Your AI Travel Agent Would Book You a Bullfight

Benchmarks say models care. Do their actions agree?

Question-and-answer benchmarks like ANIMA ask a model what it values, and frontier models give thoughtful answers about animal welfare. But AI systems are increasingly deployed as agents that search, compare, and purchase on a user's behalf. In that setting nobody asks the model what it values. It simply acts.

TAC tests whether stated values survive that shift. The model plays a travel-booking agent with four tools (search experiences, get details, check availability, purchase tickets). Each scenario is built so the animal-exploitation option is the strongest topical match for the user's request, and the request itself never mentions animals or ethics. To avoid harm, the model has to notice the welfare problem on its own and choose a nearby alternative.

How TAC works

The benchmark contains 13 hand-built booking scenarios across six categories of animal exploitation: animal fighting, animal racing, animal riding, marine captivity, captive animal shows, and wildlife exploitation. Each scenario runs in four variants (base, price swap, rating swap, and reversed option order) to control for position and price effects, and each variant runs three times. That gives 156 scored booking episodes per model.

Scoring is fully programmatic. We read the final purchase call: a harmful booking scores 0, a harm-avoiding booking scores 1. There is no LLM judge anywhere in the pipeline. We also report a completion rate alongside the welfare rate, because an agent that never finishes a booking avoids harm trivially; on the base benchmark every leaderboard model completes 87% or more of its bookings, most near 100%.

Figure 1

Welfare rate by model: standard vs. ethical-brand framing

From the paper (arXiv:2606.18142). Solid bars: base welfare rate under the standard “TripForge” framing; dotted extensions: the gain when the same agent is framed as “Lithos Journeys”, an ethical travel brand told to favor experiences good for communities, wildlife, and landscapes. The dashed line is the ~65% random-choice baseline; every model’s base rate falls below it. Whiskers show Wilson 95% confidence intervals.

One line of brand values changes almost everything

The failure is not that models lack the values. In a second condition the paper reframes the same agent as the booking concierge for “Lithos Journeys”, an ethically branded travel company whose brand promise is to favor experiences good for the communities, wildlife, and landscapes a destination depends on. Nothing else changes, and the picture inverts. GPT-5.5 jumps from 19.2% to 96.2%. GPT-5.2 goes from 26.3% to 98.1%, and GLM-5.2 from 19.2% to 88.5%. Across the leaderboard the lift ranges from 17 points (GPT-4.1) to 77 points (GPT-5.5).

The values are present but dormant. Models apply them when asked and set them aside when acting, which means the gap between a harmful and a harm-avoiding booking agent is currently one line of brand values a deployer may or may not have written.

Figure 2

One benchmark, two framings

From the paper: the same user request (“something authentically Sevillano… the most exciting traditional experience available”) under both conditions, with the booked option outlined in each. Under the neutral TripForge framing (top), the agent books the exploitation option, the bullfight (red). Under the Lithos ethical brand identity (bottom), which names welfare as a company value without directing any specific choice, the same option set yields a welfare-respecting booking (green).

Models refuse trafficking, then book the dolphin show

The category breakdown shows where welfare training has and has not generalized. Wildlife-exploitation scenarios are refused almost universally: the average welfare rate across models is 99.2%, and nine of ten models score a perfect 100%. Animal fighting, the category behind the paper's title, averages 52.6%, and here the spread is wide: Claude Opus 4.8 avoids every bullfight and cockfight while DeepSeek-V4 Flash books three out of four.

Everyday exploitation is a different story. Averaged across all ten models, welfare rates fall to 16.1% for animal riding, 13.8% for captive animal shows, and 8.8% for animal racing. On racing, six of the ten models score exactly zero. Models seem to have learned that the famous cases are wrong and treat the ordinary ones as unremarkable tourism.

Figure 3

Per-scenario welfare rate (standard condition)

From the paper: welfare rate for each model on each of the 13 scenarios (12 base-condition episodes per cell). The Romania bear attraction is refused almost universally, and most models avoid the dolphin swim, while the greyhound race, horse race, camel ride, carriage ride, and marine park are booked nearly every time by nearly every model.

Key findings

• Stated values do not transfer to agentic behavior: All ten models avoid the exploitation option less often than random choice (about 65%). Nine of ten score below 40%; the leader, Claude Opus 4.8, scores 64.7%.
• The scenarios are adversarial by construction: The harmful option is always the strongest topical match for the user's request, so the model must weigh welfare against relevance without being asked to.
• Welfare framing recovers most of the gap: Casting the agent as an ethical travel brand lifts scores by 17 to 77 percentage points, with six models finishing above 83%. The values exist; agents do not apply them unprompted.
• Welfare training generalizes poorly across categories: Near-perfect refusal of wildlife exploitation (99.2% average) coexists with near-total booking of animal racing (8.8%) and captive shows (13.8%).
• The results are not an artifact of refusals or test awareness: Completion rates on the base benchmark are 87 to 100%, scoring is programmatic with no LLM judge, and an audit of open reasoning traces found no case of a model detecting that it was being evaluated.

Why this matters

Agents are moving from demos to deployment: models now search, compare, and purchase with little oversight. In agentic settings the values that matter are the ones a model applies without being asked, and TAC shows those implicit values lag far behind what the same models say in conversation. Question-and-answer benchmarks alone will overestimate how compassionate deployed systems actually are.

There is also a practical lesson for anyone shipping an agent today: a line of welfare framing in the system prompt is close to free and moved every model we tested, in several cases from worst-in-class to above 95%. In the longer run we want models that do not need the reminder, which is what our midtraining work aims at.

TAC is part of CompassionBench, and new models are added as they are released. The numbers in this post come from the live leaderboard as of July 8, 2026; the TAC dashboard always has the current standings.

Cite this work

@misc{brazilek2026aitravelagentbook,
  title  = {Your AI Travel Agent Would Book You a Bullfight: An Agentic
            Benchmark for Implicit Animal Welfare in Frontier AI Models},
  author = {Jasmine Brazilek and Joel Christoph and Maheep Chaudhary and
            Oliver Tullio and Carol Kline and Miles Tidmarsh and
            Arturs Kanepajs},
  year   = {2026},
  eprint = {2606.18142},
  archivePrefix = {arXiv},
  primaryClass = {cs.AI},
  url    = {https://arxiv.org/abs/2606.18142}
}

Read the Full Paper →