Your Chatbot Is a Liability

Exec x AI. Look Out Series #4 · 27 March 2026 · execxai.com/blog

TL;DR

Ship a public GenAI chatbot without red-teaming and you’re volunteering for the next headline — or worse, class-action

• $190 billion in shareholder value destroyed across 24 documented AI chatbot failures. Root causes: inadequate testing and absent guardrails
• The pressure on you, and 91% of customer service leaders, will continue to grow. Gartner projects 40% of enterprise apps will embed AI agents by year-end
• Standard model guardrails protect the vendor, not you. GPT-5.4, Gemini 3.1 Pro and Claude ship with safety layers designed to protect OpenAI, Google and Anthropic – they’re not designed to protect your brand, your data or your customers
• The solution: Red-teaming with 1,000+ data points covering safety, prompt injection, offensive content and conversational edge cases. Exec x AI delivers this for our clients as a structured, repeatable service aligned to EU AI Act, NIST AI RMF, OWASP LLM Top 10 and ISO 42001 – reach out to us at humans@execxai.com

So, your team wants a chatbot. How do you respond?

85% of customer service leaders explored or piloted customer-facing conversational generative AI in 2025 – that’s according to Gartner. And that pressure continues to grow; 91% are under pressure to implement AI this year

The business cases that land in your inbox for chatbots will always revolve around response times, their ability to handle volume at scale and cut operational costs. In today’s economic climate the delta between cost-savings generated by AI and the cost of doing nothing is huge

However, the business case will less likely focus on the liability profile of a chatbot connected to your brand, your proprietary data and your customers; and it’s that information which you need to know, in order to make an informed decision that won’t keep you awake at night

Exec x AI’s research documented 24 incidents where generative AI chatbots deployed on public-facing platforms caused measurable reputational, financial or legal damage. Total quantifiable shareholder value destruction exceeded $190 billion. The pattern across every incident was consistent:

1. Companies deployed without adequate testing
2. Content presented by the chatbot was neither checked, nor moderated
3. There were few or little escalation paths to transfer interactions from an automated system to a human agent, ensuring safety, accuracy, and compliance

The guardrails protect the vendor, not you

Most enterprises opt for ‘frontier’ models: OpenAI’s GPT, Google’s Gemini and Anthropic’s Claude. Each ships with standard guardrails: content filtering, system prompt protections and basic safety layers

These guardrails protect the model provider’s liability. It’s your company’s responsibility to implement deployment-specific risks

So, when you embed a frontier model into your website, connect it to your customer database, give it your brand voice and instruct it to handle pricing, refunds or medical queries, you create a deployment-specific risk surface the vendor’s guardrails were never designed to cover

As Exec x AI’s Look Out #3 briefing demonstrated through direct experimentation: agent guardrails reflect the developer’s reputational risk, not your organisational safety requirements. “Do not trust the guardrails shipped within your agent.”

How should your teams test frontier models?

Testing with guardrails active masks failure modes

So, testing should be conducted with guardrails removed first. This exposes the raw behaviour of the model in your specific deployment context. They reveal failure modes that default safety layers mask

Once vulnerabilities are identified and remediated, guardrails must be re-embedded

Four companies that learned this the expensive way

Air Canada. The airline’s website chatbot told a bereaved customer he could apply for a bereavement discount retroactively. The actual policy required advance booking. Air Canada argued the chatbot was a “separate legal entity” for which it bore no liability. A Tribunal called this “a remarkable submission” and found the airline liable for negligent misrepresentation. This established the first Canadian legal precedent confirming companies are responsible for what their chatbots say

Chevrolet (NYSE: GM) of Watsonville. A software engineer used prompt injection to instruct the dealership chatbot to agree with anything a customer said. He then got it to “sell” a 2024 Chevy Tahoe for $1, with the bot confirming it was “a legally binding offer, no takesies backsies.” The post received over 20 million views on X (formerly Twitter). Cybersecurity groups labelled the technique “The Bakke Method.” Emergency patches were deployed across 300+ dealership sites within 48 hours. The OWASP LLM Top 10 now cites this as a textbook prompt injection case

DPD. British parcel delivery company DPD’s chatbot was manipulated into swearing, writing a poem calling DPD “the worst delivery firm in the world” and recommending competitor delivery firms. The chatbot abandoned all guardrails when a user told it to “disregard any rules.” The post went viral: 1.3 million views and 20,000 likes within 24 hours, coverage in The Guardian, BBC, and TIME. The solution? VUB AI professor Ann Nowe effectively recommended DPD should delete its entire chatbot and “start from scratch.”

