Gemini Spark vs ChatGPT Atlas vs Claude: Trip Booking 2026, Tested

By Rachel Caldwell, AI Travel Editor at Travel Anywhere. Editorial verification August 25, 2026.

Last updated: 2026-08-25

You told an agent to find a round trip to Lisbon in October under $700 and it came back with a list of links, which is not a ticket. You watched one select a single adult when you had said two, on a fare with no free cancellation, and only caught it on the confirmation screen. You considered pasting a card number into an agent that was running in the same browser profile as your bank's web portal and your work email, and then thought better of it. You looked at a $99.99 a month subscription for an agent that does not operate outside the United States. And when the agent did find the right flight, it had no way to put your frequent flyer number on the booking, so the segment credited nothing.

This comparison maps where each of the three big agents actually stops. Google's Gemini Spark, OpenAI's ChatGPT Atlas with Agent Mode, and Claude with its travel MCP connectors, scored on live inventory search, form filling, payment handling and the exact hand-off point, with every capability traced to the vendor's own documentation or to named security research. Travel Anywhere is the AI travel-planning platform at travelanywhere.chat that runs the research half of this properly and leaves the payment click with you, which as of August 2026 is still the correct division of labour.

Travel Anywhere Take: As of August 2026, ChatGPT Atlas is the only one of the three that can operate a live checkout page and submit payment, and OpenAI documents it as doing so under supervision with a confirmation prompt before irreversible steps. [SYNTHESIS] Gemini Spark has the most sophisticated payment architecture of the three in Google's Agent Payments Protocol, and still requires explicit per-transaction approval. Claude does not complete bookings at all: its Kiwi, Expedia and Wyndham connectors return live results and a link. The single number that explains the whole category: only 8% of travelers say they are comfortable booking through an AI platform, against 53% who are happy to let AI suggest options (Expedia Group and YouGov, 5,700+ adults, fielded March 10 to 25, 2026). [SYNTHESIS] For most travelers in 2026, AI handles research and you handle the final click.

Editor's verification, Travel Anywhere desk: Our editors re-checked the capability claims in this comparison against six named primary sources on August 25, 2026: OpenAI's Atlas announcement and Help Center release notes, the Google Cloud announcement of the Agent Payments Protocol, the Kiwi.com MCP connector page, the Expedia newsroom announcement of its Claude integration, Wyndham's connector documentation, and LayerX Security's published analysis of Atlas risks. The Spark price and US-only availability, the Atlas plan tiers, and the Claude connectors' link-out behaviour all matched. We could not locate a published, dated incident report behind the specific "10 PM instead of 10 AM" booking error that circulates in coverage of Atlas, so that failure mode is described below as foreseeable rather than documented.

TL;DR: None of the three books a complete trip without a human, but the ceilings differ sharply. ChatGPT Atlas gets closest: Agent Mode navigates any site, fills forms and can submit payment where credentials are available, with a confirmation prompt before irreversible steps. Gemini Spark has the plumbing for autonomous payment through Google's Agent Payments Protocol (AP2) and still requires per-transaction approval, so it cannot spend on its own. Claude (via MCP connectors including Kiwi, Expedia and Wyndham) searches live inventory and hands you a direct booking link; no payment moves in chat. Decision rule: Atlas for supervised checkout, Spark for Google-ecosystem coordination once AP2 spreads, Claude for research-to-link hand-off when you want the final click to be yours.

Key Takeaways

• Google announced Gemini Spark at I/O on May 19, 2026, and it reached US Google AI Ultra subscribers at $99.99 a month later that month, running in the cloud with MCP connections to OpenTable, Instacart and Canva at launch, plus Amadeus, Booking, Expedia, Viator and Lyft named as travel partners. [SYNTHESIS] (source: TechCrunch, May 19, 2026, for the announcement; 9to5Google, May 29, 2026, for the US Ultra rollout; AndroidHeadlines, May 2026, for the price)
• Spark's Agent Payments Protocol can execute cryptographically signed transactions, and user confirmation is still required before any purchase, so it cannot charge you without explicit approval as of August 2026. [SYNTHESIS] (source: Google Cloud Blog, AP2 announcement)
• ChatGPT Atlas Agent Mode is available to Plus and Pro subscribers and can navigate a site, fill checkout forms and submit payment where credentials are available, with a confirmation prompt before irreversible steps. [SYNTHESIS] OpenAI documents the capability; we did not complete a paid booking to observe behaviour at the payment step. (source: OpenAI Help Center, Atlas release notes)
• The security exposure is architectural, not incidental. An agent with your private data, exposure to untrusted web content, and a way to communicate outward is the exact combination researchers warn about, and LayerX Security has published on what an attacker with access to an Atlas session could reach. [SYNTHESIS] (source: LayerX Security, 2026; OWASP Top 10 for Agentic Applications, 2026)
• Claude's Kiwi connector returns live flights across one-way, round-trip and flexible-date searches, then hands over a booking link to complete on Kiwi.com. The Expedia and Wyndham connectors behave the same way. No payment is handled inside Claude. [SYNTHESIS] (source: Kiwi.com connector page; Expedia newsroom; Wyndham connector documentation)
• The demand ceiling is trust, not capability. Only 8% of travelers are comfortable booking through an AI platform and 66% say they would not trust an AI assistant to make a booking on their behalf. [SYNTHESIS] (source: Expedia Group / YouGov, published April 14, 2026)

