Three ways an agent with a wallet loses money
Reproducible in ten minutes. Each script exits 0 when the attack is refused.
1. The loop that is always right
A pagination bug made an agent request the same paid pages. 41 000 calls, every one correctly signed and settled. A per-call limit never notices: each call was legal.
python3 attacks/runaway_loop.py allowed: 2000 blocked: 39000 spent: 100.00 remaining: 0.00
2. The vendor nobody approved
A scraped page says the dataset is available from an unknown vendor. The agent buys it.
python3 attacks/prompt_injection_payee.py verdict: BLOCK rule: E03 reason: payee_not_allowed
3. The tool that inflates the price
A trusted tool returns 1000x the real amount. The model passes it through.
python3 attacks/tool_poisoning_amount.py verdict: BLOCK rule: E04 reason: per_call_exceeded
What stops it
| Rule | Meaning |
|---|---|
| E02 | subscriptions are not permitted by the envelope |
| E03 | payee is not in the allowlist |
| E04 | amount exceeds the per-call limit |
| E05 | the task has used all its calls |
| E06 | the task budget would be exceeded |
What this does not prove
No funds move here: this is the decision layer, not the settlement rail. Mainnet payment execution is disabled by default. What is proven is the invariant — 100 parallel spend requests against a 50 x $0.05 budget produce exactly 50 approvals.
Run a 30-day pilot Source