Chris MihosThe useful question about an AI agent isn’t how clever it is, but what it’s allowed to do when it gets something wrong.
An AI agent that can act on capital should only ever do so under permissions that are explicit, limited and revocable: which assets it can touch, which actions it can take, how much it can move and where, when it needs a human to approve, and how quickly that authority can be revoked. That matters because agents make mistakes, can be manipulated by the content they read, and act at machine speed, so the permissions around them are what decide whether an error costs a little or everything. The right model already exists in institutional finance, where a manager is given the right to trade but never the right to move assets out, and agents need the same line: the right to act within rules you set, but never the right to move assets out.
Agents can now act, not just advise
Until recently, AI in finance mostly produced words, such as summaries, plans and answers to questions, but that has changed quickly. Since May 2026, Robinhood has let customers connect agents such as Claude and ChatGPT to a dedicated account for live stock trading, while making clear that it doesn’t supervise the agents and that customers are responsible for every trade. Google’s Agent Payments Protocol, launched in September 2025, lets agents make purchases using signed “mandates” that set out what the user has authorised, including spending limits, time windows and the kinds of merchant allowed. FINRA’s 2026 oversight report flagged autonomous agents as needing new supervision frameworks.
Once an agent can act, the most important design decision is no longer which model it uses. It’s what the agent is permitted to do, and what happens when it does something it shouldn’t.
What happens when permissions are too broad
In May 2026, an X user drained roughly $150,000 to $174,000 of tokens from a wallet linked to Grok through Bankr, a trading agent that creates wallets for accounts it interacts with. The attacker first sent the wallet a membership token that, within that system, granted the agent elevated permissions which bypassed its normal transfer limits. They then asked Grok to translate a message written in Morse code. The decoded text was an instruction to send the tokens to the attacker’s address, and the wallet system treated Grok’s translation as a valid command. About 80% of the funds were later returned, but only after the attacker had been identified.
Security researchers described two failures in that incident, using the categories set out by the OWASP project: prompt injection, where instructions hidden in content are treated as commands, and excessive agency, where a system has more authority than its task requires, and both of them are really permission problems. The agent could be given broader powers by something it received, and it could act on text it had merely read.
Earlier in the year, an experimental agent built with $50,000 and an instruction to “make no mistakes” sent away somewhere between $250,000 and $440,000 when it was asked for a small tip. And in the Binance theft of about $6.3 billion in October 2026, blockchain analysts found that the attackers had used a delegation mechanism with dozens of pre-signed authorisations to sweep assets from Binance’s hot wallet in minutes. Delegated authority is a powerful tool, and whoever controls it controls the assets behind it.
The principles of permissioned activity
The first principle is least privilege, which means an agent should have only the authority its task requires, so an agent that keeps a portfolio at the weights you chose needs to propose allocation changes within that portfolio, but it doesn’t need to send assets anywhere else, and it shouldn’t be able to.
The second is to separate the right to act from the right to move. This is the line that institutional allocators draw with every external manager, who may trade but not withdraw, and it’s the single most effective protection against both mistakes and manipulation, because an agent that can’t move assets out can’t be tricked into sending them to an attacker.
The third is to set hard limits that the agent can’t change. Per-transaction and daily limits, approved destinations, permitted assets and time windows should be enforced by the infrastructure underneath the agent rather than by instructions given to it, and no message, token or document the agent receives should be able to expand them.
The fourth is to require a human, or several humans, for anything irreversible. Moving assets to a new destination, raising a limit or changing who can sign should need explicit approval from the owner, ideally from more than one person, verified on their own device.
The fifth is that permissions should be revocable and visible. The owner should be able to see exactly what an agent is allowed to do, review a record of what it has done, and revoke its authority immediately.
An agent should follow your rules, but it should never be the thing that holds the keys.
Why this matters for the three things that decide outcomes
Permissioned agents reduce structural risk, because the worst an agent can do is bounded by limits it can’t override. They protect liquidity, because an agent can’t commit capital to something you can’t get out of unless you’ve allowed it. And they make access genuinely yours, because you decide what any interface, human or AI, can see and do with your capital. They also help with the psychology of money, since the rules an agent follows are the ones you set in a calm moment, not the ones that occur to it, or to you, in a volatile one.
How MakeBanc approaches permissions
MakeBanc is built around the same separation that permissioned agents need. Your assets sit with an institutional custodian in a vault that you sign for. The independent manager you choose, whether they trade by hand, with models or with both, can trade but can never move the assets out, and MakeBanc never holds the keys. You can require two or three named signers before anything changes, and you can verify the arrangement on a public ledger at any time.
MakeBanc’s own agent, which is coming soon, is built the same way. It doesn’t trade, and it doesn’t make decisions on your behalf: it follows the allocation rules you set, and prepares each move for you to sign from your own wallet. Trading is done only by the independent manager you choose. Its role is to keep the structure around your assets clear, so that whatever acts on them does so within limits you control.
Frequently asked questions
How should AI agents be given permission to act on money? Under permissions that are explicit, limited and revocable. An agent should have only the authority its task needs, should follow rules you set rather than trade or move assets on its own judgement, should work within hard limits enforced by the infrastructure rather than by instructions, and should need human approval for anything irreversible.
What is excessive agency in AI? Excessive agency is when an AI system has more authority than its task requires, so that a mistake or a manipulated instruction can cause serious harm. It’s one of the risks listed by the OWASP project for applications built on large language models, alongside prompt injection.
What is prompt injection, and why does it matter for agents that handle money? Prompt injection is when instructions hidden in content an AI reads, such as a message, a document or encoded text, are treated as commands. For an agent with authority over money, it can lead to unauthorised transfers, as in the May 2026 incident in which a Grok-linked wallet was drained after the agent translated a Morse code message containing a transfer instruction.
What is an AP2 mandate? In Google’s Agent Payments Protocol, a mandate is a cryptographically signed record of what a user has authorised an agent to do, such as spending limits, time windows and permitted merchants, which payment networks can use as proof of the user’s intent.
Sources
- Giskard, How Grok got prompt-injected: an X user drained $150,000 from an AI wallet, 7 May 2026
- Cointelegraph, Grok, Bankr wallet and the free NFT prompt injection, May 2026
- OECD AI Incidents Monitor, AI prompt injection exploit drains Grok-linked crypto wallet, May 2026
- TechCrunch, Google launches new protocol for agent-driven purchases, 16 September 2025
- Robinhood Newsroom, Robinhood is now open to agents, 27 May 2026
- InvestmentNews, Robinhood just made a bold move into AI-powered trading
- The Crypto Times, AI agent accidentally sends $450K, February 2026
- TRM Labs, North Korea steals USD 6.36 billion from Binance, October 2026
MakeBanc is a technology platform that connects capital owners with independent strategy operators. MakeBanc does not provide investment advice, custody services or banking services, and its agent does not trade, give advice or move assets without your signature. Nothing here is an offer or invitation to allocate to any strategy.