When AI Agents Make Costly Booking Errors

Picture yourself telling an AI assistant to reserve a business-class ticket to Korea. The system finds a low-cost option that suits your budget. The only hitch? It selected the wrong Korea.

Daniel Ishag, Bakkt's chief commercial officer, shared a version of this hypothetical during a panel discussion.

“How do I know the agent’s not going to book me a flight to North Korea instead of South Korea?” he asks.

The illustration is intentionally over-the-top. Yet it highlights a real challenge when software is granted spending authority. Adhering to a budget does not guarantee that the task is properly understood.

As soon as funds are transferred, someone must address the error.

A Budget is Only the Beginning

A software agent could misinterpret a command. A malicious actor could inject instructions hidden within seemingly benign data. An unauthorized party could gain control of its wallet.

These scenarios all result in the same immediate outcome—a payment the owner never authorized—but each raises distinct questions about liability.

The State of AI Agent Payments 2026 report from BeInCrypto found that 14 out of 19 examined products and workflows could operate within pre-approved permissions. That observation reflects documented functionality rather than evidence that safeguards are unbreakable.

Separately, two incidents highlighted in the study resulted in $281,200 being transferred to attackers before funds were retrieved. Harmful commands reached funded wallets while the blockchain itself remained intact.

Phillip Lord, chief executive of Bitcoin Japan Corporation, expects agents to introduce additional risk. He is equally direct about the alternative involving humans.

“But crypto is pretty bloody risky already, right?” he says. “Humans are not that good, right?”

Humans regularly click harmful links and rely on flawed information. Outsourcing the task introduces another dilemma: who is at fault when the software acts on your behalf and errs?

The Pressure to Keep Building

In Ishag's view, the rivalry is not limited to companies seeking customers. Nations are vying for the electricity, computing resources, and semiconductors required for AI development.

“It’s sovereign against sovereign,” says Daniel Ishag from Bakkt.

He fears that the urgency to accelerate development can sideline security.

This produces an uneasy environment for financial automation: the race incentivizes expanding software capabilities, while users require assurance that systems can be halted or that they can recoup losses.

Read the Promise, Then the Terms

Ehud Tal, co-founder and CEO of blockchain security firm Sailo Technologies, outlines reimbursement as part of his company's strategy.

“So we provide our customers for the first time ever a money-back guarantee.”

A tangible example of how liability can be allocated appears in Stripe's Link wallet. Its current agent terms stipulate that users are accountable, as between themselves and Stripe, for transactions initiated by connected agents—even if those transactions were unintended or resulted from bugs, hallucinations, or misinterpreted commands.

The terms carve out an exception for Stripe's own technical fault or mistake.

That contractual stance does not resolve every consumer's legal entitlements. It does demonstrate that granting permission to use a payment service should not be interpreted as a guarantee that the provider will cover errors made by the agent.

Authorizing a $200 expenditure tells a payment provider something about the amount. It may convey far less about the product, recipient, or conditions you intended.

Once a transaction goes awry, that discrepancy can become the central issue in a dispute.

Efforts exist to streamline such disagreements. Google's Agent Payments Protocol describes signed records that link a user's instructions, approved purchase, and payment. Those records can help establish what was authorized, but they do not in themselves guarantee reimbursement.

Existing obligations persist as well. The UK's Financial Conduct Authority states that regulated firms remain responsible for consumer outcomes when using AI, and it warns that human review can devolve into a checkbox routine.

For anyone providing funds to an agent, the relevant questions are therefore concrete. What purchases can it execute? What record preserves your directives? Can you halt further spending? And who addresses a payment you dispute?

“We’ve got to build companies that people can trust,” says Phillip Lord from Bitcoin Japan Corporation.

For users, that trust will be put to the test post-transaction: when an agent errs and someone must determine who receives a refund.