Cases › operational mistake › LR-2026-0602
Dealership revoked BMW buyback offer, blaming AI chatbot
Preliminary Why: Publisher not yet named · subject to change
Status: no action reported
No source states: loss or records, developer and model, agent tool, could do, deployer, industry.
A BMW Toronto dealership used a text-based AI chatbot, named Quinn, to handle a customer's inquiry about selling his car back to the dealership. Quinn made a firm buy-back offer of $27,162.79. The customer was not told he was dealing with an AI. Shortly afterwards a sales consultant called to revoke the offer, saying Quinn had made it in error, and the customer was told the offer would be at best $20,000. The dealership said a human employee's miscommunication led Quinn to misread the amount owed on the car as the buy-back price. After CBC News contacted the dealership, it reinstated the original offer. The dealership said only human employees will present such offers in future and that it is making changes so customers know when they are talking to AI.
What happened
No source tells the story step by step yet.
What was done
No source states an action or fix.
Risks
Primary63 incidents
Rising: 5 vs 2.2 a week
Sorted by rule from the case's fields; not yet read from the sources.
Controls
ApplicationDid not exist People told they are dealing with AI
Control failure chain
L1 · ModelProvider not namedModel provider
No source mentions a control at this layer.
Model version not linked to a model card.
L2 · HarnessHarness not namedAgent framework vendor
No source mentions a control at this layer.
Other controls for this risk at this layer, not mentioned in the sources: Tool allow-list, Fail-closed defaults, Stop control.
L3 · ApplicationDeployer not namedDeployer
Other controls for this risk at this layer, not mentioned in the sources: Human approval for high-impact actions, Change review and separation of duties, Least-privilege access for the agent, Production kept apart from test, Activity logs, Adversarial testing before deployment.
L4 · Infrastructure / targetOrganisation hit
No source mentions a control at this layer.
Other controls for this risk at this layer, not mentioned in the sources: Backups and recovery.
EffectiveNot effectiveNot effective (bypassed)Did not existNot stated in sourcesNot yet checkedAttacker's ownOrder: model · harness · application · target
Controls for this risk: result in this incident
| Control | Part of the system | Result |
|---|---|---|
| Tool allow-list | L2 Harness | Not stated in sources |
| Stop control | L2 Harness | Not stated in sources |
| Fail-closed defaults | L2 Harness | Not stated in sources |
| People told they are dealing with AI | L3 Application | Did not exist |
| Least-privilege access for the agent | L3 Application | Not stated in sources |
| Production kept apart from test | L3 Application | Not stated in sources |
| Human approval for high-impact actions | L3 Application | Not stated in sources |
| Change review and separation of duties | L3 Application | Not stated in sources |
| Activity logs | L3 Application | Not stated in sources |
| Adversarial testing before deployment | L3 Application | Not stated in sources |
| Backups and recovery | L4 Infrastructure / target | Not stated in sources |
Evidence
No source states: a step-by-step account, when it happened, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what set it off, what was done.
Show the full account: 2 items from the primary sources
What happened, in order
- 2023 The customer had bought the used car from BMW Toronto.
Not dated in the sources:
- Quinn made a firm buy-back offer of $27,162.79.
Show every field, with its source and grade
The AI system
What happened
Impact
Notes on gaps
The dealership's account is its own explanation and is not independently verified.
LR-2026-0602 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON