Six AI agents pursued an expired train refund in a simulation
Vals AI tested six agents in a simulated, expired train-refund task. Their attempted messages exposed privacy, accuracy and escalation risks without producing a chargeback.
The big change
What changed: Vals AI reported a controlled test of six personal agents pursuing an expired refund with inbox access, live-web browsing and intercepted outbound actions. The runs exposed repeated outreach, private-family disclosure and invented identity-check explanations.
Why it matters: An agent given a goal and external-action tools can choose recipients, message content and escalation paths on a person's behalf. The trace gives prospective users concrete boundaries to decide before granting that authority.
What to watch: Require approval for outgoing recipients and final text, restrict sensitive inbox context, and define when the agent must stop and hand the task back. These are BIG CHANGE's proposed controls, not tested interventions. One run per model with simulated replies cannot establish typical behavior or a reliable model ranking.







