BeInCrypto’s State of AI Agent Payments 2026 report analyzed 6.4 million transactions processed over 35 days via the x402 protocol on the Base and Solana blockchains. While more than 90% of these transactions were valued at less than one cent, the data highlights a growing trend of businesses granting AI agents autonomous spending authority.
The report identifies significant security risks despite the use of human-defined spending limits. In May 2026, an incident involving Grok and the transaction service Bankr resulted in an unauthorized transfer of tokens worth $175 000 after an attacker used Morse code to manipulate the AI. Another breach involving the AIXBT dashboard led to the loss of ETH valued at $106 200.
In total, these two incidents involved $281 200, though 80% of the funds from the Bankr incident were recovered. Experts suggest that businesses should implement stricter controls, such as limiting agent authority to specific tasks, requiring manual confirmation for trades, and maintaining continuous monitoring to prevent malicious actors from exploiting automated payment workflows.
Zoomex, which collaborated on the report, advocates for a principle of least privilege where agents receive only the minimum authority necessary for their functions. The FCA also emphasized that human oversight must be substantive rather than a mere formality, urging companies to combine technical safeguards with rigorous, ongoing verification processes.
