We turned the 3 bugs that beat Pink's AI agent spending rules into an open test suite

Описание и применение

Создан открытый набор тестов, выявляющий ошибки в правилах расходов AI‑агентов, включая пробелы, клиентские часы и субцентовые суммы.

Задача

AI agent spending rules were bypassed by simple input‑handling bugs (trailing space, client clock, sub‑cent amount).

Результат

The suite ran 23 edge cases: 20 safe, 2 known gaps (sub‑cent amount and 0‑decimal currency), 1 not applicable, 0 new unsafe findings.

Рабочий процесс

• Run the suite against a target API using edgecases.py
• The suite mutates each input and compares the API decision to a canonical clean request
• It reports whether the mutated input was rejected, evaluated the same, or evaluated looser than the clean input
• Identify any looser evaluations as failures
• Iterate on the API to fix identified gaps

Доказательства

None of the three bugs that beat our AI agent spending rules last week were AI attacks. One was a trailing space. One was a clock. One was half a cent.

Источник

agent-spend-edge-cases is a set of edge-case inputs (23 in the current set) across six categories: currency strings, amounts, time, idempotency replays, payee-name matching, and concurrency.

Источник

We ran it against our own sandbox (coffee-template workspace, a Purchasing AI agent with a $500 per-payment cap and a $4,000/month budget). 23 cases run: 20 safe, 2 known-gap, 1 not applicable, 0 new unsafe findings.

Источник