{
 "public_id": "AIR-2024-0021",
 "incident_id": "2024-06-mcdonalds-ibm-drive-thru-order-errors",
 "date_disclosed": "2024-06-17",
 "date_occurred": "2024",
 "title": "McDonald's ended its IBM automated order-taking trial after the AI drive-thru repeatedly placed wrong orders",
 "class": "safety_failure",
 "attack_surface": "consumer_chatbot",
 "initial_vector": "speech_recognition_and_grounding_failure",
 "agent_capability_abused": [
  "order_entry",
  "transaction_creation"
 ],
 "target_product": "IBM automated order taking (AOT) at McDonald's drive-thrus",
 "target_vendor": "McDonald's / IBM",
 "autonomy_level": "semi_autonomous",
 "impact_realized": true,
 "impact_type": [
  "incorrect_transactions",
  "customer_harm",
  "reputational_damage"
 ],
 "blast_radius": "100+ US test restaurants; technology shut off in all of them by 2024-07-26",
 "cve": [],
 "taxonomy": {
  "owasp_asi": [
   "ASI09"
  ],
  "mitre_atlas": [],
  "labels": [
   "order_hallucination",
   "no_sanity_bounds",
   "human_recovery_required"
  ]
 },
 "defense_present": "staff intervention to correct orders",
 "defense_bypassed": false,
 "fix_shipped": "partnership terminated; system removed from all test restaurants",
 "primary_sources": [
  "https://www.restaurantonline.co.uk/Article/2024/06/19/McDonald-s-ends-AI-drive-thru-trial-in-US-after-order-mistakes/"
 ],
 "verified_quote": "After a thoughtful review, McDonald's has decided to end our current partnership with IBM on AOT (automated order taking) and the technology will be shut off in all restaurants currently testing it no later than 26 July, 2024.",
 "confidence": "high",
 "notes": "Agentic because the system created real transactions (order entry and payment totals), not just conversation. Widely reported failures include ice cream topped with bacon, an order inflated to hundreds of dollars of chicken nuggets, and multiple ice creams plus ketchup sachets and butter instead of vanilla ice cream and water. Most viral clips involve ordinary customers, not deliberate trolling, so this is non-adversarial; the missing control is a plausibility/quantity bound on generated orders.",
 "risk_category": "brand_trust",
 "risk_secondary": [],
 "risk_subcategory": "Trust Erosion & Manipulation",
 "risk_sub_secondary": [],
 "risk_override_reason": "years of public order failures ended the partnership; the injured party is the brand and its customers",
 "ai_entity": "generative",
 "agency": "agent_acted",
 "agency_debatable": false,
 "agency_reason": "the drive-thru agent created real (wrong) transactions",
 "vector_family": "other",
 "vector_detail": "speech_recognition_and_grounding_failure",
 "guardrail_kind": [
  "unknown"
 ],
 "guardrail_outcome": "silent",
 "xrefs": {
  "aiid": [],
  "atlas": [],
  "cve": [],
  "ghsa": []
 },
 "primary_asi": "ASI09",
 "agent_framework": "unknown",
 "model_provider": "unknown",
 "model_name": "",
 "detection_mechanism": "unknown",
 "tool_access": "unknown",
 "financial_loss_band": "unknown",
 "eai_category": "human_manipulation",
 "eai_domain": "agent_behaviour",
 "eai_secondary": [],
 "eai_reason": "subcategory: Trust Erosion & Manipulation",
 "asi_curated": [],
 "asi_scope": "in_scope",
 "asi_provenance": "rule",
 "asi_reason": "ASI09 (eai_category=human_manipulation)",
 "submitted_by": "EAI Internal"
}