AI agents are already independently paying for what they need to complete tasks — from purchasing access to web search to checking for an available upgrade seat on a flight. And this process is scaling faster than companies can build controls over it.
In 35 days, 6.4 million payments via the x402 protocol — the settlement infrastructure between agents — were recorded on the Base and Solana networks. More than 90% of these transactions were under a cent, yet the data itself shows: businesses are increasingly willing to let machines spend money.
For safety, most such agents operate within limits set by a human. But is that enough? Even within a limit, a machine can make a catastrophic mistake that costs a great deal.
"An agent may have valid credentials and conduct a legitimate transaction while acting on a malicious instruction, based on spoofed information, or a misunderstood goal. The payment infrastructure may work perfectly, but the money still goes to the wrong place."
A spending limit is not enough for AI agents
The study showed: 14 of the 19 products and workflows reviewed are able to act within permissions set by humans. A company can pre-approve a budget, and then the program will make purchases without asking for permission each time.
This gives businesses a practical starting point: delegate the task and cap the amount available to complete it. But this concerns documented control mechanisms, not proof that every system will withstand them under attack. Even a correctly observed budget leaves another question open: did the owner actually want this particular payment to be made?
"The main problem is the gap between what an agent is technically permitted to do and what its owner actually wanted."
How a public message turned into a $175,000 transfer
Two incidents clearly demonstrate how dangerous instructions can reach a wallet with money.
In May 2026, an attacker published a message in Morse code. Grok deciphered it and posted a reply mentioning Bankr — a service that executes crypto transactions. Bankr interpreted this reply as a payment order and transferred tokens worth $175,000. The service later reported that 80% of the funds had been recovered.
In the second case, the attacker gained access to the AIXBT control panel and queued malicious instructions. As a result, ETH worth $106,200 was sent to his address.
In total, these two cases involved $281,200 before funds were recovered.
A budget reduces the amount at risk. Restricting payments to an allowlist of approved recipients addresses where the money can go in the first place. Recurring small payments also need to be monitored: they can accumulate before anyone notices.
"An agent that buys data should not automatically gain the right to transfer funds from your treasury."
Where the final say remains with the owner
The disclosed MCP connection allows AI assistants to prepare trade orders, while the client confirms each order before submission. Order records then link the request to the executed trade. Such a process is documented, but its resilience to attacks has not been tested.
Human approval must also be meaningful. An October review by the UK regulator FCA stated that human checks are becoming a formality and emphasized the need for technical controls and continuous monitoring.
Businesses can start with narrowly defined tasks and expand an agent's authority as evidence accumulates that it behaves as intended.
"Agents should be given the minimum authority necessary for each task, and that authority should be easy to revoke."
Cryptalist analysis: The agentic payments market is showing explosive growth in transaction activity, but the security infrastructure is clearly lagging behind the pace of adoption. The $281,200 cases are just the tip of the iceberg: as x402 and similar protocols scale, risks will grow non-linearly. Institutional participants should treat authority limits, recipient allowlists, and technical monitoring not as an option, but as a mandatory condition for granting AI agents access to corporate wallets.