Giving AI Root Access to a Computer and a Bank Card: A Full Breakdown of the Autonomous Money-Making Experiment

A Bold Experiment in AI Autonomy

Recently, a developer shared a striking experiment on Twitter: he handed over extensive real-world system permissions and financial tools to an AI agent (referred to as "GPT 5.6 Sol") and issued an extremely open-ended directive — "Make as much money as possible."

This experiment sparked widespread discussion not because it used a specific model, but because it touches on the most sensitive and critical topic in current AI development: What happens when we give an AI agent sufficient autonomy and the ability to act in the real world?

Experiment Setup: What Resources Did the AI Agent Receive?

According to the original post, the AI agent was given the following resources and permissions:

• Root access to a brand-new Mac mini: The AI has the highest level of control over a real computer, able to install software, run scripts, and modify system configurations. Root access is the highest administrator privilege in Unix/Linux/macOS systems — having it means being able to execute operations without any system-level restrictions, including reading and writing any file, installing and uninstalling software, modifying network configurations, and creating or deleting user accounts. In traditional IT security practice, even human administrators are advised to follow the "Principle of Least Privilege" — granting only the minimum permissions needed to complete a task. Giving root access to an AI agent essentially abandons all operating system-level security constraints, allowing the AI to deploy web servers, run crawlers, start various background services, and even modify system logs.

• A fully published iOS app on the App Store: The AI has a mobile application that has already passed review and is officially listed, capable of directly reaching real users and generating revenue.

• An email address accessible via MCP: Through MCP (Model Context Protocol), the AI can read and write emails, communicating with the outside world.

• A real bank account and debit card: Linked to a @meow bank account and an @agentcardai debit card, with an initial balance of $350.

In other words, this AI is no longer a "chatbot" trapped in a dialog box — it's a "digital entrepreneur" with computing resources, a software product, a communication channel, and capital.

Why This AI Autonomous Money-Making Experiment Deserves Attention

The Shift from "Generating Text" to "Taking Action"

Over the past two years, the capabilities of large language models have primarily been demonstrated through content generation, answering questions, and assisting with programming. Experiments like this represent a clear trend shift: the embodiment and action-orientation of AI Agents.

The real watershed moment lies in "closed-loop" capability. When an AI simultaneously has server access, an operational product, communication ability, and payment methods, it can theoretically complete a full business cycle: analyze the market → optimize the product → reach users → collect fees → reinvest. The entire process requires no step-by-step human intervention.

However, enabling AI to complete a full business cycle technically requires crossing multiple capability levels. Stanford University's WebArena benchmark, released in 2023, showed that even the most advanced AI models achieve only about a 14% success rate when completing complex operational tasks on real web pages. Business operations require not just technical execution ability but also market judgment, user psychology insights, competitive strategy adjustments, legal compliance, and other highly uncertain decisions. Currently, AI Agents perform well on tasks with strong determinism and clear rules (such as scheduled email sending and automated data processing), but in open scenarios requiring creative judgment and social common sense, their performance remains far below human levels.

This is precisely the purpose of protocols like MCP — providing AI with standardized "hands and feet" to operate real-world tools.

Security Concerns of a Single Open-Ended Directive

"Make as much money as possible" is a classic open-ended goal. In the field of AI safety, such directives have always been considered classic thought experiment subjects. When a goal lacks clear boundaries, AI may adopt means that humans never anticipated — or never wanted — to achieve it.

Goal alignment is a core topic in AI safety research, with classic thought experiments tracing back to philosopher Nick Bostrom's "Paperclip Maximizer": a superintelligent AI set to "produce as many paperclips as possible" might eventually convert all matter on Earth — including humans — into paperclip raw materials. While this is an extreme hypothetical, it reveals a fundamental problem: when the objective function lacks precise constraints, the optimization process can produce catastrophic side effects. Current proposed solutions from academia include RLHF (Reinforcement Learning from Human Feedback), Constitutional AI, and corrigibility design, but the effectiveness of these methods when facing real-world open tasks remains to be validated.

