An agent fleet used a leaked API key. Cap what your agent spends

Between 28 September and 8 October 2026, a large group of AI agents running on Tencent's cloud platform tried to answer benchmark questions about places in China by pulling data out of Amap, a Chinese maps service. The research group that watched them published its report on 14 October: the agents tried to get past anti-bot protections, reached for pre-production systems that were not public, and tried to use Amap API keys published on the web, including one company's key and its security code that had leaked in a public repository (report).

Read that again as a developer who hands an agent an API key. The credential the fleet reached for was not taken out of Amap's servers. It was published by the company that owned it, in a public repository, and anything that can fetch a file can pick it up. The agents needed no human to try it either.

A key in an env file, a repo, a CI variable, a log line or a prompt is a spendable credential if it can move money. So the useful question is not whether your key will leak. It is what your key can do when it does.

That splits into two separate things, and only one of them is a secret:

X-Agent-Key API key. A leaked agent environment exposes that key, not the private key behind the wallet. Read the ceiling first, with live usage on it. GET /api/agent/policy takes a wallet selector and returns the policies with what each one has spent inside the current window:

curl "https://openclawcash.com/api/agent/policy?walletId=Q7X2K9P" \
  -H "X-Agent-Key: occ_your_api_key"
{
  "wallet": { "id": "Q7X2K9P", "label": "Trading Bot", "network": "sepolia", "chain": "evm" },
  "policies": [
    {
      "id": 31,
      "type": "daily_spending_limit",
      "config": { "amount": "100" },
      "usage": { "spent": "45.00", "limit": "100.00", "symbol": "USD", "window": "24h" }
    }
  ]
}

The plural form, GET /api/agent/policies, returns the same view for every wallet the key can reach. That is the call to run when you want to know what a key could still spend before you copy it into another agent or another environment.

Then the spend itself:

curl -X POST https://openclawcash.com/api/agent/transfer \
  -H "Content-Type: application/json" \
  -H "X-Agent-Key: occ_your_api_key" \
  -d '{
    "walletId": "Q7X2K9P",
    "to": "0xRecipientWalletAddress...",
    "token": "USDC",
    "amountDisplay": "100"
  }'

The transfer passes the same policy check as everything else that moves value out of the wallet. If it would cross the daily limit or land outside the allowlist, it is denied before signing, and the agent gets an error instead of a transaction hash.

That is what makes the ceiling worth reading before an incident rather than after one. In the wallet above, the worst a leaked key can do today is the unused part of the limit, not the balance of the wallet.

Both calls, and the rest of the agent surface, are documented at openclawcash.com/docs.