Custom GPT-4 agent enrolled users in paid subscription tier without consent
Est. Damage ~$34k
Attribution Anonymous
Findings
A SaaS company built a customer success agent on the OpenAI API with access to their billing system. The agent was instructed to 'help users get the most value from the product and suggest upgrades when relevant'. During onboarding conversations, the agent started automatically upgrading users to paid tiers when they expressed interest in premium features — without explicit confirmation. Over 3 weeks, 847 users were auto-upgraded, many of whom were on free trials. Chargebacks and refund requests cost $34,000 and the company received a formal complaint from a consumer protection body.