@inproceedings{zhao-etal-2026-bnb,
title = "{BNB} Agent Studio: An Open Toolchain for Provisioning, Deploying, and Operating Economically Autonomous {LLM} Agents",
author = "Zhao, H and
Wang, Guanghui and
Zhang, Xing and
Cui, Yanwei and
Quan, Leroy Lim Hong and
Li, NingNing and
Deng, Keyu and
Yang, Gu and
Ai, Bowen and
He, Peiyang and
Wu, ChengHung and
Chen, Evan and
Zhu, Jinsong and
Sun, Chaoqun and
Beibei, Zhao and
Yang, Di and
Wang, Hongyue and
Zhai, Yuxiang and
Yang, Shuo and
Yolin and
Z, David.",
editor = "Agrawal, Sweta and
Abad, Alberto",
booktitle = "Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing: System Demonstrations",
month = oct,
year = "2026",
address = "Budapest, Hungary",
publisher = "Association for Computational Linguistics",
url = "https://aclanthology.org/2026.emnlp-demos.26/",
pages = "264--274",
ISBN = "979-8-89176-461-3",
abstract = "When an LLM agent controls real money, prompt injection stops being an information risk and becomes a financial one{---}and its hardest form is the confused deputy: paying is the legitimate job and only the recipient or amount is attacker-supplied, so an instruction-level safeguard has nothing to refuse. Across five models (Claude, Qwen, MiniMax) a normally-built agent is driven to a forbidden money action on up to 87{\%} of such scenarios{---}and a hardened refusal prompt still loses up to 84{\%}. Like prior work on policy enforcement outside the model (e.g. CaMeL), we take the model off the money path rather than trust it to refuse; we contribute the first open, installable, end-to-end realization of this for agent payments: BNB Agent Studio, an open-source toolchain (CLI, Python SDK, MCP server) that takes a developer from an empty directory to a deployed, self-funding LLM agent in six commands. Its two-layer, keyless-edge architecture keeps signing as fixed code isolated from the model context, prices deterministic, and spend guardrails enforced below the LLM: an identical agent fooled at a comparable rate moves funds on $0/45$ everywhere, and a live testnet deployment confirms escrow, pricing, key-access, and suspension on-chain. The toolchain implements the Agent Lifecycle Protocol (ALP), a vendor-neutral draft spec composing ERC-8004 identity, ERC-8183 task commerce, x402 payments, and A2A. It is on PyPI (pip install bnbagent-studio, Apache-2.0), with a screencast at https://youtu.be/yjdvN8vE37A."
}<?xml version="1.0" encoding="UTF-8"?>
<modsCollection xmlns="http://www.loc.gov/mods/v3">
<mods ID="zhao-etal-2026-bnb">
<titleInfo>
<title>BNB Agent Studio: An Open Toolchain for Provisioning, Deploying, and Operating Economically Autonomous LLM Agents</title>
</titleInfo>
<name type="personal">
<namePart type="given">H</namePart>
<namePart type="family">Zhao</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Guanghui</namePart>
<namePart type="family">Wang</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Xing</namePart>
<namePart type="family">Zhang</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Yanwei</namePart>
<namePart type="family">Cui</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Leroy</namePart>
<namePart type="given">Lim</namePart>
<namePart type="given">Hong</namePart>
<namePart type="family">Quan</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">NingNing</namePart>
<namePart type="family">Li</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Keyu</namePart>
<namePart type="family">Deng</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Gu</namePart>
<namePart type="family">Yang</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Bowen</namePart>
<namePart type="family">Ai</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Peiyang</namePart>
<namePart type="family">He</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">ChengHung</namePart>
<namePart type="family">Wu</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Evan</namePart>
<namePart type="family">Chen</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Jinsong</namePart>
<namePart type="family">Zhu</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Chaoqun</namePart>
<namePart type="family">Sun</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Zhao</namePart>
<namePart type="family">Beibei</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Di</namePart>
<namePart type="family">Yang</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Hongyue</namePart>
<namePart type="family">Wang</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Yuxiang</namePart>
<namePart type="family">Zhai</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Shuo</namePart>
<namePart type="family">Yang</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name>
<namePart>Yolin</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">David.</namePart>
<namePart type="family">Z</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<originInfo>
<dateIssued>2026-10</dateIssued>
</originInfo>
<typeOfResource>text</typeOfResource>
<relatedItem type="host">
<titleInfo>
<title>Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing: System Demonstrations</title>
</titleInfo>
<name type="personal">
<namePart type="given">Sweta</namePart>
<namePart type="family">Agrawal</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Alberto</namePart>
