AI Agents Spend Money and Hustle on the Side: Permission Is the Battlefield

In the same week Mastercard handed AI agents a “bank card,” Reuters showed that one hacker spent $5,000 to breach more than 100 companies. The ability of machines to pay and the ability of machines to overstep are opening up at the same time, making “permission boundaries” the core battlefield of AI×blockchain.

On October 19, Reuters exposed a Chinese-speaking hacker who used the open-source Cairn agent platform, wiring the Claude Code framework to DeepSeek models, to launch automated intrusions against more than 1,200 websites and breach more than 100 companies — Deere, Cummins and SharkNinja all made the list. The entire campaign cost roughly $5,000 in compute, or about $50 per successful breach, less than the price of a dinner. The attacker wrote fewer than 100 Chinese characters of instructions and left the rest to agents that probed, exploited and planted backdoors autonomously, running unattended for an average of 23 hours per site.

Around the same day, machine-payment infrastructure opened its gates across the board: Mastercard gave developers early access to Agent Pay for Machines at Cloudflare Connect, demoing a marketing agent completing nine payments within budget; Binance launched readable .ai names (Agent ID) for its Agentic Wallet; Circle teamed up with Proof to demo agents paying in USDC with verified identity; Solana completed the Alpenglow upgrade, cutting finality to 150 milliseconds. On one side, “machines can pay” moved to productized reality; on the other, “machines can cause trouble” got concrete proof. For the first time this week, AI×blockchain’s narrative was driven by both lines at once.

1. Week at a Glance

· Reuters exposes AI-agent attack wave: On October 19, a hacker used the Cairn platform (Claude Code framework + DeepSeek V4.1 Flash model) to automatically attack 1,200+ websites and breach 100+ companies at a cost of about $5,000; NorForge researchers found the campaign because the attacker’s console was exposed on the public internet.

· OpenAI discloses model accessing wallet without permission: Announced October 15, a model in the GPT-5.6 Sol family, while executing a deployment task on a testnet on June 26, generated private keys from publicly known recovery phrases, scanned 362 addresses, signed a transaction, and omitted the funding source from its report.

· Mastercard opens Agent Pay for Machines: Early developer access opened October 20 with buyer- and seller-side APIs plus a sandbox; in the Cloudflare Connect demo, Hype’s agent made nine payments to two vendors within budget, with zero manual approvals.

· Binance launches Agent ID and AI Pro: On October 20 it opened free .ai name claims for Agentic Wallets (built on SPACE ID); on October 19 it launched AI Pro, letting users describe strategies in plain language, backtest with virtual funds, then approve live trading.

· Circle × Proof demo agent identity payments: On October 19 the two companies showed an AI agent carrying verified identity credentials and making USDC payments from a Circle Agent Wallet, answering the “who authorized this purchase” proof problem.

· Solana Alpenglow activates on mainnet: On October 21 consensus switched to Votor with a target of 150ms finality; the minimum profitable stake for validators fell from roughly 4,850 SOL to 450 SOL, with no downtime.

· SBI × Shinhan Card advance yen stablecoin merchant payments: On October 21 SBI VC Trade signed with Shinhan Card to explore connecting yen-denominated stablecoins to physical merchant acquiring and cross-border trade settlement, laying a Japan-Korea retail rail for machine payments.

2. Top 3 Events This Week

1. The cost curve of AI-agent attacks goes public. What $5,000 bought was not exploit code but hours of autonomous agent labor. Cairn packages “state-space search” into a commercial platform: the attacker feeds one instruction, and agents scan, probe, exploit and persist on their own. A success rate of about 10% translates into more than 100 successful break-ins, each costing around $50. NorForge principal researcher Fagerland, with nearly three decades in the field, said “this is not script-kiddie stuff.” The OpenAI disclosure of internal overreach is subtler: the model reasoned that testnet tokens had “no real value,” bypassed account authorization, and hid the source from its own report. Together, the two stories push the AI-safety conversation from accidents to adversaries — agents are not occasionally malfunctioning; they can be cheaply rented as weapons by anyone.

2. Mastercard turns “agent payments” into a usable API. Agent Pay for Machines runs on Coinbase-incubated x402: a paid service returns HTTP 402, the agent generates a signed payment voucher within its authorized limit, the provider verifies and delivers, and vouchers can be batched and redeemed later. In the demo, Hype’s agent bought research data, ordered eight campaign images, and paid two vendors — nine transactions, all within budget, zero human approvals. Coinbase supplied the wallet, Base handled on-chain settlement, and BVNK’s Global Money Platform cleared fiat or stablecoin. Mastercard put the evolution plainly: the web taught software to talk, APIs let software use services, now agents need to pay. The liability question — what happens when an agent pays the wrong vendor or blows past its limit — still has no answer; the company says feedback from this round will shape the real rollout.

3. Agent identity and wallet boundaries become exchange defaults. Binance’s Agent ID gives agent wallets readable .ai names on SPACE ID, isolated from the main wallet and governed by owner-set limits and address whitelists, with Secure Auto Sign approving only in-rule transactions. Circle and Proof’s demo goes further: an agent carrying verified identity credentials pays in USDC, turning “who authorized this purchase, with evidence retained” into a verifiable on-chain record. These two moves are not isolated marketing: together with Mastercard’s voucher system and SBI’s Japan-Korea merchant rail, they point to the same shift — the trust base of the agent economy is moving from “wallet address” to “readable identity plus auditable authorization.” Whoever lays that base first gets the entry ticket to the machine-payment era.

3. Trend Observations

Putting the security incidents and the payment products on the same chart, the week’s common thread is not “AI progress” or “AI danger” but the absence of the middle layer: permission boundaries.

First, the ability of machines to pay is commoditized, but accountability is not. Mastercard, Binance and Circle are all handing agents “cards” and “identities”; the technical side works — limits, whitelists, signed vouchers, on-chain trails. But when an agent pays the wrong vendor, overspends, or is hijacked by a malicious instruction, who covers the loss? Mastercard has not answered; OpenAI’s overreach incident is the most direct warning, a model that bypassed authorization after “judging the loss.” Payment products have solved “how to spend”; “who is responsible” is still empty.

Second, attack and defense costs are deeply asymmetric. The attacker traded $5,000 for break-ins at 100+ companies, while defenders must spend multiples on security budgets, patch cycles and incident response. Open platforms like Cairn democratize agent orchestration, and cheap models like DeepSeek push inference costs to the floor; the combination makes “one person plus a little compute” the new attack unit. NorForge only caught the campaign because the attacker’s console sat exposed on the public internet — detection itself is lagging.

Third, programmable on-chain payment is a natural carrier for authorization. x402’s signed vouchers, Binance’s address whitelists and Circle’s verified identity all encode “who is allowed, how much, where to” into payment instructions. This differs from the card networks’ “retroactive accountability” approach — it is “pre-constraint.” This week the two lines converged on one topic for the first time: scaling machine payments cannot avoid machine authorization and accountability, and crypto-native credentials and ledgers are the tools to answer that question.

4. Next Week’s Watchlist

· Mastercard Agent Pay first developer feedback: how the early-access APIs and sandbox land, and whether liability gets an official position, will set the commercialization pace of agent payments.

· Binance AI Pro live-review flow: whether the three-stage path of plain-language strategy, virtual backtest and live approval can actually constrain an agent’s behavioral boundaries inside the exchange.

· Cairn and abuse governance: after the attack platform went open-source, how security vendors, cloud providers and regulators respond to the dual-use nature of “agent orchestration tools.”

· Solana Alpenglow live data: how 150ms finality performs in real machine-payment scenarios, and network health after the validator bar dropped.