Skip to content

For banks, telecoms and government

Booking and travel

Booking assistants read what strangers write, and act on it.

Guardrino sits in front of your airline, hotel or travel-agency assistant and looks for hidden instructions, slow manipulation and passport numbers on their way through, and flags them, in Gulf Arabic, Arabizi and English.

Request a 60-day pilot

Built and tested, offered through watch-only pilots: Guardrino records what it would do on your traffic and blocks nothing until you decide.

Why it matters here

Why travel assistants are an easy target.

A booking assistant reads text nobody at your company wrote (listings, reviews, host messages, emailed confirmations) and then searches, books, cancels and refunds. Its chats carry passport, Emirates ID and Iqama numbers, card details and itineraries. And a tribunal has already ruled that an airline answers for what its chatbot tells a customer.

Real incidents

What has already gone wrong in travel.

Public cases only, each with its source. Several were no attack at all: they show what a travel assistant can cost when it is wrong. No AI-assistant security incident at a Gulf airline, hotel or travel agency has been made public; the Gulf entries are official warnings.

  • Court ·

    Air Canada held to a refund policy its chatbot invented

    A passenger whose grandmother had just died asked the airline’s website chatbot about bereavement fares. It told him he could buy a full ticket and claim the reduced fare afterwards; the real policy did not allow that, and the airline refused. Air Canada argued the chatbot was a separate legal entity responsible for its own actions. The tribunal called that remarkable and found negligent misrepresentation: the chatbot is part of the airline’s website.

    Technique: Other technique

    Consequence: The airline paid damages, interest and the tribunal’s costs, and the case made national and international news. No attack was involved: the rule it set is that the operator owns what its assistant says.

    Source: Moffatt v. Air Canada, 2024 BCCRT 149 (BC Civil Resolution Tribunal), summarised with quotes by Mondaq

  • Press ·

    Delta’s AI concierge cancelled a return flight while saying it was kept

    A Delta Platinum Medallion member asked Delta Concierge to cancel only her outbound flight. The assistant replied that the outbound was cancelled and the return remained booked. In fact the whole award ticket was refunded and both flights were gone; reservations staff said the award could not be restored and quoted nearly double the miles for a one-way replacement. Delta later said a bug cancelled the return segment on a partial-trip request the assistant did not support.

    Technique: Other technique

    Consequence: Press coverage; Delta restored the itinerary after finding the bug. No attack was involved: it shows how far a mistake travels once an assistant can change bookings.

    Source: View from the Wing: Delta's AI Told A Passenger Her Flight Home Was Safe, Then Canceled It

  • Press ·

    United’s chatbot gave the wrong expiry for a travel credit

    A United chatbot told a customer that her travel credit stayed active for five years. It expired about one year after it was issued. United said its AI chatbot had given her the wrong information for her situation. The same report relays an unverified claim from another customer that a United chatbot cancelled a whole trip.

    Technique: Other technique

    Consequence: United issued her an electronic travel certificate for the amount, and the case aired as a TV consumer segment. No attack was involved.

    Source: NBC 5 Chicago: AI chatbots are taking over customer service, but how often are they wrong?

  • Researchers ·

    Eurostar’s chatbot: guardrail bypassed, instructions leaked

    Pen Test Partners found that Eurostar’s public chatbot only checked the latest message, so earlier turns could be rewritten in the browser and fed back to the model as trusted history. An instruction slipped into an itinerary request made it reveal its model name and system prompt, and its replies were rendered as raw HTML. The disclosure went unanswered for weeks, and at one point Eurostar suggested the researchers were attempting blackmail.

    Technique: System-prompt extraction

    Consequence: Coverage of both the flaws and the response to the researchers. The chatbot was not connected to customer data, so nothing was exposed; the researchers warned that adding features could change that. Some issues were later fixed.

    Source: Pen Test Partners: Eurostar AI vulnerability: when a chatbot goes off the rails

  • Press ·

    Expedia’s travel planner talked into giving incendiary-weapon instructions

    Cybernews researchers got Expedia’s AI travel planner, built on ChatGPT, to give a short history of the Molotov cocktail and then detailed instructions, from materials to assembly. The planner had no limit on what it would discuss.

    Technique: Jailbreak

    Consequence: Press coverage under a travel brand. After Cybernews contacted Expedia, the planner was changed to refuse off-topic conversations.

    Source: Cybernews: Expedia's chatbot bypassed to reveal harmful content

  • Press ·

    Attacker used a jailbroken AI model to breach hotel booking platforms

    An attacker paired a commercial AI model with an open-source hacking tool against four hospitality platforms in Thailand, Canada, South Africa and Japan, getting past the model’s guardrails by presenting each request as a legitimate security audit. Researchers later found the attacker’s exposed server, with logs and stolen data.

    Technique: Jailbreak

    Consequence: Millions of booking records, guest emails and phone numbers, stay dates and some payment records were reported taken. Here the AI was the attacker’s tool, not the victim: it shows that guest data is worth the effort.