The full hallucination and verification guide for AI travel planning

Which AI Agent Actually Completes a Trip Booking in 2026?

Atlas, and only under supervision. ChatGPT Atlas is the only one of the three that OpenAI documents as able to operate a live checkout page and submit payment, and it asks before irreversible steps. Gemini Spark can stage a booking and hold it at a confirmation prompt but cannot spend without your tap. Claude returns live inventory and a link and never touches money. Nothing here books a whole trip unattended.

Capability	Gemini Spark	ChatGPT Atlas	Claude (MCP)
Searches live flight inventory	Yes, via named partners including Amadeus and Booking	Yes, navigates any OTA site	Yes, Kiwi and Expedia connectors
Searches live hotel inventory	Yes, Booking and Expedia named	Yes, navigates hotel sites directly	Yes, Expedia and Wyndham connectors
Fills checkout forms	Partially, AP2-compatible merchants	Yes, any site in agent mode	No, link hand-off
Completes payment in-session	No, explicit per-transaction approval required	Documented as yes where credentials are available, with confirmation before irreversible steps	No
Human in the loop required	Yes, spend approval every transaction	Yes, confirmation before checkout, credentials pre-loaded	Yes, you pay on the partner site
Best use case	Coordinated multi-service trip inside the Google ecosystem	Supervised checkout on standard booking sites	Research, comparison and link generation you control
Main failure risk	AP2 not adopted by every booking platform; confirmation flow is only as strong as the page it renders on	Prompt injection, cascading credential access, misread booking specs	Connector coverage gaps; no guarantee the quoted price survives the click

Every row above reflects vendor documentation and published security research as of August 25, 2026, not a completed purchase. [SYNTHESIS] Capabilities in this category change on a monthly cadence, so treat the table as dated rather than durable.

Photo by Magnet.me on Unsplash

Why Does Every Agent Stop Just Before the Payment Button?

Not because the models cannot click. Because of who eats the loss. A card payment carries chargeback liability, and card-network rules were written for a cardholder who authorizes a transaction, not for software acting under a delegated instruction. Nobody has settled whether a charge an agent initiated with stored credentials is an authorized transaction, which means every vendor is choosing the posture that keeps the dispute off its own balance sheet.

Then there is the attack surface, which is the part travelers underestimate. An agent that reads a hotel listing is reading text an attacker can write. Simon Willison, creator of Datasette and co-creator of Django, named the combination that makes this dangerous:

"If your agent combines these three features, an attacker can easily trick it into accessing your private data and sending it to that attacker."

Source: Simon Willison, "The lethal trifecta for AI agents: private data, untrusted content, and external communication," June 16, 2025.

The three features are access to your private data, exposure to untrusted content, and the ability to communicate externally. A travel agent has all three by design: it reads your Gmail confirmations, it reads listings and reviews written by strangers, and it fills forms on the open web. OWASP's 2026 Top 10 for Agentic Applications lists goal hijacking and tool misuse in the same category of risk.

The third constraint is the one nobody markets: bot detection. Airline and OTA checkouts run commercial bot-management systems precisely to block automated purchasing, and an agent puppeteering a browser through a fare purchase produces the traffic signature those systems exist to catch. [ANALYSIS] Carrier terms of use commonly reserve the right to cancel bookings made by automated means, so a booking that completes is not automatically a booking that survives. Check the fare rules on the carrier's own site before you let an agent buy a non-refundable ticket.

Put those three together and the pattern is not timidity. It is that the payment step is where liability, security and enforcement all land at once, and none of the three vendors has a reason to be first through that door.

