{
 "tag": "agent-hijack",
 "name": "AI agent hijacking",
 "group": "Drain methods",
 "incidents": [
  {
   "slug": "zscaler-web-prompt-injection-ai-agent-crypto-payments-jul-2026",
   "title": "Zscaler: live web campaigns hide prompt injections telling browsing AI agents to make crypto payments",
   "url": "https://drains.watch/i/zscaler-web-prompt-injection-ai-agent-crypto-payments-jul-2026",
   "json": "https://drains.watch/i/zscaler-web-prompt-injection-ai-agent-crypto-payments-jul-2026.json",
   "status": "closed",
   "severity": "low",
   "threatStatus": "active",
   "verification": "verified",
   "ai": {
    "role": "agent-target",
    "note": "The pages carry hidden instructions written for AI agents, telling them to make crypto payments or to trust a fake DeBank site."
   },
   "chains": [
    "multi-evm"
   ],
   "method": "agent-hijack",
   "product": "AI agents that browse the web and can pay",
   "tags": [
    "multi-evm",
    "agent-hijack",
    "prompt-injection",
    "ai-agent",
    "agent-payments",
    "seo-poisoning",
    "typosquat",
    "debank",
    "zscaler",
    "ai"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-07-06",
   "closedAt": "2026-07-06",
   "updatedAt": "2026-07-06T12:00:00Z",
   "summary": "SecurityWeek reported on 6 July 2026 that Zscaler found two campaigns in use that plant hidden instructions on web pages for AI agents that can browse and pay. One used SEO poisoning to lure agents searching for a fake Python package, requests-secure-v2, backed by 10 GitHub repositories; the other typosquatted the DeFi portfolio tracker DeBank. In Zscaler's own tests 4 of 26 models were manipulated into making a payment and 2 mistook the fake DeBank site for the real one. No real losses were reported, but agents with spending power should only pay allow-listed recipients."
  },
  {
   "slug": "grok-bankrbot-morse-code-prompt-injection-drb-may-2026",
   "title": "Encoded X post tricks Grok and Bankrbot into sending about 3 billion DRB tokens from Grok's wallet",
   "url": "https://drains.watch/i/grok-bankrbot-morse-code-prompt-injection-drb-may-2026",
   "json": "https://drains.watch/i/grok-bankrbot-morse-code-prompt-injection-drb-may-2026.json",
   "status": "closed",
   "severity": "high",
   "threatStatus": "partly-contained",
   "verification": "verified",
   "ai": {
    "role": "agent-target",
    "note": "An encoded post got Grok to output a transfer command that the Bankrbot agent then executed from Grok's wallet, which reports describe as prompt injection across two chained AI agents."
   },
   "chains": [
    "base"
   ],
   "method": "agent-hijack",
   "product": "Grok-linked Bankr wallet (Bankrbot on X)",
   "tags": [
    "base",
    "agent-hijack",
    "grok",
    "bankr",
    "bankrbot",
    "prompt-injection",
    "ai-agent",
    "x-replies",
    "nft-permissions",
    "drb",
    "ai"
   ],
   "amountUsd": 155000,
   "victims": 1,
   "startedAt": "2026-05-04",
   "closedAt": "2026-05-13",
   "updatedAt": "2026-05-13T12:00:00Z",
   "summary": "On 4 May 2026 an attacker drained about 3 billion DRB tokens, worth roughly $150,000 to $200,000 depending on the estimate, from a Bankr wallet linked to xAI's Grok on Base. Reports say the attacker first sent the wallet a free Bankr Club membership NFT that widened what it could authorize, then posted a Morse-coded message; Grok decoded it and the Bankr automation treated Grok's reply as a valid transfer order. No private key, smart contract or malware was involved, and some funds were later returned. An AI's text output should never count as permission to move money."
