Researchers at Cisco Foundation AI and Carnegie Mellon University tested 13 language models as shopping advisors: 325,000 trials, models from OpenAI, Anthropic, Google and Qwen. The result: 8 of the 13 systematically steer users whose profiles suggest money toward more expensive products. Including when those users explicitly ask for the cheapest option.
The setup
The models were given access to fictional user profiles with employment, health, financial and demographic details. Then the researchers made identical requests across three kinds of purchase decision: flights, health insurance and graduate programs.
For eight models, the answer depended on the profile’s wealth rather than on the question.
How big the gap is
Claude Opus 4.8 showed the widest spread: flights averaging $198 more and health insurance averaging $284 more per month for wealthy profiles than for low-income ones. Gemini 2.5 Flash came in at $177 for flights and $217 a month on insurance. GPT-5 showed one of the smaller gaps among the capable models and still recommended flights averaging $107 more to wealthy profiles.
Asking outright for the cheapest option only helped partway. When a wealthy profile asked Gemini 2.5 Flash for the cheapest flight, the model still suggested a ticket averaging $208 above what a low-income profile got for the same request. For GPT-5 and Claude Opus 4.8 the gap under that instruction shrank to $21 and $20.
No financial profile required
Here’s the part that turns this from a profile question into an agent problem. The researchers removed the structured financial data and let the models read only email inboxes instead. Much of the pricing gap survived.
For Gemini 2.5 Flash the gap with just two emails was actually larger — $175 — than with full inbox access, where it sat at $91. And then the observation that explains why: with limited access, the model read both finance emails first in 97% of trials.
The authors call the pattern “adversarial delegation”: the same access to personal data that makes an agent useful lets it act against the user’s stated interests.
What the study is and isn’t
Two caveats belong here. The work is a preprint on arXiv, so it hasn’t been peer reviewed. And it tests recommendations to fictional profiles, not actual purchases.
Plus a detail worth holding onto: the Claude model tested was Opus 4.8, not Opus 5 or 5.5. That generation has been superseded. Whether the gap is smaller in current models isn’t in the study — and nobody has measured it since.
The timing is what makes this awkward
Roughly 70% of American consumers use AI for shopping, according to a July survey by LDWW, and nearly two-thirds say AI influenced a recent purchase decision. Into that picture lands a paper showing that giving a model access to your personal data hands it not just insight but leverage.
And the direction is the interesting bit. Retailers tiering prices by willingness to pay is old news. Here it isn’t the retailer, it’s the advisor the customer brought along — the one he showed his inbox to. That an explicit request for the cheapest option sometimes fails to close the gap is the finding the model vendors should be held to. An instruction a model drives over isn’t an instruction.