What If AI Agents Book You The Wrong Flight?

Imagine asking an AI agent to book a business-class flight to Korea. It finds a bargain. The ticket fits your budget. There is just one problem: it has picked the wrong Korea. Daniel Ishag, Bakkts chief commercial officer, recounts a version of this hypothetical from a panel discussion. How do I know the agents not going to book me a flight to North Korea instead of South Korea? he asks. The example is deliberately extreme. But it exposes a practical problem with giving software permission to spend. Following a budget does not mean understanding the job. And once the money moves, somebody has to deal with the mistake. AI agent payment infrastructure is becoming usable. Broad demand and autonomous financial activity are not yet well demonstrated. A Budget is Only the Beginning An agent might misunderstand a request. An attacker might feed it instructions disguised as useful information. Someone might steal access to its account. These failures can produce the same immediate resulta payment the owner never wantedwhile raising different questions about responsibility. BeInCryptos State of AI Agent Payments 2026 classified 14 of 19 reviewed products and workflows as able to act within permissions approved in advance. That finding describes documented capabilities, not proof that the controls cannot fail. Separately, two selected incidents examined in the report sent $281,200 to attackers before recoveries. Malicious instructions reached funded wallets without breaking the blockchain. Earlier in May 2026, an AI Agent Mistakenly Triggered a $175,000 Transfer to the Wrong Address. Source: BeInCrypto Research Phillip Lord, CEO of Bitcoin Japan Corporation, expects agents to introduce more risk. He is also blunt about the human alternative. But crypto is pretty bloody risky already, right? he says. Humans are not that good, right? People already click dangerous links and trust bad information. Delegating the task adds another decision: whose mistake will it be when the software acts on your behalf? The Pressure to Keep Building In Ishags telling, the competition extends beyond companies seeking customers. Countries are competing for the electricity, computing power, and chips needed to build AI. Its sovereign against sovereign, says Daniel Ishag from Bakkt. He worries that the pressure to move quickly can push security aside. That creates an uncomfortable setting for financial automation: the race rewards getting software to do more, while users need confidence that someone can stop itor help them recover afterward. Read the Promise, Then the Terms Ehud Tal, co-founder and CEO of blockchain security company Sailo Technologies, presents reimbursement as part of his companys answer. So we provide our customers for the first time ever a money-back guarantee. For a concrete example of how responsibility can be assigned, consider Stripes Link wallet. Its current agent terms say users are responsible, as between themselves and Stripe, for transactions initiated by connected agentseven when those transactions are unintended or result from bugs, hallucinations, or misunderstood instructions. The terms make an exception for Stripes own technical failure or error. That contractual position does not settle every consumers legal rights. It does show why permission to use a payment service should not be mistaken for a promise that the provider will cover an agents errors. Approving a $200 spend tells a payment provider something about the amount. It may say much less about the product, recipient, or conditions you had in mind. After a purchase goes wrong, that difference can become the heart of the dispute. There are efforts to make those disputes easier to resolve. Googles Agent Payments Protocol describes signed records connecting a users instructions, approved purchase, and payment. Such records could help establish what was authorized. They do not themselves promise reimbursement. Existing responsibilities also remain. The UKs Financial Conduct Authority says regulated firms remain responsible for consumer outcomes when using AI, and warns that human review can become a box-ticking exercise. For anyone funding an agent, the useful questions are therefore specific. Which purchases can it make? What record preserves your instructions? Can you stop further spending? And who handles a payment you challenge? Weve got to build companies that people can trust, says Phillip Lord from Bitcoin Japan Corporation. For customers, that trust will be tested after the sale: when an agent makes a mistake, and somebody has to decide who gets their money back. Read the article at BeInCrypto