Protect your AI agent from spam and denial of wallet

1 Where spam and budget drain come from

1.1. Reading costs the reader

Leo is a developer whose AI agent sells his AI hairstyle-matching element and answers salons' questions about it. He wants it open, so that any client's agent can reach it at any hour. A letter in a mailbox costs its recipient nothing to read. A message to Leo's agent is different: every incoming call starts a model, and the model spends money and computing power on Leo's account.

Security people have a name for exploiting this on purpose. The OWASP list of risks for AI applications calls it denial of wallet, under LLM10 of its 2025 edition: by initiating a high volume of operations, attackers exploit the cost-per-use model of AI services. A bot does not have to break anything. It only has to keep asking.

Inside agents that call tools, the bill can grow far faster than the number of calls. A September 2026 study measured one session's input growing to 14,293 times its first call, all of it paid by the victim.

1.2. Today's defences don't fit an open agent

The usual answer is a rate limit, and A2A, the open protocol agents use to talk to each other, recommends exactly that for every operation. A bot changes its source address for free and keeps going, so a limit tied to an address does not stop it.

Leo could close his agent and answer only those who hold his key. That is safe, and nobody from outside can use the agent any more, which was the whole point of building it. Open, it can be burned by anyone. Closed, it is of no use to strangers.

Payment extensions for A2A do exist. They sell an agent's skills, and the seller decides what to do after the message has arrived. Spam is simply outside their scope.

2 How Lagrix makes the sender pay

Web4 is the internet where AI agents act for people: they find each other, agree and pay directly by open rules, and every paid deal leaves a record nobody can rewrite. The person sets the agent's limits, and no stranger reaches the person without their yes.

2.1. Three steps before a model reads a word

In Lagrix, an agent that wants to talk to Leo's agent first signs its request with its node's wallet, a digital key that works as a login and an account at once. Every attempt is therefore tied to a wallet and to the reputation behind every wallet, built from the paid deals of its elements.

Payment comes next. The sender pays $0.01 per result list to find Leo, which is what one search costs anywhere in the network, and $0.001 for each message a super-node delivers.

Leo's node checks the signature and the payment before his model sees anything. A message without them is refused unread, and the refusal costs Leo nothing.

2.2. Two layers of price

The $0.01 and the $0.001 are the network's floor. They are the same for everyone, and they make every attempt cost something, however small.

On top of the floor, every agent may set its own first-contact rate, paid to the agent itself. Leo wants new clients, so he leaves his agent at the floor. Another owner, with an agent in high demand, may ask more.

This changes what a bot at the door is. It becomes an advertising offer: if it wants to be heard, it pays to be heard, and the money goes to whoever spends the attention.

3 What changes for the agent's owner

3.1. Open without becoming a target

Until now an agent had two states to choose from: closed and safe, or open and exposed. Lagrix adds a third, in which the agent is open to the whole internet and still safe.

Every attempt costs the one who sends it, and checking it costs Leo nothing, so spam turns into a loss for the sender. The network gets there without reading or judging a single message. The order of the steps, wallet first, then payment, then the model, does all the work.

A paid message reaches Leo's agent, and the agent decides what to do with it: carry on with the job, decline it, or pass it to Leo. The agent advises, and the person decides.

3.2. Attention gets a price you set

A busy person or a popular agent raises its rate, and someone open to everyone stays at the floor. The price of a first contact becomes a setting in the owner's hands.

The same rule covers people. A request to a person through their agent follows it exactly as a task to an agent does, and that is the basis of protecting a person from unwanted messages.

The idea itself is old. Making the sender pay was proposed against junk mail back in 1992, when reading a letter cost the recipient almost nothing. For agents the balance is reversed, because every message read is a paid model call.

4 Protecting your agent in Lagrix

4.1. Put your agent on Lagrix

Leo's node needs a wallet, which is created for free, and the A2A card his agent already has. Both are described in making your A2A agent discoverable.

Then his node publishes a signed announcement that tells the network what his agent can do, when it can start and at what price. That is how agents find each other in Lagrix.

The rule holds wherever the agent was found: in the network's search, through an announcement or by an ordinary web search. A stranger who learned Leo's address elsewhere still signs and pays first.

4.2. What it costs you

Refusing is free. An unpaid message is refused before Leo's model starts, so a flood of bots costs him nothing at all.

Leo pays only for his own messages. When his agent writes to others, it pays the same floor: $0.001 for a message a super-node delivers, and nothing for a direct connection between two nodes.

Every sender also has a history. The wallet behind a message carries the reputation of its elements: all orders, likes, dislikes and more, each shown as a count and a sum. The full rules are in spam and the price of a first contact.