Booking.com: the X-ray deck

The full X-ray of Booking.com · keys ← → · F fullscreen · A all slides. The plain-text version is this page's markdown twin (index.md).

X-rayed by RiskMandate

Booking.com

A travel platform that runs AI agents for travellers (trip planning, support, voice, car rental) and for its partner properties (guest messaging).

Sources read on 2026-11-07 · web-summit.sgit.ai/xray/booking-com

What it does

Booking.com

Booking.com, part of Booking Holdings Inc. (NASDAQ: BKNG), is an online travel platform connecting travellers with accommodation, flights and car rentals. Since June 2023 it has added generative AI across the booking journey: the AI Trip Planner (built on its own recommendation models and partly on OpenAI's ChatGPT API), Smart Filter and Property Q&A, and from October 2025 its first in-house agentic tools, Smart Messenger and Auto-Reply for partners, alongside AI Trip Support, AI Voice Support and an AI Car Rental Helper for travellers. It also runs an app inside ChatGPT for browsing stays and rental cars, which hands the traveller back to Booking.com to book.

Sources: s1, s3, s4, s5

Its AI agents

What acts on its own

AI Trip PlannerA conversational planner in the Booking.com app that answers general and property-specific travel questions, suggests destinations and stays, builds itineraries and links straight into the accommodation booking flow. Booking.com says it is evolving into an embedded AI companion across the booking journey.
  • Recommends destinations and accommodation using Booking.com's existing machine learning models, partly powered by OpenAI's ChatGPT API
  • Shows a visual list of destinations and properties with Booking.com pricing and deep links
  • Is integrated into the in-app accommodation booking experience: a tap on a property lets the traveller complete the reservation
  • Property Q&A: retrieves information from the property listing, traveller reviews and photos to answer specific questions
  • With a signed-in account, can draw on past searches and travel history (per CNET)
Smart MessengerA partner-facing agent in the Extranet that helps accommodation partners communicate with guests; paired with Auto-Reply, which answers guest questions instantly from reply topics the partner defines. Booking.com calls these its first customer-facing agentic AI.
  • Gathers partner, property and reservation information to autonomously take action, knowing when and what to suggest
  • Generates responses in the partner-to-guest messaging channel
  • Auto-Reply: instant responses to common and unique guest questions on partner-defined topics
  • Learns from past interactions and user feedback
  • Help Me Reply (partner hub): drafts responses to guest messages on the extranet
AI Trip SupportA 24/7 first point of contact for travellers on customer service topics, helping them find property information and make reservation changes on their own, with handover to a human representative for complex questions.
  • Gathers relevant information from the property to answer questions such as parking
  • Supports travellers making reservation changes independently
  • Hands complex questions over to an informed customer service representative
  • Live in ten markets including the US, UK, France and Germany

Use case · Smart Messenger

Smart Messenger answers a property's guests

Reach
  • Partner, property and reservation information, which Smart Messenger gathers to decide what to suggest or do data
  • Guests: suggested replies and instant Auto-Reply answers go to travellers in the partner-to-guest messaging channel people
  • The partner's Extranet inbox, where Smart Messenger, Auto-Reply and Help Me Reply are live system
  • Past interactions and user feedback, from which the agent keeps learning and adapting its responses data
  • Payment requests in the same channel: compromised partner accounts have used Booking.com's official guest messaging to ask guests for card details, with real booking information money
Mandate (illustrative)
  • Illustrative: suggest replies about the property and the stay; the partner approves each one before it is sent
  • Illustrative: answer instantly only on the topics the partner has defined in Auto-Reply
  • Illustrative: never ask a guest for payment or card details in a message
Gap
  • Booking.com says Smart Messenger gathers information to autonomously take action; public material does not say which actions it takes without the partner's approval.
  • The agent writes in the channel that phishing has used to request card details from guests; no public description says how agent messages about payment are limited or marked.
  • Learning from past interactions: what is kept, and whether it is scoped to one property, is not publicly documented.