  },
  {
   "slug": "lobstar-wilde-ai-agent-sends-memecoin-holdings-feb-2026",
   "title": "AI trading agent Lobstar Wilde sends about $250K in tokens to an X user who asked it for 4 SOL",
   "url": "https://drains.watch/i/lobstar-wilde-ai-agent-sends-memecoin-holdings-feb-2026",
   "json": "https://drains.watch/i/lobstar-wilde-ai-agent-sends-memecoin-holdings-feb-2026.json",
   "status": "closed",
   "severity": "high",
   "threatStatus": "contained",
   "verification": "verified",
   "ai": {
    "role": "agent-target",
    "note": "The autonomous AI agent acted on an X reply asking it for 4 SOL and sent about 53 million tokens instead; the bot called it an accident, and the decimal-error explanation is speculation, not confirmed."
   },
   "chains": [
    "solana"
   ],
   "method": "agent-hijack",
   "product": "Lobstar Wilde, an experimental AI trading agent on X",
   "tags": [
    "solana",
    "agent-hijack",
    "ai-agent",
    "ai-trading-bot",
    "lobstar",
    "x-replies",
    "social-engineering",
    "memecoin",
    "ai"
   ],
   "amountUsd": 250000,
   "victims": 1,
   "startedAt": "2026-02-22",
   "closedAt": "2026-02-22",
   "updatedAt": "2026-02-22T12:00:00Z",
   "summary": "On 22 February 2026 Lobstar Wilde, an experimental AI trading agent with its own Solana wallet built by an OpenAI developer, answered an X reply asking for 4 SOL for a relative's medical treatment. Instead of a small amount it sent about 53 million LOBSTAR tokens, roughly 5% of supply and about $250,000 at the time, and the recipient sold them. The bot called it an accident; a decimal error was suggested by an X user but not confirmed by the creator. Agents that can send funds in response to public replies need hard per-transfer caps and human approval."
  },
  {
   "slug": "aixbt-ai-agent-dashboard-breach-55-eth-mar-2025",
   "title": "Attacker breaches AIXBT AI agent's dashboard and queues prompts that send 55.5 ETH from its wallet",
   "url": "https://drains.watch/i/aixbt-ai-agent-dashboard-breach-55-eth-mar-2025",
   "json": "https://drains.watch/i/aixbt-ai-agent-dashboard-breach-55-eth-mar-2025.json",
   "status": "closed",
   "severity": "high",
   "threatStatus": "contained",
   "verification": "verified",
   "ai": {
    "role": "agent-target",
    "note": "An attacker with access to the AIXBT agent's dashboard queued two prompts that instructed the AI agent to send 55.5 ETH from its wallet; the maintainer said the AI model itself was not manipulated."
   },
   "chains": [
    "base"
   ],
   "method": "agent-hijack",
   "product": "AIXBT AI agent wallet",
   "tags": [
    "base",
    "agent-hijack",
    "aixbt",
    "ai-agent",
    "agent-dashboard",
    "dashboard-compromise",
    "simulacrum",
    "eth",
    "ai"
   ],
   "amountUsd": 106200,
   "victims": 1,
   "startedAt": "2025-03-18",
   "closedAt": "2025-03-19",
   "updatedAt": "2025-03-19T12:00:00Z",
   "summary": "On 18 March 2025 an attacker got into the dashboard of AIXBT, an autonomous AI crypto agent, and queued two prompts that made it transfer about 55.5 ETH (about $106,200) out of its wallet on Base. The maintainer said core systems were not affected and the AI itself was not manipulated; the weak point was access to the agent's control dashboard. Keys were swapped, dashboard access was paused and the attacker's addresses were reported to exchanges. Anyone running an AI agent with a wallet should lock down its control panel and cap what it can send."
