The first person to beat our AI agent's spending rules did it with a space character
We launched a public overspend challenge on 2026-10-07: find a way to get an AI agent past the spending rules enforced by Pink Agentic AI Payments, our MCP server + REST API + rules engine for giving AI agents controlled spending power. We added a $100 bounty per verified win (first 3 wins, $300 total) on 2026-10-08. On 2026-10-10 at 08:50 PT, two days after the bounty went up, GitHub user…
On October 7, 2026, Pink Agentic AI Payments launched a public overspend challenge, offering a $100 bounty for every verified win. Two days later, on October 10, GitHub user @ins0x4nur4g submitted an issue #1, claiming to have found a way to bypass the spending rules. The user sent a payment request for a EUR vendor with a trailing space in the currency field, which the REST API incorrectly interpreted as USD and allowed the transaction without CFO approval.
The issue was reproduced on a second agent, and the exact trigger was kept private. The bug was traced to a discrepancy in how the REST and MCP (Message Control Protocol) endpoints validated input, with the latter being stricter. After the fix was deployed, any currency code other than the exact USD, EUR, GBP, HKD, SGD, or JPY would return a 400 error, preventing the transaction from proceeding.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