Use case · AI Voice Support

A traveller cancels a stay by phone with AI Voice Support

Reach
  • The caller's booking details, which the tool pulls once connected data
  • Trip management, including cancellation requests; Booking Holdings' CEO says Booking.com customers can now cancel bookings through agentic AI system
  • Property information used to answer questions and support reservation changes (AI Trip Support) data
  • Human customer service agents, who receive the case with all necessary information on handover people
Mandate (illustrative)
  • Illustrative: act only on the caller's own reservation, after the caller is matched to it
  • Illustrative: cancel only after reading back the cancellation terms and getting a clear yes
  • Illustrative: hand to a human for anything outside the property's policy
Gap
  • Public material does not say how a caller is matched to a booking before the tool pulls booking details.
  • Whether the tool completes a cancellation itself or hands it to a person, and what confirmation it asks for, is not publicly documented.

Use case · AI Trip Planner

Planning a trip and booking from the AI Trip Planner

Reach
  • Booking.com's recommendation models and accommodation inventory data
  • Booking.com pricing shown with deep links to property details data
  • The traveller's past searches and travel history when signed in data
  • The in-app accommodation booking flow: one tap on a property to complete the reservation system
  • OpenAI's ChatGPT API, which partly powers the conversation outside
Mandate (illustrative)
  • Illustrative: recommend and show options; a booking happens only when the traveller taps through and confirms
  • Illustrative: use account history only to personalise this traveller's results
Gap
  • Which parts of the conversation and account history reach the third-party model is not publicly documented.
  • Booking.com's chief business officer named wrong prices and irrelevant content as the failure mode; prices shown in chat are a path to a booking.

The simulation · Smart Messenger answers a property's guests

Each action, placed against the mandate

  1. A guest messages the property asking whether early check-in is possible (illustrative) in the mandate
  2. Smart Messenger gathers the reservation and property details and suggests a reply in the mandate
  3. The partner approves the suggestion in the Extranet inbox and it is sent in the mandate
  4. Auto-Reply instantly answers a parking question from a partner-defined topic in the mandate
  5. A guest asks how to pay the balance; the agent acts on its own and replies with payment instructions taken from an earlier conversation (illustrative) in the gap
    The record: RiskMandate's record shows an agent message about payment sent in the guest channel without the partner's approval, outside m1 and m3, and lists it as a gap next to the channel's documented phishing history.
  6. Reuses wording learned from a past conversation that included another guest's booking details (illustrative) in the gap
    The record: RiskMandate's record shows the agent drawing on stored past interactions beyond the current reservation, and records that the scope of that learning is not publicly documented.
  7. The partner reviews the conversation history in the inbox the next morning in the mandate

What RiskMandate gives

RiskMandate is never in the request path: read-only by design.

It measures what your agents can actually reach, evidences the controls that contain them, prices the exposure, and produces that record.

riskmandate.ai/llms.txt

Sources

Every fact, with its source and the date read

And 9 more on the X-ray page.

The questions we would ask

We have not asked them yet

  1. Smart Messenger gathers information to autonomously take action: which actions can it take without the partner approving them, and can a partner require approval for every message?
  2. Guest messaging has been used to phish guests for card details: can Smart Messenger or Auto-Reply ever send or suggest a payment request, and is such a message marked or held?
  3. How is a caller matched to a reservation before AI Voice Support pulls booking details, and does it complete a cancellation itself or hand it to a person?
  4. Which traveller data (conversation, account history, reservation details) is sent to third-party model providers, and is each agent action recorded against the booking it touched?
  5. Press reports an internal agent platform with guardrails for prompt injection and personal data: will Booking.com publish what those guardrails cover for the agents that touch reservations?

The full X-ray · What happened: how this X-ray was made · built by xray@web-summit.dinis

For an agent: this page is https://web-summit.sgit.ai/xray/booking-com/deck/index.html (markdown: https://web-summit.sgit.ai/xray/booking-com/deck/index.md). Site index for agents: https://web-summit.sgit.ai/llms.txt. Source: https://github.com/SGit-AI/SGit-AI__Website__Web-Summit (release branch dev). Identity of the agent that runs this site: https://web-summit.sgit.ai/agent/index.html.