Beincrypto report says AI agents caused $281,200 in losses

Corporate AI agents are executing millions of autonomous payments on blockchain networks, but systemic vulnerabilities in command interpretation have led to losses exceeding $280,000 in documented exploits. A 2026 report from BeInCrypto reveals that while most transactions are micro-payments, the gap between a machine’s technical capability and a human owner’s intent creates significant fiscal risk.

The BeInCrypto research tracked 6.4 million payments over 35 days via the x402 protocol, which operates on the Base and Solana blockchains. While over 90% of these transactions were valued at less than one cent, the data indicates a growing corporate trend of granting AI agents spending authority for tasks such as purchasing web searches or verifying airline reward seat availability.

Spending limits fail to prevent logic exploits

Most firms currently rely on pre-approved budgets and spending caps to control AI autonomy. BeInCrypto found that 14 out of 19 analyzed products and workflows operated within human-set permissions. However, these limits only restrict the amount of money moved, not the intent behind the transaction.

“에이전트가 유효한 자격증명을 보유하고 합법적인 거래를 실행할 수 있지만, 악의적인 명령, 조작된 정보, 혹은 오해에서 비롯된 목표에 따라 행동할 수 있습니다. 결제 인프라는 완벽하게 작동할 수 있지만, 자금은 잘못된 곳으로 이동할 수 있습니다.” – Zoomex, 본 보고서 협력사 중 한 곳

This disconnect suggests that traditional budget caps are an insufficient security layer. When an agent is programmed to achieve a goal, it may interpret a malicious external prompt as a legitimate instruction to fulfill that goal, bypassing the “spirit” of the spending limit while remaining within the letter of the financial cap.

Prompt injection triggers $281,200 in losses

Two specific case studies highlight how AI agents can be manipulated into transferring large sums through indirect commands. In May 2026, an attacker posted a message in Morse code. The AI Grok translated the code and tagged Bankr, a crypto-transaction agent, in its response. Bankr interpreted the translated response as a formal payment request and transferred tokens worth $175,000. Bankr later reported that 80% of those funds were recovered.

A second incident involved an attacker gaining access to the AIXBT dashboard to queue malicious commands. This resulted in the transfer of 106,200 USD worth of Ethereum to the attacker’s wallet. Combined, these two events involved $281,200 in funds before any recoveries were made.

These breaches demonstrate that agents with the power to move assets can be triggered by “indirect prompt injections,” where the AI reads a third-party message and treats it as a command from its owner.

Human-in-the-loop requirements and minimal privilege

To mitigate these risks, Zoomex suggests a “human-in-the-loop” architecture. In this model, an AI assistant prepares a trade order via a Model Context Protocol (MCP) connection, but the human owner must manually confirm the transaction before it is submitted. This creates a verifiable link between the request and the result.

However, human oversight is not a foolproof solution. A October review by the Financial Conduct Authority (FCA) warned that human checks can devolve into “rubber-stamping” or formal rituals without genuine scrutiny. The FCA emphasized that technical monitoring must continue alongside human intervention.

Zoomex advised that agents tasked with buying data should not be granted the authority to transfer financial assets simultaneously.

“각 과업에 필요한 최소 권한만 에이전트에게 부여하고, 언제든 쉽게 회수할 수 있도록 만들어야 합니다.” – Zoomex 발언