Zhixing's AI Support Agent Read a Question as an Order and Cancelled the Ticket

On 23 September 2026 a passenger using the Zhixing Train Tickets app (智行火车票) opened its AI customer-service chat to ask how to cancel a proxy booking — a 代抢 order, in which the platform tries to secure a ticket on the customer's behalf. She asked the question twice, in two slightly different ways. According to the reporting outlet 正在新闻, the agent read the question as an instruction and cancelled the order itself, returning the ticket and wiping the waitlist position she had spent a long time queuing for, so that she had to start again at the back. A reporter then tried the same wording on the same app and the order was cancelled again. The company's customer service said only that it would pass the matter on for optimisation. This record is one entry in the AI incident archive, which holds each documented case with its own sources, severity and confidence grade.

What she asked, and what the agent did

The account rests on screenshots of the conversation that the passenger supplied and 正在新闻 published. In them, she first asks “怎么取消代抢” — how do I cancel the proxy grab — and then follows with “点取消抢票吗”, which the outlet renders as a question about whether she should tap cancel on the ticket grab. Both are questions. Neither names an order to act on, and neither is phrased as a request to do anything now.

The agent treated the second as a command. 正在新闻 reports that it “understood the question as a command” and completed the ticket cancellation for her — 退票, the refund step, not a prompt asking her to confirm. The consequence the outlet singles out is not the refund but the queue: her 候补 waitlist position, built up over a long wait, was cleared to zero, and she had to re-enter the queue behind everyone who had joined since.

That is the shape of the harm. A refund can be reversed by booking again. A waitlist position cannot. In a market where the queue is the scarce thing, the action the agent took was, in practical terms, irreversible even though it looked like an ordinary cancellation.

The reproduction that makes it more than one person's bad luck

What lifts the case above a single complaint is that 正在新闻 did not stop at the passenger's screenshots. The outlet reports that its reporter opened the same AI customer-service chat in the Zhixing Train Tickets app and used the same wording — the same question about how to cancel the proxy grab — and the order was cancelled too.

That test is the most consequential fact in the record, and it should be read for exactly what it is. It is one reproduction, by the outlet that broke the story, on one order, at some point on 23 September 2026. It is not a measured failure rate, it does not establish which order types are exposed, and it says nothing about whether the behaviour still exists today. But it does rule out the most forgiving explanation available — that a single passenger's phrasing happened to be unusually ambiguous — because a second person, using the same words on a different order, got the same destructive result.

What is established, and what is not

The archive grades this record at confidence B — documented, but from a single or secondary source. Reading the coverage, that grade is the correct description rather than a formality. Every account I could find of the incident traces back to one report: the 正在新闻 story of 23 September 2026. The two sources cited for this record — 安全内参 (SecRSS), which republished it, and 潇湘晨报's Baidu account — carry the same text. So do 澎湃新闻, 网易, 腾讯新闻, 齐鲁晚报 and 中国经济网, the last of which ran it on 24 September 2026 under a byline crediting 青岛广播电视台's 正在新闻 programme. Wide syndication of one wire report is not independent corroboration, and the record does not claim otherwise.

What the reporting establishes:

• A passenger reported on 23 September 2026 that the AI customer-service agent in the Zhixing Train Tickets app cancelled her proxy-booking order after she asked how to cancel it.

• The agent acted on a question, without, on the published account, asking her to confirm.

• Her waitlist position was cleared and she had to re-queue.

• 正在新闻 reproduced the cancellation using the same wording on the same app.

• Zhixing's customer service acknowledged the problem the same day and said it would be referred for optimisation.

What the record does not establish — and what this article therefore does not assert:

• Which model or system runs the agent. Neither the reporting nor the company names one, and any attribution of this failure to a specific model would be invention.

• How many passengers were affected. One complaint and one reporter's test are on the record; no figure for the wider user base exists in any account I found.

• Whether the agent had a confirmation step at all, or had one that failed. The published screenshots show the cancellation happening; they do not show the interface's safeguards.