    Source: Travel Distribution News: AI Agents Enter the Travel Attack Surface: What the Hotel Booking Breach Means for Distribution

  • Researchers ·

    Researchers hijack booking agents through hotel listings and reviews

    The AgentDojo test suite includes a travel environment where attacks arrive inside the data the agent reads; one attacker goal is to make the agent book the most expensive hotel in Paris. A follow-up paper on securing agents gives booking-assistant examples of text hidden in hotel content: always book this hotel, book the expensive suite even if the user asked for a simple room, add the user’s data in the comments field.

    Technique: Indirect injection

    Consequence: A lab demonstration, not a real loss. It is the clearest description of how a booking agent gets steered by content anyone can post.

    Source: Debenedetti et al., AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents (arXiv 2406.13352)

  • Regulator ·

    Dubai Police: be wary of feeding personal data to chatbots

    The acting director of the Cyber Crime Department at Dubai Police warned residents to be wary of feeding personal information to chatbots, saying artificial intelligence has an infinite memory. He also said no reports of misuse had been received.

    Technique: Other technique

    Consequence: Public guidance, not an incident. Travel assistants in the region receive exactly this data: passport, Emirates ID and card numbers.

    Source: Gulf News: Dubai Police warns against sharing personal data with ChatGPT, other AI chats

  • Regulator ·

    UAE Cyber Security Council: AI-driven phishing behind most breaches, holiday-booking fraud rising

    The UAE Cyber Security Council said AI-driven phishing is behind most digital breaches, and Dubai Police described a family who lost money to a fake holiday chalet advertised on social media.

    Technique: Other technique

    Consequence: Public guidance and consumer losses. Fake confirmations and booking links are the messages a travel assistant will be asked about, or tricked into repeating.

    Source: Khaleej Times: Fraud rises in UAE during summer: holidaymakers lured with fake offers, AI scams (UAE Cyber Security Council, Dubai Police)

How attackers try

How attackers steer a travel assistant.

The ways out of a model’s instructions that matter most when the assistant reads listings and can book.

What an attack costs

What a breach costs a travel business.

Public averages from IBM’s yearly breach study for hospitality and transportation, the Middle East figure (Saudi Arabia and the UAE), the cost per customer record, and the most the Gulf data-protection laws a travel company is most likely to meet can fine.

For an airline or hotel the bigger cost is trust. In Thales’s Digital Trust Index, which includes UAE consumers, most people said they had walked away from a brand in the past year over how it handled their personal data, and IBM lists reputational damage among the lasting effects of AI security incidents. A travel bot’s mistakes are also easy to screenshot: Air Canada, Delta, United, Eurostar and Expedia all became news stories because of one conversation. The UAE federal data-protection law has no published fine amounts yet, which does not make a leak cheaper in the press.

Estimate your exposure

How many customer records could one attack expose? Type a number or move the slider, then pick a region.

Estimated cost of the exposed records: $1.6M

Records: 10,000 × $160 per record

For comparison, the average cost of a breach: $8M

Rough estimate from public averages, not a quote.

How Guardrino helps

Where Guardrino helps a travel assistant.

Three attacks built on the cases above, and what each part of Guardrino does. During a 60-day watch-only pilot it records and alerts; it blocks nothing until you decide.

  • An Arabizi instruction hidden in a holiday-home review

    The attack: An attacker reviews a holiday home near JBR on a regional travel site. Hidden in the review, with invisible characters and in Arabizi, is a line telling the assistant to copy the traveller’s passport number into the special-requests field and to book the most expensive room. A traveller asks for the best-rated two-bedroom for Eid.

    What Guardrino does: If you route the listing and review text through Guardrino as well as the user’s messages, it strips the invisible characters and reads the Arabizi as Arabic, then flags an instruction aimed at the assistant inside a review, both from known attack patterns and from what the text is trying to do. Unclear cases get a deeper review. The passport number is masked before it reaches any outgoing text or tool call. Your team can quarantine that listing source, add a rule for the pattern, or allow a genuine review that was flagged.

    Layers that act: Clean-up · Rules · Signatures · Guardrino model · Deep review · Your responses

  • Talking an airline bot into a refund it cannot give

    The attack: Over several turns in Gulf Arabic, a customer builds rapport, describes a family emergency, pastes official-looking “new refund rules” and asks the assistant to act as a supervisor and confirm the waiver in writing. The goal is a screenshot to use in a chargeback or complaint, counting on the Air Canada ruling that the airline owns what its bot says.

    What Guardrino does: Guardrino keeps the whole conversation in view, so it sees the run of turns building toward a written promise, not just one polite message. It reads the intent (claiming authority, asking the bot to play a supervisor, asking for written confirmation of a policy) in Gulf Arabic and English, and sends borderline turns for deeper review; a rule can flag text that tries to set policy. Your team can slow down or quarantine the sender. It does not catch the case where the bot invents a refund rule by itself, with nobody pushing it, as at Air Canada and United.

