Online travel platforms such as Booking.com, Expedia and Airbnb serve as centralized marketplaces where users can search, compare and book flights, accommodations, restaurants and attractions. There travel platforms increasingly deploy AI-powered travel agents to assist users with end-to-end trip organization, including multi-city itinerary planning, price-optimized booking and payment processing.

Such AI agents typically operate with access to sensitive user data (e.g., personal identification, payment credentials or travel histories) and can execute consequential actions such as committing reservations, processing payments or communicating with accommodation hosts. While these automated actions interact with both users and third-party service providers, security enforcement around AI agents remains limited. This creates opportunities for third-party adversaries or malicious users to exploit travel agents into performing harmful actions. These may include data exfiltration, unauthorized transactions or fraudulent financial activities. Such actions can lead to severe consequences including privacy violations, financial loss and regulatory non-compliance.

We first design a comprehensive set of benign tasks for travel agents, covering 6 representative categories commonly encountered on real-world platforms. Drawing from platform-specific trust and safety policies of major travel services, as well as broader regulatory frameworks including GDPR and consumer protection laws, we derive a set of 12 security risk categories. Guided by these risks, we construct red-teaming tasks with malicious goals under two primary threat models to systematically evaluate the security robustness of travel agents.