We turned the 3 bugs that beat Pink's AI agent spending rules into an open test suite

说明与用途

创建了一个公开测试套件，用于发现 AI 代理支出规则中的输入处理错误，包括尾随空格、客户端时钟和亚分金额。

问题

AI agent spending rules were bypassed by simple input‑handling bugs (trailing space, client clock, sub‑cent amount).

结果

The suite ran 23 edge cases: 20 safe, 2 known gaps (sub‑cent amount and 0‑decimal currency), 1 not applicable, 0 new unsafe findings.

工作流

• Run the suite against a target API using edgecases.py
• The suite mutates each input and compares the API decision to a canonical clean request
• It reports whether the mutated input was rejected, evaluated the same, or evaluated looser than the clean input
• Identify any looser evaluations as failures
• Iterate on the API to fix identified gaps

证据

None of the three bugs that beat our AI agent spending rules last week were AI attacks. One was a trailing space. One was a clock. One was half a cent.

来源

agent-spend-edge-cases is a set of edge-case inputs (23 in the current set) across six categories: currency strings, amounts, time, idempotency replays, payee-name matching, and concurrency.

来源

We ran it against our own sandbox (coffee-template workspace, a Purchasing AI agent with a $500 per-payment cap and a $4,000/month budget). 23 cases run: 20 safe, 2 known-gap, 1 not applicable, 0 new unsafe findings.

来源