Unauthorised transactions or spend
An agent pays, trades, orders or commits money nobody authorised.
NIST AI 600-1 · No exact NIST AI 600-1 categoryFSB agentic AI consultation (2026)OWASP Agentic ASI02
5incidents (primary) · 5 more as secondary
1read for controls · 4 not yet
1fixes reported
0repeats after a fix
Incidents per month
No rise: 1 in Oct 2026, against an average of 0.3 over the 3 months before.
Developers
OpenAI · 1
Where the chain broke
| Part of the system | Incidents where the control was not effective or did not exist | Incidents where the control was effective | Incidents where sources don't mention the control | Incidents not yet checked for controls |
|---|---|---|---|---|
| L1 Model Model provider | 1 | 4 | ||
| L2 Harness Agent framework vendor | 1 | 4 | ||
| L3 Application Deployer | 1 | 4 | ||
| L4 Infrastructure / target Organisation hit | 1 | 4 |
Controls for this risk, by layer
| Control | Incidents where the control was not effective or did not exist | Incidents where the control was effective | Incidents where sources don't mention the control | Most common reason it was not effective |
|---|---|---|---|---|
| Separate identity for each agent L3 Application | 1 | |||
| Rate and spend limits L3 Application | 1 | |||
| Payment mandates and transaction limits L3 Application | 1 | |||
| Human approval for high-impact actions L3 Application | 1 | |||
| Undo for agent actions L3 Application | 1 | |||
| Alerts on unusual tool use L3 Application | 1 | |||
| Out-of-band verification of payment and identity requests L4 Infrastructure / target | 1 |
7 of 7 controls for this risk not yet recorded as effective.
Fixes reported and what followed
| Incident | Control added by the fix | Incidents after the fix |
|---|---|---|
| LR-2026-0793 2026-10-16 · OpenAI Fix reported | Not tied to a control | No repeat on record |
| LR-2026-0606 2026-05-09 Advice in source, not a fix by the party | Not tied to a control |
Incidents
EffectiveNot effectiveNot effective (bypassed)Did not existNot stated in sourcesNot yet checkedAttacker's ownOrder: model · harness · application · target
| Date | Incident | Risk | Where it failed | Controls mentioned in sources |
|---|---|---|---|---|
| 2026-10-16 | OpenAI discloses four more rogue incidents involving financial, medical and government data OpenAI |
Unauthorised transactions or spend | Not yet checked | |
| 2026-09-04 | Video call with fake participants led to $25 million transfer | Unauthorised transactions or spend | Not yet checked | |
| 2026-05-09 | AI agent bogus scan leaves developer begging for crypto donations | Unauthorised transactions or spend | Not yet checked | |
| 2026-05-01 | Grok and Bankr prompt-injected via Morse code to transfer DRB tokens; 14 Bankr wallets later drained | Unauthorised transactions or spend | ||
| 2026-02-25 | Lobstar Wilde AI crypto agent sends 52.4M LOBSTAR tokens to a random user | Unauthorised transactions or spend | Not yet checked |
Also under this risk as a secondary risk: LR-2026-0273, LR-2026-0648, LR-2026-0545, LR-2026-0501, LR-2026-0422