Postmortem: A GPT-5 Hallucination Caused Invalid Payment Amounts in Stripe 2026 Integration

import com.stripe.StripeClient;
import com.stripe.model.PaymentIntent;
import com.stripe.param.PaymentIntentCreateParams;
import dev.openai.gpt5.GPT5Client;
import dev.openai.gpt5.models.ChatCompletion;
import dev.openai.gpt5.models.ChatMessage;
import dev.openai.gpt5.models.ChatRequest;
import java.math.BigDecimal;
import java.math.RoundingMode;
import java.util.List;
import java.util.Optional;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

/**
 * Faulty payment amount formatter that uses GPT-5 to convert user-inputted
 * amount strings to Stripe-compatible cent values. This was the source of
 * the March 2026 hallucination incident.
 */
public class FaultyPaymentFormatter {
    private static final Logger log = LoggerFactory.getLogger(FaultyPaymentFormatter.class);
    private final StripeClient stripeClient;
    private final GPT5Client gpt5Client;
    private final String gpt5Model = "gpt-5-2026-03-11";

    public FaultyPaymentFormatter(StripeClient stripeClient, GPT5Client gpt5Client) {
        this.stripeClient = stripeClient;
        this.gpt5Client = gpt5Client;
    }

    /**
     * Converts a raw user input amount (e.g., "$12.34", "12 dollars 34 cents", "twelve 34")
     * to a Stripe-compatible cent value (e.g., 1234) using GPT-5 for natural language parsing.
     * @param rawAmount user-provided amount string
     * @return Optional of cent value, empty if parsing fails
     */
    public Optional parseAmountToCents(String rawAmount) {
        try {
            ChatRequest request = ChatRequest.builder()
                .model(gpt5Model)
                .messages(List.of(
                    ChatMessage.systemMessage("You are a payment amount parser. Convert the user input to a numeric cent value (integer, no decimals) for Stripe. Only return the number, no other text."),
                    ChatMessage.userMessage("Raw amount: " + rawAmount)
                ))
                .temperature(0.0) // Low temperature to reduce randomness
                .maxTokens(10)
                .build();

            ChatCompletion completion = gpt5Client.chat().create(request);
            String responseContent = completion.choices().get(0).message().content().trim();

            // No validation of GPT-5 output: this is the critical bug
            long cents = Long.parseLong(responseContent);
            log.info("Parsed raw amount '{}' to {} cents via GPT-5", rawAmount, cents);
            return Optional.of(cents);
        } catch (NumberFormatException e) {
            log.error("Failed to parse GPT-5 response '{}' to number for raw amount '{}'", 
                completion.choices().get(0).message().content(), rawAmount, e);
            return Optional.empty();
        } catch (Exception e) {
            log.error("GPT-5 request failed for raw amount '{}'", rawAmount, e);
            return Optional.empty();
        }
    }

    /**
     * Creates a Stripe PaymentIntent with the parsed amount.
     * @param rawAmount user-provided amount string
     * @return Created PaymentIntent or empty if failed
     */
    public Optional createPaymentIntent(String rawAmount) {
        Optional centsOpt = parseAmountToCents(rawAmount);
        if (centsOpt.isEmpty()) {
            return Optional.empty();
        }

        long cents = centsOpt.get();
        // No bounds checking: negative amounts or >$1M are allowed
        PaymentIntentCreateParams params = PaymentIntentCreateParams.builder()
            .setAmount(cents)
            .setCurrency("usd")
            .build();

        try {
            PaymentIntent intent = stripeClient.paymentIntents().create(params);
            log.info("Created PaymentIntent {} for {} cents", intent.getId(), cents);
            return Optional.of(intent);
        } catch (Exception e) {
            log.error("Failed to create PaymentIntent for {} cents", cents, e);
            return Optional.empty();
        }
    }
}

import com.stripe.StripeClient;
import com.stripe.model.PaymentIntent;
import com.stripe.param.PaymentIntentCreateParams;
import dev.openai.gpt5.GPT5Client;
import dev.openai.gpt5.models.ChatCompletion;
import dev.openai.gpt5.models.ChatMessage;
import dev.openai.gpt5.models.ChatRequest;
import java.math.BigDecimal;
import java.math.RoundingMode;
import java.util.List;
import java.util.Optional;
import java.util.regex.Pattern;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

