AI Agent Payment Errors Often Start Outside Wallets

An AI agent that sends money to the wrong recipient usually executes a destination supplied by another system. In documented cases, attackers changed that data without compromising the wallet or its signing process.

Methods include hidden instructions in tool descriptions, fake software packages, altered payee or tool records, and malicious servers that redirect requests to trusted services. One scan found 1,862 publicly accessible servers that responded to unauthenticated requests. An April 2026 analysis counted about 200,000 vulnerable instances across a software supply chain with more than 150 million package downloads.

In one case, the postmark-mcp package presented itself as an email integration and released 15 clean versions. A later version copied outgoing email to an attacker-controlled address and affected an estimated 300 organisations. Another technique, called cross-server shadowing, uses instructions from a malicious server to influence requests sent to other servers trusted by the agent.

Approving a payee or integration once does not ensure that its destination will remain unchanged. Tool definitions and payment records may be modified after approval without requiring a new confirmation. In a payment system, an attacker could replace a supplier’s address weeks after approval while the agent continues to treat the record as trusted.

Security researchers and developers are testing controls that link tool definitions to specific versions and use cryptographic checks to detect changes. A modified tool or payee record would then require fresh approval. Version pinning, checks on software sources and alerts for changes can provide additional controls.

Older fraud methods also affect automated payment systems. Address poisoning places a small transfer from a lookalike address in a transaction history, hoping that a later payment will be copied from it. Payment-instruction fraud uses a fake or compromised supplier message to request a change in payment details. An agent that does not compare the new details with a separate record may accept the request.

Spending limits do not prevent a payment of the approved amount from going to the wrong recipient. An allowlist maintained outside the agent can block payments to new addresses. A change to a payee’s details can be treated as a new counterparty request that requires a second approval.

Companies can verify payment-detail changes through a previously confirmed phone number instead of replying to the message that requested the change. A small test transfer can be used for a new destination. Alerts for unexplained small incoming payments can help identify address-poisoning attempts. First payments to unknown counterparties can remain on reversible payment rails until the relationship is established.

Stablecoin transfers are generally final after confirmation. Issuers may freeze tokens at a destination, but they generally act after law-enforcement requests or legal process rather than solely on a victim’s email. Tether has reported freezing more than $4.4 billion in assets through cooperation with more than 340 agencies in 65 countries. Circle says it acts when legally required or at the request of law enforcement.

Victims should record the transaction hash, destination address, blockchain network, amount and timestamp. They should report the fraud to law enforcement and contact any exchange or custodial service that received the funds. A freeze prevents further movement but does not return the assets. Recovery may require additional legal action.