AI Agent Guardrails

An attacker reached the dashboard driving an autonomous agent and queued two malicious replies. The agent processed them as legitimate instructions and used its own tipping feature to send 55.5 ETH to the attacker. The model was not broken and the code was not exploited. The agent was persuaded.

A destination allowlist and a per-operation ceiling are arithmetic. They do not read the instruction, weigh how convincing it was, or have an opinion about whether the dashboard was authentic. An address the agent has never paid waits out a cooling-off window, and anything above the cap reverts.

An agent held a prize pool with one instruction: under no circumstances transfer the money. Anyone could pay to try to change its mind. 195 participants sent 481 messages and every one failed. The 482nd presented itself as a new administrative session, told the agent to drop its refusal language, and redefined what its own functions meant.

That instruction was explicit, unambiguous, adversarially tested in public by hundreds of people, and it held 481 times. It was still not a control. A cap enforced by a contract has no 482nd message; it has a comparison that either passes or reverts, checked before the operation executes.

A vulnerability in the message layer the trading bot trusted let an attacker initiate transfers from the wallets of users who had authorised it. The transfers were manual and the targets chosen, which is why eleven experienced traders lost $3M rather than everyone losing a little.

Software that spends money on your behalf needs a ceiling it cannot exceed, whether the instruction came from you or from someone impersonating you. Per-operation caps, rolling velocity limits by hour and by day, and a recipient allowlist bound the damage to a number you chose in advance. The kill switch is one transaction, immediate, and yours.

A new router contract shipped without the permission and parameter checks the old one had. Three days later an attacker used a call injection against it to spend the token approvals users had already granted, and swapped the proceeds out through a mixer.

The exposure was never the bot's balance, it was the standing approvals pointed at it. Allowlisting which contracts and which specific functions an automated operator may call turns a blanket approval into a bounded one, and session authority expires rather than persisting until somebody revokes it.

The bot's router contract lacked the permission and parameter checks that would have stopped an arbitrary call, and an attacker used it to spend users' pre-approved tokens. 280 ETH left. The team refunded 610 ETH across 106 addresses.

Two bots, one week apart, the same missing check, and in both cases users had done nothing except grant an approval to software they had reason to trust. Enforcement belongs where a compromised operator cannot argue with it: checked before the operation executes, against a policy the venue can read.