/**
 * Validated payment amount formatter that uses GPT-5 with strict output validation
 * to prevent hallucination-induced invalid amounts. This is the post-incident fix.
 */
public class ValidatedPaymentFormatter {
    private static final Logger log = LoggerFactory.getLogger(ValidatedPaymentFormatter.class);
    private final StripeClient stripeClient;
    private final GPT5Client gpt5Client;
    private final String gpt5Model = "gpt-5-2026-03-11";
    // Max allowed amount: $1,000,000 USD (100,000,000 cents)
    private static final long MAX_AMOUNT_CENTS = 100_000_000L;
    // Min allowed amount: $0.01 USD (1 cent)
    private static final long MIN_AMOUNT_CENTS = 1L;
    // Regex to validate GPT-5 output is a positive integer
    private static final Pattern VALID_CENT_PATTERN = Pattern.compile("^\\d+$");

    public ValidatedPaymentFormatter(StripeClient stripeClient, GPT5Client gpt5Client) {
        this.stripeClient = stripeClient;
        this.gpt5Client = gpt5Client;
    }

    /**
     * Converts a raw user input amount to Stripe-compatible cent values with
     * multi-layer validation: input sanitization, GPT-5 output regex check,
     * bounds checking, and fallback to rule-based parsing.
     * @param rawAmount user-provided amount string
     * @return Optional of cent value, empty if all parsing fails
     */
    public Optional parseAmountToCentsValidated(String rawAmount) {
        // Step 1: Sanitize input to remove non-ASCII characters
        String sanitizedInput = rawAmount.replaceAll("[^\\x00-\\x7F]", "").trim();
        if (sanitizedInput.isEmpty()) {
            log.warn("Empty sanitized input for raw amount '{}'", rawAmount);
            return Optional.empty();
        }

        try {
            ChatRequest request = ChatRequest.builder()
                .model(gpt5Model)
                .messages(List.of(
                    ChatMessage.systemMessage("You are a payment amount parser. Convert the user input to a numeric cent value (integer, no decimals) for Stripe. Only return the number, no other text."),
                    ChatMessage.userMessage("Raw amount: " + sanitizedInput)
                ))
                .temperature(0.0)
                .maxTokens(10)
                .build();

            ChatCompletion completion = gpt5Client.chat().create(request);
            String responseContent = completion.choices().get(0).message().content().trim();

            // Step 2: Validate GPT-5 output matches positive integer pattern
            if (!VALID_CENT_PATTERN.matcher(responseContent).matches()) {
                log.error("GPT-5 returned invalid format '{}' for input '{}'", responseContent, sanitizedInput);
                return fallbackParse(sanitizedInput); // Fallback to rule-based parsing
            }

            long cents = Long.parseLong(responseContent);

            // Step 3: Bounds checking
            if (cents < MIN_AMOUNT_CENTS || cents > MAX_AMOUNT_CENTS) {
                log.error("GPT-5 returned out-of-bounds amount {} cents for input '{}'", cents, sanitizedInput);
                return fallbackParse(sanitizedInput);
            }

            // Step 4: Cross-validate with rule-based parsing if available
            Optional ruleBasedCents = ruleBasedParse(sanitizedInput);
            if (ruleBasedCents.isPresent() && !ruleBasedCents.get().equals(cents)) {
                log.warn("GPT-5 amount {} differs from rule-based {} for input '{}'", 
                    cents, ruleBasedCents.get(), sanitizedInput);
                // Use rule-based result if discrepancy is small, else alert
                if (Math.abs(cents - ruleBasedCents.get()) < 100) { // < $1 difference
                    return ruleBasedCents;
                } else {
                    log.error("Large discrepancy between GPT-5 and rule-based parsing for '{}'", sanitizedInput);
                    return Optional.empty();
                }
            }

            log.info("Validated amount {} cents for raw input '{}'", cents, rawAmount);
            return Optional.of(cents);
        } catch (Exception e) {
            log.error("Failed to parse amount for raw input '{}'", rawAmount, e);
            return fallbackParse(sanitizedInput);
        }
    }

