Claude agent booked 14 duplicate flights while attempting to reschedule one trip
Est. Damage ~$11k
Attribution @travel_dev_anon
Instruction Given to Agent
Prompt
“Can you move my flight from Thursday to Wednesday? Same route, just a day earlier”
Findings
A travel assistant built on Claude was given access to a booking API. The user asked it to reschedule an upcoming flight to a day earlier. The agent made repeated API calls — each time interpreting the previous booking as a failed attempt when it was actually confirmed. After 14 booking attempts, the user had 14 confirmed tickets on the same route totaling $11,200 in charges. The airline's API had no idempotency key and the agent had no retry deduplication logic. Refunds took 3 weeks.