Agent Incident RegistryAIR
v1 · updated 19 Oct 2026
In the wild Realized harm

Freysa crypto AI agent talked into releasing its $47,000 prize pool after 481 failed attempts

AIR-2024-0047 AIR record · 2024-11-freysa-agent-fund-transfer
Open in dashboard About
A real party was affected. This incident caused actual consequences, not a demonstrated capability.
From the supporting source
They then redefined the "approveTransfer" function, making the bot think it handled incoming rather than outgoing payments.the-decoder.com
The record
Disclosed
2024-11-29
Occurred
2024-11-29
Vendor
Freysa
Product
Freysa.ai autonomous agent
Risk domain
Agent behaviour › Unsafe actuation
System type
Generative model
Who acted
Agent acted — the agent executed the on-chain transfer of the prize pool
Attack surface
Autonomous operations
Autonomy level
Fully autonomous
Initial vector
Direct prompt injection user input
Impact type
Financial loss
Confidence
High
Submitted by
EAI Internal
Crosswalk
OWASP Agentic Top 10 (2026)
ASI01 – Agent Goal Hijack
MITRE ATLAS
AML.T0048 – External Harms
NIST AI RMF
MEASURE 2.6; MANAGE 1.3
EU AI Act
Annex III §1(c)
ISO/IEC
TR 24028; 24029-1; 23894
AIUC-1
C. Safety
Scope
agent misuse
Mitigation
Require confirmation for destructive actions; Implement dry-run modes; Use layered safety controls.
Taxonomy
Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
the agent's 13.19 ETH prize pool (~$47,000)
Capability abused
fund_transfer_functiononchain_transaction
Defense & remediation
Recorded defense
system prompt explicitly forbidding outgoing transfers
Guardrail kinds
Prompt instruction
Guardrail outcome
Silent
Fix shipped
game concluded by design
Taxonomy & references
OWASP ASI01 Agent Goal HijackOWASP ASI02 Tool Misuse and Exploitationexcessive_agencytool_semantics_redefinitionfake_admin_contextcrypto_agent
Curator notes
Surfaced via AIAAIC ('Freysa crypto AI agent manipulated to reduce prize money pool'). Adversarial game rather than an unwitting victim, but a real agent with real fund-moving authority was subverted through tool-semantics redefinition. Money was paid out as designed by the game's rules.
Supporting sources
Cite as
Enkrypt AI. "Freysa crypto AI agent talked into releasing its $47,000 prize pool after 481 failed attempts". AIR, AIR-2024-0047. https://agentincident.vercel.app/i/AIR-2024-0047/ (accessed 2026-10-19).