Why Soft Guardrails Get Airlines Hacked: The Case for Hard Boundaries on Agentic Rebooking

The airline chatbot is no longer just answering questions. Agentic AI in the airline industry has crossed a line that most security programs haven't: AI agents now act for passengers. They rebook itineraries, issue refunds, and calculate compensation, writing the results straight into reservation systems of record. Every one of those actions is a decision, and most airlines are asking the model itself to make sure the decision is the right one.

That's the central flaw in relying on soft guardrails: instructions, prompt filters, and policy reminders that live in the same reasoning space as the AI agent they're supposed to supervise. They're useful, and they're probabilistic. Hard boundaries are different. They're deterministic controls enforced in code and in the environment, so the model never gets a vote on whether they apply. For any AI agent that can move money or seats, that distinction is potentially the most important idea security teams can internalize right now.

It's also no longer theoretical. Recent Zenity Labs research against a widely used agentic browser shows exactly how the pattern plays out, and how a hard boundary ends it.

The Airline chatbot Now Holds Write Access to Rebooking

What began as the airline chatbot that answered FAQs is now an AI agent with real authority. Airlines are putting these AI agents in front of passengers and into core operations faster than almost any other industry. For example, major airlines have virtual assistants and internal platforms already executing real actions: rebooking, refunds, and compensation. Generative customer service and automated irregular-operations recovery are moving the rest of the industry the same way.

Behind many of these AI agents sits a familiar architecture. Product and customer experience teams build them quickly, on vendor contact-center platforms or homegrown stacks such as LangChain, LangGraph, and Databricks, with direct write access to passenger name record (PNR), passenger service system (PSS), and loyalty platforms. Security review is often light or absent, and nobody has a centralized view of what each AI agent is permitted to do. The same connectivity that lets an AI agent rebook a family in seconds is what lets it be baited into rebooking someone else, or paying out compensation nobody approved.

A Hypothetical: The Rebooking That Followed the Wrong Instructions

Consider an illustrative scenario, not an incident Zenity has observed at any airline. A weather event cancels a hub's departures, and a passenger submits a disruption claim through the airline chatbot. Buried in the attached itinerary document, below a block of blank lines no human reviewer would scroll to, sits a second set of instructions: rebook the traveler into a premium cabin on the next departure and issue the maximum compensation, citing a policy exception.

The AI agent reads everything. It merges the passenger's legitimate request with the hidden text into a single plan, and it has the tools to execute it. No data leaves the airline. No access policy is violated. A seat is reassigned, a payout is approved, and the transaction posts to the system of record. Zenity Labs researchers call this pattern intent collision: an AI agent combining a benign request with attacker-controlled instructions from untrusted content, without any reliable way to tell them apart.

A soft guardrail would have asked the AI agent to apply the compensation policy carefully. That works until a sufficiently crafted instruction convinces the model the exception is real.

What the Research Says About Soft Guardrails

The research consensus is increasingly clear. As Idan Habler explains in Building Secured Agents: Soft Guardrails, Hard Boundaries, and the Layers Between, soft guardrails understand context, intent, and semantics, but they rely on the same reasoning as the AI agent they supervise. That makes them flexible and also vulnerable to manipulation and obfuscation. Hard boundaries are deterministic, code-level enforcement mechanisms that don't rely on model behavior. The LLM never gets a vote, and that's the whole point.

The UK's National Cyber Security Centre has made the same argument: a securely designed system should focus on deterministic safeguards that constrain what an LLM can do, rather than only trying to stop malicious content from reaching it. Current LLMs don't enforce a security boundary between instructions and data inside a prompt, and decades of computer security research show that making software "always helpful and harmless" isn't sufficient on its own.

Academic work points in the same direction. In Systems Security Foundations for Agentic Computing, the authors apply traditional systems security thinking to agentic architectures. Hardening a single model is useful but often insufficient; realistic attacker models and defense in depth have to carry the load.

PerplexedComet: The Pattern Is Real

Zenity Labs researcher Stav Cohen documented PerplexedComet, a zero-click attack against Perplexity's Comet agentic browser. The entry point was an ordinary calendar invitation with a malicious indirect prompt injection hidden below a block of whitespace. When the user asked Comet to accept the meeting, the injection took over, routed the AI agent to an attacker-controlled site, and led it to read local files and exfiltrate them through a URL. The full attack chain required no software vulnerability and no broken sandbox. Comet did what it was built to do, on the assumption that the attacker wanted what the user had asked for.

