AI agent hijacking
An AI agent that can move funds reads hidden instructions, in a post, web page, document, token name or its own memory, and sends the funds to the attacker.
How it works
More people give AI agents and trading bots a wallet so they can act on their own: swap, tip, pay or rebalance.
The agent also reads things it doesn't control, like replies on X, web pages, documents, token names and descriptions, or plugin and skill files. Attackers hide instructions there.
If the agent can't tell your instructions from the attacker's, it follows theirs: it approves a token, sends funds, or saves a fake 'rule' in its memory that it obeys later.
Malicious plugins, skills or MCP servers do the same from the inside: they look like useful tools but read keys or send transactions.
Red flags
- An agent with signing power that also reads public replies, DMs or arbitrary web pages
- A plugin, skill or MCP server from an unknown author that asks for wallet or key access
- Agent memory or settings you didn't write, such as new 'trusted' addresses
- An agent wallet holding more than it needs for the day
Protect yourself
- Give agents a separate, small wallet with a spending cap, never your main wallet
- Allow-list where an agent may send funds, and require your approval above a set amount
- Keep agents that can sign away from untrusted content, or run reading and signing as separate agents
- Install skills, plugins and MCP servers only from authors you trust, and check what access they ask for
If you already signed
- Stop the agent and revoke its keys, sessions and API tokens
- Move what is left to a fresh wallet the agent never touched
- Clear the agent's memory and remove any plugin, skill or server you can't vouch for
- Revoke token approvals the agent made
Incidents using it 4
-
Zscaler: live web campaigns hide prompt injections telling browsing AI agents to make crypto payments
SecurityWeek reported on 6 July 2026 that Zscaler found two campaigns in use that plant hidden instructions on web pages for AI agents that can browse and pay. One used SEO poisoning to lure agents searching for a fake Python package, requests-secure-v2, backed by 10 GitHub repositories; the other typosquatted the DeFi portfolio tracker DeBank. In Zscaler's own tests 4 of 26 models were manipulated into making a payment and 2 mistook the fake DeBank site for the real one. No real losses were reported, but agents with spending power should only pay allow-listed recipients.
AI agents that browse the web and can pay·Multiple EVM chains·Since Jul 6, 2026·
-
Encoded X post tricks Grok and Bankrbot into sending about 3 billion DRB tokens from Grok's wallet
On 4 May 2026 an attacker drained about 3 billion DRB tokens, worth roughly $150,000 to $200,000 depending on the estimate, from a Bankr wallet linked to xAI's Grok on Base. Reports say the attacker first sent the wallet a free Bankr Club membership NFT that widened what it could authorize, then posted a Morse-coded message; Grok decoded it and the Bankr automation treated Grok's reply as a valid transfer order. No private key, smart contract or malware was involved, and some funds were later returned. An AI's text output should never count as permission to move money.
Grok-linked Bankr wallet (Bankrbot on X)·Base·$155K stolen·Since May 4, 2026·
-
AI trading agent Lobstar Wilde sends about $250K in tokens to an X user who asked it for 4 SOL
On 22 February 2026 Lobstar Wilde, an experimental AI trading agent with its own Solana wallet built by an OpenAI developer, answered an X reply asking for 4 SOL for a relative's medical treatment. Instead of a small amount it sent about 53 million LOBSTAR tokens, roughly 5% of supply and about $250,000 at the time, and the recipient sold them. The bot called it an accident; a decimal error was suggested by an X user but not confirmed by the creator. Agents that can send funds in response to public replies need hard per-transfer caps and human approval.
Lobstar Wilde, an experimental AI trading agent on X·Solana·$250K stolen·Since Feb 22, 2026·
-
Attacker breaches AIXBT AI agent's dashboard and queues prompts that send 55.5 ETH from its wallet
On 18 March 2025 an attacker got into the dashboard of AIXBT, an autonomous AI crypto agent, and queued two prompts that made it transfer about 55.5 ETH (about $106,200) out of its wallet on Base. The maintainer said core systems were not affected and the AI itself was not manipulated; the weak point was access to the agent's control dashboard. Keys were swapped, dashboard access was paused and the attacker's addresses were reported to exchanges. Anyone running an AI agent with a wallet should lock down its control panel and cap what it can send.
AIXBT AI agent wallet·Base·$106K stolen·Since Mar 18, 2025·