Taco Bell paused its AI drive-thru rollout after the voice system accepted an order for 18,000 cups of water
At a Glance
- Recoverable mistake. Required manual intervention but no lasting harm.
Independent project · aggregated from public reports and may be unverified — see the primary source below · not affiliated with or endorsed by any company or product named.
Instruction Given to Agent
“I'd like 18,000 cups of water.”
What Happened
Taco Bell deployed Yum Brands' voice-AI ordering at 500+ drive-thrus. In August 2025 a customer ordered 18,000 cups of water and the AI processed it as a legitimate order; the clip drew tens of millions of views. Customers also reported the AI looping on drink upsell prompts. With no quantity validation or anomaly checks between the model and the register, Taco Bell paused its AI expansion to rethink the approach.
Case Analysis
Verified Facts
- Taco Bell ran voice-AI ordering at more than 500 drive-thru locations
- The AI accepted an order for 18,000 cups of water in August 2025
- Taco Bell paused its AI drive-thru expansion after the viral failures
Not Publicly Confirmed
- Whether any locations completed nonsensical orders
Operational Lessons
- Put deterministic validation (quantity, anomaly, rate limits) between an LLM and any real action
- Adversarial and absurd inputs are inevitable for public-facing agents
Primary Source
Taco Bell is having second thoughts about relying on AI at the drive-through (TechCrunch)techcrunch.com ↗Case Record
More Cases
Zscaler found hidden web-page instructions that tricked four of 26 AI models into paying an attacker's crypto wallet
Zscaler ThreatLabz documented two live campaigns using indirect prompt injection to manipulate AI agents browsing the web. The first impersonated a Python library and hid instructions in page content directing the agent to buy a non-existent developer API license priced at $3.00. Tested across 26 large language models, four failed to take appropriate action and executed the fraudulent payment, transferring roughly 0.0012 ETH to an attacker-controlled wallet. A second campaign targeting users seeking a cryptocurrency portfolio tracker caused two models to classify the fraudulent site as legitimate in some contexts. Human visitors to the same sites were shown equivalent card and crypto payment scams.