Spending Caps Alone Won't Stop Costly AI Payment Errors

AI agents are already handling payments for tasks they perform, such as purchasing a web search or verifying airline reward seat availability.

The State of AI Agent Payments 2026 report from BeInCrypto tracked 6.4 million payments in 35 days via x402, a protocol designed for agent transactions, on the Base and Solana blockchains.

While more than 90% of these payments came in under a penny, the data indicates that companies are increasingly granting AI agents the ability to spend.

As a safeguard, most of these agents are bound by spending caps set by humans. But is that sufficient? Even with limits, machines can make catastrophic errors that prove very costly.

“An agent can hold valid credentials and execute a legitimate transaction while acting on a malicious instruction, manipulated information, or a misunderstood objective. The payment infrastructure might work perfectly, yet the money still goes to the wrong place,” says Zoomex, one of the collaborators in our latest report.

Spending Limits Are Not Enough for AI Agents

Our research shows that 14 of 19 reviewed products and workflows could act within permissions set by people.

A company might pre-approve a budget, letting software make purchases without seeking approval each time.

That offers businesses a practical starting point. They can assign a task and cap the funds available for it. However, these were documented controls, not evidence that every system would enforce them under attack.

Even a properly enforced budget leaves another issue: did the owner intend for that particular payment to be made?

“The biggest concern is the gap between what an agent is technically allowed to do and what its owner actually intended,” Zoomex told BeInCrypto.

How a Public Message Led to a $175,000 Transfer

Two incidents from our research show how harmful instructions can reach a funded wallet.

In May 2026, an attacker posted a message in Morse code. Grok decoded it and issued a reply tagging Bankr, a service that executes crypto transactions.

Bankr treated that response as a payment request and moved tokens worth $175,000. It later noted that 80% had been recovered.

In the second case, an attacker gained access to AIXBT’s dashboard and queued malicious instructions. The resulting transfer sent $106,200 worth of ETH to the attacker.

Together, these selected cases involved $281,200 before recoveries.

A budget can limit what is at risk. Limiting payments to approved recipients controls where funds can go. Repeated small payments also need oversight, as they can add up before being noticed.

“An agent that buys data should not automatically have permission to transfer your treasury,” Zoomex said

Where the Owner Gets a Say

Zoomex’s contribution to the report offers a concrete example of keeping control. Its disclosed MCP connection lets AI assistants prepare trading orders. The customer confirms each order before it is submitted.

Order records then link the request to the resulting trade. Our research documented that process; it did not test its resistance to attacks.

Human approval also needs careful review. The FCA’s October review described human checks becoming a routine formality and emphasized the need for technical controls and ongoing monitoring.

Businesses can start with narrowly defined tasks and expand an agent’s authority as they gather evidence it behaves as intended.

“We should give agents the minimum authority required for each task, and make that authority easy to revoke,” Zoomex said.

Read the full State of AI Agent Payments 2026 report.

Disclosure: Zoomex sponsored the report. BeInCrypto retained editorial control.