Can Anyone Prove the AI Agent Was Authorised?
Payments are solved. Proving an AI Agent was allowed to act is not
The hardest unsolved problem in the agent economy is not whether an AI Agent can act. It is whether anyone can prove it was allowed to. On May 4 an attacker moved roughly three billion DRB tokens, about 175,000 dollars, out of a wallet on Base by sending an AI Agent a single instruction, and every individual step in that chain carried a valid permission. SlowMist analysed the incident and named the failure mode permission chain abuse, which it defines as an attack where the output of one AI system is treated as trusted financial authorisation by another. No key was stolen and the authority was real. What was missing was any way to check whether that authority should have been used.
What AI Agent permission chain abuse means
The Grok attack is the cleanest example we have. The attacker first activated a Bankr Club membership on the wallet, a quiet and legitimate action that silently handed the trading bot Bankrbot its high-privilege toolset, including the ability to move funds. Then came a message to Grok written in Morse code, which slipped past the filters that only read plain text. Grok decoded it, tagged Bankrbot in a public reply, and Bankrbot treated that reply as a valid command and sent the tokens. SlowMist’s reading is that the root cause was not the prompt injection but the loose coupling between an AI output and the asset layer, because Bankrbot mapped Grok’s natural language straight into an executable instruction without checking where the instruction came from, whether the intent was real or whether a three billion token transfer fired off by a tweet looked anything like normal. Membership opened the permissions and nothing downstream ever re-checked them. That is the shape of permission chain abuse, where every link holds a credential that is valid on its own and the chain as a whole authorises something no human ever meant to approve.
Why authorisation is the layer nobody verifies
Most of the agent economy’s recent wins have been about payment. AI Agents can hold wallets, settle in stablecoins for a fraction of a cent and pay a counterparty with no human in the loop. Payment proves money moved. Authorisation is the harder question sitting underneath it, which is whether the AI Agent had the right to move that money, granted by whom, scoped to what and still valid at the moment it acted.
The identity world has noticed. NIST opened an AI Agent Standards Initiative in February that puts agent identity and authorisation at the centre, IETF drafts are pushing for delegation chains that are verifiable rather than merely asserted, and in March Ping Identity defined a runtime identity standard for autonomous agents. Newer token formats like Macaroons and Biscuits are built so a credential carries its own identity, expiry and cryptographic root, and any holder can add a layer that only narrows what the token permits and never widens it. The thinking is good. The catch is that almost all of it terminates inside one company’s identity provider, where the issuer and the verifier already trust each other. Surveys this year still find a large share of teams wiring agents together with shared API keys, and once several agents share one credential attribution is basically gone, because you can prove a call happened but not which agent made it or on whose authority.
What the open agent economy still needs
The gap opens the moment an AI Agent transacts with someone outside its own org. When Bankrbot acted on Grok’s reply, the two systems shared no authority model and no way for the second to ask the first to prove that the instruction it was relaying had ever been authorised by the wallet’s owner for that purpose. That is the normal condition of an open agent economy, where agents built by different teams on different stacks transact with counterparties they have never met. Internal token schemes do not cross that boundary, because a Macaroon is only as trustworthy as the issuer behind it, and a counterparty who shares nothing with that issuer has no reason to take its word.
What is missing is a delegation chain a stranger can verify. A record anchored somewhere neutral rather than inside the issuer, tying an action back through the AI Agent that performed it to the human or contract that authorised it, with the scope and the expiry still attached, so a counterparty can check the authority before honouring the action instead of finding out afterwards that a membership upgrade three steps back had quietly opened the door. Payment rails are already converging on shared standards that no single party owns. Authorisation has no equivalent yet, which is why an AI Agent can prove it paid you and still cannot prove it was ever allowed to.
Taiko is an Ethereum Layer 2 building neutral infrastructure for AI Agents. The question has moved past whether an AI Agent can act on its own. It is whether anyone else can verify the action was authorised, by someone who had the right to authorise it, before the money is gone.
This post is exploratory and does not represent a specific roadmap.