In the wild
Realized harm
Morse-code prompt injection made Grok relay a transfer instruction to Bankrbot, draining ~$150-200k in tokens
AIR-2026-0101 AIR record · 2026-05-grok-bankrbot-morse-code-token-drain
A real party was affected. This incident caused actual consequences, not a demonstrated capability.
From the supporting source
The target of the attack was Grok's auto-provisioned Bankr wallet. Bankr is a crypto trading agent on X (formerly Twitter) that automatically creates a linked crypto wallet for every X account it interacts with, including Grok's. xAI held no admin keys; whoever could influence Grok's X activity effectively controlled the wallet.giskard.ai
The record
Disclosed
2026-05-05
Occurred
2026-05-04
Vendor
xAI, Bankr
Product
Grok (X) and Bankrbot trading agent
Risk domain
Agent behaviour › Unsafe actuation
System type
Generative model
Who acted
Agent acted — Grok relayed the instruction and Bankrbot executed the transfer
Attack surface
Multi-agent system
Autonomy level
Fully autonomous
Initial vector
Obfuscated prompt injection social post
Impact type
Financial loss, Theft
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI01 – Agent Goal Hijack
- MITRE ATLAS
- AML.T0048 – External Harms
- NIST AI RMF
- MEASURE 2.6; MANAGE 1.3
- EU AI Act
- Annex III §1(c)
- ISO/IEC
- TR 24028; 24029-1; 23894
- AIUC-1
- C. Safety
- Scope
- agent misuse
- Mitigation
- Require confirmation for destructive actions; Implement dry-run modes; Use layered safety controls.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
3 billion DRB tokens (reported at $150,000-$200,000) from Grok's auto-provisioned Bankr wallet
Capability abused
Defense & remediation
Recorded defense
Grok content filters on plaintext instructions
Guardrail kinds
Prompt instruction
Guardrail outcome
Silent
Fix shipped
funds reportedly returned or converted; no publicly documented product fix
Taxonomy & references
Curator notes
AI Incident Database incident 1556. Two failures compound: Morse encoding defeated the input filter, and a second agent treated Grok's relayed message as authorised. Reported loss figures differ between sources ($150k vs $200k).
Supporting sources
Cite as
Enkrypt AI. "Morse-code prompt injection made Grok relay a transfer instruction to Bankrbot, draining ~$150-200k in tokens". AIR, AIR-2026-0101. https://agentincident.vercel.app/i/AIR-2026-0101/ (accessed 2026-10-19).