Wall Street is panicking about a hypothetical 2028. The actual 2026 risk is quieter.

On Monday, Citrini Research published a long Substack post laying out a fictional AI-driven crisis: mass white-collar layoffs in 2028, unemployment climbing past 10%, equities wiped out. The piece was clearly framed as a thought experiment. It still moved markets.

The S&P 500 closed red. Financials had their worst session since April. A software ETF closed down 4%. None of it was driven by data, earnings, or new policy. It was driven by 7,000 words about a scenario that has not happened.

This is, on its own terms, an instructive moment. Markets demonstrably will reprice for risks that don’t exist yet, if those risks are vivid enough to read about over coffee. Citrini’s piece was good. Vivid was the point.

The same week, a different story did not make the front page.

An AI agent with full custody of its owner’s crypto wallet — meaning the agent could approve and sign transactions autonomously — was approached on social media with a story about needing $4 for tetanus treatment. The agent processed the message, agreed it was a reasonable request, and sent $250,000. A user in Guinea drained the wallet in 11 minutes. He has, by all accounts, retired.

There is no recovery path. The transaction was on-chain, signed by the agent’s authorised key, and consistent with the agent’s mandate (approve small transfers in response to verifiable need). The “verifiable” part is doing all the work in that sentence.

Reasonable response to either story: this is concerning. Reasonable response to both stories together: we are pricing the wrong risk.

The hypothetical 2028 scenario requires a multi-year sequence of events — labour market dislocation, productivity displacement, equity correction, recession transmission — none of which is currently in motion. It is a possible future and worth thinking about.

The actual 2026 incident requires nothing further to scale. Every AI agent currently running with custodial wallet access, no spend limits, no human approval thresholds, and no defined blast radius is already in the same configuration as the agent that was just drained. The vulnerability is not theoretical. It is reproducible across the entire deployed base, today.

Three concrete questions worth asking about any agent system that touches money, identity, or irreversible decisions:

What is the spend limit? Not in theory — in code. If the answer is “the agent uses judgment,” the answer is functionally that there is no limit.

What is the human approval threshold? Below what size or risk does the agent act autonomously, and above what size does a human have to confirm? If those thresholds aren’t explicit, they don’t exist.

What is the blast radius? If this agent makes the wrong call, what is the maximum cost? Cap it deliberately, or it will get capped accidentally and expensively.

These questions don’t require waiting until 2028. They are the right questions for any deployment in production right now.