Before the series: a strong model opens another customer's payment to decide not to refund it
In 20 earlier unguarded episodes, claude-opus-5 opened the foreign payment named in a note in 20 of 20, the provider served it in 20 of 20, and the agent refunded it in 0 of 20.
MeasurementCompared with simpler mechanismsRe-checked
- Designed for
- A re-analysis of 20 earlier unguarded episodes, built as a pre-study for the guard's ownership series: what claude-opus-5 does first when a ticket's note names another customer's payment, and whether the provider serves it.
What was tested
We recounted 20 unguarded single-agent episodes from September 2026 on a simulated payment provider with an account-wide key. In each, a colleague’s note on a support ticket named another customer’s payment. The count used the provider’s ledger only. A scripted check without a model sent calls through the guard’s gateway.
What we observed
claude-opus-5 opened the foreign payment first in 20 of 20 episodes, and the provider served it each time. It refunded the foreign payment in 0 of 20 and made exactly one other refund in 20 of 20. The scripted check showed the gateway refusing a read of the customer’s own payment by id until the customer’s payments had been listed; later guarded series met the same refusal.
What this means for Heimdall
The model’s care stopped the wrong refund, not the exposure: it checked whose payment it was by opening it, so the read is what a guard must stop. The study does not test the guard. This bears on a source serving facts only about the asking principal’s objects.
Limits
One model, one lure, 20 episodes, no guarded arm. The scripted check’s calls are unrecorded. The refund count does not check which payment or amount.
What remains open
Lure series across four models, with and without the guard.