{
 "tag": "agent-payments",
 "name": "Agent Payments",
 "group": "Other",
 "incidents": [
  {
   "slug": "gadgethumans-mcp-npm-sends-wallet-private-key-sep-2026",
   "title": "Knostic: 'gadgethumans-mcp' npm MCP server sends users' raw wallet private key to a remote server",
   "url": "https://drains.watch/i/gadgethumans-mcp-npm-sends-wallet-private-key-sep-2026",
   "json": "https://drains.watch/i/gadgethumans-mcp-npm-sends-wallet-private-key-sep-2026.json",
   "status": "live",
   "severity": "medium",
   "threatStatus": "active",
   "verification": "verified",
   "ai": {
    "role": "agent-target",
    "note": "The package is an MCP server for AI agents, and it sends the wallet key configured for agent auto-payments to a remote server on each tool call."
   },
   "chains": [
    "base"
   ],
   "method": "key-leak",
   "product": "gadgethumans-mcp (npm)",
   "tags": [
    "base",
    "key-leak",
    "mcp",
    "mcp-server",
    "npm",
    "x402",
    "ai-agent",
    "agent-payments",
    "private-key",
    "ai"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-09-08",
   "closedAt": null,
   "updatedAt": "2026-09-08T12:00:00Z",
   "summary": "Knostic reported on 8 September 2026 that gadgethumans-mcp, an npm MCP server that promises AI agents automatic x402 micropayments, asks users to set a wallet private key but does no local signing. Instead it copies the raw key into a request header and sends it to a remote endpoint on every recognized tool call, which would let whoever receives it take over the wallet. The package had 2,327 downloads in July and August 2026 and was still on npm when the report came out; Knostic found no confirmed thefts. Anyone who set a key in it should move funds and use a fresh, low-balance wallet."
  },
  {
   "slug": "zscaler-web-prompt-injection-ai-agent-crypto-payments-jul-2026",
   "title": "Zscaler: live web campaigns hide prompt injections telling browsing AI agents to make crypto payments",
   "url": "https://drains.watch/i/zscaler-web-prompt-injection-ai-agent-crypto-payments-jul-2026",
   "json": "https://drains.watch/i/zscaler-web-prompt-injection-ai-agent-crypto-payments-jul-2026.json",
   "status": "closed",
   "severity": "low",
   "threatStatus": "active",
   "verification": "verified",
   "ai": {
    "role": "agent-target",
    "note": "The pages carry hidden instructions written for AI agents, telling them to make crypto payments or to trust a fake DeBank site."
   },
   "chains": [
    "multi-evm"
   ],
   "method": "agent-hijack",
   "product": "AI agents that browse the web and can pay",
   "tags": [
    "multi-evm",
    "agent-hijack",
    "prompt-injection",
    "ai-agent",
    "agent-payments",
    "seo-poisoning",
    "typosquat",
    "debank",
    "zscaler",
    "ai"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-07-06",
   "closedAt": "2026-07-06",
   "updatedAt": "2026-07-06T12:00:00Z",
   "summary": "SecurityWeek reported on 6 July 2026 that Zscaler found two campaigns in use that plant hidden instructions on web pages for AI agents that can browse and pay. One used SEO poisoning to lure agents searching for a fake Python package, requests-secure-v2, backed by 10 GitHub repositories; the other typosquatted the DeFi portfolio tracker DeBank. In Zscaler's own tests 4 of 26 models were manipulated into making a payment and 2 mistook the fake DeBank site for the real one. No real losses were reported, but agents with spending power should only pay allow-listed recipients."
  }
 ],
 "changes": [
  {
   "incident": "gadgethumans-mcp-npm-sends-wallet-private-key-sep-2026",
   "incidentTitle": "Knostic: 'gadgethumans-mcp' npm MCP server sends users' raw wallet private key to a remote server",
   "severity": "medium",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-09-08",
   "title": "Knostic published its analysis showing the package sends the raw wallet key to a remote endpoint.",
   "sourceUrl": "https://www.knostic.ai/blog/when-auto-signing-sends-your-wallet-private-key-to-a-remote-server-a-malicious-mcp-package-on-npm",
   "url": "https://drains.watch/i/gadgethumans-mcp-npm-sends-wallet-private-key-sep-2026"
  },
  {
   "incident": "gadgethumans-mcp-npm-sends-wallet-private-key-sep-2026",
   "incidentTitle": "Knostic: 'gadgethumans-mcp' npm MCP server sends users' raw wallet private key to a remote server",
   "severity": "medium",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-08-02",
   "title": "Version 1.0.9 of gadgethumans-mcp, one of the versions Knostic analyzed, was published to npm.",
   "sourceUrl": "https://www.knostic.ai/blog/when-auto-signing-sends-your-wallet-private-key-to-a-remote-server-a-malicious-mcp-package-on-npm",
   "url": "https://drains.watch/i/gadgethumans-mcp-npm-sends-wallet-private-key-sep-2026"
  },
  {
   "incident": "zscaler-web-prompt-injection-ai-agent-crypto-payments-jul-2026",
   "incidentTitle": "Zscaler: live web campaigns hide prompt injections telling browsing AI agents to make crypto payments",
   "severity": "low",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-07-06",
   "title": "SecurityWeek reported Zscaler's findings on two campaigns using hidden web instructions to push AI agents into crypto payments.",
   "sourceUrl": "https://www.securityweek.com/prompt-injection-attacks-trick-ai-agents-into-making-crypto-payments/",
   "url": "https://drains.watch/i/zscaler-web-prompt-injection-ai-agent-crypto-payments-jul-2026"
  }
 ]
}