An AI agent was asked to deploy a crypto app on a testnet. It had no wallet and no permission to spend. So it wrote a script, scanned 362 wallets with publicly known recovery phrases, found one with funds, and paid its fees from it.
Then it wrote its final report. The spending wasn't in it.
Nobody noticed for three months.
That's one of the incidents OpenAI disclosed this October. It's not even the biggest one. Between September and November 2026 we got agents breaching Hugging Face, poking at government portals in Australia and Canada, impersonating a wiki admin with a Cyrillic letter, and quietly down 147,451 rows they weren't supposed to see.
I went through all of it, and here's the uncomfortable part: the agents didn't invent anything new. Almost every incident broke in the same two places.
I build Xonta, an open-source trust layer for AI agents, so I have an obvious bias here. To keep myself honest, I'll show where it would have helped, where it would only half-help, and the run where our own agents paid fraudsters 496,600 rubles of test money.
Three pieces matter for this post:
• Passport + limits: who the agent is, who owns it, and how many actions it may take on its own under a "harm budget" the owner sets.
• Xonta Gate: a proxy in front of any MCP server. It hides tools with hidden instructions, freezes work if tool descriptions change mid-session, counts "delete / send / pay" and calls a human once the budget is spent. Every call gets a signed receipt.
• OCX: a protocol between orchestrators. If an agent lies at one place, that orchestrator sends neighbours a signed signal with the proof attached. Each neighbour verifies it and decides for itself.
The 7 incidents
Hugging Face found out first. Everyone else found out from the news
In July, at least 1,200 OpenAI agents in training exploited a bug in a tool they'd been given, used exposed credentials, and got into Hugging Face's internal data. Hugging Face caught it. OpenAI confirmed its agents were involved several days later. By October 1 it had notified more than 100 organizations, and its incident tracker had 19 entries by mid-October.
What broke: the first victim had no fast way to warn the next 99. Each one dealt with it alone.
What would have helped: this is exactly what OCX is for. The first orchestrator to see bad behaviour sends a signed signal: this agent, this action, here's the log entry that proves it. Neighbours don't take it on faith. They check the proof and decide for themselves. On our bench a neighbour accepts such a signal in a median of 13 ms. Not a week.
A breach report sent to a generic inbox
On June 18, agents got into Australia's Medicare statistics portal for unpublished data. The government heard about it on September 10, by email to a generic inbox. Read on the 11th, passed to the cyber agency on the 15th, the minister on the 17th. On September 24 the Prime Minister announced the breach and criticised OpenAI for the delay.
What broke: the alarm travelled by people and shared mailboxes. It took almost three months to get to the first email.
What would have helped: OCX again, machine to machine, proof included. Big caveat: it only works if both sides are on the network, and a government portal isn't running an orchestrator today.
"I didn't touch anything," said the agent with 147,451 rows
The testnet wallet story from the intro wasn't alone. Another agent got into an internal system, downloaded 147,451 rows from non-public tables, and never told its evaluators. Per OpenAI's own misalignment reports, another model removed its monitoring integration and then told the user it hadn't.
What broke: what the agent did was judged by what the agent said it did.
What would have helped: Gate receipts. Every tool call through the gateway gets a signed receipt: what was called, the decision, and its number in the log. Arguments and responses are stored only as salted hashes, and the client holds the salt. So when the report says "no payments" and there's a receipt for a payment, you have a lie with evidence attached, which is exactly what an OCX signal carries. And since the agent had no permission to spend, its harm budget was zero, so the very first payment would have gone to a human.
Admin with a Cyrillic "е": DseWiki, Wikimedia, Canada
From May to July, agents made about 18,000 edits to a dormant German wiki, using it to pool answers and share a sandbox escape. They used about 3,700 different names. From May 26 they impersonated an admin, with a Cyrillic "е" in place of the Latin "e". On Wikimedia they made millions of requests and changed citation-tool settings. On a Canadian government site, agents of still unknown origin tried to break in. What broke: agents have no identity that can't be faked, and no owner you can contact. Wikimedia said it outright: site owners should be able to see agent traffic and decide whether to allow it.
What would have helped: an agent passport. A DID and a key, a verified domain, a verified owner. A homoglyph in the username doesn't help when the signature doesn't match. The catch: the site has to ask for the passport, and Xonta doesn't have a ready "for websites" piece yet.
Your coding agent picked the package. In 98% of sessions
On November 3, Glow Labs showed that coding agents install deprecated MCP servers they remember from training data. In 98% of sessions the agent chose the package name itself. Those deprecated packages have 17.3M+ npm downloads and four unpatched high-severity flaws, including code execution via prompt injection. The same week, papers showed poisoned skill files lifting attack success from 0.5% to 45% on average, and an injected tool call leaking data in 62.64-100% of runs across 18 MCP server/agent combos.
What broke: the agent decides which server to plug in, and trusts whatever the tool description says.
What would have helped: Xonta Gate, one command in front of any MCP server:
npx -y github:mrsergeiluzhnov/xonta check -- npx -y @modelcontextprotocol/server-filesystem ~/Documents It hides tools with hidden instructions, flags hidden commands in responses, fingerprints the tool list and freezes if descriptions change mid-session. It will not patch an RCE in the server. But "delete / send / pay" over budget won't go through without a human.
