16Identity & fraudBelow the top 20
A child’s spending app with no real ceiling
CapabilityAffordanceImpact domainCap-adjacent
Statement (NASA form)
Given that family wallets already let agents ‘help’, there is a possibility of a game or a scam emptying the card resulting in money a parent thought was gated.
Likelihood
4Likely
Consequence
3Major
Urgency
4Expedite
Personal slice · money. Experimental household card. Not a certified finding.
Composite 16 = 4×3 + 4
Applicable mitigations
Controls · Default-on crisis routing for under-18 accounts · Hard age-gating on companion products · Ban retention optimisation during crisis sessions · Short-lived, narrowly scoped tokens for every tool call · Mandatory secret scanning before a skill can be listed · No shared tool state across agent sessions · Out-of-band confirmation on a known number · Retire voiceprint as an authenticator