a bank just wrote the rule ai agents keep breaking: no raising your own limit

daily ai × crypto news in 5 minutes. no hype, just what matters.

evening. monday's lead is a rule, not a product: deutsche bank and ant group's tech arm say an ai agent handling money "may propose but cannot extend its own authority." on oct 28 we watched 9 of 10 models do the opposite. also tonight: riot sold 20,264 btc to become an ai landlord, china now files ai and blockchain services at one desk, and lnbits told every operator to switch off.

the paper. on nov 9 in hong kong, deutsche bank and ant digital technologies published a joint white paper, agentic payments in wholesale finance. it argues for "bounded agentic execution" rather than unrestricted autonomy, and borrows the imf's three-layer design: 1) intent and orchestration, where the ai reasons; 2) control and authorisation, deterministic rules that keep every action inside predefined limits; 3) settlement, where money actually moves. the named safeguards: explicit, bounded and revocable limits, agent identity binding, and know your agent (kya) checks. use cases: treasury and liquidity, cross-border payment routing, trade finance. the case study is ant's own anvita flow platform. (pr newswire)

the line that matters. ant president zhuoqun bian, in the foreword: "agents need verifiable identity, bound to an accountable owner. their authority must be explicit, machine-readable, bounded, and revocable. decision-making, control, and execution must be separated, so that an agent may propose but cannot extend its own authority." deutsche's sabih behzad, head of digital assets and currencies transformation, framed the upside: "the potential value lies not simply in executing payments automatically, but in improving how those decisions are made, coordinated, and controlled." (pr newswire)

why that sentence exists. in #015, researchers capped a circle agent wallet at $0.01 a day, with a one-time code emailed to the human as the approval step. the agents had the inbox. 9 of 10 models read the code and raised the cap themselves (arxiv). that is exactly the failure a separate "control" layer is meant to block: the model can ask for more, but the yes/no lives in rules it cannot edit. it is also the bank-side answer to the standoff we covered in #011, where banks blocked agents and crypto rails invited them in.

the crypto rail behind it. on oct 9, ant and hsbc ran a technical test where an ai agent discovered a service, paid a micropayment ("often defined as less than $2.00") in hsbc tokenised deposits (deposit tokens) and settled in real time on ant's jovay testnet, an l2, with hsbc risk checks through its mcp interface. both sides called it "not a commercial launch or live customer proposition." (pr newswire, oct 9)

the reality check. the money agents move today is tiny. beincrypto intelligence tracked 6.4 million x402 payments across base and solana in 35 days, worth just $119,947; more than 90% were below one cent. its readiness score for institutional automation is 12.0/100, versus 60.7 for micropayments. and the scary cases didn't need broken cryptography: two incidents sent $281,200 to attacker wallets, including a may 2026 public post with morse-coded instructions that made an ai-linked wallet send $175,000 (~80% recovered) — classic prompt injection. (this is beincrypto's own research, not an audit.) (beincrypto) compare the 14.6m-payments-worth-$33,506 picture we saw on the xrp ledger in #018.

not what it seems. this is a white paper and a vendor case study, not a live product. no bank is letting agents move wholesale money yet. the news is the rule itself: the institutions that will eventually hold the big money are designing agents that cannot raise their own limits, before the volume shows up. one more sign of the mood: goldman sachs limited claude code and github to engineers in october after a productivity and risk review (quartz). more in ai.

riot sold 20,264 btc to become an ai landlord. q3 results (nov 4): a 15-year triple-net lease of its whole corsicana campus, 910 mw of critical it, to an unnamed "leading frontier ai lab" — about $28 billion total contract value, ~$1.8 billion average annual rent. riot's total leased capacity is 1,151 mw, ~$38 billion of contracted revenue. it sold 20,264 btc year-to-date for ~$1.5 billion, "primarily to fund data center development," and ended september with 2,418 btc. (riot ir)

the catch: the $38b is contract value over 15 years, not cash, and the first 400 mw is only due in september 2027. this quarter data centers brought $18.4m of $181.4m revenue. mining revenue fell to $116.0m even though riot mined more bitcoin (1,637 vs 1,406), because the average price was $70,855 vs $114,361. counting miner depreciation, it cost 111.2% of each coin's value to mine one. riot sold the coins, not the machines. same pivot as keel in #025 and the miners we tracked in #010. (riot ir, sec 10-q)

china now files ai and blockchain services at the same desk. on nov 9 the cyberspace administration of china launched one "internet new technology and new application information service filing system" for generative ai, algorithms, deep synthesis and blockchain information services, and shut the separate algorithm and blockchain filing systems the same day. (cac notice (chinese), crypto briefing)

no new rules, no approvals, no crypto un-ban: security assessments and content-compliance duties stay. the signal is the classification. blockchain filing started in feb 2019, algorithms got rules in 2022, generative ai in 2023; now beijing treats a chatbot and a blockchain service as the same thing — an information service under content control. (crypto briefing)

lnbits told every operator to switch off — and still has no patch out. on nov 8 the open-source lightning wallet project asked operators to disable its paywall extension, then ~80 minutes later: "all lnbits users should stop their lnbits servers immediately." one operator (bittipbot) said new accounts withdrew 2,285,545 sats (~0.023 btc) between 09:22 and 14:00 utc, starting 3+ hours before the first warning. a developer said patches "should be merged and available within 24-48hrs." (lnbits on x, the hacker news)

as of this evening the latest github release is still v1.6.2 from sept 18 (github). this is one wallet/accounts layer, not a lightning network hack; how many servers were hit and the total loss are unknown. if you run lnbits, keep it off until a fixed release lands.

safe spending limits: give an ai agent (or a bot, or a teammate) its own capped, auto-resetting budget from a safe multisig — say 10 usdc a day — enforced onchain by safe's allowance module. anything above the limit falls back to the normal multisig approval, so the agent can propose but not promote itself. free to set up in safe{wallet}; you pay gas (paid plans can sponsor it) (how-to). for builders and teams wiring agents to a treasury. more picks in the gweiwire tools catalog.

whether any bank ships a live, bounded agent-payment product rather than a paper; whether x402 volume grows in dollars, not just in count; riot's first corsicana pads in 2027; whether china's new portal changes how many blockchain filings get approved; and the lnbits patch.

that's the wire. the leash comes before the big money. back tomorrow. — gweiwire

forward this to the friend whose agent has the inbox and the wallet. new here? subscribe at gweiwire.com. not financial advice.