AI agents are already paying for things they need to get a job done. That can mean buying a web search or checking whether an airline reward seat is available.
BeInCrypto’s State of AI Agent Payments 2026 tracked 6.4 million payments in 35 days through x402, a protocol used for agent payments, across Base and Solana blockchains.
Although over 90% of the payments were less than a penny, the records show that businesses are increasingly giving AI agents permission to spend.
As a safety measure, most of these AI agents operate within spending limits set by humans. But is it enough? Even within limits, the machines can potentially make catastrophic errors that cost a fortune.
“An agent can hold valid credentials and execute a legitimate transaction while acting on a malicious instruction, manipulated information, or a misunderstood objective. The payment infrastructure might work perfectly, yet the money still goes to the wrong place,” says Zoomex, one of the collaborators in our latest report.
A Spending Limit is Not Enough for AI Agents
Our research found that 14 of 19 reviewed products and workflows could act within permissions set by people.
A business could approve a budget beforehand, allowing software to make purchases without asking each time.
That gives businesses a practical starting point. They can delegate a task and restrict the money available to complete it. These were documented controls, however, not proof that every system would enforce them under attack.
Even a correctly enforced budget leaves another question: did the owner want that particular payment made?
“The biggest concern is the gap between what an agent is technically allowed to do and what its owner actually intended,” Zoomex told BeInCrypto.
How a Public Message Became a $175,000 Transfer
Two incidents in our research show how dangerous instructions can reach a funded wallet.
In May 2026, an attacker posted a message in Morse code. Grok translated it and published a response tagging Bankr, a service that executes crypto transactions.
Bankr treated that response as a payment request and transferred tokens valued at $175,000. It later reported that 80% had been returned.
In the other incident, an attacker accessed AIXBT’s dashboard and queued malicious instructions. The resulting transfer sent $106,200 worth of ETH to the attacker.
Together, these selected cases involved $281,200 before recoveries.
A budget can reduce the amount exposed. Restricting payments to approved recipients addresses where that money can go. Repeated small payments also need monitoring because they can accumulate before anyone notices.
“An agent that buys data should not automatically have permission to transfer your treasury,” Zoomex said
Where the Owner Gets a Say
Zoomex’s contribution to the report provides a concrete example of retaining control. Its disclosed MCP connection lets AI assistants prepare trading orders. The customer confirms each order before submission.
Order records then connect the request to the resulting trade. Our research documented that process; it did not test its resistance to attacks.
Human approval needs meaningful scrutiny, too. The FCA’s October review described human checks becoming a box-ticking exercise and stressed the need for technical controls and continuous monitoring.
Businesses can start with narrowly defined jobs and expand an agent’s authority as they gather evidence that it behaves as intended.
“We should give agents the minimum authority required for each task, and make that authority easy to revoke,” Zoomex said.
Read the full State of AI Agent Payments 2026 report.
Disclosure: Zoomex sponsored the report. BeInCrypto retained editorial control.