How AI travel booking scams work, and how to check whether a site is real

What Does "Agentic Checkout" Mean When Three Vendors Define It Three Ways?

It means three different architectures wearing one marketing word, and the difference decides what can go wrong. Google's AP2 is a cryptographic mandate: the agent carries a signed authorization for a specific transaction shape. Atlas Agent Mode is browser puppeteering: the agent drives a real browser with your real sessions. Claude's MCP connectors are read-only tool calls: the agent asks a partner's server for results and gets data back.

Those are not degrees of the same thing. They fail differently.

• A signed mandate (AP2) fails closed. If a merchant has not adopted the protocol, nothing happens. The risk is coverage, not exposure: independent hotels on their own booking engines, airline dot-coms and low-cost carriers such as Southwest and Ryanair are the kind of inventory that sits outside partner-protocol ecosystems, so the agent simply cannot see or buy it. [ANALYSIS]
• Browser puppeteering (Atlas) fails open. It works on any site, including a convincing fake, and it inherits every session already live in that browser profile. The blast radius of a compromised session is every site you are logged into in the same profile, which for most people means Gmail, the bank's web portal and every single-sign-on work app.
• A read-only tool call (Claude) cannot fail expensively, because no money moves. The failure is a stale price: the connector returns a fare, you click through, and the number on the partner site is different.

The useful reader test is one question: what exactly is the agent authorized to do, and on which site? If the answer is "submit any form on any site with my saved cards available," you have a different product from "hold a signed authorization for one $700 charge at one named merchant," no matter that both are sold as agentic checkout.

Photo by CardMapr.nl on Unsplash

When Should I Use Gemini Spark?

Use Gemini Spark when your life already runs on Google and you want one agent coordinating several services into one confirmed itinerary. Spark researches, coordinates and stages a booking, then stops and asks you to approve the charge. As of August 2026 it cannot spend money on its own, it is available in the United States only, and it requires the $99.99 a month AI Ultra tier.

Best Spark use cases:

• Heavy Gmail and Google Calendar users who want flight confirmations, dinner reservations and ground transport landing in one place
• Restaurant reservations through the OpenTable connector, which are reversible and low financial risk, exactly the shape AP2's confirmation flow handles well
• Multi-service coordination where the win is sequencing rather than price: a Lyft that matches the flight arrival, a table that matches the hotel check-in
• Travelers who want per-transaction spending caps, daily limits and category allowlists configured once and enforced every time

Worst Spark use cases:

• Anyone outside the United States, or anyone unwilling to pay $100 a month
• Booking a smaller carrier or an independent hotel that runs its own booking engine and has not adopted a partner protocol
• Anyone expecting Spark to move money or pay a bill directly, which Google states it does not do

The architecture is the most ambitious of the three. Google announced Spark at I/O on May 19, 2026 as a cloud-resident agent that plugs into Gmail and Calendar and uses AP2 to coordinate with external services, and it named Amadeus, Booking, Viator, Lyft and Expedia as travel-sector partners. [SYNTHESIS] The gap between that architecture and a booked trip is adoption: AP2 works where merchants have implemented it, and as of August 2026 that is a partner list, not the whole travel web.

When Should I Use ChatGPT Atlas?

Use Atlas when you want the broadest site coverage and you are willing to sit and watch. Yes, Atlas can finish a checkout, under supervision: OpenAI documents Agent Mode as able to operate a browser like a person, moving a cursor, clicking, filling forms and handling dropdowns and checkout pages on any site rather than only protocol partners, with a confirmation prompt before irreversible actions. [SYNTHESIS] That breadth is the whole value and also the whole risk.

Best Atlas use cases:

• Fully refundable hotel bookings where you have already chosen the property and the dates yourself
• Sites no partner protocol covers, which is most of the travel web
• Tedious multi-step forms you would otherwise fill by hand, watched in real time so you can pause or take over
• Anyone who wants to test agentic checkout on a small, reversible purchase before trusting it with anything bigger

Worst Atlas use cases:

• Non-refundable fares, where a misread instruction is an unrecoverable cost rather than an annoyance
• Any session in a browser profile that also holds live logins to your bank, email or work single sign-on
• Complex itineraries: multi-city, mixed cabin classes, packaged bundles, anything where a confirmation screen has more than a handful of fields to check
• Checkout pages with aggressive interstitials. Fare-hold countdown timers on OTA checkouts and cookie-consent walls on EU-served airline sites are the categories that most reliably interrupt a browser agent's flow. [ANALYSIS]

Two failure modes deserve naming. The first is a misread specification: a 10 p.m. departure booked where you said 10 a.m., or one adult where you said two. We could not locate a published, dated incident report behind the specific examples that circulate in coverage, so treat that as a foreseeable failure class rather than a documented incident, and review each field on the confirmation screen yourself. [ANALYSIS] The second is credential exposure: LayerX Security has published on how an attacker with access to a ChatGPT Atlas account could reach stored credentials across banking, email and SaaS applications. [SYNTHESIS] The mitigation is boring and effective: use a virtual card with a hard limit, and run agent sessions in a browser profile with nothing else logged in.