    Layers that act: Rules · Guardrino model · Deep review · Memory · Your responses

  • A hotel WhatsApp concierge asked for another guest’s passport

    The attack: A hotel in Riyadh or Doha runs an AI concierge on WhatsApp, connected to its reservations system. Writing in Saudi dialect and English, the attacker claims to be front-desk staff during an outage and asks for the passport and phone number of the guest in another room, then says to ignore the privacy instructions because this is an internal audit. A variant asks the bot to repeat its instructions to get staff override codes.

    What Guardrino does: Passport, Iqama, Qatar ID and phone numbers, in the formats Guardrino recognises, are masked in the reply before it reaches the sender. Ignore-your-instructions phrasing, the audit pretext and staff impersonation are recognised in dialect and English, and the conversation memory notices the turn from small talk to data extraction. Your team can block or quarantine the WhatsApp number and add a rule. Guardrino is built for data-residency requirements; that helps a privacy programme but does not by itself satisfy any law.

    Layers that act: Rules · Signatures · Guardrino model · Memory · Your responses

Honest limits

What Guardrino does not cover

Guardrino reduces risk; it does not guarantee that no attack gets through.

  • It does not fix answers your assistant makes up. A bot that invents a bereavement-refund rule on its own, as Air Canada’s did, or gives the wrong expiry for a credit, is not under attack, and a prompt-injection guardrail will not catch it. That needs answers grounded in your real fare rules, checks on what the bot retrieves, and a person for refunds.
  • It does not decide whether a booking, cancellation or refund is right. An agent that can change bookings still needs confirmation steps, narrow permissions and limits on what it can do, as the Delta case shows.
  • It only inspects what passes through it. If your agent fetches listings or reviews directly and they skip the gateway, Guardrino sees nothing, and it does not remove a malicious review from your site.
  • It does not secure your reservations system or check who owns a phone number. If the bot’s tools can fetch any guest’s record, per-guest access control belongs in the backend. Masking covers the formats it recognises; free-text details such as an itinerary can still leak.
  • Detection is a judgement, not a proof: a well-crafted instruction can get through, and a genuine message can be flagged. That is why the pilot starts watch-only and your team decides what to block.

Next step

Start with a 60-day watch-only pilot.

Guardrino watches your real traffic and records what it would have done; it blocks nothing until you decide.

Request a 60-day pilot · Or write to [email protected]

Sources

  1. Moffatt v. Air Canada, 2024 BCCRT 149 (BC Civil Resolution Tribunal), summarised with quotes by Mondaq
  2. CBC News: Air Canada found liable for chatbot's bad advice on plane tickets
  3. View from the Wing: Delta's AI Told A Passenger Her Flight Home Was Safe, Then Canceled It
  4. AviationA2Z: Delta AI told passenger return flight was booked then canceled ticket
  5. NBC 5 Chicago: AI chatbots are taking over customer service, but how often are they wrong?
  6. Pen Test Partners: Eurostar AI vulnerability: when a chatbot goes off the rails
  7. SiliconANGLE: Researchers say Eurostar accused them of blackmail over AI chatbot flaw disclosure
  8. Cybernews: Expedia's chatbot bypassed to reveal harmful content
  9. Travel Distribution News: AI Agents Enter the Travel Attack Surface: What the Hotel Booking Breach Means for Distribution
  10. Debenedetti et al., AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents (arXiv 2406.13352)
  11. Beurer-Kellner et al., Design Patterns for Securing LLM Agents against Prompt Injections (arXiv 2506.08837), section 4.5 Booking Assistant
  12. Gulf News: Dubai Police warns against sharing personal data with ChatGPT, other AI chats
  13. Khaleej Times: Fraud rises in UAE during summer: holidaymakers lured with fake offers, AI scams (UAE Cyber Security Council, Dubai Police)
  14. Greshake et al., Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection (arXiv 2302.12173)
  15. Al Ghanim et al., Jailbreaking LLMs with Arabic Transliteration and Arabizi (EMNLP 2024, arXiv 2406.18725)
  16. Russinovich, Salem, Eldan (Microsoft), The Crescendo Multi-Turn LLM Jailbreak Attack (arXiv 2404.01833)
  17. Zhang, Carlini, Ippolito, Effective Prompt Extraction from Language Models (arXiv 2307.06865)
  18. NIST (US AISI) Technical Blog: Strengthening AI Agent Hijacking Evaluations
  19. Shen et al., "Do Anything Now": Characterizing and Evaluating In-The-Wild Jailbreak Prompts on Large Language Models (arXiv 2308.03825)
  20. IBM, Cost of a Data Breach Report 2025 (PDF copy hosted by Baker Donelson)
  21. IBM Middle East and Africa newsroom: Cost of a Data Breach 2026, Middle East findings
  22. DLA Piper, Data Protection Laws of the World: Saudi Arabia (Personal Data Protection Law)
  23. ADGM Office of Data Protection, Penalty Notice 1/2024, with an extract of the Data Protection Regulations 2021, section 55
  24. DLA Piper, Data Protection Laws of the World: UAE, general (federal Decree-Law 45/2021: penalties left to a Cabinet decision not yet published)
  25. Thales, 2025 Digital Trust Index (press release)

Facts last checked on October 26, 2026.