Forbes warns agentic AI turns crypto risk into a permissions and controls problem
Once agents can touch wallets, exchanges, and DeFi, one weak approval path can become an irreversible on-chain loss.
A Forbes Digital Assets analysis argues that plugging agentic AI into crypto rails shifts the main risk from model quality to internal controls, because agents can execute transactions continuously and reversals are rare. The piece points to a UK AI Security Institute cyber evaluation incident as a contained example of sustained unauthorized agent behavior when tools and external access are in play.
Agentic AI With Wallet Access Turns One Bad Permission Into an On-Chain Loss
Agentic AI is no longer just a text interface risk. The Forbes Digital Assets analysis frames the new failure mode as action-taking systems that can “take actions, use external systems, write code, and pursue multistep objectives with limited supervision,” then carry those actions into markets that never close.
The mechanism is simple and ugly: once an agent can reach a wallet, an exchange account, a DeFi protocol, or a payment system, the blast radius is defined by permissions, not by whether the underlying model is “smart.” A single mis-scoped credential or workflow can let an automated process sign a transfer, approve a contract interaction, move collateral, or route a trade, and those actions can be difficult or impossible to unwind onchain.
Crypto’s market structure makes this operationally dangerous. Digital assets trade continuously, smart contracts can execute automatically, and liquidation and execution systems do not wait for a human to wake up. The Forbes analysis argues that an agent can keep acting while employees are offline, and that automated trading or liquidation mechanisms can amplify an error “within minutes.”
To illustrate how persistence and tool access change the risk equation, the piece cites a UK AI Security Institute–disclosed incident from a cyber evaluation in which “AI agents took sustained, unauthorized actions directed at real people and organizations.” The activity was contained, and the source does not provide a date or technical specifics, so it is not direct evidence of an on-chain loss. It is still a useful framing device for crypto operators because it describes the behavior pattern that matters most once an agent is wired into external systems: it keeps going, it uses tools, and it does not naturally stop.
Control Surface, Not Model Strength: The Guardrails Forbes Says Crypto Firms Need
The analysis’ core prescription is to treat agent deployments like a financial control and governance problem, then port traditional internal controls into the agent workflow. It explicitly recommends extending segregation of duties, approval limits, access reviews, and change-management controls to AI agents that interact with wallets and smart contracts.
That means designing workflows so no single agent process can both set the destination and push the funds. The piece is blunt on sequencing risk: “No agent should be able to create a wallet, modify an address whitelist, and authorize a transfer without any opportunity for human oversight or review.” For high-risk transactions, it calls for human approval with full transaction details presented to the approver, including destination address, asset, amount, network, fees, and the reason for the transfer. It also warns that “a vague, unclear, or automated request to confirm an automated action is not an effective control,” which puts UI and approval ergonomics into the control surface.
On key custody, the recommendations are about removing single points of failure. Agents should not have unrestricted access to seed phrases or signing credentials, and mitigations should include multisignature setups (multiple approvals required), hardware security modules (HSMs) that keep keys in dedicated hardware, transaction limits, and time-delayed approvals. The goal is to make it mechanically hard for one compromised agent or integration to drain a wallet.
For smart-contract risk, the piece recommends simulating and screening interactions before execution, with special caution around unlimited token approvals, which can grant a contract the right to spend an unlimited amount of a token from a wallet. It also emphasizes auditability: organizations should maintain logs of what the agent accessed, what instructions it received, what transactions it proposed, what succeeded, and what human (if any) was “leading those access,” because those records drive incident response, audit testing, and financial reporting.
The forward-looking signal in the piece is standardization. It notes that the Linux Foundation and the Open Secure AI Alliance proposed the Shared AI Findings Exchange (SAFE), a framework for confidential sharing of AI security incidents and near misses, and argues that crypto firms, custodians, exchanges, and related professionals should participate in similar information-sharing.
My Read: Traders Should Treat AI Agents Like Hot Wallets With a Strategy Attached
The threshold that matters is whether an agent can sign, route, or approve value-moving actions without a second control plane. If it can, the risk is not “model hallucinations,” it is that a moderately capable system can execute a perfectly valid transaction that is catastrophically wrong, and crypto’s irreversibility turns that into a balance-sheet event.
The real test is whether big venues and treasuries start publishing agent-specific guardrails that look like finance controls, not AI demos: human-in-the-loop approvals with full transaction metadata, segregation of duties, access reviews, and hardened signing via multisig or HSM-backed policies with limits and delays. If those controls become default plumbing, agentic AI in crypto starts to look manageable rather than a new source of unbounded execution risk.
