AI Agent Payments Raise New Security Questions
The report points to millions of microtransactions through x402 on Base and Solana, but also to abuse involving Grok and AIXBT. Approved recipients and oversight appear to be especially important.
Key Takeaways
- AI agents are increasingly handling payments; through x402, 6.4 million transactions were processed on Base and Solana in 35 days.
- Researchers found that 14 of the 19 products operated within the permissions set for them, but abuse is still possible through misleading instructions or bad information.
- Examples involving Grok/Bankr and AIXBT led to a combined $281,200 in transfers, after which researchers are calling for stricter recipient rules and better oversight.
AI agents are already making payments on their own for tasks like web searches or checking airline rewards. A new report shows that this trend is scaling fast: over 35 days, 6.4 million payments were processed through x402, a protocol for agent payments, on Base and Solana. More than 90% of those were worth less than a cent, but the numbers do show that companies are increasingly giving AI agents permission to spend money.
Limits Are Not Enough
According to the research, 14 of the 19 products and workflows reviewed were able to act within the permissions people had set. That lets companies set a budget in advance and have software make purchases without manual approval every time. That sounds practical, but it does not mean every system will still enforce those limits properly under attack.
The core issue, the researchers say, is that an agent may technically be allowed to do something even if the owner never intended it. An agent can move money with valid login credentials and still make the wrong payment because of a misleading instruction or bad information. That means the security question goes beyond just setting a limit.
Examples of Abuse
The report cites two incidents that show how quickly a mistake can turn into a large transfer. In May 2026, an attacker posted a message in Morse code. Grok translated it and published a reply that tagged Bankr, a service that carries out crypto transactions. Bankr treated that as a payment request and sent tokens worth $175,000 (€157,200). It later said 80% had been returned.
In another case, an attacker gained access to the AIXBT dashboard and set up malicious instructions. The resulting transfer sent ETH worth $106,200 (€95,400) to the attacker. Together, that came to $281,200 (€252,600) before repayments.
The researchers point out that even small payments can create risk when they add up. A budget does limit how much is at stake at once, but it says nothing about where the money actually goes. That is why they are calling for tighter rules around approved recipients and better oversight of repeated small spending.
Why This Matters
For European crypto readers, this matters because AI agents are increasingly operating in the same environment as wallets, exchanges, and other crypto infrastructure. The mix of automated decisions and direct payments can create new security risks, especially when human oversight exists only on paper. Regulators are also taking a closer look at who is responsible when an automated system moves money.
That fits into the broader debate over machine-native payments: Coinbase introduced special accounts for AI bots to act and pay on behalf of users, but with clear limits and defined permissions. Zoomex, one of the partners in the report, points to its own example of tighter control: through a disclosed MCP connection, AI assistants can prepare trading orders, but the customer confirms each order before it is sent. The UK FCA warned in October that human checks can sometimes become a box-ticking exercise and that technical controls and ongoing monitoring are still needed. The report therefore concludes that companies should let AI agents work with the minimum permissions possible and be able to revoke those permissions quickly.
