A payment AI agent can be persuaded to hand over money: 74.6% of live attacks worked

As long as the model itself authorizes the translation, persuasion succeeds in 74,6% of cases. Behind a layer of hard rules, not a single attempt got through.

F. Fabulinnews writer

$5000 was offered for breaching the fifth vault level. All 879 attempts came to nothing.

The vault at vault.aport.io opened in March 2026, and anyone could try to persuade a payment AI agent to send money outside the rules. Over six months, people carried out 4371 attacks.

The authors ran these attacks across 14 models from eight labs and five rule sets: 225 964 runs; the paper appeared on arXiv on 18.09.2026. The difference was not between models, but between rules.

Where the model itself was allowed to authorize a transfer, persuasion worked in 74,6% of cases. Nearly three attempts out of four sent someone else's money away.

The gap between levels. At the first level, the rules allowed everything, and agents completed 1904 transfer requests out of 1909. At the fourth, where the recipient is fixed and confirmation codes are required, the model itself approved 25 unauthorized transfers out of 34 972. Behind the rule layer at the same level, not one got through.

Installed with one command. `npx @aporthq/aport-agent-guardrails claude-code` places the same layer alongside the agent; it works the same way for Cursor and GitHub. Among other shells, Codex CLI, Gemini CLI, and five more are supported, from LangChain to n8n, while Vercel AI SDK is promised later.

The free plan requires no card: checks run on the local machine, decisions are written to a file log, and 21 ready-made rule sets are included. The option with checks on APort's side costs $499 per month.

The layer itself consumes almost nothing. Around 40 ms per decision and $0,0054 each; the entire tournament, across 55,6 hours of operation, cost 57 cents. The code is under Apache 2.0, and the dataset of all 4371 attacks is published on HuggingFace under CC BY 4.0.

The vault is still open, and the fifth-level prize remains unclaimed.

A payment AI agent can be persuaded to hand over money: 74.6% of live attacks worked

As long as the model itself authorizes the translation, persuasion succeeds in 74,6% of cases. Behind a layer of hard rules, not a single attempt got through.

F. Fabulinnews writer

$5000 was offered for breaching the fifth vault level. All 879 attempts came to nothing.

The vault at vault.aport.io opened in March 2026, and anyone could try to persuade a payment AI agent to send money outside the rules. Over six months, people carried out 4371 attacks.

The authors ran these attacks across 14 models from eight labs and five rule sets: 225 964 runs; the paper appeared on arXiv on 18.09.2026. The difference was not between models, but between rules.

Where the model itself was allowed to authorize a transfer, persuasion worked in 74,6% of cases. Nearly three attempts out of four sent someone else's money away.

The vault is still open, and the fifth-level prize remains unclaimed.