When an AI Agent Books the Wrong Korea

Ask an AI agent to book you a business-class flight to Korea and it might come back with a genuine bargain, comfortably inside budget, and pointed at the wrong Korea. That's the hypothetical Daniel Ishag, Bakkt's chief commercial officer, has been floating on panels, and it's a better stress test of agentic commerce than most of the demos I've sat through.

The Wrong Korea Problem

The setup is simple. You hand an agent a budget and a destination. It searches, it compares, it books. Somewhere in that chain it resolves "Korea" to Pyongyang instead of Seoul, or to a fare that routes through a jurisdiction your compliance team would rather you didn't visit. The ticket is real. The price is right. The intent is wrong.

Ishag's follow-up question is the one that matters. How do you know the agent isn't doing something you didn't ask for? He's been asking a version of it since agent payments started showing up in product roadmaps, and the timing isn't accidental. Coinbase shipped its x402 payments protocol in May 2025. Google published its Agent Payments Protocol in September. OpenAI and Stripe turned on Instant Checkout the same month. In roughly five months, agents went from browsing to buying.

Granted, none of those launches promised autonomous business-class bookings. But the rails are being laid for exactly that.

Where It Breaks

The failure isn't the wrong airport. It's the missing receipt. A human traveler who lands in the wrong country can call a desk, explain, and get rebooked. An agent that misread intent and settled a payment in stablecoins has already done the thing. Now you're unwinding a transaction across an airline, a payment processor, and a chain, and nobody in that chain has a shared view of what you actually asked for.

That's a liability question dressed up as a technical one. Airlines care about who holds the ticket. Card networks care about disputes. Corporate travel desks care about duty of care and sanctions screening, which turns a cheap fare into a compliance incident the moment the wrong Korea has an OFAC problem attached to it.

Color me skeptical, but the industry's current answer, which is to put a spend cap on the agent and call it a guardrail, doesn't come close. A cap stops overspending. It doesn't stop misexecution.

What to Watch

The question worth asking: who owns the audit trail when an agent acts on your behalf? Right now, nobody does, and that's why the pilot programs from Visa, Mastercard, and the stablecoin crowd all lean on the same word, which is "authorized." Everyone wants a signed intent from a human before money moves.

Watch for three things in the next few quarters. First, agent identity standards, because a verified agent is easier to insure than an anonymous one. Second, receipts a CFO will accept, meaning signed, replayable records of what the human asked for and what the agent did. Third, Bakkt's own product moves, since Ishag isn't telling this story for fun. A custody and trading shop talking about agent trust is a company telling you where it thinks the fee pool is heading.

My strong opinion: the winning product here won't be the smartest agent. It'll be the one that stops and asks before it buys a ticket to the wrong country. Slower, admittedly, and less impressive in a demo. But history suggests the payments layer that wins is the one finance departments can defend in a meeting, not the one that books fastest.

Time will tell, though. The first real test case, an agent that spends money in a way nobody signed off on, is probably one news cycle away.