0xGithubr

Most AI agents today don't pay for themselves. They run on someone's AWS account, an OpenAI key tied to a card, or a SaaS subscription billed to a person. Autonomous agents need autonomous payments, that's why we're introducing the Agent Survival Pack with launch rewards today 🧵👇

Someone gifted Grok a free NFT and used it to steal $174,000. > Grok, the AI built by xAI, has a publicly labeled onchain wallet on Base. Anyone can see it on Basescan. > An attacker linked to the address ilhamrafli.base.eth spotted something. Grok's wallet had limited transfer capability on its own. > So the attacker gifted Grok's wallet a Bankr Club Membership NFT. > That gift was not generosity. It was a key. > The NFT unlocked Bankr's full toolset inside Grok's agent including the ability to sign and execute transfers autonomously. > Then the attacker sent Grok a crafted prompt. The exact message was deleted before anyone could screenshot it. > Known techniques used in attacks like this include hiding instructions in Morse code, base64 encoding, or framing commands as games or tests to bypass filters. > Grok's intent parsing layer read the prompt as a legitimate user command and decided to execute it. > Bankr signed and broadcast the transfer. 3,000,000,000 DRB tokens worth approximately $174,000 moved from Grok's wallet to the attacker's address. > The tokens were instantly bridged to a second wallet linked to ilhamrafli.base.eth and dumped. > The attacker's X account was also deleted within minutes of the transfer. > The exploit only required a free NFT and a carefully worded message. The most sophisticated AI in the world was robbed with a gift and a sentence.