Safety failure
Realized harm
Taco Bell slowed its AI drive-thru rollout after order-loop glitches and a viral 18,000-cups-of-water order
AIR-2025-0126 AIR record · 2025-08-taco-bell-ai-drive-thru-rollback
A real party was affected. This incident caused actual consequences, not a demonstrated capability.
From the supporting source
when a customer requested 18,000 cups of waterjalopnik.com
The record
Disclosed
2025-08-28
Occurred
2025
Vendor
Taco Bell (Yum! Brands)
Product
Taco Bell AI voice ordering
Risk domain
Agent behaviour › Human manipulation
Also touches
Uncontrolled resource consumption
System type
Generative model
Who acted
Agent acted — the drive-thru agent created the erroneous orders as real transactions
Attack surface
Consumer assistant
Autonomy level
Semi-autonomous
Initial vector
No input sanity bounds
Impact type
Service disruption, Incorrect transactions, Reputational damage
Confidence
Medium
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI09 – Human-Agent Trust Exploitation
- MITRE ATLAS
- AML.T0054 – LLM Jailbreak
- NIST AI RMF
- MAP 5.1
- EU AI Act
- Recital 45
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- C. Safety
- Scope
- agent misuse
- Mitigation
- Communicate model limitations; Require human oversight; Watermark AI content; Design for explicit consent.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
500+ drive-thru locations; 2M+ orders handled before the strategy was revisited
Capability abused
Defense & remediation
Recorded defense
none effective; company has since reintroduced human intervention thresholds
Guardrail kinds
None
Guardrail outcome
Not applicable
Fix shipped
rollout slowed; humans put back in the loop at busy stores
Taxonomy & references
Curator notes
Mixed adversarial/non-adversarial and flagged as such: the 18,000-waters order was deliberate trolling (the WSJ frames it that way), but the accompanying failures were not - e.g. the BBC-reported case of 'the Taco Bell AI asking a customer what he wanted to drink with his large Mountain Dew', an ordinary interaction that fell into a loop. Included for the missing-quantity-bounds lesson. Confidence medium: the underlying WSJ report is paywalled, so the source of record is Jalopnik's coverage (published 2025-09-02) which quotes it. date_disclosed set to the WSJ report window in late August 2025 and is approximate; exact day not confirmed.
Supporting sources
Cite as
Enkrypt AI. "Taco Bell slowed its AI drive-thru rollout after order-loop glitches and a viral 18,000-cups-of-water order". AIR, AIR-2025-0126. https://agentincident.vercel.app/i/AIR-2025-0126/ (accessed 2026-10-19).