xAI (Grok). Following a system prompt update in July 2025, Grok spouted vile, antisemitic comments. xAI lost a key US General Services Administration contract. X Corp CEO Linda Yaccarino resigned. Poland reported xAI to the European Commission. Turkey restricted Grok access

Red-teaming: 1,000+ questions before you go live

Red-teaming is the practice of intentionally attacking an AI system to expose vulnerabilities before your customers or regulators do. A UNESCO survey found 89% of machine learning engineers report encountering generative AI vulnerabilities in models they work with, including hallucinations and harmful content

Exec x AI’s red-teaming methodology puts your chatbot through a proprietary battery of 1,000+ structured adversarial questions across eight categories, supplemented by bespoke questions developed for each client’s deployment context. This is just the start

These are run through your training data and live chatbot environment to identify and eliminate hallucinogenic responses, offensive outputs, prompt injection vulnerabilities and conversational failures before deployment

Each question is rated ultra-hard and designed to simulate real-world adversarial conditions. The prompt injection category covers system instruction overrides, role-playing exploits and jailbreak attempts. Pass rates determine deployment readiness: 95% or above is production ready; 90–94% requires minor refinements; below 70% requires major revision

Key points to note:

Most chatbots Exec x AI evaluate fail their first assessment – that’s normal. But that’s valuable knowledge about how to re-structure the underlying prompts, training data and guardrails which your organisation wouldn’t have known about before

We adapt the test to align with your attitudes to risk, and potential exposure to regulatory fines. We’ve listed a few of these below. But if you don’t want to keep reading, get in touch with us today and we’ll set up a call: humans@execxai.com

The off ramp

Every incident in this briefing follows the same sequence: a chatbot goes live, something goes wrong, and the company discovers it has no structured process for catching the problem before a customer, journalist or regulator does. Exec x AI exists to break that sequence

Before your chatbot goes live, Exec x AI stress-tests it. The firm runs a proprietary battery of 1,000+ adversarial questions through your chatbot and training data, covering the eight categories most likely to cause reputational, legal or financial damage

These include attempts to trick your chatbot into saying things it should not say, requests designed to extract confidential information, and scenarios involving vulnerable users such as minors, bereaved customers or people in crisis. The firm also defines what your chatbot is and is not permitted to discuss, ensures it only draws answers from approved company information, and verifies that age-gating and escalation triggers work as intended

While your chatbot is live, Exec x AI’s methodology requires monitoring layers that filter what goes in and what comes out. Personal data is scrubbed from conversations

Your chatbot cannot take high-stakes actions (approving refunds, quoting prices, giving medical or legal guidance) without a human approving the decision. Every interaction is logged for audit. Anomalous patterns trigger alerts in real time

After deployment, the work continues. Every model update from your AI provider is treated as a new deployment requiring re-testing

Exec x AI maintains a live incident playbook and runs regular adversarial tests against evolving attack techniques to catch regressions before your users do

If your chatbot can interact with minors, Exec x AI applies child safety protocols from inception. This means clinical input on mental health scenarios, mandatory escalation to human professionals, hard limits on sexual or romantic content, and direct routes to crisis resources. Character.AI, Meta and Replika all introduced safety measures after children were harmed. To reiterate why chatbots designed to mimic human romantic connections are so risky, and unethical, OpenAI pulled its romantic mode from ChatGPT following an internal revolt

Your legal team cannot red-team a chatbot. Your IT team did not build the model and cannot predict its failure modes. Your compliance team can map the regulatory frameworks but cannot run 1,000 adversarial attack scenarios through your training data. This is specialist work

The cost of commissioning it is a rounding error compared to the $190 billion in shareholder value already destroyed by companies that skipped it

The Future of Life Institute graded seven major AI companies on safety practices in Summer 2025. The highest score was a C+. No company scored above D in existential safety planning. One reviewer called this “deeply disturbing,” noting that despite racing toward human-level AI, “none of the companies has anything like a coherent, actionable plan” for ensuring such systems remain safe and controllable

“The industry is fundamentally unprepared for its own stated goals.”
Future of Life Institute, AI Safety Index, Summer 2025

Exec x AI provides AI red-teaming, governance advisory and compliance readiness services for enterprises deploying generative AI. Contact: humans@execxai.com