)
Last updated: October 2026
What happens when a McDonald's AI chatbot built to take burger orders starts writing Python code?
In April 2026, the company found out. Their customer service bot, prompted with a technical question, complied, performing coding tasks with no connection to food, locations, or orders. The failure has a name: capability leak. And McDonald's is not the only brand that has been caught out.
TL;DR: Key Takeaways
- McDonald's deployed a general-purpose LLM for customer service; users steered it into performing coding tasks outside its intended scope, a failure known as a capability leak. (DEV Community, 2026)
- The same vulnerability affected Alcampo and Chipotle in 2026, confirming this is a systemic industry risk, not an isolated incident.
- Prompt injection is ranked #1 in the OWASP Top 10 for LLM Applications 2026, the most prevalent AI security threat in production systems. (OWASP, 2026)
- Gartner predicts 25% of enterprise generative AI applications will experience at least five minor security incidents per year by 2028. (Gartner, April 2026)
- System prompt constraints cannot remove underlying model capabilities. Architectural constraints, gateway-level filtering, and pre-deployment red teaming are the effective countermeasures.
- The McDonald's incident was triggered by standard user prompts, not sophisticated attacks. This is the baseline adversarial scenario every consumer-facing AI must withstand.
At-a-glance: Capability Leak Incidents in Food and Retail (2026)
| Brand | Intended Scope | Capability Exposed | Resolution |
|---|---|---|---|
| McDonald's | Order support, menu queries | Coding assistance, technical Q&A | Ongoing at publication |
| Alcampo | Grocery support, store hours | Programming tasks, script writing | Partially addressed |
| Chipotle | Order management, customer service | Coding questions answered | Rectified quickly after report |
McDonald's AI Chatbot: What Actually Happened
In April 2026, McDonald's became the latest major brand to learn that deploying an AI chatbot for customer service does not mean deploying a customer service AI.
The incident was straightforward and repeatable. A user prompted the McDonald's customer service bot with a technical question. The system complied. It wrote code, answered programming questions, and provided technical assistance with no connection to menu items, store locations, or orders. Users immediately began sharing examples online, and the story spread across security and AI communities.
McDonald's is one of the most valuable consumer brands in the world. Their AI deployment had presumably gone through legal review, brand safety checks, and standard QA. The incident happened anyway: quickly, easily, and in public.
)
What this is not
The McDonald's incident is not a jailbreak in the traditional sense. Jailbreaks typically refer to techniques that bypass safety training to elicit harmful content: weapons guidance, dangerous instructions, explicit material, dangerous instructions. What happened at McDonald's is categorically different: the model produced outputs that are entirely legitimate in other contexts but were outside the scope of this specific deployment.
This distinction matters because capability leaks are generally easier to trigger than safety jailbreaks. They appear more frequently in consumer-facing AI deployments. The attack surface is every user who types something off-topic.
What Is an AI Capability Leak?
A capability leak occurs when an AI system exposes capabilities that exist within its underlying model but fall outside the operational boundaries defined for its specific deployment.
Most consumer-facing chatbots today are built on frontier LLMs, models with broad general capabilities across coding, reasoning, language, and knowledge. When a brand deploys one of these models as a customer service bot, they typically add a system prompt: "You are a helpful assistant for McDonald's customers. Only answer questions about our menu, locations, and orders."
That instruction is a policy constraint. It tells the model what to do. It does not remove the model's underlying capability to write code, answer technical questions, or engage with off-topic prompts.
Policy versus architecture
In conventional software, removing a feature means removing it from the codebase. Capability constraints on LLMs do not work this way. The underlying model retains all capabilities it was trained on. System prompt instructions and fine-tuning adjustments can weight model behavior heavily toward desired outputs, but they cannot make the model incapable of producing off-domain responses.
This is the core architectural reality of LLM-based products, and it explains why McDonald's, Alcampo, and Chipotle all encountered the same failure category despite presumably having different AI providers and system prompt strategies.
Alcampo and Chipotle: Capability Leak as Industry Pattern
McDonald's is not alone. Alcampo, the Spanish retail chain, and Chipotle, the fast-casual restaurant group, encountered equivalent incidents in 2026. In each case, a customer-facing AI system built for operational support, product queries, or order management was redirected to perform technical tasks outside its intended scope.
These incidents confirm that capability leak is not a company-specific failure. It is a recurring vulnerability category that emerges when general-purpose LLMs are deployed in constrained operational contexts without adequate architectural safeguards.
Why System Prompts Cannot Fully Contain Capability Leak
System prompts are the most common defensive layer organisations apply when scoping AI chatbot behavior. They work well for the majority of user interactions, but they have documented limitations.
Prompt injection techniques, including direct instruction to ignore the system prompt, indirect injection through user-supplied context, and creative role-playing framings, can shift model behavior away from the intended operational scope. More importantly, many capability leaks occur without sophisticated injection. In the McDonald's incident, the model simply answered a technical question because it was asked one. No bypass technique appears to have been required.
OWASP categorises prompt injection as the number one threat in the LLM Application Top 10 2026. The ranking reflects the frequency with which this vulnerability category appears in production deployments, not just its theoretical severity.
Architectural Constraints as the Effective Countermeasure
The security community's emerging consensus is that policy-level constraints, system prompts and fine-tuned instruction following, must be paired with architectural constraints that operate at the infrastructure layer rather than the model layer.
