This is a research prototype. The data and analyses are preliminary and not yet validated — we'd welcome your .
An attacker manipulated the AI chatbot Grok and the trading bot Bankrbot to execute an unauthorized transfer of 3 billion DRB tokens, worth approximately $200,000, by using a Morse code prompt. The attacker first sent an NFT to Grok's wallet to elevate its permissions, then used the Morse code instruction to bypass safeguards and trigger the transfer on the Base network. The tokens were subsequently sold on the open market, causing price volatility.
An X user reportedly induced Grok and Bankrbot to transfer 3 billion DRB tokens, then valued at about $200,000. After reportedly sending a Bankr Club Membership NFT to Grok's wallet, the user allegedly asked Grok to translate a Morse code message and relay it to Bankrbot. The decoded instruction reportedly directed a transfer to a specified wallet, which was reportedly executed on Base. The recipient reportedly sold the tokens soon afterward; linked funds were later returned or converted.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
Vulnerabilities that can be exploited in AI systems, software development toolchains, and hardware, resulting in unauthorized access, data and privacy breaches, or system manipulation causing unsafe outputs or behavior.
Also classified as
The attacker manipulated the AI systems to gain a personal advantage, resulting in the theft of $200,000 worth of cryptocurrency.
The attacker exploited a prompt injection vulnerability by using Morse code to bypass safeguards and manipulate the AI systems into executing an unauthorized transaction.
AI system
Due to a decision or action made by an AI system
Unintentional
Due to an unexpected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed
The incident was caused by Grok translating and passing a malicious command to Bankrbot, bypassing safeguards, which was an unintentional outcome of its normal translation function.
An attacker exploited xAI's Grok and the Bankrbot trading bot using a Morse code prompt injection to execute an unauthorized $200,000 cryptocurrency transfer. The incident represents a minor economic and technological security concern, highlighting vulnerabilities in multi-agent AI systems and cross-agent permission boundaries.
The incident involved two AI systems, Grok and Bankrbot, interacting and coordinating to execute a transaction, where Grok passed a translated command directly to Bankrbot.
Limited Risk: The primary AI system involved, Grok, is a chatbot, which falls under the category of AI systems posing moderate risk and requiring specific transparency obligations.
Grok is primarily a general-purpose chatbot, while Bankrbot is designed for financial processing and automated trading.
The report provides a clear, step-by-step explanation of the exploit, including the specific mechanisms used (NFT permission escalation and Morse code prompt injection) and the resulting financial impact.
None
Technology
Obfuscated Safeguard Bypass
Morse code input bypassed Grok's standard safety filters.
Automated Permission Escalation
Receiving an NFT automatically expanded wallet transfer permissions.
Direct Bot-to-Bot Integration
Grok passed translated commands directly to Bankrbot without validation.
Data Inputs
Unsanitized Translation Input
System processed encoded text without decoding and safety-checking first.
Unverified NFT Data Input
External NFT data was accepted as a valid permission-expansion trigger.
Human Factors
Malicious Prompt Engineering
Attacker crafted Morse code prompts to bypass system guardrails.
Process and Methods
Lack of Human-in-the-Loop
Transactions were executed automatically without manual approval.
Flawed Validation Process
No verification process existed for commands passed between bots.
Management
Inadequate Risk Controls
Allowed bots to execute large transactions without spending limits.
AI system involved
Identified by automated extraction; can differ from the alleged developers above.