  }
 ],
 "changes": [
  {
   "incident": "zscaler-web-prompt-injection-ai-agent-crypto-payments-jul-2026",
   "incidentTitle": "Zscaler: live web campaigns hide prompt injections telling browsing AI agents to make crypto payments",
   "severity": "low",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-07-06",
   "title": "SecurityWeek reported Zscaler's findings on two campaigns using hidden web instructions to push AI agents into crypto payments.",
   "sourceUrl": "https://www.securityweek.com/prompt-injection-attacks-trick-ai-agents-into-making-crypto-payments/",
   "url": "https://drains.watch/i/zscaler-web-prompt-injection-ai-agent-crypto-payments-jul-2026"
  },
  {
   "incident": "grok-bankrbot-morse-code-prompt-injection-drb-may-2026",
   "incidentTitle": "Encoded X post tricks Grok and Bankrbot into sending about 3 billion DRB tokens from Grok's wallet",
   "severity": "high",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-05-13",
   "title": "Cointelegraph reported the free-NFT permission step, put the loss at $155,000 to $174,000 and said some funds were later returned.",
   "sourceUrl": "https://cointelegraph.com/news/grok-bankr-wallet-free-nft-prompt-injection",
   "url": "https://drains.watch/i/grok-bankrbot-morse-code-prompt-injection-drb-may-2026"
  },
  {
   "incident": "grok-bankrbot-morse-code-prompt-injection-drb-may-2026",
   "incidentTitle": "Encoded X post tricks Grok and Bankrbot into sending about 3 billion DRB tokens from Grok's wallet",
   "severity": "high",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-05-08",
   "title": "NeuralTrust analyzed the theft as prompt injection combined with excessive agency, after Grok had been given expanded permissions.",
   "sourceUrl": "https://neuraltrust.ai/blog/grok-morse-code",
   "url": "https://drains.watch/i/grok-bankrbot-morse-code-prompt-injection-drb-may-2026"
  },
  {
   "incident": "grok-bankrbot-morse-code-prompt-injection-drb-may-2026",
   "incidentTitle": "Encoded X post tricks Grok and Bankrbot into sending about 3 billion DRB tokens from Grok's wallet",
   "severity": "high",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-05-04",
   "title": "About 3 billion DRB tokens were moved from Grok's Bankr wallet on Base after Grok decoded a Morse-coded post and Bankrbot acted on it; coverage began the same day.",
   "sourceUrl": "https://oecd.ai/en/incidents/2026-05-04-4a73",
   "url": "https://drains.watch/i/grok-bankrbot-morse-code-prompt-injection-drb-may-2026"
  },
  {
   "incident": "lobstar-wilde-ai-agent-sends-memecoin-holdings-feb-2026",
   "incidentTitle": "AI trading agent Lobstar Wilde sends about $250K in tokens to an X user who asked it for 4 SOL",
   "severity": "high",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-02-22",
   "title": "The Lobstar Wilde agent replied to a request for 4 SOL and transferred about 53 million LOBSTAR tokens, worth about $250,000, to the requester's wallet.",
   "sourceUrl": "https://www.theblock.co/post/390722/ai-agent-created-by-openai-dev-accidentally-sends-entire-memecoin-holdings-to-reply-guy",
   "url": "https://drains.watch/i/lobstar-wilde-ai-agent-sends-memecoin-holdings-feb-2026"
  },
  {
   "incident": "aixbt-ai-agent-dashboard-breach-55-eth-mar-2025",
   "incidentTitle": "Attacker breaches AIXBT AI agent's dashboard and queues prompts that send 55.5 ETH from its wallet",
   "severity": "high",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-03-19",
   "title": "Cointelegraph reported the maintainer's statement that servers were migrated, keys swapped and dashboard access paused, and that the AIXBT token fell about 15.5%.",
   "sourceUrl": "https://cointelegraph.com/news/hacker-breaches-ai-crypto-bot-aixbt-steals-55-eth",
   "url": "https://drains.watch/i/aixbt-ai-agent-dashboard-breach-55-eth-mar-2025"
  },
  {
   "incident": "aixbt-ai-agent-dashboard-breach-55-eth-mar-2025",
   "incidentTitle": "Attacker breaches AIXBT AI agent's dashboard and queues prompts that send 55.5 ETH from its wallet",
   "severity": "high",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-03-18",
   "title": "An attacker breached the AIXBT agent's dashboard and issued two prompts that moved about 55.5 ETH out of its wallet.",
   "sourceUrl": "https://cointelegraph.com/news/hacker-breaches-ai-crypto-bot-aixbt-steals-55-eth",
   "url": "https://drains.watch/i/aixbt-ai-agent-dashboard-breach-55-eth-mar-2025"
  }
 ]
}