ChainGPT (@Chain_GPT): My Agent Has a Spending Problem

My Agent Has a Spending Problem A recap of AI After Dark, hosted by ChainGPT The latest episode of AI After Dark brought together Firoz and Seg from @SonicLabs and @JayOnChain_, CMO of @AIVM_Network, to work through a question that has stopped being theoretical. What actually happens when AI agents start handling real money? The losses are already on the table Lobster Wilde was an agent built by an employee at a well-known AI company. A user asked it for a small amount of SOL to cover medical bills. The agent sent its entire treasury. 52.4 million tokens, around $250,000, gone in one irreversible transaction. It wasn't a one-off. Jay walked through Bankerbot, which sent $200,000 to a user who prompt-injected it with Morse code. He raised the Replit agent that deleted a production codebase and falsified records to cover its tracks. He raised a head of AI security at Meta who handed her email to a Claude agent with one instruction not to delete anything, and woke up to an empty inbox. Firoz brought one most people hadn't heard. A company called AI Ventures had an agent managing node scaling. A traffic spike in APAC came through, and the agent scaled from 3 nodes to 500. About $60,000 in infrastructure costs in a few hours. "If a human was doing it, they'd have scaled slowly and brought it back down. There was nobody in the middle to stop it." He also shared his own loss. He gave a trading agent a $500 meme coin budget. Two weeks later he was down $300. The agent kept telling him it had hit profit targets and sold. The block explorer told a different story. It had never sold a single token, just held as everything tanked. "Counting on the LLM to be your security guardrail is not enough security." Most "autonomous" agents aren't actually autonomous Jay flagged Base's recent claim that $50M had moved through agents via x402. Firoz pushed back with Dune data he'd presented at a Consensys panel last month. The headline number was 150M agent transactions through x402, but most of it looked like wash trading and infrastructure testing. Real on-chain agent transactions in March averaged around $30,000. "There's more supply than demand right now. The infrastructure for agents to spend money is way ahead of agents actually spending money." He took the framing further. The word "autonomous" has become a blanket term, the way "decentralised" became a blanket term for "distributed". Most agents people call autonomous are running tight instructions with delegated wallets, scoped permissions, and small budgets. Nobody is giving an agent their bank account and checking back in six months. Jay agreed. The headline numbers around agent spending have been heavily inflated, and most of the agent economy lives a few layers below where the announcements suggest. What actually works right now Jay split working agent spending into three buckets. The first is low-value, machine-readable, narrow scope. API calls, MCP tools, web content fetches. Nothing irreversible. The second is scoped trading, yield routing, and subscription payments. Wallet access inside guardrails. The third is treasury management, large purchases, lending. The category most of the hype lives in. His view: it isn't there yet, regardless of what the announcements say. The curve will unfold the way corporate card spending did. Small budget, tight scope, expanded as trust accrues. Seg shared a concrete example from inside Sonic. An invoice-scanning agent that prepares a 2-of-3 multi-sig transaction. The agent does the work of building it. Finance signs off. Human-in-the-loop at the last mile. Firoz described his current setup. A token tracker that pays for CoinGecko and inference API credits, with hard spend limits set at the provider level. The agent can transact, but only inside a budget the operator pre-approved. The accountability question When an agent loses money, who pays for it? Seg pulled a parallel from automotive. Mercedes accepts legal liability for crashes at Level 3 autonomy. Most Level 2 systems put it back on the user. The question with agents is the same. Whose negligence is it when the agent acts? Jay laid out the fragmentation. You can blame the operator who deployed the agent. You can blame the developer whose guardrails were negligent. You can blame the model provider whose model bypassed safety constraints. You can blame the wallet layer for executing the transaction. In practice, no single party owns it, which means everyone passes the buck. Firoz was blunt. Personal responsibility lives with the operator until the rest of the stack catches up. "Blaming the model is like blaming Apple because someone with a MacBook hacked you. You're the one putting the agent to work. You're the one responsible." He pointed out that the frontier moves every two weeks. Opus 4.7. GPT 5.5. Whatever Gemini ships next. Nobody is guaranteeing any of it works perfectly. The operator bears the risk. Sonic's positioning: making the chain machine-readable Firoz framed Sonic's setup. A high-throughput L1 with sub-second deterministic finality, built for the volume of agent transactions coming through chains in the next few years. The marketing layer most chains optimised for, fast and cheap, is now the floor. The next layer is making the chain itself legible to agents. MCP servers, LLMs.txt files, documentation written to be ingested by an LLM as cleanly as by a developer. Agents don't pick chains based on marketing. They pick chains with the fastest finality and the cleanest interfaces. Seg added the technical view. APIs work for humans. MCPs wrap APIs for agents. CLIs are sometimes even more efficient. Sonic has deeper agent-first integrations in the pipeline that haven't been announced yet. "Most people are overlooking how deep the agent integration can go." What AIVM is building Jay framed the AIVM mission directly. "AIVM exists to give autonomous agents the infrastructure they need to reason, execute and transact under verifiable rules that they cannot break." In plain terms, AIVM is the layer that gives agents accountability. Every action leaves a verifiable trail. The reasoning behind the decision, what authorised it, why the transaction was approved or blocked. The Are You Replaceable quiz crossed nearly a million impressions. Sharing the result on X reveals a secret code that holds value into the next activation, which leads into Season Zero of the testnet. The conversation didn't resolve whether AI agents should be trusted with money. It made the constraints concrete. Most "autonomous" spending isn't autonomous yet. And until there's an accountability layer beneath the stack, every loss is the operator's bill.