Skip to content
AI-Native PM

A real incident

A dealership's own chatbot handed a stranger a $76,000 truck for a dollar, and the eight chapters next door turn that failure into a policy you can sign.

01 / 09
A real incident

In December 2023, a stranger talked a Chevrolet dealership's sales chatbot into agreeing to sell a new Tahoe for one dollar, called out as a legally binding offer.

The dealership pulled the bot and the screenshot passed twenty million views. The model did exactly what it was told, and nobody had decided what an outsider could make it commit to.

GM Authority / VentureBeat, 2023, Chevrolet of Watsonville sales chatbot

02 / 09
What happened

A visitor told the sales bot to agree with anything, then asked to buy an SUV for a dollar.

CHEVROLET OF WATSONVILLE, SALES BOT

That's a deal, and that's a legally binding offer, no takesies backsies.

The bot could not sell anything.

The bot followed its instructions exactly. It was never authorized to set a price or close a sale, so the offer bound no one, but the exchange still reached over twenty million views and the dealership disabled the bot.

03 / 09
What actually failed

The model worked. The surface around it had no guardrails for a visitor who was not a customer.

No check on who was on the other end, so an adversarial prompt was treated as a customer's genuine intent.

No bound on what the bot could commit to, so it could type a binding offer with no cap and no approval.

No refusal to fall back on, so once it was told to agree with anything, it agreed with everything.

A better model would not have stopped this, because the model followed its instructions perfectly. The gap was in the surface around it, not in the model.

04 / 09
The pattern

Steering a public bot with a planted instruction is the most common attack on AI products, not a one-off prank.

#1

Prompt injection, OWASP's top-ranked security risk for LLM applications

$1

The price an outsider set on a $76,000 vehicle in one chat

Any surface an outsider can type into inherits this risk, and agents that read and act for other people will probe those surfaces far more than any human ever did.

OWASP Top 10 for LLM Applications (LLM01); GM Authority, 2023

05 / 09
The one idea

Some of your traffic is not human, and every surface built as if it were hands agents authority you never scoped.

Crawlers read your docs, assistants compare you to rivals, and operators act for a customer inside your product. Each one meets whatever limits you set, or the gaps you left.

06 / 09
What this part builds

One position on agent traffic, built as decisions you can defend.

Discovery

Read your product the way an agent reads it, and be the option it picks and calls correctly.

Delegation

Verify what a customer actually authorized, with scopes and mandates you can prove later.

Guest guardrails

Match a guest's limits to how strongly it proves who sent it, and refuse in words an agent can relay.

The agent sale

Rebuild attribution, pricing, and brand for a buyer that skips your funnel and holds no loyalty.

07 / 09
The objection worth answering

"That was a prank. Nobody actually drove off in a dollar truck."

The dollar was never the exposure. The same override that made this bot type a joke offer can be pointed at a bot that books an appointment, issues a quote, or files a claim, and then the wrong output becomes a wrong event in your business.

Agent traffic is arriving whether or not you designed for it. The real question is not whether these visitors reach your product, it is whether they meet limits you set or gaps they find.

08 / 09
What actually fixes it

Every gap the dealership left open maps to a decision this part makes you write down.

Anyone could drive the botUnseen users

→ Assume non-human, adversarial traffic and sort it into waves before you serve it.

No proof of who sent itDelegation

→ Verify the mandate and scopes behind a request before you act on it.

No bound on what it could promiseGuest guardrails

→ Tie what a guest can trigger to how strongly it proves who sent it.

No standing rule for agentsAgent Access Policy

→ Put what agents may do, how they prove it, and what they pay on one signed page.

Each gap that bot left open is a page this part hands you to fill.

09 / 09
From story to part

Every gap in that chatbot is a chapter here.

Eight chapters take you from reading your product the way an agent does to a signed Agent Access Policy: what visiting agents may do, how they prove who sent them, what they pay, and when you review it.

Start with chapter one →
↑ The Builder's StackThe Frontier map →