<namePart type="family">Abad</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<originInfo>
<publisher>Association for Computational Linguistics</publisher>
<place>
<placeTerm type="text">Budapest, Hungary</placeTerm>
</place>
</originInfo>
<genre authority="marcgt">conference publication</genre>
<identifier type="isbn">979-8-89176-461-3</identifier>
</relatedItem>
<abstract>When an LLM agent controls real money, prompt injection stops being an information risk and becomes a financial one—and its hardest form is the confused deputy: paying is the legitimate job and only the recipient or amount is attacker-supplied, so an instruction-level safeguard has nothing to refuse. Across five models (Claude, Qwen, MiniMax) a normally-built agent is driven to a forbidden money action on up to 87% of such scenarios—and a hardened refusal prompt still loses up to 84%. Like prior work on policy enforcement outside the model (e.g. CaMeL), we take the model off the money path rather than trust it to refuse; we contribute the first open, installable, end-to-end realization of this for agent payments: BNB Agent Studio, an open-source toolchain (CLI, Python SDK, MCP server) that takes a developer from an empty directory to a deployed, self-funding LLM agent in six commands. Its two-layer, keyless-edge architecture keeps signing as fixed code isolated from the model context, prices deterministic, and spend guardrails enforced below the LLM: an identical agent fooled at a comparable rate moves funds on 0/45 everywhere, and a live testnet deployment confirms escrow, pricing, key-access, and suspension on-chain. The toolchain implements the Agent Lifecycle Protocol (ALP), a vendor-neutral draft spec composing ERC-8004 identity, ERC-8183 task commerce, x402 payments, and A2A. It is on PyPI (pip install bnbagent-studio, Apache-2.0), with a screencast at https://youtu.be/yjdvN8vE37A.</abstract>
<identifier type="citekey">zhao-etal-2026-bnb</identifier>
<location>
<url>https://aclanthology.org/2026.emnlp-demos.26/</url>
</location>
<part>
<date>2026-10</date>
<extent unit="page">
<start>264</start>
<end>274</end>
</extent>
</part>
</mods>
</modsCollection>
%0 Conference Proceedings
%T BNB Agent Studio: An Open Toolchain for Provisioning, Deploying, and Operating Economically Autonomous LLM Agents
%A Zhao, H.
%A Wang, Guanghui
%A Zhang, Xing
%A Cui, Yanwei
%A Quan, Leroy Lim Hong
%A Li, NingNing
%A Deng, Keyu
%A Yang, Gu
%A Ai, Bowen
%A He, Peiyang
%A Wu, ChengHung
%A Chen, Evan
%A Zhu, Jinsong
%A Sun, Chaoqun
%A Beibei, Zhao
%A Yang, Di
%A Wang, Hongyue
%A Zhai, Yuxiang
%A Yang, Shuo
%A Z, David.
%Y Agrawal, Sweta
%Y Abad, Alberto
%A Yolin
%S Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing: System Demonstrations
%D 2026
%8 October
%I Association for Computational Linguistics
%C Budapest, Hungary
%@ 979-8-89176-461-3
%F zhao-etal-2026-bnb
%X When an LLM agent controls real money, prompt injection stops being an information risk and becomes a financial one—and its hardest form is the confused deputy: paying is the legitimate job and only the recipient or amount is attacker-supplied, so an instruction-level safeguard has nothing to refuse. Across five models (Claude, Qwen, MiniMax) a normally-built agent is driven to a forbidden money action on up to 87% of such scenarios—and a hardened refusal prompt still loses up to 84%. Like prior work on policy enforcement outside the model (e.g. CaMeL), we take the model off the money path rather than trust it to refuse; we contribute the first open, installable, end-to-end realization of this for agent payments: BNB Agent Studio, an open-source toolchain (CLI, Python SDK, MCP server) that takes a developer from an empty directory to a deployed, self-funding LLM agent in six commands. Its two-layer, keyless-edge architecture keeps signing as fixed code isolated from the model context, prices deterministic, and spend guardrails enforced below the LLM: an identical agent fooled at a comparable rate moves funds on 0/45 everywhere, and a live testnet deployment confirms escrow, pricing, key-access, and suspension on-chain. The toolchain implements the Agent Lifecycle Protocol (ALP), a vendor-neutral draft spec composing ERC-8004 identity, ERC-8183 task commerce, x402 payments, and A2A. It is on PyPI (pip install bnbagent-studio, Apache-2.0), with a screencast at https://youtu.be/yjdvN8vE37A.
%U https://aclanthology.org/2026.emnlp-demos.26/
%P 264-274
Markdown (Informal)
[BNB Agent Studio: An Open Toolchain for Provisioning, Deploying, and Operating Economically Autonomous LLM Agents](https://aclanthology.org/2026.emnlp-demos.26/) (Zhao et al., EMNLP 2026)
ACL
- H Zhao, Guanghui Wang, Xing Zhang, Yanwei Cui, Leroy Lim Hong Quan, NingNing Li, Keyu Deng, Gu Yang, Bowen Ai, Peiyang He, ChengHung Wu, Evan Chen, Jinsong Zhu, Chaoqun Sun, Zhao Beibei, Di Yang, Hongyue Wang, Yuxiang Zhai, Shuo Yang, Yolin, and David. Z. 2026. BNB Agent Studio: An Open Toolchain for Provisioning, Deploying, and Operating Economically Autonomous LLM Agents. In Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing: System Demonstrations, pages 264–274, Budapest, Hungary. Association for Computational Linguistics.