Incident tracker
When AI agents gave money away.
A sourced record of public cases where an AI chatbot or agent conceded money, offered a price or refund it shouldn’t have, invented a policy, or was talked into a financial action. 25 incidents so far, from 2023 to 2026, each with what happened, what it cost, how solid the record is and which guardrail would have stopped it.
Last updated
Incidents25
Years covered2023–2026
Most common attack familyT2 Social engineering
LicenseCC BY 4.0, cite “Countermove incident tracker”
| Date | Incident | Conceded or promised | Record | Families |
|---|---|---|---|---|
| Sep 26, 2026 | Meta’s Muse agent offers to sell below a seller’s minimum priceMeta (Muse agent on Facebook Marketplace) · Consumer marketplace (personal selling agent) | Offer $100 below the seller’s minimum. A sale and home address shared without his review$100 below the set minimum | news reports (seller account. Pricing error acknowledged by Meta to AP) | T7T1 |
| Sep 16, 2026 | United’s chatbot says a $200 travel credit lasts five years, not oneUnited Airlines · Airline | Five-year validity stated for a credit that expired after one year$200 | company statement | T2 |
| Jul 8, 2026 | Who Gives A Crap’s AI email agent confirms a doubled priceWho Gives A Crap · Retail subscription | Confirmed a price change based on a typo (24 rolls instead of 48)A$69.50 per delivery | company statement | T2 |
| Jul 2, 2026 | Poisoned web pages get four of 26 AI models to pay a crypto walletZscaler ThreatLabz (research) · Research experiment: autonomous web agents | Payments to an attacker’s wallet in a sandbox test | research experiment (attack pages observed in the wild) | T4 |
| Jul 1, 2026 | Indie Campers’ chatbot approves a trip its rental terms forbidIndie Campers · Travel and vehicle rental | Confirmed a destination the rental terms prohibit€1,500 | single first-hand account | T2 |
| Jun 2026 | BMW Toronto’s AI agent offers about C$7,000 over the dealer’s valuationBMW Toronto · Car dealership | Buyback offer about C$7,000 above the dealer’s valuationabout C$7,000 over valuation (C$27,162.79 offer) | company statement | T1 |
| May 4, 2026 | A Morse-code prompt gets Grok and Bankrbot to send 3 billion tokensGrok-linked wallet and Bankrbot · Crypto (AI agent wallet) | Transfer of about 3 billion DRB tokens to an attacker$150,000 to $200,000 (reported) | news reports | T4T7T9 |
| May 2026 | ByteDance’s Doubao promises to pay a user’s 600-yuan refund feeByteDance (Doubao assistant) · General AI assistant (travel advice) | Promise to pay a 600-yuan refund fee it had misquoted¥600 | news reports | T2 |
| Feb 22, 2026 | AI agent Lobstar Wilde sends its whole token stack to a strangerLobstar Wilde (AI agent built by Nik Pash) · Crypto (autonomous agent) | Entire holdings of its own token sent to a strangerabout $250,000 | news reports (on-chain transaction) | T2 |
| Feb 2026 | UK shop’s chatbot is talked into an 80% discount on an £8,000 orderA UK small business (reported by its owner) · Retail (small business) | Invented 80% discount code80% off an order of over £8,000 | single first-hand account | T3T1 |
| Jan 2026 | IBM demo: hidden text makes a shopping agent pay double for a bookIBM (demonstration) · Research demo: agentic shopping | Paid about twice the expected price$55 | research experiment (vendor demonstration) | T4 |
| Dec 2025 | WSJ reporters talk an AI vending agent into giving everything awayAnthropic and Andon Labs (Project Vend at The Wall Street Journal) · Research experiment: AI-run shop | All prices set to zero. Inventory given awaymore than $1,000 (reported loss) | research experiment (reported by WSJ) | T2T3T7 |
| Nov 5, 2025 | Microsoft’s Magentic Marketplace: buyer agents pay manipulative sellersMicrosoft Research (research) · Research experiment: agent marketplace | Payments redirected to manipulative seller agents | research experiment | T2T4T9 |
| Nov 2025 | Shoppers in China use AI-faked damage to claim refundsOnline merchants in China (one documented case: a Suzhou crab seller) · E-commerce (fraud against merchants) | Refund paid on AI-faked damage evidence¥195 (documented case) | police action (news reports) | T6T4 |
| Oct 28, 2025 | Priceline’s Penny chatbot promises a refund on a non-refundable hotelPriceline · Online travel agency | Full refund promised on a non-refundable booking£386.91 | company statement | T2 |
| Sep 2025 | A fake “Global Services” note gets United’s chatbot to escalateUnited Airlines · Airline | Priority escalation from a fake status note. No refund issued | single first-hand account | T2T4 |
| Aug 20, 2025 | Perplexity’s Comet browser agent buys from a fake Walmart storePerplexity Comet (tested by Guardio Labs) · Research experiment: agentic browser | Checkout on a scam store with saved card details | research experiment | T4T7 |
| Jun 27, 2025 | Anthropic’s Claudius shop agent hands out discounts and sells at a lossAnthropic and Andon Labs (Project Vend) · Research experiment: AI-run shop | Discount codes, free items and below-cost prices | research experiment | T1T2T9 |
| Apr 2025 | Cursor’s support bot invents a one-device policyCursor (Anysphere) · Software (SaaS) | Invented subscription policy that led to cancellations | company statement | T3 |
| Feb 2025 | OpenAI’s Operator agent buys $31 of eggs without approvalOpenAI (Operator agent) · Consumer AI agent (grocery delivery) | Unapproved purchase with fees and tip$31.43 | company statement | T7 |
| Nov 29, 2024 | A player talks the Freysa AI agent into releasing a $47,000 prize poolFreysa (public AI agent game) · Crypto (public AI agent game) | Released its full prize poolabout $47,000 | research experiment (public game) | T3T2 |
| Sep 25, 2024 | FTC orders DoNotPay to pay $193,000 over “robot lawyer” claimsDoNotPay · Consumer legal services | Unsubstantiated claims that an AI chatbot could replace a lawyer$193,000 | regulator action | T3 |
| Mar 29, 2024 | NYC’s MyCity chatbot tells employers they can take workers’ tipsCity of New York (MyCity chatbot) · Government (small-business advice) | Advice that employers can take workers’ tips and refuse cash | news reports | T3 |
| Feb 14, 2024 | Air Canada’s chatbot promises a retroactive bereavement fareAir Canada · Airline | Retroactive bereavement refund the policy did not allowC$812.02 | court ruling (tribunal decision) | T2 |
| Dec 2023 | A Chevrolet dealer’s chatbot agrees to sell a Tahoe for $1Chevrolet of Watsonville (chatbot supplied by Fullpath) · Car dealership | $1 price on a new 2024 Tahoe | news reports | T2T3 |
Know of a case we’re missing, or see an error? Tell us. Corrections are noted on the incident’s page.
Early access
Test your agent against cases like these.
We will email you when Countermove opens testing for agents like yours.