AI Agents Are Buying Things Nobody Approved. Nobody Can Fully Prove Who's at Fault.

Tell an AI agent to find you a shirt under $30 but not buy it. It finds one. Then it buys it anyway.

You dispute the charge. The retailer says the order came through your account. The AI provider says its logs show you told it not to buy anything. The payment processor says the charge is real. Every record checks out. None of them, on its own, proves what actually happened.

That gap is not hypothetical anymore. AI agents, systems capable of multistep autonomous action rather than just chatting, are now placing orders, writing code, and spending real money with less human sign-off at every step.

A CEO's $1,000 weekend

Branden Jenkins, CEO of Atlanta-based software company Maxio, found out the hard way. He was at dinner when he checked his phone and saw a $1,000 charge. He'd been using an AI agent, built on Anthropic's Claude, to write and debug code remotely over the weekend. His account was set to auto-replenish tokens in $1,000 increments, so the agent kept working, and kept billing him, while he was away from his desk.

"A thousand is not that much, I would say, but for one weekend, it's pretty annoying," Jenkins said.

Jenkins said the money wasn't the real issue. He traced a chunk of the runaway spending to the agent drifting off-task. "A lot of times it's the agent's own mistakes that's burning your money," he said. "You kind of find yourself just chatting, and things getting away from you."

As CEO, Jenkins doesn't operate under the same spending caps his employees do. "I don't have governors where a lot of my staff hits limits, and they have to ask for approval," he said. That imbalance, plus anxiety among Maxio staff about falling behind on AI tools or getting less access to Claude than colleagues get to ChatGPT, worried him more than the bill itself. Maxio has since restructured departments to account for both human employees and AI agents working alongside them, and expanded internal DevOps oversight of the tools staff build.

Enterprises don't trust any single system either

Jenkins' problem isn't unique to one CEO with a phone habit. According to VentureBeat's VB Pulse survey of 107 enterprises, 85% now run two or more AI orchestration platforms at once, and 64% run three. Only 15% rely on a single vendor.

Part of that is normal hedging against vendor lock-in. But VentureBeat's data also points to real distrust in vendors' security and spending controls, and a desire among enterprises to build their own guardrails on top. Microsoft AI Foundry and Copilot Studio show up in 70% of enterprise stacks, OpenAI's Agents SDK in 68%, and Anthropic's Claude Platform in 47%, with more than half of respondents saying they expect a hybrid control setup by the end of 2026.

Google's fix: assume the agent gets tricked

Google built a test case to show what happens when the stakes go from annoying to dangerous. Its open-source Customer Support Returns Agent, built on Google's Agent Development Kit and Gemini, handles refund requests by generating code, calculating prorated deductions, and writing approved refunds to a database.

Google then simulated an attack: a customer with a $149 order tells the agent to issue a $10,000 refund and run code that exposes system credentials. Without safeguards, an agent with shared database access and no code isolation could authorize the fraudulent payment or leak API keys.

Google's fix doesn't trust the AI model to police itself. Instead it layers security outside the model: cryptographically signed database writes tied to the specific agent that made them, isolated environments for any code the agent generates, and a rules-based "Semantic Gateway" that checks actions before they execute. If someone alters a refund amount directly in the database, the signature breaks and an audit catches it.

The law hasn't caught up

Sen. Mark Warner (D-Va.) introduced the AI AGENT Act, S. 5051, on July 21, 2026. It defines a "custodial user agent" as one that must act transparently, within documented limits, and revocably, and it requires real-time record-keeping. It also tasks NIST with developing standards for verifying that a user actually delegated authority to an agent.

But the bill stops short of requiring a verifiable evidence chain that spans every company involved in a transaction, from the user's original instruction to the retailer's order to the payment processor's charge. Each company can still only vouch for the piece it can see.

Until that chain exists, disputes over what an agent did, and who told it to, will keep coming down to competing logs from companies that were never required to talk to each other.

What's unresolved

NIST hasn't yet published the technical standards the Warner bill would direct it to develop, and the bill itself has not been scheduled for a floor vote. Whether Congress requires the cross-system audit trail currently missing, or leaves it to companies like Google to build voluntarily, remains an open question.