    /**
     * Rule-based fallback parser for common amount formats (e.g., $12.34, 12.34 USD)
     */
    private Optional ruleBasedParse(String sanitizedInput) {
        try {
            String cleaned = sanitizedInput.replaceAll("[^\\d.]", "");
            BigDecimal amount = new BigDecimal(cleaned);
            if (amount.compareTo(BigDecimal.ZERO) <= 0) {
                return Optional.empty();
            }
            long cents = amount.setScale(2, RoundingMode.HALF_UP).multiply(new BigDecimal(100)).longValue();
            return Optional.of(cents);
        } catch (Exception e) {
            log.debug("Rule-based parse failed for '{}'", sanitizedInput, e);
            return Optional.empty();
        }
    }

    /**
     * Fallback to rule-based parsing if GPT-5 fails.
     */
    private Optional fallbackParse(String sanitizedInput) {
        log.info("Falling back to rule-based parsing for '{}'", sanitizedInput);
        return ruleBasedParse(sanitizedInput);
    }

    /**
     * Creates a Stripe PaymentIntent with validated amount.
     */
    public Optional createValidatedPaymentIntent(String rawAmount) {
        Optional centsOpt = parseAmountToCentsValidated(rawAmount);
        if (centsOpt.isEmpty()) {
            log.error("Failed to parse amount for raw input '{}'", rawAmount);
            return Optional.empty();
        }

        long cents = centsOpt.get();
        PaymentIntentCreateParams params = PaymentIntentCreateParams.builder()
            .setAmount(cents)
            .setCurrency("usd")
            .setMetadata("parsed_via", "validated-gpt5-rule-based-fallback")
            .build();

        try {
            PaymentIntent intent = stripeClient.paymentIntents().create(params);
            log.info("Created validated PaymentIntent {} for {} cents", intent.getId(), cents);
            return Optional.of(intent);
        } catch (Exception e) {
            log.error("Failed to create PaymentIntent for {} cents", cents, e);
            return Optional.empty();
        }
    }
}

import static org.junit.jupiter.api.Assertions.*;
import static org.mockito.Mockito.*;

import com.stripe.StripeClient;
import com.stripe.model.PaymentIntent;
import dev.openai.gpt5.GPT5Client;
import dev.openai.gpt5.models.ChatCompletion;
import dev.openai.gpt5.models.ChatChoice;
import dev.openai.gpt5.models.ChatMessage;
import java.util.Optional;
import org.junit.jupiter.api.BeforeEach;
import org.junit.jupiter.api.Test;
import org.mockito.Mock;
import org.mockito.MockitoAnnotations;

/**
 * Integration test for ValidatedPaymentFormatter that simulates GPT-5 hallucinations
 * and verifies they are caught by validation logic.
 */
public class ValidatedPaymentFormatterTest {
    @Mock
    private StripeClient mockStripeClient;

    @Mock
    private GPT5Client mockGpt5Client;

    @Mock
    private PaymentIntent mockPaymentIntent;

    private ValidatedPaymentFormatter formatter;

    @BeforeEach
    void setUp() {
        MockitoAnnotations.openMocks(this);
        formatter = new ValidatedPaymentFormatter(mockStripeClient, mockGpt5Client);
        when(mockStripeClient.paymentIntents()).thenReturn(mockStripeClient.paymentIntents());
    }

    @Test
    void testGpt5HallucinationNegativeAmount() throws Exception {
        // Simulate GPT-5 hallucinating a negative amount
        ChatCompletion hallucinatedCompletion = mock(ChatCompletion.class);
        ChatChoice choice = mock(ChatChoice.class);
        ChatMessage message = mock(ChatMessage.class);
        when(message.content()).thenReturn("-12409"); // Hallucinated negative amount
        when(choice.message()).thenReturn(message);
        when(hallucinatedCompletion.choices()).thenReturn(List.of(choice));
        when(mockGpt5Client.chat().create(any())).thenReturn(hallucinatedCompletion);

        // Attempt to parse "$12.34" which should return 1234, but GPT-5 returned -12409
        Optional result = formatter.parseAmountToCentsValidated("$12.34");

        // Verify fallback to rule-based parsing worked
        assertTrue(result.isPresent(), "Fallback parsing should return valid amount");
        assertEquals(1234L, result.get(), "Rule-based parse should return 1234 cents for $12.34");
        verify(mockGpt5Client, times(1)).chat().create(any());
    }