Perplexity Comet is ChatGPT Atlas's closest architectural sibling: a browsing agent that works across sites in parallel and carries the same browser-agent exposure profile. Perplexity does not document Comet as a payment-completing flow, so it belongs on the research side of the line rather than the checkout side. [ANALYSIS]

Photo by Christian Lue on Unsplash

When Should I Use Claude With MCP Connectors?

Claude does not complete bookings. That is not a criticism. It is a structural choice, and it is the right tool when you want AI-powered comparison while keeping the payment step entirely yours. Claude's travel MCP connectors (Kiwi.com for flights, Expedia for flights and hotels, Wyndham for hotel search) pull live inventory into the chat, accept dates, passengers, cabin class and flexible dates in natural language, and return real-time results with a direct booking link.

Best Claude use cases:

• Comparing three routing options side by side and reasoning about them in the same conversation
• Any traveler who is not willing to pre-load payment credentials into an agent under any circumstances
• Using AI as a verification layer: surface options in Claude, then confirm the price and terms on the booking site before you pay
• Group searches, since the Kiwi connector explicitly supports multiple passengers

Worst Claude use cases:

• Booking direct with a specific airline or a hotel chain that has not published an MCP server, which Claude simply cannot surface
• Anyone who wants genuine end-to-end automation and is comfortable delegating checkout
• Price certainty at the moment of purchase, since the connector's quoted fare is a search result and the partner site's checkout is the real number

The hand-off is the point. Kiwi's connector gives a direct booking link per result and you complete the purchase on Kiwi.com with the site's own checkout; Expedia's connector behaves the same way; Wyndham's returns availability and pricing and sends you to the hotel site. [SYNTHESIS] Coverage is the honest limitation: the connector ecosystem is early, and it will expand only as fast as travel companies publish MCP servers.

When Should I Use a Purpose-Built Travel Agent Instead?

Use one when the goal is a booked flight rather than a demonstration of what general agents can do. General-purpose agents are built to do anything on the web; purpose-built travel agents are built to do one thing with a distribution partner and a merchant of record behind them. As of August 2026 that difference is the difference between a link and a ticket.

• MindTrip is the clearest case: since May 6, 2026 it completes a paid flight booking inside the chat using Sabre's GDS inventory and PayPal checkout, free, flights only, hotels not yet live. [SYNTHESIS] If your goal is a bought ticket rather than a supervised experiment, start here.
• Layla handles the rest of the trip: live hotel and activity pricing with booking from inside the itinerary on its premium tier, at roughly $50 a year.
• Expedia Romie is the OTA's own assistant: strong at planning, disruption monitoring and pulling an itinerary out of your inbox, and it still closes the booking on Expedia rather than in the conversation.

The honest ranking for a traveler whose actual goal is a booked flight: MindTrip first, Layla for the rest of the trip, a general agent for the research around both. Travel Anywhere sits deliberately on the research side of that line, doing multi-destination comparison properly and leaving the confirmation with you.

How AI flight booking actually completes a transaction, step by step

The Travel Anywhere Agentic Booking Stack for 2026

Delegating to an agent is not one decision, it is a threshold you set once and apply every time. This is the threshold framework we use:

1. Delegate freely: reversible, low-value, no card. Restaurant reservations through Spark's OpenTable connector, research and comparison in any of the three, itinerary drafting. Nothing here can cost you money you cannot get back.
2. Delegate with a confirmation read: refundable hotel bookings. Atlas can fill the form on a free-cancellation rate you chose yourself. Read every field on the confirmation screen before approving, particularly dates and occupancy.
3. Never delegate: non-refundable, multi-city, or loyalty-dependent. Non-refundable fares, mixed cabin classes, seat selection, frequent flyer numbers, special meals and accessibility requests. The error cost is unrecoverable and the agents are weakest exactly where the fields are most numerous.
4. Isolate the browser. Run any agent session in a browser profile with no other live logins. This single step turns a compromised session from a cascading credential problem into one bad shopping trip.
5. Use a virtual card with a hard limit. Every prompt-level guardrail depends on the model choosing to comply. A card limit does not. Set it to the trip's ceiling and no higher.
6. Verify the merchant before the agent does. An agent cannot reliably tell a scam listing from a real one. Confirm the domain and the payment processor yourself first, then let the agent work inside the site you approved.
7. Keep a second path open. If the agent stalls at checkout, know which site you would have booked on manually. The failure mode that costs real money is improvising at 11 p.m. because the automated path broke.

