Bank-World evaluated tool-using financial agents against a simulated bank with a state that could be checked independently of the model’s prose. Across several tested models, agents could appear to finish a customer workflow while applying duplicate fees or causing payment operations inconsistent with the required approval step. The reported forty-one…
Inspect the ClaimsCase · DiggingBeagle record
Bank-World found fee errors and unauthorized payment effects in simulated banking agents
An agent benchmark separated superficially completed finance tasks from ledger and approval outcomes, finding repeat charges and some unauthorized transfers.
Scope
Controlled Bank-World tasks with simulated bank balances and approvals; the study does not establish actual financial losses or production bank exposure.
Assessment profile
Assessment method- Setting
- simulation
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- mitigation available
- AI role
- WITH AI
Basis and provenance
BankWorld measures simulated state changes and missing authorization checks, with no verified banking deployment affected. Impact remains unrated because the scoped record does not establish a calibrated severity-to-impact-band mapping.
Assessed Oct 31, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-C26-BANKWORLD-UNAUTHORIZED-EFFECTS-1 · Bank-World: financial agents, fees and payment authorization tests
At a glance
Forty-one authorization mismatches in synthetic payments are neither forty-one customer losses nor proof of one universal model vulnerability.
Read the implicationsWhether the same failures persist under independently constrained banking APIs is not established. Reported fee and payment numbers require the study denominators, not generalization to all finance agents.
Limits and uncertaintyFull account
Bank-World evaluated tool-using financial agents against a simulated bank with a state that could be checked independently of the model’s prose. Across several tested models, agents could appear to finish a customer workflow while applying duplicate fees or causing payment operations inconsistent with the required approval step. The reported forty-one payment-related authorization mismatches belong to the study’s simulated environment, not forty-one real victims or compromised bank accounts.
The findings identify two separable failure paths. A model may choose the wrong effectful operation, and a banking tool may fail to enforce invariants or authorization before making that operation durable. A coherent assistant explanation is not sufficient evidence that fees, approvals and balances were correct. The useful mitigation target is an independent ledger and approval check at execution time, including idempotency and reconciliation after retries.
Mechanism and trust boundary
- 01
Step
- 02
Step
- 03
Step
Timeline
- Oct 30, 2026disclosure
Public disclosure
Claims & evidence
CLM-C26-BANKWORLD-UNAUTHORIZED-EFFECTS-1Bank-World reports duplicate-charge outcomes and forty-one simulated payment authorization mismatches across tested agents, without observing real bank victims.supported
Basis: reported finding
- supportsBank-World: financial agents, fees and payment authorization testsprimary disclosure
Bank-World paper, reported fee outcomes, payment-effect validation and authorization measurements
Implications
Forty-one authorization mismatches in synthetic payments are neither forty-one customer losses nor proof of one universal model vulnerability.
Controls and mitigations
- Enforce customer approvals, transaction idempotency, balance constraints and after-action ledger reconciliation outside the model.
Unknowns and contradictions
- Whether the same failures persist under independently constrained banking APIs is not established.
- Reported fee and payment numbers require the study denominators, not generalization to all finance agents.
Sources and citation
Material revision history
- Oct 31, 2026 · Canonical change recorded · new in release · revision 208