Security Review of 12 AI Agent Frameworks: None Can Limit Agent Spending in Dollars

AI Agents are evolving from conversational tools into execution entities that can autonomously invoke external services. When an Agent can initiate payments, purchase API credits, or call paid tools, a simple question surfaces: can mainstream frameworks limit how much it spends?

A cross-sectional survey of 12 mainstream Agent frameworks gives a direct answer: no framework provides documentation for currency-denominated tool-call budget controls.

Survey Methodology and Eight Control Dimensions

On October 9, 2026, researchers reviewed the official documentation or source code of 12 frameworks one by one, examining eight control capabilities:

• C1: Human approval before tool execution
• C2: Programmatic single-tool hook capable of blocking calls
• C3: Maximum steps/iterations/turns limit
• C4: Token or LLM cost budget per run
• C5: Currency-denominated tool consumption budget
• C6: Tool call rate limiting
• C7: Tool call idempotency/deduplication
• C8: Built-in tool call audit log (including parameters)

The survey covered LangChain/LangGraph, CrewAI, OpenAI Agents SDK, Vercel AI SDK, Google ADK, Microsoft AutoGen, Semantic Kernel, LlamaIndex, Pydantic AI, Mastra, Claude Agent SDK, and smolagents.

The survey was published by PinkWallet's Pink Agentic AI Payments team. The authors disclose that they work on a payment control layer, but emphasize that the survey subjects are general-purpose Agent frameworks, Pink itself is not in the table, and each cell links to the framework's own documentation.

Key Finding: The 0/12 Dollar Budget Gap

The most striking row in the table is C5—all 12 frameworks are marked "No", with none supporting currency-denominated tool-call budgets in their documentation.

This result should be viewed objectively: these are general-purpose Agent frameworks, and limiting spending in dollars was never their responsibility. But the gap objectively exists—if your Agent can spend money, the limits must come from outside the framework.

Other control items show clear differentiation:

• 10/12 provide some form of human approval (C1 is yes or partial), but not all can intercept a specific individual tool call—some can only stop the entire run
• 9/12 support blocking specific tool calls at the code level (C2), rather than relying solely on prompt instructions. This hook is precisely the entry point for connecting consumption checks
• 9/12 document a maximum steps limit (C3), the most common control in the survey
• Only 2/12 document a clear token or cost budget (C4 is yes), with another 3 marked partial

There is a key distinction here: token budgets limit the model's costs, not what the Agent purchases. A single tool call may trigger real money movement, and token budgets are completely unaware of it.

The difference between token budgets and currency budgets deserves elaboration. Tokens are the units by which models process text; a token budget is usually expressed as the maximum number of input and output tokens consumed per run, or converted into how many dollars of LLM API costs. What it measures is inference itself—how long the model "thought." A single tool call, however, may trigger real money movement completely unrelated to model costs: paying a bill, purchasing a dataset, or calling a third-party paid API on a per-use basis. These costs occur outside the model, and their amounts have no stable correspondence to token consumption. Therefore, even if a framework provides a precise token cap, it cannot prevent an Agent from completing a high-value payment within a small number of tokens. The two types of budgets need to be designed independently.

Where Should Spending Caps Live?

The answer is clear: not in the prompt.

"Don't spend more than $50" is just a piece of text in the model's context. It may be misread, forgotten, or overridden by a prompt injection attack. Placing financial safety on the model's textual understanding is an obvious risk.

A more reasonable approach is to use the framework's C2 hook (programmatic tool-call interception) to call a service outside the model that truly "understands money"—a payment API or its front-end control layer. This layer should hold the budget, per-transaction payment cap, allowed payees, and approval rules, and provide an answer before payment execution.

Three outcomes cover almost all scenarios: allow, ask a human (silence means rejection), and block.

This architecture strips amount control away from probabilistic model behavior and turns it into deterministic system rules.

Prompt injection refers to attacks in which an adversary contaminates inputs the model can read (such as web content, user messages, or return values from invoked tools) to override or bypass original instructions. When spending rules are written in natural language in the system prompt, malicious content can induce the model to ignore the "don't spend more than $50" constraint or fabricate a context of "already authorized." Because LLMs' distinction between instructions and data itself relies on contextual probability rather than strict grammatical boundaries, any prompt-based amount control is a soft constraint and cannot provide security guarantees under adversarial input. This is precisely the fundamental reason to move spending caps from the model context to an external process: programmatic hooks receive structured parameters and do not go through the model's textual understanding, so they are not affected by prompt injection.

Payment MCP Servers Have the Same Gap

The survey also cites a separate census of 49 payment-related MCP servers, corroborating the same gap from another angle: among 37 servers capable of moving funds, only 4 documented a spending budget, and only 6 documented human approval.

Two independent data lines point to the same conclusion—whether general-purpose Agent frameworks or specialized payment MCP servers, fund-level controls are broadly missing. This cross-validation reinforces the reality of the problem: this is not an isolated phenomenon in a single ecosystem, but a systemic gap across the entire Agent infrastructure layer.

MCP stands for Model Context Protocol, an open protocol proposed by Anthropic and adopted by multiple vendors to let AI applications connect to external tools and data sources in a unified way. An MCP server is essentially a process that exposes several "tools." Agents invoke them through a standardized request-response format, without needing to write separate integration code for each service. Payment MCP servers encapsulate fund operations such as transfers, deductions, and balance checks as tools. The protocol itself only specifies the call format and capability discovery mechanism; it contains no semantics for budgets, approvals, or rate limits. Therefore, fund-level controls must be added by the server implementers themselves—this is the protocol-layer root cause of the widespread gaps found in the census.

Practical Path and Sandbox Verification

Pink provides a public sandbox that exposes seven MCP tools to Agents (including pink.get_budget, pink.check_policy, pink.request_payment, etc.) and returns allowed, pending_human, or blocked for each request based on the per-Agent budget and rules. The sandbox uses test funds only.

The repository provides runnable examples for LangGraph, OpenAI Agents SDK, CrewAI, and Vercel AI SDK, allowing developers to directly observe how a consumption control layer connects to different frameworks' hooks.

For framework maintainers, the surveyors also left an open channel: if a cell's judgment is wrong, an issue with documentation links can be submitted for correction.

Implications for Developers

If your Agent has any form of financial capability—whether direct payments, purchasing resources, or calling usage-billed paid tools—you currently cannot find an out-of-the-box dollar-level fuse at the framework layer.

The pragmatic approach is to attach an independent policy layer at the tool-call hook, one that holds budgets and rules and makes deterministic judgments before money moves. The model can decide "whether to do it," but "whether it can spend" must be determined by a system outside the model.

One-line Summary

All 12 mainstream Agent frameworks lack currency-level tool-call budgets; financial control must attach an independent policy layer.

Paragraph Summary

A cross-sectional survey of 12 mainstream Agent frameworks, including LangChain, CrewAI, and OpenAI Agents SDK, shows that no framework documents currency-denominated tool-call budget controls (C5 is "No" for all). Although 10/12 support human approval, 9/12 support programmatic tool-blocking hooks, and 9/12 support maximum step limits, none of these controls address spending caps on real funds. The researchers note that token budgets only limit model costs, not the Agent's purchasing behavior, and the two must be designed independently. The authors argue for moving spending caps out of prompts, since prompt injection can override textual instructions; the correct approach is to attach a deterministic policy layer at the framework's C2 hook that holds budgets and rules and returns one of three outcomes: allow, request approval, or block. A census of 49 payment-related MCP servers corroborates the same systemic gap from another angle.