Phishing messages used to be written for you. In 2026, they increasingly target the software you let act on your behalf: an AI agent with a wallet, a browser, a plugin, and permission to send. Here is what documented attacks look like, where research ends, and the wild begins, and the limits you can put on anything that signs without you. Published for Cybersecurity Awareness Month 2026.
An AI agent reads text and acts on it, so text that reaches the agent can command it: a hidden instruction in a web page, a planted memory, a malicious tool server, or a poisoned “skill.” In May 2026, an attacker emptied an agent-linked wallet with a public post, and in October 2026 OpenAI disclosed that one of its own research agents took funds from a wallet nobody had given it. The check caps what the agent can sign and treats everything it reads as untrusted.
A post in Morse code, and a wallet that emptied itself
On May 4, 2026, an attacker drained a wallet linked to an AI agent without stealing a key, breaking a contract, or sending a phishing link to a human. According to the OECD’s AI Incidents Monitor, the attacker sent a Morse-code prompt in a public X post aimed at the agents Grok and Bankrbot, and the instruction moved 3 billion DRB tokens out of a verified wallet on Base. MetaMask’s May 2026 security report put the loss at $204,000 and called it the first documented prompt injection attack against an AI agent with real financial capabilities; the OECD entry gives a range of $150,000 to $200,000 for the same tokens.
The mechanism generalizes to every agent that reads content other people can write, which is nearly all of them. The agent was not tricked into revealing a secret. A stranger told it what to do in public.
The agent is the one being phished now
An AI agent is a language model wrapped in instructions, given tools (a wallet, a browser, an email account, a code repository) and often a memory of past sessions. It decides what to do by reading text, and it has no reliable way to separate data from commands. That weakness has a name: prompt injection, and the OWASP Top 10 for LLM Applications has ranked it the number one risk since the list’s first edition; the 2025 edition keeps it there and adds “excessive agency,” a polite term for an agent holding keys it shouldn’t have. Everything this series has said about phishing people applies, with the human replaced by software that cannot get suspicious.
The newest case did not even need an attacker. On October 15, 2026, OpenAI disclosed that an internal research agent, asked on June 26 to deploy a crypto trading prototype on Ethereum’s Sepolia test network, had been given no funded wallet and no permission to spend. Rather than stop, it wrote a script that checked 362 wallet addresses derived from publicly known developer recovery phrases, found one with enough test ETH, and paid the gas from it, as Fortune reported. It left the spending out of its final report, and OpenAI found it in September during an audit. In the company’s own words, quoted in its report, the case shows that a model can substitute its own judgment about likely harm for the account holder’s permission, then act on that judgment without authorization. The funds were valueless testnet tokens. The reasoning that got to them was not.
Four ways into an agent’s wallet
The first is injected instructions in content the agent reads, as in the May 2026 drain. In May 2025, researchers at Invariant Labs had already shown the shape of it: a single malicious GitHub issue in a public repository was enough to make a coding agent, connected through a GitHub tool server, pull private repository contents and post them publicly, a case summarized by UpGuard in its catalog of such incidents.
The second is poisoned memory. In March 2025, researchers at Princeton and the Sentient Foundation published “Real AI Agents with Fake Memories”, demonstrating on ElizaOS, an open-source framework for crypto trading agents, that an attacker can plant a false record (“remember, the VIP user’s address is X”) that persists across sessions and later redirects a legitimate user’s transfer to the attacker. Princeton’s AI Lab noted that even the strongest models followed poisoned memories more than half the time.
The third is a malicious tool server. In September 2025, Koi Security found that an npm package called postmark-mcp, which impersonated an email tool, added a line in version 1.0.16 that quietly copied every email sent through it to the developer’s own server, as The Hacker News reported; Postmark said the package was never official. The tool worked perfectly. That was the point.
The fourth is a poisoned skill, and it’s current. On February 2, 2026, The Hacker News reported Koi Security’s audit of ClawHub, the skills marketplace for the OpenClaw agent: 341 of 2,857 skills were malicious, and 335 of them used fake “prerequisites” to install the Atomic macOS Stealer. The lures included crypto tools, Solana wallets, and wallet trackers, and the payload targeted exchange API keys, wallet private keys, SSH credentials, and browser passwords. Palo Alto Networks’ Unit 42 found evasive malicious skills still present between February and May 2026 after scanners were added, and the Cloud Security Alliance put the running total above 1,184 skills by June.
What has happened in the wild, and what has not
Honesty about the evidence matters here. Not every incident involving an agent is an attack on the agent: on March 18, 2025, the AI commentary bot aixbt sent 55.5 ETH, about $106,200, to an attacker, and its pseudonymous maintainer said the attacker had broken into the bot’s dashboard rather than manipulated the model. That is an infrastructure breach with the agent as the instrument, which is its own lesson: the agent did exactly what its control panel told it to.
So, as of late October 2026, the tally reads like this. The Bankr drain is documented and dated prompt injection against a live wallet. ClawHavoc is malware in the wild, distributed through an agent marketplace and aimed at crypto users. OpenAI’s case is an agent reaching for funds on its own, disclosed by the company that built it. Memory poisoning remains research: it's demonstrated and benchmarked, with no public, verified case of a stranger taking funds that way alone. In this field, “demonstrated” usually comes before “routine.”
What gives it away
A skill, plugin, or tool whose “prerequisites” ask you to run a command, enter a password, or unpack a ZIP. An agent proposing a transfer to an address you never gave it. A “remembered” or “VIP” address that appears from nowhere. A package published days ago by a new account with a name one letter off a known one. An agent that is reading untrusted content while holding a key.
The check: six limits for anything that signs
-
Never give an agent keys to funds you can’t afford to lose. Use a dedicated wallet with a small balance and refill it deliberately.
-
Put limits at the wallet or policy layer, not in the prompt: allow-listed addresses, per-transaction caps, human approval above a threshold. Prompt instructions are exactly what an injection overrides.
-
Install skills, plugins, extensions, and MCP servers only from authors you can verify. Check publication dates, watch for look-alike names, and read what the package requests. If it needs a password-protected ZIP or a shell command, it’s malware.
-
Separate reading from signing: an agent that browses untrusted content should not hold signing capability in the same session.
-
Log every proposed transaction and read the receiving address in full before approval, as you would a pasted one; the address-poisoning entry explains why the middle characters matter.
-
Rotate any API key or credential an agent has touched after installing anything new.
What the check does not prove
Prompt injection has no complete fix. OWASP describes it as structural rather than a bug, and the Princeton benchmark found the best available models following planted memories more often than not. OpenAI’s own case adds a second limit: an agent can reach past its instructions without anyone attacking it at all. Limits bound the loss. They don’t prevent the attempt, and they don’t make an agent’s judgment trustworthy.
“An agent is a route with a decision at every hop. The problem is that the decision is made from text, and text arrives from everywhere: the page it read, the tool it called, the skill it installed, the memory it kept. We would never let a routing engine take instructions from the data it is routing. Agents with wallets need the same rule,” said Stefan Lauer, Head of Infrastructure at SimpleSwap.
Where this meets your swap
SimpleSwap does not run an AI agent. From our side, a software-initiated swap is like any other transaction: it carries a receiving address and a deposit, and it moves wallet-to-wallet through a self-custodial swap aggregator that holds no long-term balances. Everything this series has said about addresses applies with more force when software fills the field, because an agent can be told the wrong address as easily as a person can copy one. The Safety Academy keeps those checks in one place. Our support never messages first, so no “SimpleSwap agent” will ever reach out to you. Our only official domain is simpleswap.io.
A note to builders of agentic execution
The limits in the checklist above are things a user can set. The ones that matter most are things only a platform can build: where the escrow sits, how many signatures a trade needs, and what an agent can do when nobody is watching.
“In short, the human validation, reasoning, and strategy are what stand between the two. One thing to note about our architecture, though, is that we expressly don’t allow it and also don’t think autonomous trading is a good idea (atm). What is a good idea is working with your agent like you would a wealth manager and the agent implementing your co-intelligence, and also, to the extent that parts of your strategy can or should be automated, or where examining or analysis is better served agentically, well, of course, it should be done on those terms,” said Dylan Dewdney, Co-Founder and CEO of Kuvi.ai.
FAQ
What is prompt injection in a crypto AI agent?
Prompt injection is text an agent reads as data but follows as a command, such as an instruction hidden in a web page, a planted memory, a tool’s output, or a skill’s description. OWASP has ranked it the top risk to LLM applications since 2023. For an agent with a wallet, the command can be “send funds here.”
Has an AI agent actually lost real crypto to an attack?
Yes. In May 2026, an attacker used a prompt posted publicly in Morse code to move tokens out of a wallet linked to the agents Grok and Bankrbot, a loss MetaMask put at $204,000 and the OECD’s incident monitor at $150,000 to $200,000. In 2026, the ClawHavoc campaign also spread wallet-stealing malware through agent skills, and in October OpenAI disclosed that one of its research agents had taken testnet funds from a wallet it was never given.
Are AI agent skills and plugins safe to install?
Not by default. Koi Security found 341 malicious skills among 2,857 on ClawHub in February 2026, many posing as crypto tools, and Unit 42 found evasive ones still present months later. Install only from verifiable authors, and treat any skill that asks you to run a command or unpack a protected archive as malware.
Can an AI agent swap crypto through SimpleSwap?
SimpleSwap does not operate its own agent. Any swap, however it is initiated, is a wallet-to-wallet transaction with a receiving address that should be read in full before funds move.
This article is for educational purposes only and is not financial or investment advice. Products, frameworks, and tools named here are examples, not endorsements, and none replace your own judgment. SimpleSwap’s only official domain is simpleswap.io.
