News for hackers. Stuff that matters.

A comment on Basically no one is using AI agents for their DoorDash orders. Parent comment

Re:Basically no one is using AI agents for their DoorDash or... by fishpen0 on Wednesday November 04, 2026 @04:04PM (#50371503)
doordash is regularly audited for PCI, they almost certainly store raw CC#s and follow modern tokenization standards. The best the agent would see is the name you stored for the card if you have multiple cards it can pick from in the account.

You can pull the PCI compliance documentation from their trust center if you are a partner https://trust.doordash.com/

For addresses, it's a almost certain the agent would see those since those are visible in the UI when ordering and required for selecting a destination for the order

[ Parent | on HN ]
Re:Basically no one is using AI agents for their DoorDash or... by 0c3ca83 on Wednesday November 04, 2026 @04:13PM (#50371616)
It's plausible, but also, AI systems have a long history of being plugged in on the wrong side of security boundaries.

Remember when you were able to take over any Instagram account by asking the helpful support AI to send a password reset to an email address of your choice?

[ Parent | on HN ]
Re:Basically no one is using AI agents for their DoorDash or... by fn-mote on Wednesday November 04, 2026 @09:15PM (#50374253)
There’s a difference between their AI and your AI. For better and worse.
[ Parent | on HN ]
Re:Basically no one is using AI agents for their DoorDash or... by harry8 on Thursday November 05, 2026 @02:02AM (#50376048)
>Remember when you were able to take over any Instagram account by asking the helpful support AI to send a password reset to an email address of your choice?

Wow, first I've heard of that. Damages must have been immense for that level of incompetence occasioning financial harm. Or do those laws only apply if you can't hire very expensive lawyers to blame a computer?

[ Parent | on HN ]