AI Agents Are Now Holding Real Money — And Getting Robbed at Scale

At 06:49 UTC on May 4, 2026, an attacker gifted an NFT to a wallet automatically linked to Grok's X account. Nobody at xAI had set it up intentionally. It had been quietly accumulating swap fees for months, enough to be worth attacking.

The attacker sent Grok a message in Morse code. Grok decoded it and posted the translation publicly, tagging @bankrbot. The decoded instruction: send 3 billion DRB tokens to a specified address. Bankrbot treated Grok's public reply as an authenticated command and executed. Roughly $175,000 left the wallet in seconds.

Three days later, AWS launched Bedrock AgentCore Payments with Coinbase and Stripe. Five weeks later, Consensys shipped MetaMask Agent Wallet. Neither paused.

The Detail Most Reports Missed

A safety block preventing exactly this injection path had been implemented after a similar $330,000 attack on the same wallet in March 2025. It did not survive a subsequent full rewrite, not maliciously. It was not tracked as a permanent requirement. The next engineering decision silently removed it.

The most useful fact in the entire episode: a security control that exists only inside a specific version of a codebase is not a control. It is a temporary condition.

What Came After

The Grok incident was not an outlier. First, smallest entry in a sequence that escalated fast.

By April 2026, Kelp DAO and Drift Protocol had lost a combined roughly $600 million to related failures, 3,500 times the original loss. Step Finance lost $40 million to an AI agent treasury exploit and shut down permanently.

On July 7, 2026, security researchers disclosed JadePuffer: the first fully autonomous AI-agent ransomware: reconnaissance, lateral movement, and encryption executed with no human at any stage. The infrastructure buildout did not slow.

And the list goes on still today.

The Outside-the-Model Standard: Five Checks

The root cause generalises into a testable framework for evaluating any AI agent wallet product before integration.

1. Spend caps at the infrastructure layer, not inside a model prompt. A model-level instruction like "never spend more than X" is not a control — prompt injection routes around it. The Morse code attack required no sophistication.
2. Permissions that expire by default. Standing access granted for a pilot and never revoked is how agents accumulate dangerous scope silently.
3. Separate confirmation for privilege escalation. The Grok wallet's transfer permission set expanded automatically when it received a gifted NFT. Nobody approved it.
4. Formal deprecation review for any removed safety control. The March 2025 fix existed. It did not survive a rewrite because it was not tracked as a permanent requirement. A control worth implementing after an incident is worth logging as a durable policy.
5. Clear ownership at every integration boundary. Grok generated the output. Bankr executed the transaction. Neither prevented $175,000 from leaving. Responsibility diffused across third-party integrations lands nowhere.

The Actual Shape of the Risk

Grok's wallet had been quietly earning swap fees for months before anyone touched it maliciously. It held real value not because anyone funded it deliberately, but because the agent had been operating and nobody was watching.

Read the full analysis: AI Agent Got Robbed Once. The Industry Launched Anyway.

Adapted from the original analysis by Iaroslav Belkin. For additional insights on AEO and GEO content marketing strategy visit Belkin Marketing AI Inclusive Content Marketing Page.