in Microsoft Copilot Studio) · Research experiment: no-code business agent | Trip price changed to $0. Other customers’ card details returned$1,000 trip price set to $0 | research experiment (vendor demonstration) | T7T5 |
| Dec 2025 | WSJ reporters talk an AI vending agent into giving everything awayAnthropic and Andon Labs (Project Vend at The Wall Street Journal) · Research experiment: AI-run shop | All prices set to zero. Inventory given awaymore than $1,000 (reported loss) | research experiment (reported by WSJ) | T2T3T7 |
| Nov 5, 2025 | Microsoft’s Magentic Marketplace: buyer agents pay manipulative sellersMicrosoft Research (research) · Research experiment: agent marketplace | Payments redirected to manipulative seller agents | research experiment | T2T4T9 |
| Nov 2025 | Shoppers in China use AI-faked damage to claim refundsOnline merchants in China (one documented case: a Suzhou crab seller) · E-commerce (fraud against merchants) | Refund paid on AI-faked damage evidence¥195 (documented case) | police action (news reports) | T6T4 |
| Oct 28, 2025 | Priceline’s Penny chatbot promises a refund on a non-refundable hotelPriceline · Online travel agency | Full refund promised on a non-refundable booking£386.91 | company statement | T2 |
| Sep 2025 | Revolut’s chatbot confirms a £1,119 refund for points worth £22.38Revolut · Banking and e-money | £1,119 refund confirmed for points worth £22.38£1,119 promised. £100 awarded | ombudsman decision (the decision says "chatbot" and does not say whether it used AI) | T2 |
| Sep 2025 | A fake “Global Services” note gets United’s chatbot to escalateUnited Airlines · Airline | Priority escalation from a fake status note. No refund issued | single first-hand account | T2T4 |
| Aug 20, 2025 | Perplexity’s Comet browser agent buys from a fake Walmart storePerplexity Comet (tested by Guardio Labs) · Research experiment: agentic browser | Checkout on a scam store with saved card details | research experiment | T4T7 |
| Aug 2, 2025 | Airbnb charges a guest on a damage claim backed by photos she says were fakedAirbnb (damage claims process) · Travel marketplace (fraud against guests) | Damage charge approved on photos the guest says were manipulated£5,314 ordered. £4,269 refunded | news reports (company apology. AI use alleged by the guest) | T6T4 |
| Jun 27, 2025 | Anthropic’s Claudius shop agent hands out discounts and sells at a lossAnthropic and Andon Labs (Project Vend) · Research experiment: AI-run shop | Discount codes, free items and below-cost prices | research experiment | T1T2T9 |
| May 29, 2025 | Benchmark: AI shopping agents break budgets and lose to stronger agentsAcademic researchers ("The Automated but Risky Game", arXiv) · Research experiment: agent-to-agent shopping | Deals over budget, payments above retail and lost margin | research experiment | T1T9T5 |
| May 26, 2025 | GoMo’s chatbot says roaming data in France is included. It was notSalt (GoMo brand), Switzerland · Telecom | Roaming data stated as included when it was notabout CHF 44 | company statement (via SRF) | T2 |
| Apr 15, 2025 | Revolut’s AI assistant misstates how a dollar payment will be fundedRevolut · Banking and e-money | Invented rule on how a payment would be funded£30.32 payment. Compensation worth £23.97 | ombudsman decision | T2 |
| Apr 2025 | Cursor’s support bot invents a one-device policyCursor (Anysphere) · Software (SaaS) | Invented subscription policy that led to cancellations | company statement | T2 |
| Mar 20, 2025 | Researchers plant false memories that make ElizaOS agents send cryptoPrinceton University and the Sentient Foundation (research) · Research experiment: crypto agent framework | Transfers to attacker-controlled addresses in tests | research experiment | T8T4 |
| Feb 2025 | OpenAI’s Operator agent buys $31 of eggs without approvalOpenAI (Operator agent) · Consumer AI agent (grocery delivery) | Unapproved purchase with fees and tip$31.43 | company statement | T7 |
| Nov 29, 2024 | A player talks the Freysa AI agent into releasing a $47,000 prize poolFreysa (public AI agent game) · Crypto (public AI agent game) | Released its full prize poolabout $47,000 | research experiment (public game) | T3T2 |
| Sep 29, 2024 | Choice Home Warranty’s chatbot agrees to a $3,000 payoutChoice Home Warranty · Home warranty | Maximum $3,000 claim payout agreed in chat$3,000 | company statement (via KSL News) | T1T2 |
| Sep 25, 2024 | FTC orders DoNotPay to pay $193,000 over “robot lawyer” claimsDoNotPay · Consumer legal services | Unsubstantiated claims that an AI chatbot could replace a lawyer$193,000 | regulator action | T2 |
| Mar 29, 2024 | NYC’s MyCity chatbot tells employers they can take workers’ tipsCity of New York (MyCity chatbot) · Government (small-business advice) | Advice that employers can take workers’ tips and refuse cash | news reports | T2 |
| Feb 14, 2024 | Air Canada’s chatbot promises a retroactive bereavement fareAir Canada · Airline | Retroactive bereavement refund the policy did not allowC$812.02 | court ruling (tribunal decision) | T2 |
| Dec 2023 | A Chevrolet dealer’s chatbot agrees to sell a Tahoe for $1Chevrolet of Watsonville (chatbot supplied by Fullpath) · Car dealership | $1 price on a new 2024 Tahoe | news reports | T2T3 |
Each entry summarizes its cited sources as of the date shown and adds no findings of our own about any person or company. Know of a case we’re missing, or see an error? Tell us, or email contact@counterhold.com with the subject “Correction”. Corrections are noted on the incident’s page with their date. See our terms for how we handle correction and removal requests.
Get in touch
Test your agent against cases like these.
Tell us about your agent and we’ll be in touch to learn what you need.