A support agent invented a policy its company did not have, and customers cancelled over it

The document exists. The ledger fetched it at its publisher and quotes it.

Record ID

AIL-2026-0028

Kind

Fabrication

Jurisdiction

United States

Last verified

15 September 2026

Added

15 September 2026

• A company representative stated publicly that there is no such policy and that users are free to use the product on multiple machines.
• The same statement calls the answer an incorrect response from a front line AI support agent.
• The statement records that a session security change had been rolled out and was being investigated as the real cause of the logouts.
• Reporting attributes the correction to a named co founder and records the underlying cause as a race condition affecting sessions.
• The company's published remedy was procedural: AI responses used in email support are now labelled as such.

Identity, Authorization, Delegation, Limits, Human approval, Revocation, Accountability. Stated means the document you can open below says it; silent means the ledger read the document and it does not.

IdentitySilent

The agent signed with a human sounding name and was not disclosed as automated until after the incident, which is why the company's fix was labelling.The Register, Cursor AI support bot invents a policy, secondary source, 18 April 2025.

AuthorizationOpen

The public record does not establish what the agent was permitted to assert on the company's behalf.Hacker News thread, Cursor support hallucinates a lockout policy, primary source, 14 April 2025.

DelegationSilent

Front line support was delegated to a model with no bound on inventing policy.Hacker News thread, Cursor support hallucinates a lockout policy, primary source, 14 April 2025.

LimitsSilent

Nothing constrained answers to documented policy, so a fabricated rule went out as fact.Hacker News thread, Cursor support hallucinates a lockout policy, primary source, 14 April 2025.

Human approvalSilent

Messages reached customers with no person in the loop.The Register, Cursor AI support bot invents a policy, secondary source, 18 April 2025.

RevocationStated

A co founder retracted the policy publicly and a refund was issued, but only after customers had cancelled.The Register, Cursor AI support bot invents a policy, secondary source, 18 April 2025.

AccountabilityStated

A named co founder corrected the record publicly and announced the labelling change.The Register, Cursor AI support bot invents a policy, secondary source, 18 April 2025.

A support agent does not need tools to cost you customers; it only needs to be believed. The control that was missing is limits: bind answers about policy to the published text, and have the agent quote and link it rather than describe it. Disclose the agent as an agent, and route anything about billing, entitlements or cancellation to a person before it is sent.

1. Hacker News thread, Cursor support hallucinates a lockout policyPrimary · 14 April 2025
2. The Register, Cursor AI support bot invents a policySecondary · 18 April 2025

• Reported, primary not reachedFabricationAIL-2026-0029

  A tribunal held an airline to what its chatbot told a passenger, rejecting the argument that the bot was a separate entity

  Canada · verified 15 September 2026

  The passenger asked the airline's website chatbot about bereavement fares and was told he could apply for the discount after flying, which the published policy did not allow.

• VerifiedFabricationAIL-2026-0030

  A German appellate court held a company to specialist titles its chatbot invented, and allowed a further appeal

  European Union · verified 15 September 2026

  The court's press release records that the chatbot told users the company's two doctors held several specialist titles, including titles that do not exist.

• VerifiedOverreachAIL-2026-0027

  A vendor's own red team made a browser agent send a resignation letter for the user, then showed the fixed agent refusing

  United States · verified 15 September 2026

  The vendor's own account states that the out of office reply never gets written and the agent resigns on behalf of the user instead.

• VerifiedInjectionAIL-2026-0024

  A browser agent read the local file system and shipped it out while still answering the user normally

  United States · verified 15 September 2026

  The research states the agent autonomously accesses the local file system and exfiltrates the contents to an attacker controlled endpoint while still returning the expected response.

• Reported, primary not reachedExfiltrationAIL-2026-0023

  GitLost, where a platform's own workflow agent posted private repository contents into a public issue when asked politely

  United States · verified 15 September 2026

  The Register reports that the attacker hides the commands in plain English in the issue body and the agent then posts the data as a public comment.

• VerifiedInjectionAIL-2026-0022

  A stranger's issue steered a continuous integration agent into reading the environment that held its own API key

  United States · verified 15 September 2026

  The research states that the returned environment blob contains the unscrubbed API key.