AI agents can now buy compute, sign up for accounts, and even hire other agents - and a new paper says nobody is checking whether they should be allowed to use what they get.
Autonomous agents increasingly acquire their own resources: cloud compute, API credentials, service accounts, and access to other agents. Existing safeguards - payment checks, budget limits, OAuth flows, fulfillment confirmations - only verify that a transaction went through. None of them decide whether the resulting resource should actually be usable, a blind spot the researchers call the post-fulfillment activation gap. Their fix quarantines everything an agent acquires, verifies its real capabilities against the provider's own records, and only activates it through a transaction that checks limits across a mapped graph of resources and permissions.
The stakes: as agents get room to shop, subscribe, and subcontract on a company's behalf, 'the payment cleared' quietly becomes 'the agent can now do whatever that resource allows' - a trust boundary most agent frameworks don't currently check. In testing across five resource classes and 810 events, the system accepted all 20 benign scenarios and rejected all 40 unsafe ones, while a separate checker rejected all 89 tampering attempts thrown at it.
One caveat: the tests ran against frozen versions of Codex's and Gemini's Model Context Protocol clients, not the constantly updated production ones - a reminder that any fix here has to keep pace with agents that change faster than papers get reviewed.