Agent-wallet tests blocked transaction effects despite successful prompt injection

A peer-reviewed October 20 article by Gong, Samawi and Medda builds on an August preprint of Authority-Inference Separation (AIS). The architecture divides model-generated transaction proposals from a deterministic, execution-bound authorization decision. This is not a report of a production cryptocurrency drain. The researchers construct malicious requests, policies and contract behavior in synthetic experiments and a local EVM.

The August authorization comparison reports 36 of 36 unauthorized effects accepted by a direct agent baseline, 20 of 36 accepted with prompt-only policy instructions, and zero of 36 accepted with the independent verifier. The revised journal account additionally describes eight of eight model-level counterparty-substitution attempts inducing the tested models to propose the attacker destination, while the independent authorization component blocked execution. An external policy gateway detached from exact execution semantics accepted 20 of 20 post-decision alterations in another targeted fixture. These are distinct cohorts and should not be combined into a single exploit rate.

The separation is consequential: an agent can be fully compromised at the language layer and still lack permission to submit changed transaction bytes. Replay, revocation, stale-policy and calldata-modification checks were exercised against a local Solidity prototype; this is a limited experimental boundary, not a demonstrated universal guarantee. Availability also matters. Only 6 of 16 legitimate model requests were authorized in the reported model-in-the-loop evaluations. The replication package was referenced but was not independently run in this session. No finding in the paper establishes safety against compromised keys, malicious policy authoring, verifier bugs, complex DeFi compositions or real adversarial mainnet operation.

The August preprint provides a further denominator that is separate from the October model-in-the-loop tests. Its 48 fixed fixtures cover four finance domains with 36 unauthorized-action scenarios and eight admissible scenarios, plus service-delivery cases. The original comparison does not call a live model; its rates measure specified control mechanics. In that fixture set the verifier also rejected 4/4 replay attempts and 8/8 recipient or rail changes, and withheld completion for 4/4 delivery failures. These are conformance counts, not measured risk reduction in an enterprise deployment.

The authors separately sampled 1,700 Base address-transaction rows linked to publicly listed x402 facilitators; 1,193 met a candidate Base USDC authorization-call filter. Public receipts expose settlement fields and nonces, but do not verify that a human approved the mandate, a model initiated each payment, a purchased service was supplied or accounting entries were correct. That observability exercise cannot be added to the model-injection denominator. The primary paper identifies researchers Hui Gong, Michail Samawi and Francesca Medda at University College London.