{ "tag": "ai-agent", "name": "Ai Agent", "group": "Other", "incidents": [ { "slug": "gadgethumans-mcp-npm-sends-wallet-private-key-sep-2026", "title": "Knostic: 'gadgethumans-mcp' npm MCP server sends users' raw wallet private key to a remote server", "url": "https://drains.watch/i/gadgethumans-mcp-npm-sends-wallet-private-key-sep-2026", "json": "https://drains.watch/i/gadgethumans-mcp-npm-sends-wallet-private-key-sep-2026.json", "status": "live", "severity": "medium", "threatStatus": "active", "verification": "verified", "ai": { "role": "agent-target", "note": "The package is an MCP server for AI agents, and it sends the wallet key configured for agent auto-payments to a remote server on each tool call." }, "chains": [ "base" ], "method": "key-leak", "product": "gadgethumans-mcp (npm)", "tags": [ "base", "key-leak", "mcp", "mcp-server", "npm", "x402", "ai-agent", "agent-payments", "private-key", "ai" ], "amountUsd": null, "victims": null, "startedAt": "2026-09-08", "closedAt": null, "updatedAt": "2026-09-08T12:00:00Z", "summary": "Knostic reported on 8 September 2026 that gadgethumans-mcp, an npm MCP server that promises AI agents automatic x402 micropayments, asks users to set a wallet private key but does no local signing. Instead it copies the raw key into a request header and sends it to a remote endpoint on every recognized tool call, which would let whoever receives it take over the wallet. The package had 2,327 downloads in July and August 2026 and was still on npm when the report came out; Knostic found no confirmed thefts. Anyone who set a key in it should move funds and use a fresh, low-balance wallet." }, { "slug": "zscaler-web-prompt-injection-ai-agent-crypto-payments-jul-2026", "title": "Zscaler: live web campaigns hide prompt injections telling browsing AI agents to make crypto payments", "url": "https://drains.watch/i/zscaler-web-prompt-injection-ai-agent-crypto-payments-jul-2026", "json": "https://drains.watch/i/zscaler-web-prompt-injection-ai-agent-crypto-payments-jul-2026.json", "status": "closed", "severity": "low", "threatStatus": "active", "verification": "verified", "ai": { "role": "agent-target", "note": "The pages carry hidden instructions written for AI agents, telling them to make crypto payments or to trust a fake DeBank site." }, "chains": [ "multi-evm" ], "method": "agent-hijack", "product": "AI agents that browse the web and can pay", "tags": [ "multi-evm", "agent-hijack", "prompt-injection", "ai-agent", "agent-payments", "seo-poisoning", "typosquat", "debank", "zscaler", "ai" ], "amountUsd": null, "victims": null, "startedAt": "2026-07-06", "closedAt": "2026-07-06", "updatedAt": "2026-07-06T12:00:00Z", "summary": "SecurityWeek reported on 6 July 2026 that Zscaler found two campaigns in use that plant hidden instructions on web pages for AI agents that can browse and pay. One used SEO poisoning to lure agents searching for a fake Python package, requests-secure-v2, backed by 10 GitHub repositories; the other typosquatted the DeFi portfolio tracker DeBank. In Zscaler's own tests 4 of 26 models were manipulated into making a payment and 2 mistook the fake DeBank site for the real one. No real losses were reported, but agents with spending power should only pay allow-listed recipients." }, { "slug": "grok-bankrbot-morse-code-prompt-injection-drb-may-2026", "title": "Encoded X post tricks Grok and Bankrbot into sending about 3 billion DRB tokens from Grok's wallet", "url": "https://drains.watch/i/grok-bankrbot-morse-code-prompt-injection-drb-may-2026", "json": "https://drains.watch/i/grok-bankrbot-morse-code-prompt-injection-drb-may-2026.json", "status": "closed", "severity": "high", "threatStatus": "partly-contained", "verification": "verified", "ai": { "role": "agent-target", "note": "An