AI agents are already moving real money on-chain without a human approving each transfer. According to a report published by blockchain security firm Halborn, approximately $73 million in transactions were settled autonomously by AI agents between May 2025 and April 2026. The figure is modest compared to overall stablecoin throughput, but it represents a meaningful shift: machine-initiated payments are no longer theoretical. The report focuses less on the volume and more on what can go wrong, cataloging the authorization gaps, key-management failures, and missing control layers that make agentic payments a genuinely novel security problem rather than a repackaged smart-contract audit.
The $73 Million Baseline and Why It Matters
Halborn’s $73 million estimate spans a twelve-month window and draws from observable agent-protocol activity across major chains. The number is intentionally conservative — it captures settled transactions where an AI agent demonstrably initiated and authorized the payment, excluding human-assisted or manually co-signed flows. For context, daily stablecoin settlement routinely exceeds $150 billion, so agent payments remain a rounding error. But the growth trajectory matters more than the absolute figure. Agent-payment frameworks like x402, Coinbase Agent Payments, and Skyfire have all shipped production infrastructure within this window. Each new deployment expands the surface area where an autonomous system can move funds without real-time human oversight, and that is the scenario Halborn is concerned about.
The Four Attack Surfaces
The report identifies four categories of risk specific to agentic payments. First, private-key compromise: most agent frameworks require access to a signing key, and the prevailing pattern is to load private keys into the agent runtime environment — effectively a hot wallet with autonomous spending authority. Second, transaction-authorization scope: agents are frequently granted unlimited token approvals on the contracts they interact with, meaning a compromised or malfunctioning agent can drain an entire balance rather than exceeding a per-transaction cap. Third, prompt manipulation: because agents derive their instructions from natural-language inputs, an adversarial prompt injection can redirect payment behavior without touching the underlying key material. Fourth, the absence of rate-limiting or circuit-breakers: traditional payment systems embed velocity checks and anomaly detection, but most agent-payment prototypes have no equivalent mechanism to halt spending when behavior deviates from expected patterns.
The Control-Layer Gap
Halborn’s central architectural argument is that agent-payment systems are missing a dedicated control layer between the agent’s decision logic and the wallet’s signing function. In a conventional payment stack, multiple intermediaries — fraud engines, bank risk teams, card-network authorization systems — sit between intent and settlement. Each provides an independent check. Agent-payment protocols collapse this chain. The agent decides, signs, and broadcasts in a single flow, often within milliseconds. The report recommends inserting a programmable policy engine that evaluates each transaction against predefined constraints: maximum spend per interval, allowlisted contract addresses, multi-sig requirements above defined thresholds, and mandatory human confirmation for novel counterparty interactions. This is conceptually similar to a multisig wallet with conditional spending policies, but optimized for the latency and autonomy requirements of agent workflows.
Current Infrastructure and Key Exposure
The practical problem is that the frameworks gaining traction prioritize low-friction setup over granular access control. Coinbase’s Agent Payments kit, for example, provisions a wallet and signing credentials as part of agent initialization — convenient, but it puts the entire spending surface live by default. x402 implementations typically rely on session-based facilitators that hold balances for the duration of an agent’s operation. Skyfire’s model gives agents pre-funded accounts with spending limits, which is closer to what Halborn advocates, but the limits are set at initialization rather than dynamically enforced. Across all of these, key custody remains the weakest link. Until agent runtimes integrate with hardware-backed signing or threshold signature schemes, the key material is only as secure as the process or container running the agent — and that attack surface is well-understood by anyone who has watched a hot wallet get drained.