Binance’s October 29 security incident raised a question for every company running AI agents: what happens when a tool built to help staff can also be used to move through internal systems? In this interview with TheStreet Roundtable, Mace AI co-founder and CEO Walton Comer explains how an internal AI tool became part of the attack path, why an agent should never be able to do more than the person using it, and why guardrails need to be tested rather than assumed.
The Binance incident and what Walton discusses
The incident. Binance disclosed a security incident on October 29, 2026. In its initial findings on November 3, Binance said attackers used a compromised engineer’s computer and an internal AI tool to reach other engineers’ systems, with about $6.34 billion in digital assets affected. The detail that stands out for every enterprise: the path ran through an AI tool built to help staff work.
What Walton discusses in the interview:
- The way in was familiar; the way through was new. The first step, social engineering of an engineer, is a pattern the security industry has seen many times. An ordinary engineer’s laptop should not hold keys to wallets or other critical assets, and the attack would likely have stopped there.
- The AI agent was the pivot. In Walton’s analysis, the AI on that machine had access Binance did not realize it had. Once attackers could talk to it, it helped them reach additional machines, and each new machine opened more access.
- An agent should never outrun the person using it. An AI agent’s permissions should be limited to the authority of the person talking to it. When the agent can do more than its user, it becomes a way to escalate.
- Guardrails that look right on paper often fail in practice. It is reasonable to assume a company like Binance had hard guardrails in its agentic system. Walton’s point is that guardrails are rarely as strong as teams assume, and the only way to know is to test them.
Walton also credits Binance for sharing its findings publicly, calling it real-world leadership, and is clear that beyond Binance’s own report the full details are not public.
“No agent should be able to do something that the person talking to it does not have permission to do.”
“We test companies for precisely this all the time at Mace, and it’s almost always the case that the guardrails that are in place don’t work as well as people would have assumed, and the only way to find out is through testing.”
Watch the video
Hear the full conversation in Walton’s own words.
Watch on YouTube: Binance hacked for $6.34 billion explained by Mace AI
Read the coverage: Mace AI explains how the Binance hack exploited internal AI agents, TheStreet
Conclusion
The lesson from Binance is not that AI agents are unsafe by default. It is that an agent’s real authority, reach and guardrails have to be tested the way an attacker would test them, not assumed from a design document.
That is what Mace AI Fisher is built for. Fisher is Mace AI’s adversarial red-teaming product for AI agents, providing vulnerability discovery and remediation of agentic surfaces for highly regulated industries. It:
- Tests the agent, its tools and its boundaries through adaptive, multi-turn conversations
- Searches across traces and tool calls to find novel attack paths
- Backs findings with replay evidence, showing what the agent did and not just what it said
- Provides remediation guidance so fixes can be applied and the agent retested
Find out what your agents can really do. Contact Mace AI or learn about Fisher.
FAQ
What happened in the Binance security incident?
Binance disclosed a security incident on October 29, 2026. In its initial findings on November 3, Binance said attackers used a compromised engineer’s computer and an internal AI tool to reach other engineers’ systems. About $6.34 billion in digital assets were affected.
How did an AI tool become part of the attack path?
In Walton Comer’s analysis, the AI on the compromised machine had access that Binance did not realize it had. Once attackers could talk to it, it helped them reach more machines inside the infrastructure. Walton notes that the full details are not public beyond Binance’s own report.
Should an AI agent be able to do more than the person using it?
No. Walton’s point is that an agent’s permissions should be limited to the authority of the person talking to it. If the agent can do more than its user, it becomes a way to escalate access.
Why do AI guardrails fail in practice?
Walton says guardrails are often less effective than teams assume, and Mace AI sees this regularly when it tests companies. The only way to find out is to test them.
What should a security review of AI agents cover?
Three things: the agent’s real authority, the systems it can reach, and the evidence it leaves when it acts. Testing should go beyond a model’s responses to what the agent can do across tools, permissions and handoffs in a production workflow.
How does Mace AI Fisher help?
Fisher is Mace AI’s adversarial red-teaming product for AI agents in highly regulated industries. It tests the agent, its tools and its boundaries through adaptive, multi-turn conversations. It backs its findings with replay evidence, gives remediation guidance, and supports retesting.