An agent gets tricked into paying the wrong address. Should its wallet let it? At EMNLP 2026, @0xDamian0x demoed how BNB Agent Studio puts owner-set rules between an AI’s payment request and a signature, alongside our research with AWS co-authors. We tested a “confused deputy” attack: give an agent a legitimate job, then slip in an attacker’s recipient or amount. Across six models, the paper’s single-turn tests found: 🔸 Baseline agents executed forbidden money actions in up to 87% of scenarios. 🔸 With the same tools and prompt behind a wallet policy layer, models still attempted forbidden actions at similar rates. 🔸 The wallet layer signed zero of those actions in the test harness. The model can still get fooled. Its payment permissions stay fixed. BNB Agent Studio keeps private keys out of the model’s context. Code handles signing and pricing, enforcing the owner’s spending caps and approved recipients. The demo walked through six commands to: 🔸 Create an agent and its wallet 🔸 Set up model access and test locally 🔸 Deploy and register an onchain identity The agent can then replenish its own inference credits within owner-set limits. Separate live checks on BNB Smart Chain testnet validated payment guardrails, escrow funding, and owner-controlled suspension. Get the architecture, test results, and limitations in the whitepaper 👇