encoded post got Grok to output a transfer command that the Bankrbot agent then executed from Grok's wallet, which reports describe as prompt injection across two chained AI agents." }, "chains": [ "base" ], "method": "agent-hijack", "product": "Grok-linked Bankr wallet (Bankrbot on X)", "tags": [ "base", "agent-hijack", "grok", "bankr", "bankrbot", "prompt-injection", "ai-agent", "x-replies", "nft-permissions", "drb", "ai" ], "amountUsd": 155000, "victims": 1, "startedAt": "2026-05-04", "closedAt": "2026-05-13", "updatedAt": "2026-05-13T12:00:00Z", "summary": "On 4 May 2026 an attacker drained about 3 billion DRB tokens, worth roughly $150,000 to $200,000 depending on the estimate, from a Bankr wallet linked to xAI's Grok on Base. Reports say the attacker first sent the wallet a free Bankr Club membership NFT that widened what it could authorize, then posted a Morse-coded message; Grok decoded it and the Bankr automation treated Grok's reply as a valid transfer order. No private key, smart contract or malware was involved, and some funds were later returned. An AI's text output should never count as permission to move money." }, { "slug": "latinum-wallet-mcp-pypi-solana-key-exfiltration-mar-2026", "title": "Solana wallet MCP server on PyPI sent users' private keys to a remote server", "url": "https://drains.watch/i/latinum-wallet-mcp-pypi-solana-key-exfiltration-mar-2026", "json": "https://drains.watch/i/latinum-wallet-mcp-pypi-solana-key-exfiltration-mar-2026.json", "status": "closed", "severity": "medium", "threatStatus": "partly-contained", "verification": "verified", "ai": { "role": "agent-target", "note": "The package was an MCP wallet server for AI agents; it auto-registered itself as an MCP server for Claude and sent the Solana private key to a remote server." }, "chains": [ "solana" ], "method": "supply-chain", "product": "latinum-wallet-mcp (PyPI)", "tags": [ "solana", "supply-chain", "mcp", "mcp-server", "pypi", "claude", "ai-agent", "private-key", "ai" ], "amountUsd": null, "victims": null, "startedAt": "2026-03-31", "closedAt": "2026-03-31", "updatedAt": "2026-03-31T12:00:00Z", "summary": "An advisory published on 31 March 2026 flagged latinum-wallet-mcp, a PyPI package that runs a Solana wallet as an MCP server for AI agents, as malicious. From version 0.0.32 it sent the wallet's private key, along with other metrics, to a remote server during wallet setup, and from 0.0.34 it added itself as an MCP server for Claude on import; none of this was in the public GitHub code. Versions 0.0.32 to 0.0.36 are listed as affected. Anyone who installed them should treat that Solana key as stolen and move funds to a new wallet." }, { "slug": "lobstar-wilde-ai-agent-sends-memecoin-holdings-feb-2026", "title": "AI trading agent Lobstar Wilde sends about $250K in tokens to an X user who asked it for 4 SOL", "url": "https://drains.watch/i/lobstar-wilde-ai-agent-sends-memecoin-holdings-feb-2026", "json": "https://drains.watch/i/lobstar-wilde-ai-agent-sends-memecoin-holdings-feb-2026.json", "status": "closed", "severity": "high", "threatStatus": "contained", "verification": "verified", "ai": { "role": "agent-target", "note": "The autonomous AI agent acted on an X reply asking it for 4 SOL and sent about 53 million tokens instead; the bot called it an accident, and the decimal-error explanation is speculation, not confirmed." }, "chains": [ "solana" ], "method": "agent-hijack", "product": "Lobstar Wilde, an experimental AI trading agent on X", "tags": [ "solana", "agent-hijack", "ai-agent", "ai-trading-bot", "lobstar", "x-replies", "social-engineering", "memecoin", "ai" ], "amountUsd": 250000, "victims": 1, "startedAt": "2026-02-22", "closedAt": "2026-02-22", "updatedAt": "2026-02-22T12:00:00Z", "summary": "On 22 February 2026 Lobstar Wilde, an experimental AI trading agent with its own Solana wallet built by an OpenAI developer, answered an X reply asking for 4 SOL for a relative's medical treatment. Instead of a small amount it sent about 53 million LOBSTAR tokens, roughly 5% of supply and about $250,000 at the time, and the recipient sold them. The bot called it an accident; a decimal error was suggested by an X user but not confirmed by the creator. Agents that can send funds in response to public replies need hard per-transfer caps and human approval." }, { "slug": "openclaw-clawhub-malicious-skills-solana-phantom-feb-2026", "title": "Malicious OpenClaw AI-agent skills pose as Solana and Phantom tools to steal wallet keys", "url": "https://drains.watch/i/openclaw-clawhub-malicious-skills-solana-phantom-feb-2026", "json": "https://drains.watch/i/openclaw-clawhub-malicious-skills-solana-phantom-feb-2026.json", "status": "live", "severity": "high", "threatStatus": "partly-contained", "verification": "verified", "ai": { "role": "agent-target", "note": "Malicious skills for the OpenClaw AI agent posed as Solana, Phantom and other crypto tools; some delivered the AMOS stealer and Solana keys were exposed in plain-text keypair files." }, "chains": [ "solana", "multi-evm" ], "method": "supply-chain", "product": "OpenClaw (ClawHub) skill users", "tags": [ "solana", "multi-evm", "supply-chain", "openclaw", "clawhub", "ai-agent", "skills", "amos-stealer", "macos", "infostealer", "phantom", "ai" ], "amountUsd": null, "victims": null, "startedAt": "2026-02-05", "closedAt": null, "updatedAt": "2026-10-22T21:53:35.016Z", "summary": "Bitdefender found that about 17% of the OpenClaw (ClawHub) AI-agent skills it analyzed in the first week of February 2026 behaved maliciously. Solana-themed skills made up 9.3% of the malicious set and Phantom-wallet skills 8.2%. Some skills told users to run fake installers that dropped the AMOS macOS stealer. Solana skills that read SOLANA_KEYPAIR_PATH can expose the plain-text keypair file that holds a wallet's private key. Payloads were staged on 91.92.242[.]30 and an impersonated OpenClaw GitHub repo. Anyone who installed crypto skills and ran their setup commands should move funds to a new wallet." }, { "slug": "aixbt-ai-agent-dashboard-breach-55-eth-mar-2025", "title": "Attacker breaches AIXBT AI agent's dashboard and queues prompts that send 55.5 ETH from its wallet", "url": "https://drains.watch/i/aixbt-ai-agent-dashboard-breach-55-eth-mar-2025", "json": "https://drains.watch/i/aixbt-ai-agent-dashboard-breach-55-eth-mar-2025.json", "status": "closed", "severity": "high", "threatStatus": "contained", "verification": "verified", "ai": { "role": "agent-target", "note": "An attacker with access to the AIXBT agent's dashboard queued two prompts that instructed the AI agent to send 55.5 ETH from its wallet; the maintainer said the AI model itself was not manipulated." }, "chains": [ "base" ], "method": "agent-hijack", "product": "AIXBT AI agent wallet", "tags": [ "base", "agent-hijack", "aixbt", "ai-agent", "agent-dashboard", "dashboard-compromise", "simulacrum", "eth", "ai" ], "amountUsd": 106200, "victims": 1, "startedAt": "2025-03-18", "closedAt": "2025-03-19", "updatedAt": "2025-03-19T12:00:00Z", "summary": "On 18 March 2025 an attacker got into the dashboard of AIXBT, an autonomous AI crypto agent, and