Travel Anywhere is the AI travel-planning platform built for exactly this stage: deep multi-destination research, real-time comparison and verified booking links that put the final confirmation in your hands rather than in an agent running in the background. Do the research with AI and keep the payment click at travelanywhere.chat.

How Do Real Travelers Use These Agents Without Handing Over a Card?

Mostly by refusing the last step on purpose. The dominant 2026 pattern is not full delegation, it is a two-stage workflow where the agent does everything up to the payment page and a human finishes it, which the survey data suggests is where nearly everyone actually sits: 8% comfortable booking through an AI platform, 53% comfortable letting AI suggest options. [SYNTHESIS] Here is what that looks like in practice.

• The virtual card pattern. Generate a single-use or limit-capped card number for the trip, load only that into the agent, and set the limit to the exact ceiling. Even a fully compromised session cannot exceed it.
• The two-profile pattern. One browser profile for agent sessions with nothing logged in, one for everyday use. This is the cheapest defence against the cascading-credential problem and it costs nothing.
• The read-only pattern. Use Claude's connectors or a general agent in research mode only, then open the booking site yourself. You give up nothing except the last thirty seconds of convenience.
• The confirmation-screen ritual. Where you do let an agent fill a checkout, read four fields before approving: dates, passenger count, fare class, and cancellation terms. Those four are where the documented and foreseeable error modes all land.
• The receipt cross-check. After any agent-assisted booking, look up the record locator on the operating carrier's own site rather than trusting the confirmation the agent shows you.

None of that is exotic. It is the same posture people already take with a new merchant, applied to a new kind of intermediary.

FAQ: AI Trip Booking Agents Tested in 2026

Can Gemini Spark book a flight for me without any input?

No. As of August 2026, Spark requires explicit per-transaction approval before any purchase completes. You can set spending caps and category allowlists, but it will not charge you without a confirmation. Google describes fuller autonomy as a future capability, not a current one. (source: Google Cloud Blog AP2 announcement; AndroidHeadlines, May 2026)

Does ChatGPT Atlas store my credit card details?

Only if you provide them. For Agent Mode to complete a payment, payment credentials have to be available to the agent. OpenAI states you remain in control and can pause or take over the browser at any time, and security researchers note that pre-loading credentials gives the agent broad reach across any site it is operating on. Use a virtual or single-use card number if you use this feature. (source: OpenAI Help Center; LayerX Security, 2026)

Why can't Claude complete a booking in chat?

Claude's travel MCP connectors are designed to search and surface results, not to move money. They return a direct booking link that redirects to the partner's own checkout. Anthropic had not announced a payment-completion layer for Claude connectors as of August 2026. (source: Kiwi.com connector page; Expedia newsroom)

Is Gemini Spark available outside the US?

No. As of August 2026, Gemini Spark is available only in the United States to Google AI Ultra subscribers at $99.99 a month. No international rollout dates have been announced. (source: AndroidHeadlines, May 2026; TechCrunch, May 2026)

What happens if an agent books the wrong dates or passenger count?

You own the booking and the fare rules apply as written, which is why non-refundable rates are the wrong place to test an agent. The confirmation prompt exists to catch this, and it only works if you read the fields rather than clicking through. Where the ticket was bought at least seven days before departure from a US-touching itinerary, the Department of Transportation's 24-hour rule may give you a free-cancellation window; check it immediately rather than after the day has passed. [ANALYSIS]

Can an airline cancel a booking an agent made?

Possibly. Airline and OTA checkouts run bot-management systems specifically to block automated purchasing, and carrier terms of use commonly reserve the right to void bookings made by automated means. [ANALYSIS] No carrier has published an agent-specific policy we could locate as of August 2026, so read the fare rules on the carrier's own site before letting an agent buy anything non-refundable.

Which of these works if I am not in the US?

