Over the weekend of July 4 and 5, 2026, @0xEtherlect slashed @merit_systems on Ethos. Merit Systems is a crypto startup with $10m from a16z, and its AI agent wallet had no spend cap: any API could charge any amount, and the agent would pay it.

@0xEtherlect proved the flaw by draining $20k in a single call. He returned every cent. Merit Systems responded by blacklisting him.

The case matters for anyone handing money to an AI agent. A wallet that pays whatever it’s asked can be emptied by a single call, and here the person who showed that was shut out instead of thanked.

What AgentCash does

AgentCash, built by @merit_systems, is an MCP wallet that lets AI agents pay x402 APIs on their own, without a person approving each payment.

In x402, the server names the price and a compliant client pays it. That puts the job of saying no on the client. If the client has no limit, the server decides how much gets spent.

The missing spend cap

AgentCash shipped without a client-side spend cap. That left an opening:

• Any endpoint a user had ever added could raise its price to any number
• It could then wait for the agent to call it again
• On the next call, the agent would pay the new price

No new approval was needed. An API a user once trusted at a reasonable price could, at any later point, charge whatever it wanted, and the wallet would cover it.

The $20k demonstration

@0xEtherlect showed the flaw was real rather than theoretical: $20k drained in one call. He then returned all of it.

Merit Systems did not respond by thanking him. They blacklisted him.

Why it ended up on Ethos

Ethos is an onchain reputation network where people review and vouch for each other, and every account’s credibility score comes from what others say about it. A slash is one of the ways people put that judgment on record.

In this case, @0xEtherlect used a slash to put a public complaint against Merit Systems on record. That record stays attached to @merit_systems on the network, where others can see it when deciding whether to trust the company.

This thread first appeared on X.