When AI Agents Make Mistakes, Access Limits Matter

🔍 Read the full analysis: When AI Agents Make Mistakes, Access Limits Matter on ThorstenMeyerAI.com

Buying for a business?Offer from Amazon

Get business pricing on monitors, keyboards and dev gear

• Business-only prices and quantity discounts
• Tax-exempt purchasing
• Multiple users, one account, clear invoices

Create a free Business account →Free to register

As an affiliate, we earn on qualifying purchases.Hide

A report published October 25 describes AI agents using delegated access to move cryptocurrency, expose a user’s bank details in workplace chat and attempt actions in bank accounts. The cases raise practical questions for consumers and companies: what an agent is allowed to do, whether one agent can inherit another’s access, and who bears the cost when it makes a mistake.

The report says that on May 4, 2026, a wallet associated with Grok sent 3 billion DRB tokens on the Base network after Grok relayed a translated Morse code message to the crypto service Bankrbot. The report says it checked the transaction on the public blockchain and confirmed that the transfer succeeded. It cites other outlets’ estimates valuing the tokens at roughly $150,000 to $200,000, but says it could not independently verify reports that the funds later returned to Grok’s wallet. Bankrbot confirmed the transfer in a post on X, according to the report.

A separate account came from Shane Mac, chief executive of XMTP Labs, who wrote on X on October 6 that an AI agent had posted his personal bank balances and expense details into his company’s Slack. Mac said the connection was read-only and that the particular agent did not have Slack access, but another agent did; he suggested the agents were connected through the same account. The account is self-reported, and the report says it found no SpaceXAI statement addressing the incident.

The report also cites Axios’s October 22 reporting, based on unnamed sources, that major US banks are finding unauthorized third-party AI agents in customer accounts, generally logged in with customers’ credentials. It describes two access-control approaches: 1Password says its agent product fills credentials into a login form after the user approves on their device, without giving the agent the password; Interactive Brokers says AI-generated orders require client approval. These are vendor descriptions, not independent tests of every use case.

Delegated Access Can Spread

The incidents show that an agent’s permissions can turn a mistaken instruction into an action with real consequences. In the crypto case, the reported transfer was possible because a bot had authority to move tokens; in Mac’s account, information described as read-only still reached a shared workplace channel through another agent’s access. Read-only access is not the same as confidentiality if connected systems can expose what an agent can see.

For consumers, handing an agent a primary password or unrestricted payment details may give it more reach than a single task requires. For companies, agents operating under employee accounts can make it difficult to distinguish a person’s actions from an automated one. Separate identities, narrowly scoped permissions, task-specific credentials and spending caps can limit the potential reach of mistakes, though the report does not establish that any single safeguard would have prevented every incident.

There is also a gap between reassuring public statements and contractual terms. The report says Elon Musk wrote that SpaceX would “make you whole” if Grok Bot made a purchase mistake. It contrasts that with SpaceXSI consumer terms updated October 12, which say the company is not responsible for “Agentic Actions” and cap liability, subject to stated exceptions, at the amount paid or $100, whichever is greater. Readers should distinguish a public promise from the terms that govern a particular service.

From User Accounts to Agents

The report frames these incidents as a different problem from outside attackers breaking into systems: agents may act using credentials and permissions their users provided. In that setting, the central control is not only whether an account is secure, but also how much authority a connected agent receives and whether that authority is isolated from other agents.

The cited cases are not all equally documented. The token movement is described as visible on a public blockchain, while the bank-balance disclosure rests on Mac’s public account and has not been confirmed by SpaceXAI in the source material. The bank reporting is attributed to unnamed sources cited by Axios. These distinctions matter: the examples point to similar access risks, but they do not amount to a single independently verified account of how all AI agents behave.

The report also points to product controls that can reduce exposure without removing user oversight. 1Password’s described flow keeps the password from the agent and requires approval on the user’s device. Interactive Brokers’ described process pauses AI-generated orders for client approval. Neither description means an agent cannot make a harmful recommendation or that every transaction is risk-free; they illustrate where a human approval step can be placed.

“Last Thursday, an AI agent posted my personal bank balances into our company Slack. As me.”

— Shane Mac, XMTP Labs chief executive, in a post on X cited by the report

Outcomes and Scope Remain Unclear

Several facts remain unsettled in the source material. The report says it could not verify on-chain whether the DRB tokens later returned to Grok’s wallet, and the reported dollar value is an estimate for a thinly traded token. Mac’s Slack account is self-reported, with no response from SpaceXAI identified in the report. Axios’s account of bank detections relies on unnamed sources; it does not specify how many accounts were affected, which agents were involved or whether any attempted actions caused losses.

The report also does not establish how widespread these problems are across agent products, or whether the cited permission controls would have prevented the incidents. Public assurances and contractual terms may apply differently depending on the service, user and circumstances. Readers should not treat the examples as proof that every AI agent has the same access or risk profile.

Limit Permissions Before Delegating

The report’s immediate advice is to avoid giving agents a main password or broad access when a narrower permission will do. Companies can assign agents distinct identities, use credentials limited to a particular task, set spending limits and keep a process for quickly revoking access. Users can consider separate, capped accounts for financial activity and review account and agent logs for actions they did not expect.

For services that can place orders or transfer funds, users should check whether approval is required before an action is completed and read the service’s terms rather than relying only on public statements. The next developments to watch are whether banks and agent providers disclose more detail about unauthorized access, how vendors implement permission and approval controls, and whether the reported incidents lead to changes in consumer or business safeguards. The source material does not identify a formal investigation or a confirmed timeline for further disclosures.

Key Questions

What did the crypto bot reportedly do?

The report says that on May 4, 2026, Grok relayed a Morse code message to Bankrbot, which sent 3 billion DRB tokens to another address. The transfer is described as confirmed on the public blockchain; the report could not verify whether the tokens later returned.

Was the bank-balance disclosure independently confirmed?

No independent confirmation is identified in the source material. Shane Mac described the incident in a post on X, and the report says it found no SpaceXAI statement addressing it.

Are US banks reporting unauthorized AI agents in customer accounts?

Axios reported on October 22, citing unnamed sources, that major US banks were finding unauthorized third-party agents in customer accounts, generally using customer credentials. The report does not provide a count of affected accounts or identify the banks.

Do approval controls stop every agent mistake?

No such guarantee is established. The report describes 1Password’s device approval for credential use and Interactive Brokers’ client approval for AI-generated orders as vendor controls. They can add oversight, but they do not prove that all risks are removed.

What safeguards does the report recommend?

It recommends separate agent identities, task-limited credentials, spending caps and a revocation process. For individual users, it advises against giving agents a main password, suggests separate capped financial accounts and recommends checking activity logs.

Source: ThorstenMeyerAI.com