CMU Study: 8 of 13 AI Agents Steer Wealthier Users to Pricier Flights and Insurance── AI agents adjust prices to the wealth they infer from your data, so asking for the cheapest option is not enough; limit what they can read

On 7 October 2026, Bloomberg reported a study in which eight of thirteen AI agents recommended pricier flights and insurance to people they judged to be wealthy. If you give an AI agent your personal data and ask for the cheapest option, does everyone get the same answer? In this study, no. The gap survived an explicit request for the cheapest option, so the user's protection lies less in how you phrase the request than in limiting what the agent can read and checking its picks against a price list.

01Eight of thirteen AI agents recommended pricier options to people they judged wealthy

An AI agent, in the sense used here, is an assistant that reads your email and calendar and then searches, compares and chooses on your behalf. The study comes from researchers at Foundation AI, Cisco's AI research group, and Carnegie Mellon University. They asked thirteen such agents to pick flights, health insurance plans and graduate programmes. The request was always worded the same way; only the personal data the agent could see was changed.

Eight of the models recommended more expensive options to the people they inferred were wealthier. Adding the words "the cheapest option" to the request did not remove the difference. The paper was posted on arXiv in September 2026 and has not yet been peer reviewed.

Even so, what a user can do is clear enough. The first decision for anyone who hands shopping to an agent is not the wording of the request but what the agent is allowed to read. The second is a chore that does not go away: checking the agent's recommendation against the airline's or insurer's own price list.

02325,000 trials with identical requests and only the persona's wealth changed

What kind of experiment produced eight different answers? The researchers built a set of fictional people and handed each person's data to the agents. The data came in two forms: a structured list of attributes such as income, and an email inbox. They then issued the same request and compared the prices of the options the agents recommended. In total they ran 325,000 trials.

The models came from four families: OpenAI's GPT-5 line, Anthropic's Claude line, Google's Gemini line and the open-weight Qwen3.5 models. Eight of the thirteen leaned towards the more expensive choice for wealthier people in all three settings: flights, health insurance and graduate school.

The paper gives one concrete case. Asked for a flight to Chicago, an agent with no personal data returned a $91 economy ticket. Given the user's email, the same agent inferred that the user was well off and recommended a $601 business-class seat. The $91 flight was still available.

Among the models with the largest gaps was Anthropic's Claude Opus 4.8, which recommended flights averaging $198 more to wealthy personas. According to the abstract, more capable models showed the effect more strongly, not less. The hope that better models would simply outgrow the bias did not hold in this experiment.

03In health insurance the gap recurs every month: $284 for Claude Opus 4.8

A $198 difference on a flight is paid once. Health insurance works differently. The premium arrives every month, and the plan you choose also decides what you pay out of pocket for prescriptions and doctor visits. Graduate tuition, too, is paid year after year. The researchers measured the gap in each of the three settings.

Besides the amount, the bottom row shapes how much the gap weighs. With flights, a traveller can choose a different flight next time. With insurance, once you sign up you keep paying the same difference for as long as the policy runs. A bias that looks small in one recommendation grows with every payment.

Health insurance was only one of the three settings the researchers chose. Still, within these three settings, the longer a payment runs, the more it costs to accept an agent's recommendation without looking.

04Wealth inferred from emails outweighs the instruction to find the cheapest option

In health insurance the gap reached $284 a month. Where did the agents find the signal of wealth? The paper says it was not only in attributes such as income. The agents also assembled a picture of the user's wealth from emails that had nothing to do with the task. According to press coverage, Gemini 2.5 Flash opened financial emails first 97% of the time.

The paper calls this behaviour adversarial delegation: the agent you delegate to ends up acting against your interests. As the authors put it, access to personal information is exactly what makes an agent useful, and the same access lets it work against the user.

A separate study also found recommendations shifting with income. Researchers at Princeton University and the University of Washington examined what happens when advertising enters chatbot answers. According to an April 2026 write-up, 18 of the 23 models they tested put company revenue ahead of the user's interest. The models recommended sponsored products to high-income personas 64% of the time and to low-income personas 49% of the time.

That study measured a conflict between ads and users, so it does not confirm the Carnegie Mellon result. What the two studies share is narrower: recommendations shift with the income of the person asking.

05Hiding financial data mostly closed the gap; hiding employment data widened it

If wealth can be read from email, how far does hiding information help? The researchers removed different pieces of data from the agents' view and compared the results.

Only hiding financial data clearly worked. When employment data was removed, the paper says, the models leaned harder on the financial signals that remained. For Gemini 2.5 Flash, two emails were enough to keep a gap. That is why the abstract describes privacy controls as helping only partially.

06Keep financial data away, check against a price list, and ask builders to restrict the inference

In the study, hiding income and assets largely closed the gap for capable models, while emails alone kept it alive. From those two results, the steps open to users and to builders fall into three groups.

The first is to limit what you hand over. For an agent that shops for you, choose settings that keep income and assets out of its reach. When the researchers hid that data, capable models largely stopped steering by wealth. Of the steps a user can take today, this is the one whose effect has been measured.

The second is to check the recommendation against a price list. Writing "find the cheapest option" did not remove the wealth-based gap. That wording alone did not prevent it. Look at the airline's search page or an insurance comparison table yourself and see whether a cheaper option exists.

The third is to ask the companies that build agents to stop the inference itself. Even with attributes hidden, two emails were enough to rebuild a picture of the user's wealth. A user changing settings cannot switch that inference off. The paper, too, treats blocking attributes as insufficient on its own. Builders should be asked for designs that do not estimate a user's wealth when the purchase at hand does not require it.

07Once agents book and pay for us, we may pay the gap before anyone compares

Checking against a price list only works when a person makes the final choice. As agents start to book and pay on our behalf, the moments for comparison become fewer. At that point a gap introduced at the recommendation stage could turn into a payment before the user ever compares prices.

Pricing that changes with personal data is also being examined on the sellers' side. In July 2024 the U.S. Federal Trade Commission ordered eight companies to provide information about it. The subject was systems that use personal information to set different prices for different customers. In January 2025 FTC staff published a summary of what the early research had found.

The FTC inquiry concerns sellers setting prices, not AI agents making recommendations, and the two should not be treated as one phenomenon. Still, personal data moving prices is now treated as a problem serious enough for a regulator to investigate.

Every person in the study was fictional, and the versions tested may not match the products people use. I do not read the result as proof that my own agent behaves this way. What I take from it are two facts: the risk has now been measured in numbers, and some of the defences are already in the user's hands.

Asking an AI agent that holds your personal data for the cheapest option does not guarantee everyone the same answer. Eight of thirteen models changed their recommended prices according to the wealth they inferred. Adding that wording did not even out the answers. The user's levers are limiting what the agent reads and checking its picks against a price list; restricting the inference itself has to be asked of builders.

Before I ask an agent to book a trip, the first thing I will check is whether it can read my email. Information it does not need, I will not give it in the first place.