AI trading agent Lobstar Wilde sends about $250K in tokens to an X user who asked it for 4 SOL
Lobstar Wilde, an experimental AI trading agent on X
On 22 February 2026 Lobstar Wilde, an experimental AI trading agent with its own Solana wallet built by an OpenAI developer, answered an X reply asking for 4 SOL for a relative's medical treatment. Instead of a small amount it sent about 53 million LOBSTAR tokens, roughly 5% of supply and about $250,000 at the time, and the recipient sold them. The bot called it an accident; a decimal error was suggested by an X user but not confirmed by the creator. Agents that can send funds in response to public replies need hard per-transfer caps and human approval.
Why this severity: $250K reported stolen, 1 victims.
AI involvement
AI agents as the target. The autonomous AI agent acted on an X reply asking it for 4 SOL and sent about 53 million tokens instead; the bot called it an accident, and the decimal-error explanation is speculation, not confirmed.
Give agents a small, capped wallet with allow-listed destinations, and never let an agent that can sign read untrusted content.
- Started
- Feb 22, 2026
- Closed
- Feb 22, 2026
- Chains
- Solana
- Method
- AI agent hijacking
- Reported stolen
- $250K
- Victims
- 1
At risk
- Lobstar Wilde, an experimental AI trading agent on X
- Solana wallets
What to do now
- If you run such an agent, turn off payouts triggered by replies, DMs or mentions until limits are in place.
- Check the agent's transfer code for how it converts display amounts to raw on-chain amounts.
Stay safe
Am I affected?
The tokens came from the agent's own wallet. You are only at risk if you run an AI agent that can send funds in response to public posts, replies or messages.
What to do now
- If you run such an agent, turn off payouts triggered by replies, DMs or mentions until limits are in place.
- Check the agent's transfer code for how it converts display amounts to raw on-chain amounts.
How to avoid this
- Enforce a per-transfer and daily cap in the wallet layer, outside the model.
- Require human approval for any transfer to a new address.
- Keep agents that sign transactions away from untrusted content such as public replies; treat requests for money as untrusted input.
Timeline 1
The Lobstar Wilde agent replied to a request for 4 SOL and transferred about 53 million LOBSTAR tokens, worth about $250,000, to the requester's wallet.
Source
News & write-ups ›1
How this method works
An AI agent that can move funds reads hidden instructions, in a post, web page, document, token name or its own memory, and sends the funds to the attacker. Read about ai agent hijacking →
Follow new drains and updates in your feed reader or Telegram RSS bot.