Documented incidentDisclosed 2024-02-14Air CanadaCourt record

Airline held liable when its website chatbot gave wrong bereavement-fare advice (Moffatt v. Air Canada, 2024)

A customer relied on Air Canada's website chatbot, which told him he could apply for a bereavement fare retroactively; the airline's policy did not allow that.

What happened

  • Air Canada argued it could not be held liable for information provided by its chatbot.Moffatt v. Air Canada, 2024 BCCRT 149
  • The tribunal largely allowed the customer's claim and ordered Air Canada to pay a total of $812 CAD.Moffatt v. Air Canada, 2024 BCCRT 149

The failure pattern

AI action exceeds its intended scopeAn AI agent or assistant takes an action, or makes a promise, that nobody meant it to be able to make.How to prevent it Privileged action without an enforceable approval gateLimits and approvals live in a prompt, a UI checkbox or a convention instead of code the automation cannot bypass.How to prevent it
Watch the pattern: AI action exceeds its intended scope

Safeguards that address it

CollectSEA's engineering analysis of what would have prevented or contained this failure.

  • Ground policy answers in the authoritative policy sourceAnswer refund and eligibility questions from current policy text and link to it instead of free-form generation.
  • Treat chatbot statements as company statementsConstrain what the assistant may promise, add disclaimers that cannot substitute for accuracy, and review high-stakes answers.

Related standards

CollectSEA's mapping through this incident's failure pattern; not an official determination by the standards bodies.

Building something similar?

Describe your design and see every precedent that applies, with safeguards you can hand to your coding agent.

Analyze your design

Incidents with the same pattern

Security advisory2026-10-16AI agent

Security issue reported in Software component

The WSP MCP AI Agents Connector plugin for WordPress is vulnerable to Sensitive Information Disclosure in versions up to, and including, 2.9.5.

AI action exceeds its intended scopenvd.nist.gov
Security advisory2026-10-16AI agent

Software component issue could run attacker-controlled scripts in a browser

Wheels CLI 4.0.0 through 4.1.1 insufficiently validates or escapes caller-supplied values and package contents. Deploy release/version/rollback values can execute shell commands on deploy hosts as the SSH user and on the…

AI action exceeds its intended scopenvd.nist.gov
Security advisory2026-10-16AI agent

Security issue reported in @aborruso/ckan-mcp-server

The MCP Apps UI resource (an interactive DataStore table rendered in the host's webview/iframe) communicates with its parent via postMessage.

AI action exceeds its intended scopegithub.com
Security advisory2026-10-15AI agent

Security issue reported in Software component

undici is an HTTP client library for Node.js. In versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its Agent dispatcher passes its constructor options through a JSON-based deep clone before…

AI action exceeds its intended scopenvd.nist.gov
Security advisory2026-10-15AI agent

Security issue reported in Software component

undici is an HTTP client library for Node.js. In versions 7.0.0 through 7.30.0 and 8.0.0 through 8.12.1, when an originless Agent composes the redirect and cache interceptors in that order with a shared cache store, the…

AI action exceeds its intended scopenvd.nist.gov