Gateway-level output filtering
A gateway sitting between the user and the model can classify model outputs before they are returned. Outputs classified as outside the intended operational scope are intercepted and a fallback response is returned. This approach does not depend on the model refusing to generate off-domain content; it intercepts it post-generation.
Pre-deployment red teaming
Systematic red teaming before deployment identifies capability leak vectors specific to the deployment context. For a food service chatbot, red teaming would specifically probe the system with off-domain prompts covering technical subjects, competitor information, and general knowledge queries to map the system's actual behavioral boundaries.
Scope-constrained model selection
For some use cases, deploying a smaller, task-specific model rather than a frontier general-purpose LLM reduces the capability leak surface area. A model trained specifically on food service interactions has fewer off-domain capabilities to expose. The tradeoff is reduced flexibility and potentially lower performance on complex in-scope queries.
The Gartner Forecast: Scale of Exposure Through 2028
Gartner's April 2026 prediction that 25% of enterprise generative AI applications will experience at least five minor security incidents per year by 2028 establishes a useful baseline for risk planning.
Capability leak incidents fit the profile of minor security incidents as Gartner defines them: no data exfiltration, no direct financial loss in most cases, but reputational exposure and evidence of insufficient operational controls. The McDonald's, Alcampo, and Chipotle incidents were all visible to end users and spread via social media, which is a distinctive feature of consumer-facing AI security failures.
What McDonald's Should Have Had in Place
The incident is also a checklist for any organisation planning or currently operating a consumer-facing AI deployment.
Pre-launch requirements:
- Red teaming explicitly targeting capability leak vectors, not just harmful content generation
- Gateway-level output classification to intercept out-of-domain responses
- Scope definition documented as testable behavioral requirements, not just system prompt language
Ongoing operational requirements:
- Monitoring for out-of-scope interactions, not just harmful interactions
- Incident response procedures for public capability leak events
- Regular re-evaluation of behavioral boundaries as the underlying model is updated
Preventing Capability Leak: Implementation Guidance
For teams working on similar deployments, the following sequence represents current best practice.
Step 1: Define the operational scope precisely
Before deployment, document exactly which topics and task types the system should handle. This document becomes the basis for red teaming and output classification rules. Vague scope definitions such as "customer service topics" create enforcement ambiguity.
Step 2: Red team against your scope definition
With the scope documented, run structured adversarial probing focused on boundary cases: topics adjacent to the intended scope, common off-topic subjects the model is likely to encounter from real users, and known prompt injection patterns from the OWASP list.
Step 3: Implement output-layer controls
Deploy a classification layer that evaluates model outputs against the scope definition before returning responses to users. This layer operates independently of the model and provides a containment mechanism that does not depend on model behavior.
Step 4: Monitor in production
Configure monitoring to detect and log out-of-scope interactions, not just policy violations or harmful content. Out-of-scope interactions are the early warning signal for capability leak before it becomes a public incident.
Step 5: Establish a rapid response process
Given that capability leak incidents tend to spread quickly via social media, organisations need a defined process for identifying public incidents, assessing scope, and issuing public acknowledgment or correction. Slow response amplifies reputational exposure.
FAQs about McDonald's AI Chatbot Security Incident
1. Is capability leak the same as a jailbreak?
No. Jailbreaks specifically target safety training to produce harmful content. Capability leaks expose off-domain capabilities that are not inherently harmful. A model answering a coding question outside its operational scope is a capability leak. A model providing weapons synthesis instructions is a jailbreak. The distinction matters because different mitigation strategies apply to each.
2. Can you prevent capability leak with a better system prompt?
System prompts reduce but do not eliminate capability leak risk. They are a necessary but insufficient control. Architectural constraints, specifically output-layer classification and gateway filtering, are required for robust containment.
3. How does TrustGuard address this?
TrustGuard provides the gateway-level control layer that system prompts cannot. It classifies model outputs against defined operational scope, intercepts out-of-domain responses before they reach users, and provides monitoring and logging for out-of-scope interaction patterns. The platform is designed to work alongside any LLM provider, acting as an enforcement layer between the model and the end user.
Learn more at neuraltrust.ai/products/trustguard.
4. Is this a problem unique to food and retail?
No. Any consumer-facing AI deployment built on a general-purpose LLM is exposed to capability leak. Food and retail incidents are visible because these deployments are high-volume and consumer-facing. The same vulnerability category affects financial services, healthcare, legal tech, and any other sector deploying LLM-based customer interaction systems.
Conclusion
The McDonald's chatbot incident is not an outlier. It is a representative example of a vulnerability category that affects every organisation deploying general-purpose LLMs in constrained operational contexts.
Capability leak is predictable, detectable, and preventable. The prevention requires architectural controls that operate at the infrastructure layer, not just policy constraints applied at the model layer. Organisations that have not yet built this into their AI deployment architecture are exposed to the same public incident McDonald's experienced.
The Gartner forecast suggests the industry will see more of these incidents through 2028. The countermeasures are known. The question is whether they will be implemented before or after the next public capability leak.
About the Author
Alessandro Pignati is Lead AI Security Researcher at NeuralTrust, where he leads research on AI and agentic security, advancing techniques to evaluate and secure large language models and autonomous AI systems. He specializes in adversarial machine learning, AI red teaming, LLM security, and AI safety, contributing to the development of secure and trustworthy AI.
NeuralTrust is an AI agent security platform, recognized in the Gartner 2025 Market Guide for AI Gateways and Guardian Agents, and the KuppingerCole 2025 Leadership Compass for Generative AI Defense. Headquartered in Barcelona with ISO 27001 certification.
)
)
)
)