How it fails
The animation steps through one representative failure and the control that stops it. Use the arrow buttons to go at your own pace.
Overview
An agent creates an economic or contractual effect beyond the person's accepted terms, including a mistaken purchase, recurring charge, cancellation, or resource bill. The entry protects the exact commitment and its cumulative effect. Outcomes can follow benign misunderstanding even when every login is legitimate.
Common examples of vulnerability
- A nonrefundable booking is made for the wrong dates.
- A free trial or comparison step accepts a recurring subscription.
- A payment is repeated after a timeout with unknown outcome.
- Many purchases below the per-action cap exceed the intended total.
- A self-hosted agent loops and burns the person's paid API quota.
- Terms change between approval and execution and the old approval is reused.
Example attack scenarios
Documented scenarios generalize a real case listed below. Hypothetical scenarios have no matching public case yet.
Scenario 1: Research request becomes a purchase Documented
A person asks an agent to find the cheapest dozen eggs for delivery. The agent places an order with a saved card, picks a more expensive option than one it already found, and misreports the total.
Scenario 2: Many small commitments exceed the budget Documented
An assistant accepts one discount, refund, or purchase after another, each small, until the total is well past what the person intended.
Scenario 3: Units error sends the whole balance Documented
An agent that holds funds loses state, misreads a token balance or decimal, and sends a vast amount where a trivial amount was intended.
Scenario 4: Retry loop burns paid quota overnight Documented
A self-hosted agent loops on a failing tool call. With no budget cap or call limit, it keeps paying for model calls until the person notices the bill.
Real-world cases
Dated and sourced. Nothing here shows how common the failure is; it shows that it has happened or been demonstrated.
OpenAI Operator buys eggs a columnist only asked it to find
- What happened
- The Washington Post's Geoffrey Fowler asked Operator to find the cheapest dozen eggs for delivery. It ordered a dozen on Instacart for $13.19 (more than double the $5.99 it had found elsewhere) using a card saved on his account; fees and tip made the total $31.43, and Operator reported it as $19.68. He learned of it from a card alert. OpenAI said Operator should have asked for confirmation, told him it made a mistake and fell short of its safeguards, and said it was examining why Operator 'occasionally doesn't send confirmations'.
- Caveats
- Read via a syndicated copy of the column (Anchorage Daily News); the original Washington Post page was not opened. Small amount, but a clear instance of a missing confirmation on a purchase.
- Grounds
- Scenario 1
- Sources
- Fowler column (Anchorage Daily News reprint) · AI Incident Database #1028
Project Vend: an agent running a small shop gives discounts under pressure and sells below cost
- What happened
- In Anthropic's month-long experiment, a Claude-based shopkeeper ('Claudius') was talked into many discount codes over Slack, let customers lower quoted prices after the fact, gave some items away, priced items without research, and bought metal cubes it then sold for less than it paid. Anthropic concluded it 'would not hire Claudius' as configured.
- Caveats
- A small business run in Anthropic's office, not a personal agent. Anthropic says weak scaffolding explains many failures; no dollar total is stated in the post.
- Grounds
- Scenario 2
- Sources
- Anthropic, Project Vend
Lobstar Wilde sends about $442,000 of tokens in a single transaction
- What happened
- On 22 February 2026 at 4:32 pm UTC, an autonomous trading agent given $50,000 of Solana and the instruction 'make no mistakes' sent about 52.4 million LOBSTAR tokens (about $441,788) in one transaction to a user who had asked for 4 SOL. The agent later admitted the error and lost its whole holdings; the recipient sold part for roughly $40,000. Other accounts say a session crash wiped the agent's memory and it misread its token balance.
- Caveats
- The builder's explanation is not in the report; the decimal-misread theory comes from an outside X user, valuations range from about $250,000 to $450,000, and some observers suspect marketing staging. A crypto agent, not a consumer personal agent.
- Grounds
- Scenario 3
- Sources
- Cointelegraph · CCN
Runaway agent loops that run up model bills
- What happened
- Practitioner write-ups describe agents stuck in loops without budget caps: a policy database lists a four-agent LangChain/A2A pipeline reportedly costing $47,000 before anyone noticed, another reports 14,000 redundant tool calls ending in a $437 charge, and one reports a developer burning $6,000 of Claude Code credits overnight. A static-analysis study of 6,549 agent repositories found 68 confirmed infinite-loop failures across 47 projects.
- Caveats
- The dollar figures are anecdotes from blogs and a vendor database; the underlying posts were not reviewed, so they are unverified. The repository study is the more reliable evidence that the failure mode exists.
- Grounds
- Scenario 4
- Sources
- PolicyLayer attack entry · DevToolPicks on runaway Claude Code sessions
Prevention and mitigation
What you can do
- Set cumulative budgets (per day and per month), not only per-transaction limits.
- Review material, recurring, or irreversible commitments before they execute.
- Check receipts at the merchant or card statement, not only the agent's report.
What the provider must do
- Bind approval to payee, total amount and currency, fees, dates, recurring terms, and cancellation consequences; changed terms require renewed approval.
- Enforce aggregate limits, idempotency keys, transaction-status checks, and resource caps outside the model.
- Block execution when material terms are uncertain.
- Use scoped, single-use or merchant-bound payment credentials; resist replay and re-binding of approvals.
Where a safeguard is unavailable, offer a narrower mode such as read-only access or manual completion rather than rely on an instruction to the model.
See the reference guard controls for PAA06 →
Test it
Framework crosswalk
Related mechanisms in other OWASP work. This is an analytical mapping, not equivalence.
Top 10 for Agentic Applications 2026Personal focus: Cumulative personal spending and consequential commitments.
Improve this entry on GitHub →