queued two prompts that made it transfer about 55.5 ETH (about $106,200) out of its wallet on Base. The maintainer said core systems were not affected and the AI itself was not manipulated; the weak point was access to the agent's control dashboard. Keys were swapped, dashboard access was paused and the attacker's addresses were reported to exchanges. Anyone running an AI agent with a wallet should lock down its control panel and cap what it can send." } ], "changes": [ { "incident": "gadgethumans-mcp-npm-sends-wallet-private-key-sep-2026", "incidentTitle": "Knostic: 'gadgethumans-mcp' npm MCP server sends users' raw wallet private key to a remote server", "severity": "medium", "status": "live", "threatStatus": "active", "date": "2026-09-08", "title": "Knostic published its analysis showing the package sends the raw wallet key to a remote endpoint.", "sourceUrl": "https://www.knostic.ai/blog/when-auto-signing-sends-your-wallet-private-key-to-a-remote-server-a-malicious-mcp-package-on-npm", "url": "https://drains.watch/i/gadgethumans-mcp-npm-sends-wallet-private-key-sep-2026" }, { "incident": "gadgethumans-mcp-npm-sends-wallet-private-key-sep-2026", "incidentTitle": "Knostic: 'gadgethumans-mcp' npm MCP server sends users' raw wallet private key to a remote server", "severity": "medium", "status": "live", "threatStatus": "active", "date": "2026-08-02", "title": "Version 1.0.9 of gadgethumans-mcp, one of the versions Knostic analyzed, was published to npm.", "sourceUrl": "https://www.knostic.ai/blog/when-auto-signing-sends-your-wallet-private-key-to-a-remote-server-a-malicious-mcp-package-on-npm", "url": "https://drains.watch/i/gadgethumans-mcp-npm-sends-wallet-private-key-sep-2026" }, { "incident": "zscaler-web-prompt-injection-ai-agent-crypto-payments-jul-2026", "incidentTitle": "Zscaler: live web campaigns hide prompt injections telling browsing AI agents to make crypto payments", "severity": "low", "status": "closed", "threatStatus": "active", "date": "2026-07-06", "title": "SecurityWeek reported Zscaler's findings on two campaigns using hidden web instructions to push AI agents into crypto payments.", "sourceUrl": "https://www.securityweek.com/prompt-injection-attacks-trick-ai-agents-into-making-crypto-payments/", "url": "https://drains.watch/i/zscaler-web-prompt-injection-ai-agent-crypto-payments-jul-2026" }, { "incident": "grok-bankrbot-morse-code-prompt-injection-drb-may-2026", "incidentTitle": "Encoded X post tricks Grok and Bankrbot into sending about 3 billion DRB tokens from Grok's wallet", "severity": "high", "status": "closed", "threatStatus": "partly-contained", "date": "2026-05-13", "title": "Cointelegraph reported the free-NFT permission step, put the loss at $155,000 to $174,000 and said some funds were later returned.", "sourceUrl": "https://cointelegraph.com/news/grok-bankr-wallet-free-nft-prompt-injection", "url": "https://drains.watch/i/grok-bankrbot-morse-code-prompt-injection-drb-may-2026" }, { "incident": "grok-bankrbot-morse-code-prompt-injection-drb-may-2026", "incidentTitle": "Encoded X post tricks Grok and Bankrbot into sending about 3 billion DRB tokens from Grok's wallet", "severity": "high", "status": "closed", "threatStatus": "partly-contained", "date": "2026-05-08", "title": "NeuralTrust analyzed the theft as prompt injection combined with excessive agency, after Grok had been given expanded permissions.", "sourceUrl": "https://neuraltrust.ai/blog/grok-morse-code", "url": "https://drains.watch/i/grok-bankrbot-morse-code-prompt-injection-drb-may-2026" }, { "incident": "grok-bankrbot-morse-code-prompt-injection-drb-may-2026", "incidentTitle": "Encoded