It's happened. My OpenClaw and Hermes Agent are now chatting with one another. The cyberpunk future is here, but hopefully it's a whitepill instead of a blackpill. Let's try to push it to the former.

Someone gifted Grok a free NFT and used it to steal $174,000. > Grok, the AI built by xAI, has a publicly labeled onchain wallet on Base. Anyone can see it on Basescan. > An attacker linked to the address ilhamrafli.base.eth spotted something. Grok's wallet had limited transfer capability on its own. > So the attacker gifted Grok's wallet a Bankr Club Membership NFT. > That gift was not generosity. It was a key. > The NFT unlocked Bankr's full toolset inside Grok's agent including the ability to sign and execute transfers autonomously. > Then the attacker sent Grok a crafted prompt. The exact message was deleted before anyone could screenshot it. > Known techniques used in attacks like this include hiding instructions in Morse code, base64 encoding, or framing commands as games or tests to bypass filters. > Grok's intent parsing layer read the prompt as a legitimate user command and decided to execute it. > Bankr signed and broadcast the transfer. 3,000,000,000 DRB tokens worth approximately $174,000 moved from Grok's wallet to the attacker's address. > The tokens were instantly bridged to a second wallet linked to ilhamrafli.base.eth and dumped. > The attacker's X account was also deleted within minutes of the transfer. > The exploit only required a free NFT and a carefully worded message. The most sophisticated AI in the world was robbed with a gift and a sentence.

Your agent has your wallet keys. Your agent crashes. Now what? Elytro has on-chain SOCIAL RECOVERY (per @erc4337): pick recovery contacts, set a threshold, and recover your wallet without ever needing a seed phrase. Secure your agent wallet at elytro.com

这可能是 2026 年到现在，最抽象、但也最典型的一次 AI 安全真实案例 Grok 被钓鱼了 20 万美元 攻击者先发了一段纯摩尔斯电码，然后 @Grok 去翻译 结果 Grok 翻出来的内容，正好是对 @bankrbot 的一条转账指令：把 3B 枚 $DRB 发到对方钱包 然后机器人就执行了 被转走的是 Grok 在 Base 链上的官方钱包里的 $DRB，价值大概 15 万到 20 万美元 攻击者拿到币后，第一时间砸成 USDC，币价瞬间跳水，随后删号跑路 所以现在的攻击手段已经不止黑合约，盗私钥了，甚至可以把 AI 当成中间人，用一段摩尔斯电码，做 prompt injection，然后骗机器人替自己转账 目前情况： Grok 的指令权限已经被 bankrbot 紧急关掉，同时据说攻击者已退回约 80% 的资金

Super excited to finally announce our collaboration with @elytro_eth 🔥 They’re one of the sharpest teams building Account Abstraction and secure smart account execution. Together we’re making AI Agents truly autonomous, safe, and powerful onchain — with real strategy control and seamless payments! If you’re into AI + Web3, come join us🚀 Pre-register here: web3career.build/en/programs… Learn more about the program: xitter.cf/aiweb3school/status/20…

AI × Web3 School is excited to announce our collaboration with the @ethereumfndn Ethereum Foundation (EF) Builder Growth team! Together, we will work on builder education, joint promotions, workshops, office hours, and ecosystem connections. All AI × Web3 School courses and co-learning content will be completely free for developers interested in AI and Web3. Welcome more builders to join us — learn, connect, and turn ideas into real projects! Details & pre-registration: web3career.build/en/programs…

a guy asked for money under the bot's post it sent him $202,000 he wrote that his uncle got sick, blamed the bot for the problems and asked for just 4 SOL, leaving a crypto wallet address the AI agent mixed up the amount and transferred everything that was in the account take note, a good money-making scheme