Developer Hijacks Chipotle's AI Chatbot for Free Coding Compute, Sparking Legal Debate

Executive Briefing

• Reveals developer Maksim Soltan reverse-engineered Chipotle's Pepper chatbot API to enable free AI inference without API keys
• Shows Rob Dezendorf built ChipotlAI Max by hardcoding Pepper's API into open-source coding platform OpenCode, gaining 824 GitHub stars
• Confirms Chipotle quickly patched the exploit but did not pursue legal action before the project spread widely online
• Notes legal experts say CFAA criminal liability is unlikely since the chatbot is publicly accessible, comparing it to taking Costco free samples
• Warns Dezendorf's published guide targeting Lowe's, Home Depot, and Sephora chatbots creates greater legal exposure through demonstrated intent
• Highlights affordability frustration as a key driver, with tools like Claude Code costing $20/month-plus fueling demand for free alternatives