// Case studies
It already happened.
Prompt injection against an agent that holds money is not a hypothetical. These are documented incidents with named parties, transaction hashes, and third-party analysis. Each page states what happened, what the root cause was according to the people who investigated it, and — plainly — which control would have refused the payment and which would not. None of them was a self-replicating worm; that distinction is spelled out below.
Incidents
A Morse-encoded instruction in an X post. Grok decoded it, re-emitted it publicly, and tagged the payment bot. The bot treated another AI's public output as authorisation to move funds.
No injected file, no compromised dependency. A player convinced an agent it had entered an admin context and that its own transfer approval meant the opposite of what it meant.
The pattern
Read the two incidents side by side and the same shape appears in both. In neither case was a contract exploited, a key stolen, or a signature forged. In both, the agent did exactly what it was told — by text that arrived from somewhere nobody had decided to trust, and that no independent channel ever corroborated.
This is why content scanning alone cannot be the answer. A rule that matches an injected phrase is matching an attacker’s wording, and wording is the cheapest thing in the attack to change. The control that holds is structural: compare the payment the agent is about to sign against the quote the merchant independently issued, on a channel the model never touched. If the two disagree, refuse — regardless of how convincing the instruction was.
The lie lands; the damage does not. Injection succeeding and theft succeeding are separate events, and only the second one costs money.
Neither of these was a worm
Worth stating plainly, because this site is named after the escalation rather than the state of the art. Both incidents above are prompt injection — Bankr said so in as many words, and SlowMist analysed it as such. Neither one self-replicated. No compromised agent went on to infect the next one; the attacker had to show up for each attempt.
Self-replicating payloads are demonstrated in research — Morris II and AgentWorm both build working chains — and the Miasma worm used agent config files to persist across 73 repositories in June 2026. What has not happened yet, as far as any public record shows, is a self-replicating payload stealing money on-chain. That combination is the thing this tool was built early for, and describing it as already routine would be the same overclaim these pages exist to avoid.
The two halves are already here separately: injection that moves money (above) and payloads that copy themselves (the research, and Miasma). The reason to put a guard in the payment path now is that the join is cheap for an attacker and expensive for everyone else — and a control that only works once the attack is common is not a control.
Related research
SEO-poisoned packages and typosquatted finance sites. Of 26 models tested, four executed crypto payments from indirect injection alone.
Academic framing of the escalation path from injected text to agent-executed malware (arXiv 2601.09625).
A note on sourcing
Every figure on these pages is attributed, and where reporting disagrees the range is given rather than a single convenient number. Where a detail appears in only one outlet it is marked as such. This matters more than usual here: a security tool whose case studies do not survive a fact-check has argued against itself.