When the agent had the keys, and never opened a repo

The agent had earned trust on a small test inbox. On the real inbox, it began deleting everything older than a week. Stop commands from the operator's phone did nothing. She had to reach the Mac mini and kill the process by hand.

1. The task on record is to review the inbox and suggest what to archive or delete, with confirmation before any action. That instruction lives in the agent's chat context as English prose.
2. The active mailbox scope can modify and delete. The session has a live mutation credential instead of a read-only credential that can only propose.
   Mitigation

   Vault + Vault Secrets Operator

   The suggest session receives a read-only mailbox credential. Delete and modify use a separate Vault path that VSO never projects into this workload. A capability the session never received cannot return through context summarisation.

3. The real inbox is large. Context compaction summarises older history to stay within the token budget, and the confirm-before-acting constraint disappears from the working context.
   Mitigation

   Tool gateway + role-based access

   Delete and batch-modify tools are not registered for a suggest role. Withdrawing a registration enforces the boundary as configuration, so compaction cannot restore a tool that was never registered to the session.

4. Batch deletion runs. Stop commands sent from the phone are more prose in the same window the agent is compacting. The run stops only when the machine is shut down.
   Mitigation

   AuthBridge + IBAC

   With unclassified_policy: judge, every outbound mailbox mutation is judged against the task on record, which was suggest only. A bulk delete fails that test. AuthBridge is a separate sidecar the agent proxies through, so the check remains in force when the agent's own context changes.

5. The only record of what happened is the agent's own chat window, the same context it was compacting, plus whatever is left in the mailbox.
   Mitigation

   Out-of-process decision logging

   The audit record survives independently of the agent process and provides evidence of the attempted mutation, the stop command, and the denial.

I couldn't stop it from my phone. I had to RUN to my Mac mini like I was defusing a bomb.

Sources: TechCrunch · Fast Company · Fortune · Windows Central

Researchers documented a production path in which an email could become a tool instruction. Copilot retrieved tenant content and inbound mail into one working context, placing untrusted text beside privileged internal data.

1. Copilot retrieves the user's tenant content and inbound mail into one context. An external email can therefore sit beside internal files, Teams messages, and prior chat.
2. Standing authority provides tenant-scoped Graph access, far broader than answering one question about one thread.
   Mitigation

   Identity-derived token exchange

   Each Graph call receives a short-lived token derived from the human and the task in front of them. Reading an unrelated internal file because an email requested it does not match the task, so no token is minted for that access.

3. A prompt-injection classifier and link and image handling rules form the main barriers. Researchers chained around them with reference-style Markdown and automatically fetched content.
   Mitigation

   Default-deny, in both directions

   Inbound untrusted mail is treated as data until a separate validator turns it into a request. Outbound, a fetch to an unclassified external host is judged, so Markdown that reads as an instruction cannot mint a retrieval.

4. The model's next helpful action becomes exfiltration. The credential is not stolen; the product's own Graph permission is already in place.
   Mitigation

   AuthBridge + IBAC

   The sidecar sees the outbound call. Sending internal context to a host because an email requested it does not match the task, so the call is stopped before it leaves the pod.

5. In the demonstrated chain, the only trace of the leak is the copilot's own chat and the outbound request itself, both inside the channel being drained.
   Mitigation

   Independent audit plane

   The decision record lives in a separate namespace behind credentials the copilot does not hold, outside the channel the exfiltration attempts to drain.

The first known zero-click AI vulnerability.

Sources: Microsoft MSRC / CVE-2025-32711 · Aim Labs · SOC Prime · Checkmarx · Sentra

The private key remained in place, and the contract behaved as designed. External text became a signed transaction because two agents trusted each other and a public reply.

1. Grok is asked to read a public reply and decode a message. The task is ordinary assistant work.
2. The wallet behind the agent chain can move its whole balance. Before the attack, an airdropped Bankr Club Membership NFT widened its permissions inside Bankr to include transfers and swaps. Nobody at xAI or Bankr approved the change.
   Mitigation

   Vault + Vault Secrets Operator

   The signing key never sits in the agent container. It lives in Vault Transit, and only the registered transfer workload may call sign, under a short TTL. Destination allow-lists and amount caps sit in the gateway in front of that call. An NFT arriving in a wallet cannot change either.

3. The attacker posts the transfer instruction in Morse code, reportedly with concatenation tricks mixed in, then asks Grok to decode and print it. Grok, which had earlier declined a plain request because it could not move funds, emits the literal command string in a public reply and tags Bankrbot.
   Mitigation

   Tool gateway + role-based access

   Signing and transfer are separate registrations from reading and decoding social text. A decode session holds no transfer tool, so a decoded string remains text.

4. Bankrbot reads the reply as authorization and signs the transfer. Between $150,000 and $200,000 in DRB tokens leaves the wallet. The chain inclusion is final. About 80% of the value came back later, after the DRB community identified the attacker and negotiated.
   Mitigation

   AuthBridge + IBAC

   The proposed signature is judged against the task on record, which was decoding a message. A full-balance transfer to a new address fails that test and never broadcasts.

5. The only records are the public X thread and the on-chain transaction. Neither shows what the agent believed it was authorised to do.
   Mitigation

   Independent audit plane

   The proposed signature is logged out of process before broadcast, creating evidence of intent before the funds leave. The record is independent of the agent and the public transaction stream.

Bankr's founder, 0xDeployer, said in the post-mortem that an earlier version of the agent had a hardcoded block on Grok replies, added to stop one model injecting another. The block did not survive a rewrite. A boundary that lives in one service's code is one refactor away from disappearing. A boundary enforced by a separate sidecar is not.

A near neighbour, a year earlier. In March 2025, the AiXBT agent sent 55.5 ETH, about $106,000, from its Simulacrum wallet after an attacker got into the agent's dashboard and queued two malicious replies. The maintainer said the model itself was not manipulated, so the entry point differs. The rest rhymes: a signing capability that could move the book, and an on-chain record as the only account of why.

Sources: OECD AI Incidents Monitor · CCN · Giskard · CryptoSlate, with the Bankr post-mortem · AiXBT precedent: The Block · AI Incident Database 1003

The chatbot did not call an API. It committed the company in language, and the airline was held to its words. That makes this case useful for any system that can spend money, reputation, or legal position through speech.

1. A customer asks the airline's website chatbot about bereavement fares. The chatbot says he can claim the discount retroactively within 90 days of the ticket being issued. The airline's own bereavement page says the policy does not apply once travel is complete.
2. The policy exists as retrieval text the model can quote. It is not an authorization check on a commitment, and the channel can speak for the airline.
   Mitigation

   Versioned policy source

   The generator quotes from a policy artifact at a known revision, a Git commit or an OPA bundle, not whatever wiki text retrieval surfaced. A quoted fare rule carries the digest of the policy it came from rather than being improvised at the counter.

3. The customer relies on the promise, books, and is later refused. A tribunal holds the airline to the chatbot's words.
   Mitigation

   Tool gateway and IBAC for typed commitments

   Committing the firm is modelled as a registered action. Quoting a fare is allowed. Promising an exception outside policy is not registered, and any request for one is judged against the policy object rather than granted in prose.

4. The only record of the commitment is the screenshot the customer took of the chat.
   Mitigation

   Independent audit plane

   The customer-facing commitment is bound to a workload identity and the policy revision behind it. The record is an authorization decision, not a screenshot.

A remarkable submission.

Sources: Moffatt v. Air Canada, 2024 BCCRT 149 (CanLII) · American Bar Association · Pinsent Masons · McCarthy Tetrault