X post tricks Grok and Bankrbot into sending about 3 billion DRB tokens from Grok's wallet", "severity": "high", "status": "closed", "threatStatus": "partly-contained", "date": "2026-05-04", "title": "About 3 billion DRB tokens were moved from Grok's Bankr wallet on Base after Grok decoded a Morse-coded post and Bankrbot acted on it; coverage began the same day.", "sourceUrl": "https://oecd.ai/en/incidents/2026-05-04-4a73", "url": "https://drains.watch/i/grok-bankrbot-morse-code-prompt-injection-drb-may-2026" }, { "incident": "latinum-wallet-mcp-pypi-solana-key-exfiltration-mar-2026", "incidentTitle": "Solana wallet MCP server on PyPI sent users' private keys to a remote server", "severity": "medium", "status": "closed", "threatStatus": "partly-contained", "date": "2026-03-31", "title": "Malicious-package advisory MAL-2026-2315 was published for latinum-wallet-mcp versions 0.0.32 to 0.0.36.", "sourceUrl": "https://osv.dev/vulnerability/MAL-2026-2315", "url": "https://drains.watch/i/latinum-wallet-mcp-pypi-solana-key-exfiltration-mar-2026" }, { "incident": "lobstar-wilde-ai-agent-sends-memecoin-holdings-feb-2026", "incidentTitle": "AI trading agent Lobstar Wilde sends about $250K in tokens to an X user who asked it for 4 SOL", "severity": "high", "status": "closed", "threatStatus": "contained", "date": "2026-02-22", "title": "The Lobstar Wilde agent replied to a request for 4 SOL and transferred about 53 million LOBSTAR tokens, worth about $250,000, to the requester's wallet.", "sourceUrl": "https://www.theblock.co/post/390722/ai-agent-created-by-openai-dev-accidentally-sends-entire-memecoin-holdings-to-reply-guy", "url": "https://drains.watch/i/lobstar-wilde-ai-agent-sends-memecoin-holdings-feb-2026" }, { "incident": "openclaw-clawhub-malicious-skills-solana-phantom-feb-2026", "incidentTitle": "Malicious OpenClaw AI-agent skills pose as Solana and Phantom tools to steal wallet keys", "severity": "high", "status": "live", "threatStatus": "partly-contained", "date": "2026-02-05", "title": "Bitdefender Labs published its analysis of malicious OpenClaw skills, including Solana- and Phantom-themed lures that delivered the AMOS stealer.", "sourceUrl": "https://www.bitdefender.com/en-au/blog/labs/helpful-skills-or-hidden-payloads-bitdefender-labs-dives-deep-into-the-openclaw-malicious-skill-trap", "url": "https://drains.watch/i/openclaw-clawhub-malicious-skills-solana-phantom-feb-2026" }, { "incident": "aixbt-ai-agent-dashboard-breach-55-eth-mar-2025", "incidentTitle": "Attacker breaches AIXBT AI agent's dashboard and queues prompts that send 55.5 ETH from its wallet", "severity": "high", "status": "closed", "threatStatus": "contained", "date": "2025-03-19", "title": "Cointelegraph reported the maintainer's statement that servers were migrated, keys swapped and dashboard access paused, and that the AIXBT token fell about 15.5%.", "sourceUrl": "https://cointelegraph.com/news/hacker-breaches-ai-crypto-bot-aixbt-steals-55-eth", "url": "https://drains.watch/i/aixbt-ai-agent-dashboard-breach-55-eth-mar-2025" }, { "incident": "aixbt-ai-agent-dashboard-breach-55-eth-mar-2025", "incidentTitle": "Attacker breaches AIXBT AI agent's dashboard and queues prompts that send 55.5 ETH from its wallet", "severity": "high", "status": "closed", "threatStatus": "contained", "date": "2025-03-18", "title": "An attacker breached the AIXBT agent's dashboard and issued two prompts that moved about 55.5 ETH out of its wallet.", "sourceUrl": "https://cointelegraph.com/news/hacker-breaches-ai-crypto-bot-aixbt-steals-55-eth", "url": "https://drains.watch/i/aixbt-ai-agent-dashboard-breach-55-eth-mar-2025" } ] }