We turned the 3 bugs that beat Pink's AI agent spending rules into an open test suite

Description and use

An open test suite was created to expose input‑handling bugs in AI agent spending rules, covering trailing spaces, client clocks, and sub‑cent amounts.

Problem

AI agent spending rules were bypassed by simple input‑handling bugs (trailing space, client clock, sub‑cent amount).

Outcome

The suite ran 23 edge cases: 20 safe, 2 known gaps (sub‑cent amount and 0‑decimal currency), 1 not applicable, 0 new unsafe findings.

Workflow

• Run the suite against a target API using edgecases.py
• The suite mutates each input and compares the API decision to a canonical clean request
• It reports whether the mutated input was rejected, evaluated the same, or evaluated looser than the clean input
• Identify any looser evaluations as failures
• Iterate on the API to fix identified gaps

Evidence

None of the three bugs that beat our AI agent spending rules last week were AI attacks. One was a trailing space. One was a clock. One was half a cent.

Source

agent-spend-edge-cases is a set of edge-case inputs (23 in the current set) across six categories: currency strings, amounts, time, idempotency replays, payee-name matching, and concurrency.

Source

We ran it against our own sandbox (coffee-template workspace, a Purchasing AI agent with a $500 per-payment cap and a $4,000/month budget). 23 cases run: 20 safe, 2 known-gap, 1 not applicable, 0 new unsafe findings.

Source