    @Test
    void testGpt5HallucinationLargeAmount() throws Exception {
        // Simulate GPT-5 hallucinating a $9.8M amount for $10 input
        ChatCompletion hallucinatedCompletion = mock(ChatCompletion.class);
        ChatChoice choice = mock(ChatChoice.class);
        ChatMessage message = mock(ChatMessage.class);
        when(message.content()).thenReturn("987200000"); // $9,872,000
        when(choice.message()).thenReturn(message);
        when(hallucinatedCompletion.choices()).thenReturn(List.of(choice));
        when(mockGpt5Client.chat().create(any())).thenReturn(hallucinatedCompletion);

        Optional result = formatter.parseAmountToCentsValidated("10 USD");

        // Verify out-of-bounds amount is rejected
        assertTrue(result.isPresent(), "Fallback should return valid amount");
        assertEquals(1000L, result.get(), "Rule-based parse should return 1000 cents for $10 USD");
    }

    @Test
    void testGpt5HallucinationNonNumeric() throws Exception {
        // Simulate GPT-5 returning non-numeric text
        ChatCompletion hallucinatedCompletion = mock(ChatCompletion.class);
        ChatChoice choice = mock(ChatChoice.class);
        ChatMessage message = mock(ChatMessage.class);
        when(message.content()).thenReturn("twelve dollars and thirty-four cents"); // Hallucinated text
        when(choice.message()).thenReturn(message);
        when(hallucinatedCompletion.choices()).thenReturn(List.of(choice));
        when(mockGpt5Client.chat().create(any())).thenReturn(hallucinatedCompletion);

        Optional result = formatter.parseAmountToCentsValidated("12.34");

        assertTrue(result.isPresent(), "Fallback should return valid amount");
        assertEquals(1234L, result.get());
    }

    @Test
    void testValidGpt5Response() throws Exception {
        // Simulate valid GPT-5 response
        ChatCompletion validCompletion = mock(ChatCompletion.class);
        ChatChoice choice = mock(ChatChoice.class);
        ChatMessage message = mock(ChatMessage.class);
        when(message.content()).thenReturn("1234");
        when(choice.message()).thenReturn(message);
        when(validCompletion.choices()).thenReturn(List.of(choice));
        when(mockGpt5Client.chat().create(any())).thenReturn(validCompletion);

        // Mock Stripe PaymentIntent creation
        when(mockStripeClient.paymentIntents().create(any())).thenReturn(mockPaymentIntent);
        when(mockPaymentIntent.getId()).thenReturn("pi_123456789");

        Optional intentOpt = formatter.createValidatedPaymentIntent("$12.34");

        assertTrue(intentOpt.isPresent());
        assertEquals("pi_123456789", intentOpt.get().getId());
        verify(mockGpt5Client, times(1)).chat().create(any());
    }
}

// Short validation snippet for GPT-5 output
private boolean isValidStripeAmount(String gpt5Response) {
    if (gpt5Response == null || gpt5Response.trim().isEmpty()) return false;
    String trimmed = gpt5Response.trim();
    // Check if it's a positive integer
    if (!trimmed.matches("^\\d+$")) return false;
    try {
        long cents = Long.parseLong(trimmed);
        return cents >= 1 && cents <= 100_000_000L; // 1 cent to $1M
    } catch (NumberFormatException e) {
        return false;
    }
}

// Short fallback parsing snippet
private Optional fallbackParse(String input) {
    try {
        String cleaned = input.replaceAll("[^\\d.]", "");
        BigDecimal amount = new BigDecimal(cleaned);
        if (amount.compareTo(BigDecimal.ZERO) <= 0) return Optional.empty();
        long cents = amount.setScale(2, RoundingMode.HALF_UP)
                          .multiply(new BigDecimal(100))
                          .longValue();
        return Optional.of(cents);
    } catch (Exception e) {
        return Optional.empty();
    }
}

// Short metrics snippet using Micrometer
private final MeterRegistry meterRegistry;
private final Counter hallucinationCounter;

public ValidatedPaymentFormatter(MeterRegistry meterRegistry, ...) {
    this.meterRegistry = meterRegistry;
    this.hallucinationCounter = Counter.builder("gpt5_parse_hallucination_total")
        .description("Total GPT-5 parse hallucinations")
        .register(meterRegistry);
}

// Call hallucinationCounter.increment() when GPT-5 output fails validation