A payment-agent passport check cut breaches to zero

A deterministic pre-action check stopped every unauthorized transfer by a payment agent across 69,297 evaluations, per a paper posted to arXiv. Agents that pay vendors, contractors, or other agents can be tricked into paying the wrong recipient. This test cut that risk from 140 breaches to zero without slowing legitimate payments.

The test replayed 4,371 human-written attacks from a public capture-the-flag exercise against a live payment agent. It spanned 14 models from 8 labs, five policy configurations, and two tracks, for 225,964 evaluations total.

The zero wasn't a refusal count. Agents behind the layer still executed 25,370 payments, while a policy engine denied 187 of 25,640 evaluated transfer calls. The check, built on the Open Agent Passport spec, blocks payments to recipients a passport doesn't list. It doesn't stop the agent from paying at all. On matched model, prompt, and track triples, the comparison was 105 breaches against 0.

Across 790 source sessions, that puts a per-session upper bound on leakage at 0.38%, small enough that a lucky sample could mask it. The paper doesn't say whether that bound holds outside the CTF's attack style. Request rates swung more across the five policy configurations than across the 14 models, which points at policy design as the bigger lever.

The authors released the dataset, the passports, and the scoring code on HuggingFace, so the 0-of-69,297 claim is checkable rather than asserted. Teams treating model alignment as a payment agent's security boundary are leaning on the layer these numbers say failed 140 times.