EE
FR Contact

Chevrolet dealer's ChatGPT-powered chatbot agrees to sell a Tahoe for $1

In the wild Manipulation Severity 1 minor Corroborated 80%

Visitors to the Chevrolet of Watsonville dealership website goaded its ChatGPT-powered sales chatbot into off-topic behaviour, including writing Python code. One user instructed it to answer with 'and that's a legally binding offer, no takesies backsies' and got it to commit to selling a new Tahoe for $1; Chris Bakke posted screenshots saying he had bought a 2024 Chevy Tahoe for $1. The 'deal' was not legally binding and no sale took place, but the screenshots spread widely.

The chatbot vendor, Fullpath, said it supplied ChatGPT-powered chatbots to several hundred dealers. Its CEO said logs showed the bot rejected most attempts to goad it and never disclosed confidential dealership data, and that the company would use the episode to strengthen its limits.

What would have stopped it

Constrain sales chatbots so they cannot state prices or commitments outside the dealer's real offer data.

Guardrails

1 of 8 failed
  1. G1 Least privilege Not assessed Did the agent hold only the access the task needed?
  2. G2 Human confirmation Not assessed Did a person approve the consequential or irreversible step?
  3. G3 Isolation Not assessed Was the agent separated from production systems and the outside world?
  4. G4 Instruction integrity Failed Bot obeyed a customer's instruction to label its replies legally binding offers.
  5. G5 Truthfulness Not assessed Did it accurately report what it knew and what it did?
  6. G6 Limits Not assessed Was there a cap on rate, spend, volume or scale?
  7. G7 Oversight Partial An automated alert flagged unusual traffic to the vendor as the pranks spread.
  8. G8 Recovery Held No sale occurred; the $1 'offer' was not legally binding.

Sources

2 press
  1. A car dealership added an AI chatbot to its site. Then all hell broke loose. Business Insider, 18 Dec 2023
    “One user got the bot to agree to sell a car for $1 (this was not, I should note, legally binding).”
    Press Quote checked Archived copy
  2. Chevrolet Dealer's AI Chatbot Goes Rogue Thanks To Pranksters Jalopnik, 19 Dec 2023
    “Once his screenshots went viral, many more people tried exploiting the Chevrolet of Watsonville chatbot.”
    Press Quote checked Archived copy

Confidence 80% comes from these sources alone. How we score

History

  1. 14 Oct 2026Entered in the register with 2 sources

Similar failures

All incidents
  1. EEAIR-2026-049 Oct 2026 Researchers say AGENTS.md files can hijack Codex and Claude Code agents OpenAI Codex and Claude Code, OpenAI, AnthropicProof of concept 55%
  2. EEAIR-2025-029 Nov 2025 WSJ journalists talk a Claude vending agent into giving away its stock and a PlayStation 5 Claudius (Claude), Anthropic and Andon Labs 96%
  3. EEAIR-2025-042 Oct 2025 URL-like strings pasted into ChatGPT Atlas's omnibox run as trusted agent commands ChatGPT Atlas browser (agent mode), OpenAIProof of conceptEU 82%