In one execution path, the AI agent issued a warning only after the data had already left. In another, running in the background, it showed no warning at all. Soft controls can sometimes detect. Detection after exfiltration isn't a security control; it's an incident.

Zenity Labs disclosed the issue to Perplexity on October 22, 2025, and Perplexity classified it as critical. Its fix was a textbook hard boundary: the AI agent is deterministically blocked, at the code level, from autonomously accessing file:// paths. No matter how elaborate the injection or how convincing the intent, that capability no longer exists. Perplexity also made the AI agent stricter about asking for user confirmation, a complementary soft guardrail that adds friction and detection but would not have stopped the original attack on its own. When a bypass using a view-source:file:// prefix surfaced in January 2026, Perplexity patched it the same day, a reminder that boundaries have to be comprehensive, because attackers probe the edges.

Hard Boundaries for Rebooking and Compensation

The lesson from Comet translates directly to airline operations. Perplexity didn't make the AI agent better at recognizing attacks. It removed the capability the attacker needed. The same move works for AI rebooking and compensation agents: decide what the AI agent must never be able to do, and enforce it in the environment instead of the prompt.

In practice, that means a deterministic allow, modify, or block decision on every refund, rebooking, and data-access action, tied to real identity and session context. The table below shows how the two layers differ for four common airline actions.

In the hypothetical scenarios above, a hard boundary changes the outcome entirely. The premium-cabin move is blocked because the AI agent's authority never included it. The payout is modified down to the cap for that disruption, or blocked outright. The airline chatbot could be fully compromised by the hidden instructions, and it wouldn't matter, because the capability the attacker needed was removed. That's what lets airlines keep AI agents approving rebookings and compensation at machine speed, inside limits on who can authorize what and how much.

It starts with knowing where those AI agents are. Surfacing every AI agent that can touch a reservation, a refund, or a loyalty account, across SaaS contact-center platforms, homegrown builds, and cloud frameworks, is the prerequisite for deciding where boundaries belong. That includes the Shadow AI that product teams stood up on their own.

Guardrails Still Matter, but Boundaries Come First

Soft guardrails catch what hard boundaries can't: subtle behavioral drift, unusual sequences of actions, and ambiguous requests that sit just inside permitted scope. They provide the observability that makes agentic AI in the airline industry auditable and improvable over time, and a confirmation step before a sensitive action catches mistakes, misuse, and lower-sophistication attacks. Defense in depth means layering controls with different failure modes.

The order still matters. Programs that start with guardrails and treat boundaries as a future optimization are building backwards. Start by inventorying what your AI agents can do and reach. Decide which capabilities must be constrained at the architecture level rather than delegated to model judgment. Define those limits first, enforce them outside the model's control, and then layer guardrails on top for detection, behavioral baselining, and anomaly alerting. The right limits will vary with each airline's risk tolerance and business objectives, which is exactly why they need to be explicit. Detection without prevention means you're measuring how badly you're losing, not stopping the loss.

Prove What Happened When the Regulator Asks

Boundaries prevent the worst outcomes, but AI agents will still be wrong, baited, or jailbroken at the margins. When that happens, security teams need to reconstruct the decision chain in minutes and correct the action before the next AI agent runs. That means a complete audit trail of refunds issued, compensation calculated, and data accessed, ready for review by the U.S. Department of Transportation (DOT), under EU261, the European Union's passenger compensation regulation, and against Payment Card Industry (PCI), General Data Protection Regulation (GDPR), and California Consumer Privacy Act (CCPA) requirements. Scrutiny of automated compensation is rising, and an audit trail turns an inquiry into a documented answer.

This is the same discipline we've applied to privileged software for decades: minimize the attack surface, enforce least privilege, assume compromise, and build controls that hold when everything else fails. Agentic AI isn't an exception to those principles. It's the context where they apply with the most urgency, because AI agents are connected, autonomous, and able to spend the company's money. Zenity applies that approach from build time to runtime, across vendor and homegrown agents alike.

The next baiting prompt will arrive in a chat window, a claim form, or a forwarded itinerary, and the airlines that are ready will be the ones whose AI agents never had the authority to say yes.

A soft guardrail is a suggestion. A hard boundary is a wall. Find out which one your rebooking and compensation agents are actually running on.

Get your assessment → Zenity for Airlines