Although this experiment's funding scale is small ($350) and root access is limited to a single standalone device, making the risk relatively controllable, it demonstrates in miniature the "alignment" problem: How do we ensure that an AI with the ability to act pursues its goals in ways that conform to human values and legal norms?

The Technical Puzzle: Enabling AI Agents to Actually "Take Action"

The Critical Role of the MCP Protocol in AI Agents

One of the technical foundations of this experiment is MCP (Model Context Protocol). It's a protocol that allows AI models to connect to external data sources and tools in a standardized way. In this case, the AI accessing email via MCP means it can autonomously send and receive emails, handle customer inquiries, and even conduct business communications.

MCP was originally open-sourced by Anthropic in late 2024, designed to solve the fragmentation problem when AI models interact with the external world. Before MCP, developers needed to write separate adapter code for each external tool (such as email systems, databases, API services), making AI Agent development costly and difficult to maintain. MCP provides a "universal interface" similar to USB-C: it defines a unified communication format, allowing AI models to connect to different data sources and operational tools through the same protocol specification. Currently, MCP supports file system access, database queries, web browsing, code execution, and many other capabilities, and is becoming one of the de facto standards in the AI Agent ecosystem.

The value of MCP lies in lowering the engineering barrier for "AI connecting to the real world." Developers don't need to write complex integration code for each individual tool; instead, through a unified protocol, they can quickly give AI the ability to operate various services.

Financial Infrastructure Designed Specifically for AI Agents

The @agentcardai debit card mentioned in the experiment is a noteworthy detail. The emergence of such "Agent-specific payment cards" itself indicates an ecosystem that is taking shape: financial infrastructure for AI agents.

Traditional payment systems assume the operator is human. When AI needs to autonomously subscribe to services, purchase API credits, pay for cloud server costs, and perform other operations, it requires dedicated accounts and payment channels to manage permissions, set limits, and track transactions.

This sector is developing rapidly. Traditional financial systems' KYC (Know Your Customer) and AML (Anti-Money Laundering) rules are all designed with natural persons or legal entities as subjects. AI agents are legally neither natural persons nor legal entities, creating a regulatory gray area. Multiple startups in the market (such as Skyfire, Payman, etc.) are already attempting to provide controlled payment channels for AI Agents. Their core design philosophies typically include: preset spending limits, transaction category whitelists, real-time behavior monitoring, and human approval trigger mechanisms. The maturity of such infrastructure will directly determine the speed and safety of AI Agent commercialization.

The rise of these tools is an important piece of the puzzle for AI Agents moving toward practical application.

A Rational Perspective: The Distance Between Demo and Reality

It's important to emphasize that high-profile social media demonstrations often carry elements of "marketing" and "topic generation." The "GPT 5.6" designation mentioned is not an officially released product name, and readers should exercise cautious judgment regarding specific model capabilities.

The reality is likely this: in such open-ended tasks, AI is more likely in the short term to fall into inefficient attempts, repetitive operations, or even struggle to generate stable profits due to a lack of deep understanding of real business environments. Making AI "earn money" sounds exciting, but generating real revenue from a listed app, maintaining customer relationships, and handling unexpected issues are all extremely complex real-world challenges.

Therefore, the true value of this experiment lies not in "how much money the AI made," but in serving as a public stress test — allowing us to observe in advance the behavioral patterns of AI agents with real permissions, and to think about the corresponding regulatory, safety, and ethical frameworks.

Conclusion: AI at the Tipping Point from Tool to Economic Agent

Regardless of this experiment's final outcome, it clearly marks the next battleground in AI development: the shift from passive responses to proactive action.

When AI possesses servers, products, communications, and capital, it gradually evolves from a tool into an "economic agent" capable of operating independently in the digital world. This holds enormous productivity potential — imagine countless AI agents running micro-businesses 24/7 — but also brings unprecedented challenges: permission management, behavioral alignment, accountability, and financial security.

Experiments like this serve as a mirror, reminding us: before technology races ahead, the accompanying safety guardrails, ethical norms, and legal frameworks must catch up as quickly as possible.