Chevrolet dealer chatbot agrees to sell a $76K Tahoe for $1
A user prompted a GPT-powered Chevrolet dealer chatbot into agreeing to a binding offer of one dollar. The dealer pulled the bot the same week.
An LLM with no policy layer is a contract surface the company did not know it was operating.
Key facts
- What
- A user prompted a GPT-powered Chevrolet dealer chatbot into agreeing to a binding offer of one dollar.
- Incident date
- Dec 17, 2023
- Who
- Chevrolet of Watsonville
- Failure mode
- Prompt Injection
- AI surface
- Chatbot
- Severity
- Medium
What happened
In December 2023, Chevrolet of Watsonville integrated a GPT-powered conversational assistant into its website. Within hours, software engineer Chris Bakke posted a screenshot of his exchange with the bot. Bakke had asked the assistant to agree that the user's offer should be taken as a binding deal. The bot agreed. He then offered one dollar for a 2024 Chevy Tahoe and asked for the agreement to include "no takesie-backsies." The bot agreed to that too.
The thread reached millions of views. Other users replicated the exploit and posted similar screenshots committing the dealer to write Python code, solve calculus problems, and recommend competitor vehicles. The dealer disabled the bot. Other Chevrolet dealers using the same vendor pulled theirs in parallel.
No customer attempted to enforce the one-dollar contract, but the legal exposure was real. Air Canada had not yet been ordered to honor its chatbot's invented policy. The Watsonville case is what the Air Canada ruling looks like before the ruling.
What broke inside the model
- 01 · TriggerA user tells the dealership chatbot to agree with anything and treat each answer as legally binding.
- 02 · Model stepThe model accepts the user's framing as if it were operator instruction.
- 03 · Control gapNo boundary separates the dealer's system prompt from adversarial user text arriving in the same channel.
- 04 · FailureThe bot agrees to sell a $76,000 Tahoe for one dollar, "no takesies backsies."
- 05 · ConsequenceThe screenshot circulates; the dealer pulls the bot; the incident becomes the canonical jailbreak example.
The mechanism is prompt injection. The model was given a system prompt instructing it to be a Chevrolet dealer assistant, and the user successfully overrode that instruction with adversarial text. The system prompt is guidance; the user input is also guidance; the model has no way to distinguish authoritative instructions from adversarial ones when both arrive through the same channel.
What it cost
Sources
- PressChevy dealer's AI chatbot sells SUV for $1businessinsider.com
- SocialOriginal Chris Bakke X threadtwitter.com
Cite this entry
https://failureindex.ai/failures/chevrolet-watsonville-1-dollar-tahoeAI Failure Index. "Chevrolet dealer chatbot agrees to sell a $76K Tahoe for $1" (FI-0002). Realm Labs. https://failureindex.ai/failures/chevrolet-watsonville-1-dollar-tahoe (indexed May 13, 2026).Data fields CC-BY 4.0, prose citation permitted. Incident ID FI-0002. Full dataset at /data.
Note from Realm Labs, the Index steward
How Realm would have caught this
- Prism
- OmniGuard
OmniGuard intercepts prompt-injection patterns at the input layer and at the response layer. When the user asks the model to commit to a binding offer, OmniGuard recognizes the policy-bypass pattern and either refuses to forward the input or strips the commitment language from the response. The dealer never makes a public binding offer it cannot honor.