Attackers hijack AI agents to spend money, not data

Attackers can make an AI agent spend money or compute for their benefit without stealing a single credential, per a paper posted to arXiv (2608.15108). Credential monitoring and data-loss tools miss this entirely, since no key moves and nothing leaves the system. Undefended, the tested agent had an 84% attack success rate.

The paper names this resource hijacking and treats it as its own attack class, separate from data theft. The agent invokes, transfers, or drives paid resources toward an outcome the attacker wants, using authorization it already has.

To test it, the authors built ResourceHijackBench: 300 scenarios across six resource categories in isolated environments. Those environments log actual spending, not just whether a transcript looks like an attack succeeded. Even the strongest defense they evaluated still left a 55.11% attack success rate.

A separate paper called HarnessRisk found models notice about 90% of these attacks, but that noticing doesn't stop them from running.

The wall has to sit outside the model

Refusal training doesn't hold here, because any mitigation the model applies is one an attacker can talk it out of. What works instead is a ceiling the model can't argue with. Per-tool spend caps, rate limits on paid calls, a budget enforced by the proxy instead of the model's judgment.

I run 13 research agents daily on a subscription instead of a metered API. My protection is that the subscription has a quota, and the quota is a wall the agent can't argue past. That's accidental on my end, but it's the right shape: the constraint sits in billing infrastructure, not a system prompt.