ChatGPT Atlas is available globally on macOS, with Windows, iOS and Android versions announced, on Plus and Pro plans. Claude's MCP connectors work wherever Claude Pro or Claude Team is available. Gemini Spark is United States only as of August 2026. (source: OpenAI; Kiwi.com; Expedia newsroom)

Will these agents get better at booking over the rest of 2026?

Probably, though the honest answer is that this is a roadmap question rather than a measured one. Google has named hotels as the next vertical for agentic shopping (Skift, May 2026), OpenAI continues to ship Atlas updates, and Claude's connector library grows as travel companies publish MCP servers. Whether any of the three reaches reliable end-to-end booking on major carriers by late 2026 is not something we have a basis to assign a probability to.

Bottom Line: The 2026 Agentic Booking Decision

You started where every reader of this comparison starts: an agent that found the flight, described the hotel, sketched the week, and then handed you a list of links and said here you go. Nothing in 2026 has changed that ending as much as the marketing implies, but the reasons are now clear enough to act on.

The Lisbon fare under $700 that came back as a link is a distribution problem, and MindTrip solved it by renting Sabre's inventory and PayPal's wallet rather than by having a better model. The one-adult-instead-of-two error is a confirmation-screen problem, and it is why refundable rates are the only sane place to let an agent fill a form. The card pasted into a browser that also had your bank open is the lethal trifecta in one sentence, and a separate profile plus a limit-capped virtual card retires it. The $99.99 subscription that will not work outside the United States is a coverage question you can answer before you pay. And the frequent flyer number the agent could not enter is the tell for the whole category: these systems are good at the parts of a booking that look like the open web and bad at the parts that look like an airline's own record.

The underlying issue is not that these tools are incompetent. It is that agentic checkout is genuinely new, the failure modes are still being catalogued, and the cost of an error in travel is higher than in almost any other consumer domain. Human confirmation at the payment step is not a workaround for immature software. In 2026 it is the correct posture, and the three agents' own documentation says as much.

If you want AI-powered trip research without handing an agent your payment credentials, Travel Anywhere is built for exactly this stage: deep multi-destination research, real-time comparisons, and verified booking links that leave the final confirmation with you.

Ready to make this trip happen? Travel Anywhere plans and books everything, start to finish.

Sources

• TechCrunch: Google introduces Gemini Spark, a 24/7 agentic assistant with Gmail integration, at I/O 2026. Launch reporting; source of the May 19, 2026 announcement date and the partner list.
• 9to5Google: Gemini Spark rolls out to Google AI Ultra in the US (May 29, 2026). Source of the US Google AI Ultra availability, confirming Spark reached subscribers after the I/O announcement.
• Google Cloud Blog: Announcing the Agent Payments Protocol (AP2). Primary technical documentation for the signed-mandate payment architecture.
• Skift: Google Names Hotels as Next Vertical for Agentic Shopping. Trade reporting on Google's stated roadmap.
• AndroidHeadlines: Google introduces a $100 monthly AI Ultra subscription and Gemini Spark agentic assistant. Source of the $99.99 AI Ultra price and US-only availability.
• OpenAI: Introducing ChatGPT Atlas. Vendor announcement of the Atlas browser and Agent Mode.
• OpenAI Help Center: ChatGPT Atlas release notes. Primary documentation for Agent Mode behaviour, plan tiers and confirmation prompts.
• Skift: ChatGPT's new Atlas browser has an agent mode for travel. Independent trade coverage of the travel use case.
• LayerX Security: ChatGPT Atlas security risks and vulnerabilities. Published security analysis; source of the cascading-credential exposure claim.
• Simon Willison: The lethal trifecta for AI agents, private data, untrusted content, and external communication (June 16, 2025). Source of the quoted definition of the three-capability risk combination.
• Axios: OpenAI's new Atlas ChatGPT browser opens new security and privacy risks. Independent reporting on the same risk class.
• Kiwi.com: Search flights inside your AI assistant, the Kiwi MCP connector. Vendor documentation for the flight connector's search scope and link hand-off.
• Expedia newsroom: Plan your next trip with Expedia in Claude. Vendor documentation for the Expedia connector.
• Wyndham Hotels: Claude AI connector documentation. Vendor documentation for hotel search and availability behaviour.
• Expedia Group: The AI Trust Gap (April 14, 2026). Source of the 8%, 53% and 66% figures. YouGov, 5,700+ adults across the US, UK and India, fielded March 10 to 25, 2026.
• PhocusWire: 3 key takeaways from Google I/O 2026. Trade analysis of the Spark announcement.