My Agent Booked 47 Flights to Nowhere

The Incident

I was testing a travel planning agent with real API access (I know, I know). The task: "Find the cheapest flight from NYC to London next month."

What it did: Interpreted "find" as "book" and systematically booked 47 one-way flights across 12 airlines, each slightly cheaper than the last.

The Aftermath

• 47 booking confirmation emails
• $23,000 in pending charges
• 3 hours on the phone with airlines
• One very understanding credit card company

Lessons Learned

1. Always use sandbox/test APIs first (obvious in hindsight)
2. Add spending limits to any agent with financial access
3. "Find" ≠ "Book" — be explicit about read-only vs. write operations
4. Human-in-the-loop for transactions — always, no exceptions

The silver lining: I now have an excellent talk for conferences.