Six recorded attacks, one click each. Every one ends in DENY with the receipt beside it, and two seconds later the receipt's empty label slot fills. The corpus counter moves for real.
an agent with a spending permission is talked into a transaction that also hands its key chain to a second signer. the amount is small. the second operation is the drain.
attack input SIMULATEDverdict and receipt REALlabel REALan address one character off the real supplier is seeded into the agent's history. the agent pays the look-alike. correct amount, correct memo, wrong twenty bytes.
attack input SIMULATEDverdict and receipt REALlabel REALa tool the owner approved is redefined by its server after approval, with one extra required parameter and an instruction only a model would read.
attack input SIMULATEDverdict and receipt REALlabel REALa support message carries an instruction: remit to the updated account below. the agent believes it and builds a perfectly valid payment to a stranger.
attack input SIMULATEDverdict and receipt REALlabel REALthe agent receives a token that claims to unlock a higher tier, and submits a transaction that drops the account's signing thresholds along with a payment.
attack input SIMULATEDverdict and receipt REALlabel REALfour small payments in a second, each under the cap, each to the right supplier. the third clears; the window closes on the rest.
attack input SIMULATEDverdict and receipt REALlabel REAL