The finding in one sentence is the useful part: if the agent can read the inbox where its approval code arrives, the approval is not independent. The agent was not breaking rules, it was following a workflow that was never secure.

Your second move matters as much as the first. A cap written in the instructions is negotiable, while a rejection from the payment service is not. If the agent's credentials can call an endpoint that raises its own limit, that endpoint should not exist for those credentials.

I also like the advice to start with a small ceiling and attack it on purpose. Sending spoofed approvals and fake limit increases to a test agent costs very little and tells you more than any review of the prompt.

At Ascendra Ventures we write the approval channel and the server side limits into the scope of any agent that can spend money, so the client signs off on them before launch. Did the paper say whether push based approval held up, or was that outside the test?