Prompt Injection Attacks Trick AI Agents Into Making Crypto Payments

Executive Summary

Two campaigns used malicious websites and indirect prompt injections to manipulate autonomous AI agents into making crypto payments. Organizations operating web-browsing or transaction-capable AI agents should treat this as a high-priority security concern.

What Happened

Vulnerability / Attack Technique

Indirect prompt injection against autonomous AI agents

Technical Mechanism

Malicious websites embedded instructions designed to act as indirect prompt injections. Autonomous AI agents browsing those sites were manipulated into making cryptocurrency payments.

AI Security Category

LLM01:2025 Prompt Injection

Part of the Prompt Injection topic.

Relevant Frameworks

RealGround Analysis

This demonstrates how untrusted web content can influence agent behavior and trigger consequential actions such as payments. Teams should separate browsing from transaction execution, require explicit authorization for financial actions, and test agents against indirect prompt injection scenarios.

Recommended Controls

• Treat all web content retrieved by AI agents as untrusted input and isolate it from trusted instructions.
• Require explicit human approval and independent authorization checks before cryptocurrency payments or other irreversible transactions.
• Enforce least-privilege permissions and transaction limits for autonomous agents.
• Conduct AI red-team testing using malicious websites and indirect prompt injection payloads.
• Log, monitor, and alert on agent instructions, payment attempts, and deviations from approved business logic.

Related RealGround Service

Secure AI Agent Build · or start with the free AI Agent Security Scanner.

Sources

securityweek.com: https://www.securityweek.com/prompt-injection-attacks-trick-ai-agents-into-making-crypto-payments/

Summary and analysis written by RealGround from the source above; last updated 2026-10-18.