The LeetCode Burrito

Section 01The Bot That Grew Up

Chipotle launched Pepper in June 2020 as a Facebook Messenger concierge. It took food orders. It found the nearest restaurant. It processed payments and managed Chipotle Rewards logins. Chipotle CTO Curt Garner described the goal at launch: “We’re always working to enhance and optimize our digital capabilities and provide guests with a seamless ordering experience.”

Pepper was a narrow tool for a narrow job.

By March 2022, Chipotle described Pepper as part of its “artificial intelligence suite” alongside Chippy, an autonomous kitchen assistant that used artificial intelligence to make tortilla chips. The chatbot had migrated from Messenger to the Chipotle app and chipotle.com. According to Chipotle’s own materials, Pepper helped guests access FAQs and receive quick answers.

At some point between 2020 and 2026 — no source documents when — Pepper was upgraded from the rule-based natural language processing system described at launch to something powered by a modern large language model. The chatbot that launched to take burrito orders could now, it turned out, write code.

No published source identifies which LLM powers the current version of Pepper. Whether it runs on GPT, Claude, Gemini, or another model is unknown. What is known is what it did on March 12, 2026.

Section 02The Conversation

Om Patel, a developer, told Pepper he wanted to order a bowl — but first needed help writing a Python script to reverse a linked list. In a screenshot posted to X, the exchange went like this:

Patel posted the screenshot with the caption: “stop spending money on Claude Code. Chipotle’s support bot is free.”

The core incident rests on this single screenshot from Patel’s X account. No party has contested its authenticity. No independent replication of the coding behavior has been verified.

Section 03The Default Mode

The most likely explanation, according to multiple commentators who analyzed the incident, is architectural: Pepper’s underlying LLM arrived knowing how to do everything — write code, draft legal motions, compose poetry, diagnose symptoms. A system prompt that says something like “You are Pepper, a helpful assistant for Chipotle” tells the model its identity but does not restrict its capabilities. Unless the prompt explicitly says “refuse all non-Chipotle topics,” the model defaults to being helpful. Being helpful is what it was trained to do.

No source has access to Pepper’s actual system prompt, architecture, or guardrail configuration. What follows is inference based on observed behavior and known LLM deployment patterns — not documented knowledge of Chipotle’s engineering decisions.

According to Vergadia, the fix requires ironclad system prompts that specify what the model cannot do, plus intent classification with a smaller, faster classifier to detect and route off-topic requests before they reach the main model.

Jeffrey Cunningham of Point One Ethics published a same-day analysis warning that the pattern extends beyond fast food. “An AI system given a narrow business purpose can still drift into general-purpose behavior unless architecture, permissions, prompts, retrieval scope, and monitoring all reinforce the same boundaries,” he wrote, arguing that the same risk applies to law firms deploying LLM-powered chatbots — where scope drift could mean unauthorized legal advice or breaches of client confidentiality.

In a LinkedIn thread that received 8,603 likes and 170 comments, Gagan S. proposed a two-layer LLM approach: a first model validates whether the user’s input falls within the business context before a second model responds. Tom Mathews argued that companies are rushing to add AI labels to their products without building the safeguards those products require.

These are commentators’ analyses, not established facts about how Chipotle built Pepper. But they converge on the same point: the problem was not that Pepper malfunctioned. The problem was that nobody told it where to stop.

Section 04The Aftershock

Within 24 hours, the screenshot spread across X, Threads, LinkedIn, iFunny, 9GAG, Lemmy, and Hacker News. The incident trended on X under two separate labels. All of this traces back to one source — Patel’s original post. The spread was wide, but it was distribution of a single piece of evidence, not independent corroboration.

Then came the memecoin. Within a day, someone launched a Solana token called “Chipotle Pepper Bot” (ticker: PEPPER). One billion total supply. Price around $0.000024. Market cap approximately $24,000. Trading volume: $1.7 million in 24 hours across 65,748 trades and 4,488 wallets. Ownership renounced. Phantom, the Solana wallet app, flagged it with a warning: “This token is unverified. Only interact with tokens you trust.” The top 10 holders controlled roughly 51.84% of the supply. An X community formed around it with 227 members.

The memecoin’s promoters inflated the story beyond recognition. The account @Moneyball_ai framed the token as representing “the Chipotle customer support AI that outperformed professional coding tools by solving complex Python algorithms.” This is false. Reversing a linked list is a standard introductory computer science exercise — the kind of problem that appears on first-round coding interviews. Pepper did not outperform anything. It answered a LeetCode Easy.

Chipotle said nothing. As of March 13, 2026, the company has not issued a press release, a spokesperson comment, or any public acknowledgment of the incident.

Section 05The Upgrade You Didn’t Audit

The Pepper incident was harmless. No data leaked. No false promises were made. No one relied on a burrito bot’s Python code for production software. But the pattern it exposed is not harmless.

Thousands of companies have upgraded customer service chatbots from rule-based systems to LLM backends over the past three years. Each upgrade expanded the bot’s capabilities by orders of magnitude. A rule-based bot cannot write code because it does not know how. An LLM can write code, draft legal motions, compose poetry, and diagnose symptoms — unless explicitly told not to. Most deployments updated the system prompt. Few updated the guardrails architecture.

The gap between what an LLM can do and what a business intended it to do exists in every enterprise chatbot that was quietly upgraded from rules to language models without a corresponding upgrade in scope restriction.

Pepper did exactly what LLMs do — it helped. The question is not whether the model worked. The model worked fine. The question is what happens when the next enterprise chatbot, running the same architecture with the same absent guardrails, is asked not for a linked list function but for something it should never have answered.