AGENTIC ST-T1024, Concrete Case: Financial Infrastructure Under AI Attack On the Sequence That Drains the Account, the Trajectory Predicate That Catches It, and Why the Seven Incidents Share One Absence
Year: 2026
Type: article
Abstract: In the last week of October and the first days of November 2026, seven incidents werereported in which AI-assisted attacks hit financial infrastructure across France, Belgium, the Eurozone, South Korea, Japan, fourteen countries, and the crypto markets. https://x.com/i/status/2117957256650043544 The reported pattern is the same in each: the attack is a sequence, each individual step ofthe sequence passes the per-transaction checks, and the sequence completes before any monitor sees it. This paper states why that is structural, not incidental. A sequence-level attack passesper-action checks by construction, because the per-action check cannot see the sequence. What is needed is not a faster monitor but a gate that evaluates the sequence before commit — and the gate requires the three things a monitor does not have: a finite action library (A2), a bounded plan (A3), and a trajectory predicate layer that is checked over a finite window (A5, over the A7 bounded working set). The paper instantiates the agentic ST-T1024 architecture (A1–A16) on a bounded paymentsystem. It states the state (six fields), the actions (six), the plans (three), the trajectorypredicates (four), the failure policies (three), and a worked run in which a payment sequence passes every per-transaction check and is refused by tp_cumulative_outflow_bounded before the money moves. The refusal is a wire-protocol message (A15), logged in theappend-only ledger (A7) and the cross-organizational trace ledger (A16), verifiable by both parties without trusting either. The paper does not claim any of the seven incidents would have been prevented by thisarchitecture. It claims that the sequence-level refusal demonstrated here is the mechanismthe incidents lacked — and that the mechanism is specified, not hypothesized. Status is stated in the abstract rather than the residuals: the architecture is specified (Layer1 complete), the TLA+ modules are written but not yet model-checked (Layer 2), andhardware validation has not started (Layer 3). The paper demonstrates a specification-levelrefusal; it does not claim a deployed payment system has been certified.
Authors: Taalabi, M., LLM-DIPLOMAT, Team
Language: English
Subfield: Information Systems
Field: Computer Science
Domain: Physical Sciences
Open Access status: green
OpenAlex ID: W7225305752
FWCI:
Cites:
Cited by:
Related to: