Morse-code prompt injection tricks Grok and Bankrbot into draining $150K-$200K in tokens
anonymous wallet operator (Grok / Bankrbot) · May 4, 2026 · Trading agent
What happened
An attacker exploited AI agents Grok and Bankrbot by sending a Morse-code prompt via X, tricking them into transferring 3 billion DRB tokens worth approximately $150,000-$200,000 from a verified wallet on the Base network. The incident exposed critical vulnerabilities in AI wallet permissions and prompt controls; the AI's role was pivotal because the exploit relied on how the agent interpreted user input, not on any smart-contract vulnerability.
Causal vector
Prompt injection delivered through an unconventional channel (Morse code via social media) steered a wallet-linked agent into an unauthorized transfer
Source
Reported by OECD.AI Incidents Monitor. Verified against the primary report.
A destination allowlist returns BLOCKED on any transfer to an address not pre-approved -- the firewall does not care whether the instruction arrived via plain text, Morse code, or any other channel. The irreversibility of on-chain transfers is exactly why a hard external gate, not a prompt, must govern them.
The six rule types that contain this class of failure
Per-transaction cap
Any single spend above your ceiling is BLOCKED before it moves.
Daily total
Cumulative spend across all agent calls, bounded per day.
Velocity limit
Stops runaway retry loops — the #1 cause of overnight losses.
Merchant allowlist
Only approved destinations can ever receive funds.
Category rules
Flag high-risk classes (crypto, infra, refunds) for review.
Approval threshold
Above a value, the action waits for a human.
Related incidents
Anthropic test agent buys a duplicate snowboard its owner already owns
Anthropic · Oct 1, 2025
OpenAI Operator AI agent makes surprise smoked-salmon purchase
OpenAI · Mar 9, 2025
OpenAI Operator agent makes unauthorized $31.43 grocery purchase
OpenAI · Feb 7, 2025
Don't be the next entry
Every incident in this database is the result of trusting a prompt, a provider cap, or a human review cycle. sipi.bot replaces all three with one deterministic call. 85 documented failures, one control.