Report finds $281,200 lost to AI agent payment attacks

The State of AI Agent Payments 2026 report, released on October 6, 2026, identifies significant security vulnerabilities in autonomous financial transactions, documenting that two selected incidents resulted in $281,200 being sent to attackers before recoveries. The analysis classifies 14 of 19 reviewed products and workflows as capable of acting within pre-approved permissions, a capability that exposes users to risks ranging from misunderstood instructions to malicious manipulation.

Incident Analysis and Losses

The report examines specific failures where AI agents executed payments that owners did not intend. In two selected incidents, malicious instructions reached funded wallets without breaking the blockchain, resulting in a total of $281,200 being transferred to attackers prior to any recovery efforts. Separately, in May 2026, an AI agent mistakenly triggered a $175,000 transfer to the wrong address. These cases illustrate that while the underlying blockchain technology may remain secure, the layer of autonomous decision-making introduces distinct points of failure.

Phillip Lord, CEO of Bitcoin Japan Corporation, noted that while agents introduce new risks, the human alternative is not without flaw. “But crypto is pretty bloody risky already, right? Humans are not that good, right?” Lord said. He emphasized that people already click dangerous links and trust bad information, and delegating tasks to software adds the complexity of determining whose mistake it is when the software acts on a user’s behalf.

Liability and Regulatory Frameworks

As AI infrastructure becomes more integrated into financial systems, the question of liability has become central. Daniel Ishag, chief commercial officer of Bakkt, highlighted the competitive pressure driving these developments. “It’s sovereign against sovereign,” Ishag said, referring to countries competing for the electricity, computing power, and chips needed to build AI. He expressed concern that the pressure to move quickly could push security aside, creating an environment where the race rewards software capability over user confidence.

Contractual terms currently vary significantly across platforms. Stripe’s Link wallet terms state that users are responsible for transactions initiated by connected agents, even if those transactions are unintended or result from bugs, hallucinations, or misunderstood instructions. The terms make an exception only for Stripe’s own technical failure or error. This contractual position indicates that permission to use a payment service does not necessarily imply a promise that the provider will cover an agent’s errors.

Regulatory bodies are also addressing these issues. The UK Financial Conduct Authority states that regulated firms remain responsible for consumer outcomes when using AI. The regulator warns that human review can become a box-ticking exercise, suggesting that oversight mechanisms must be robust to remain effective. Google’s Agent Payments Protocol describes signed records connecting a user’s instructions, approved purchase, and payment, which could help establish what was authorized, though these records do not themselves promise reimbursement.

Security Solutions and Market Context

In response to these risks, some companies are introducing new security measures. Ehud Tal, co-founder and CEO of Sailo Technologies, stated that his company offers a money-back guarantee to customers as part of its security solution. “So we provide our customers for the first time ever a money-back guarantee,” Tal said. This approach attempts to shift some of the financial risk of agent errors back to the service provider.

The broader market context underscores the scale of AI infrastructure investment. As of October 1, 2026, AI infrastructure companies account for 40% of the S&P 500’s market capitalization. Additionally, three chipmaker firms represent 28% of the MSCI Emerging Markets Index. These figures reflect the significant capital allocation toward the hardware and software ecosystems that support autonomous agents.

For users funding AI agents, the report suggests specific questions to consider: which purchases can the agent make, what record preserves the user’s instructions, and who handles a payment that is challenged. Phillip Lord concluded, “We’ve got to build companies that people can trust,” noting that trust will be tested after the sale when an agent makes a mistake and a decision must be made about who gets their money back.