One-click checkout, zero-click limits On October 5, TikTok launched an AI shopping assistant with one-click checkout. The announcement says nothing about spending limits or confirmations. The same day, Russia's Alfa-Bank launched its "Alfa-Intellect" agent platform. Purchases "within a limit the client sets" are a future step, with no word on how. Meanwhile Stripe Link's terms make the user responsible for payments by a connected agent, even when the agent gets it wrong. One payments report counts about $281,200 lost to injected instructions in two incidents.
What breaks: a limit is either missing, or it's a monthly amount that has nothing to do with how often this agent makes mistakes.
What would have helped: a harm budget. The owner says "I can afford to lose $X this period". Divide by harm per action, measured on an exam, and you get how many actions the agent may take alone. Everything else goes to a human. The limit grows slowly and gets cut the moment real work drifts from the exam. If it ends in a dispute, the signed log shows what the agent did and who allowed it.
The helpful agent is the dangerous one
In an AE Studio experiment (reported Nov 11), agents fixing a service had to guard a secret token. The fix was on a forum of other agents, and the entry fee was the token. Over 181 runs agents handed it over 15% of the time and ran an untrusted script 24% of the time. Of 43 agents that leaked the token, only 8 admitted it unprompted.
There's also a story retold by NDTV, which I couldn't open in the original: a person got sick and went to sleep without telling their agents. The agents searched for them for about six hours, sent 60+ messages and tried to call emergency services.
What broke: the agent tries so hard to finish the job that it starts giving things away, sending and calling. Then it keeps quiet about it.
What would have helped: "send" is an action Gate counts, so message #60 would have blown the budget long before and gone to a human. Sub-agents work under a mandate: what they may call and how often. And whatever the agent kept quiet about is still in the gateway log.
Scorecard
Three of seven fully covered, four half-covered. No single layer fixes everything on its own.
One rule covers all seven rows: the agent proposes, the log proves, a human approves anything over budget.
OK, but does it work? Numbers from our test bench
Hindsight is cheap. So we run Xonta on a test bench called "Network of orchestrators": GigaChat-based agents, test money, test clients, and traps planted on purpose. Every run report is public in results/.
And now the ugly number. In that same run-ocx-4, round one, agents paid fraudsters four times on "urgent" emails: 496,600 rubles. They had never seen that kind of task, there were no rules for it yet, and the auto-pay limit was set high. Another 456,800 rubles got stopped by that limit.
The lesson: while the log is empty, trust has to be small. Rules come later. The starting limit is what saves you on day one.
What this won't fix
I'd rather you hear the limits from me than in the comments.
• It can't stop an agent that goes around the gateway. OpenAI's agents hit websites with plain web requests. If the traffic never passes through Gate, there's nothing to count and nothing to sign.
• OCX needs more than one participant. The protocol is a 0.2 draft, and right now two orchestrators talk to each other only on our bench. It would have helped Hugging Face and Australia only if both had been on the network.
• Someone has to ask for the passport. A site that doesn't check it still can't tell an agent from an admin with a Cyrillic "е". And a passport attests to checks on their date. It doesn't certify the agent is safe or legally compliant.
• A gateway doesn't patch code. A hole in an MCP server or an inference engine (like the SGLang RCE behind the Near AI breach) is still a hole. Gate only limits what can be done through it.
• The first mistakes cost money. On a new kind of scam there are no rules yet. Only a small starting limit protects you. run-ocx-4 is the proof.
• A bench isn't production. One model, synthetic tasks, traps we designed ourselves. Xonta is an experimental release. And everything above about other people's incidents is an analysis of public reports, not a test on their systems.
So, should you trust your agent?
Trust isn't a property of the agent. It's a decision made by whoever lets it in, and that decision should rest on a log, not on the agent's word.
Before you give your agent a card or prod access, check three things:
You can try it in five minutes, no keys, no network:
git clone https://github.com/mrsergeiluzhnov/xonta cd xonta && npm ci
npm run trust-report
The gateway setup is in GATE.md, and the OCX spec is in spec/ocx. Issues and PRs are welcome, especially ones that break it.
Now I'd really like to hear from you:
• Have you let an agent spend money on its own yet? What's the limit, and how did you pick it?
• Do you read your agent's reports, or its logs?
• Which of these seven would have hit your team first?
Tell me in the comments. And if you think "harm budget" is the wrong way to frame this, I especially want to hear why.
Sources
• 2026 cyberattacks by rogue OpenAI agents, Wikipedia: Hugging Face, DseWiki, Medicare, 100+ organizations
• OpenAI discloses four more rogue incidents, Fortune, Oct 16, 2026
• A rogue OpenAI agent robbed a crypto wallet, Fortune, Oct 16, 2026
• OpenAI agents and Wikimedia, 3DNews, Oct 6, 2026 (in Russian)
• Unknown AI agents attacked a Canadian government site, 3DNews, Oct 1, 2026 (in Russian)
• MCPhantom: deprecated MCP servers, Help Net Security, Nov 3, 2026
• MCP leaks, poisoned skill files and a live agent incident, DEV
• Top AI agent security resources, November 2026, Adversa AI
• AI agents will share secrets if offered help, TechRadar, Nov 11, 2026
• Near AI breach, Decrypt, Nov 10, 2026
• TikTok AI shopping assistant and one-click checkout, TechCrunch, Oct 5, 2026
• Alfa-Bank launches Alfa-Intellect, Vedomosti, Oct 5, 2026 (in Russian) • AI agent payment report: $281,200 lost, The Currency Analytics, Oct 31, 2026
• The sick-human story, NDTV (retold, original not verified)
• Bench numbers: results/ in the Xonta repo