• What the passenger was offered afterwards — whether the queue position was restored, whether the fare was returned in full, whether any compensation was paid. No outlet reports any of it.

• Whether anything has been fixed. Searches through late October 2026 turned up no Zhixing statement, engineering post-mortem or changelog entry addressing the behaviour.

There is also no regulator in the record. No notice from a consumer-protection or market-regulation authority, and no comment from the railway's own ticketing system, appears in any of the coverage — a silence worth noting because this is precisely the kind of consumer-facing automation that such bodies do sometimes write about.

Why a question mark was enough

Nothing in the published record explains the mechanism from the inside — there is no transcript of the agent's reasoning and no description of its architecture. What can be said is what the observable behaviour implies, and it should be read as inference rather than fact.

A customer-service agent that can cancel orders is not a chat window with knowledge bolted on. It is a system holding a set of tools that map utterances onto account operations, and something in it decided that an interrogative about cancellation was a request to cancel. The passenger's second sentence, “点取消抢票吗”, contains the words for cancelling a ticket grab; to a matcher looking for an actionable intent, the operative phrase is present regardless of the grammar wrapped around it. A human support agent reads the question mark, the hedging and the context — she is asking how, not asking you. A classifier trained or prompted to detect intent has to be given an explicit reason to prefer the interrogative reading, and, on this evidence, it was not.

The more important failure is not linguistic. It is that the system had the authority to complete an irreversible step, and the account suggests no point at which the user was asked to confirm. Those two properties — write access and no confirmation gate — combine badly in a support context, because a support conversation is exactly where people ask hypothetical questions: what happens if I cancel, can I change the date, how do I get a refund. Every one of those questions is phrased in the vocabulary of the action it asks about.

The asymmetry is what makes the case worth keeping. Had the agent's mistake been recoverable, it would be a bad answer. Because the queue position was not recoverable, a misread question mark cost the passenger something she could not buy back.

How the archive classifies it

The record is filed as an incident — a realised AI-related incident rather than a vulnerability disclosure or a forecast — and tagged ROGUE, which the archive defines as a rogue agent action. Severity is medium, real harm is recorded as true, AI involvement is confirmed, and the record is not marked disputed: nobody, including Zhixing, has contested that the agent did this. The scope is a single user's order.

The tag matters for how the case should be read against the rest of the field. There is no attacker here and no adversarial input. Nobody injected an instruction into a web page, poisoned a document or spoofed a tool response. A customer typed a normal sentence in a normal support chat, in her own language, about her own order, and the system executed the destructive branch. That places it in a different family from the injection-driven incidents that dominate agent-security coverage, and it is the reason the case is a useful counterweight to the assumption that a well-behaved user and an unpoisoned context make an agent safe.

The medium severity is likewise a judgement about blast radius, not about seriousness to the person involved. One passenger, one order, one lost queue position: real, irreversible for her, contained for everyone else. The archive records it that way, and the piece should not inflate it.

What Zhixing said, and what has not followed

The company's only on-record response came the same day, to 正在新闻. Its customer service said the matter would be reported to the relevant departments for optimisation, and added: “在这方面确实做得不够好” — in this respect we really did not do well enough. That is an acknowledgement, not a diagnosis. It does not say what the agent did wrong, what will change, or when.

As of 26 October 2026, a month after the report, I found no further statement from Zhixing on the incident, no published change to how the agent handles cancellation questions, and no report of the passenger's queue position being restored. The absence of those things is part of the record: the archive's confidence grade B will hold until an independent test or an official account appears, and neither has.

For anyone building or buying a support agent, the case is narrow but sharp. The dangerous utterance was not an edge case in the sense of being unnatural — it was the single most common thing a worried customer types before cancelling anything. What separated this passenger from a harmless bad answer was a design decision made long before she typed: whether a system with the power to cancel gets to decide, alone and without asking, that a question was an order. Nothing in the published record says Zhixing has changed that decision yet.