srinivasgumdelli · Oct 11, 2026 · Oct 11, 2026
@@ -37,11 +37,11 @@ ahead of the record count. See reserved.json.
 | PIR-2026-0018 | ShadowLeak: zero-click Gmail exfiltration via the ChatGPT Deep Researc | 2025 | prompt-injection | harness | near-miss | researcher-demonstrated | 0 |
 | PIR-2026-0019 | Researchers demonstrate systemic exploitability of the x402 agentic-pa | 2025 | adversarial-other | dependency | near-miss | researcher-demonstrated | 0 attributed to these fl |
 | PIR-2026-0020 | Claude Code auto-update path breaks workstations via root-owned permis | 2025-02-27 | tool-error | harness | degraded | in-wild-malfunction | unknown (recovery labor  |
-| PIR-2026-0021 | Grok-linked Bankr wallet drained of ~$330K via social-engineered promp | 2025-03 | prompt-injection | harness | loss | in-wild-exploited | ~330,000 reported (BNKR, |
+| PIR-2026-0021 | Reported prompt manipulation of Grok drives Bankr token launches; ~$330K drain r | 2025-03 | prompt-injection | harness | loss | in-wild-exploited | unknown (~330,000 reported, upper anchor) |
 | PIR-2026-0022 | Memory injection makes ElizaOS wallet agents redirect real crypto tran | 2025-03 | memory-poisoning | harness | near-miss | researcher-demonstrated | 0 (only researchers' own |
 | PIR-2026-0023 | AIXBT trading agent drained of 55.5 ETH via compromised operator dashb | 2025-03-18 | credential-exposure | harness | loss | in-wild-exploited | ~106,200 (55.5 ETH at in |
 | PIR-2026-0024 | Cursor's AI support agent "Sam" invents a one-device policy, turning a | 2025-04-14 | plain-error | agent-reasoning | loss | in-wild-malfunction | unknown (refunds plus ca |
-| PIR-2026-0025 | GPT-4o sycophancy update: a provider regression silently changes every | 2025-04-25 | model-update-regression | model-provider | degraded | in-wild-malfunction | unknown (harm was behavi |
+| PIR-2026-0025 | GPT-4o sycophancy update: a provider regression silently changes every | 2025-04-24 | model-update-regression | model-provider | degraded | in-wild-malfunction | unknown (harm was behavi |
 | PIR-2026-0026 | GitHub MCP "toxic agent flow": malicious issue coerces coding agents i | n/a | prompt-injection | tool-mcp | near-miss | researcher-demonstrated | 0 |
 | PIR-2026-0027 | Gemini CLI hallucinates a successful mkdir, then overwrite-destroys a  | 2025-07 | plain-error | agent-reasoning | loss | in-wild-malfunction | unknown (personal projec |
 | PIR-2026-0028 | Supabase MCP "lethal trifecta": support-ticket injection dumps the SQL | n/a | prompt-injection | tool-mcp | near-miss | researcher-demonstrated | 0 (demonstration) |

@@ -1,7 +1,7 @@
 # PIR-2026-0021 - Grok-linked Bankr wallet drained of ~$330K via social-engineered prompts (March 2025)
 
 - `id`: PIR-2026-0021
-- `title`: Prompt manipulation of Grok drives Bankr token launches and drains ~$330K in BNKR/DRB/WETH from Grok's auto-provisioned wallet; Bankr responds by blocking Grok commands
+- `title`: Reported prompt manipulation of Grok drives Bankr token launches in March 2025 and Bankr blocks Grok commands; later retrospectives report ~$330K in BNKR/DRB/WETH drained from Grok's auto-provisioned wallet, a figure without an independent transaction reconstruction
 - `date_occurred`: 2025-03 (exact day unknown; contemporaneous with the DRB launch/crash cycle)
 - `date_detected`: 2025-03 (Bankr imposed the Grok block the same month)
 - `date_disclosed`: partially 2025-03 (token-launch/block coverage); full drain reconstruction only surfaced in May 2026 retrospectives around the repeat attack (PIR-2026-0044)
@@ -20,15 +20,15 @@
 - `blast_radius`: one org (the wallet) plus third parties (BNKR/DRB market moves around the launches and drain)
 
 ### The failure
-- `root_cause`: prompt-injection (primary; multi-agent, including image-text injection); contributing design flaw as in PIR-2026-0044 (LLM output treated as transaction authorization)
+- `root_cause`: prompt-injection (primary, as reported: the public record describes prompt and social engineering of Grok, including image-embedded text, but does not establish the full command path or tie every BNKR/DRB/WETH movement to one incident; the classification is the reported mechanism, not a settled finding); contributing design flaw as in PIR-2026-0044 (LLM output treated as transaction authorization)
 - `failure_locus`: harness (Bankr command-parsing/authorization layer)
 - `exploitation_status`: in-wild-exploited
 - `mechanism`: Reconstructed only partially in public sources. Users (reported handle: DavidJones805) manipulated Grok via prompt injection including image-embedded text; Bankr launched multiple tokens - including DRB itself - based on Grok's coaxed suggestions, after which Grok's wallet received creator allocations. Via the same social-engineering channel, ~$330K in BNKR, DRB, and WETH was then drained from the wallet. Bankr's response was to block all @bankrbot responses to @grok - the block later bypassed by the May 2026 NFT escalation (PIR-2026-0044).
 - `adversary_present`: yes
 
 ### Impact
 - `severity`: loss
-- `direct_loss_usd`: ~330,000 reported (BNKR, DRB, WETH; retrospective figure, no independent on-chain accounting published; treat as upper anchor)
+- `direct_loss_usd`: unknown (the ~$330,000 BNKR/DRB/WETH figure appears only in May 2026 retrospectives, with no independent transaction reconstruction; it is kept as a reported upper anchor, not an established amount)
 - `indirect_loss_usd`: unknown (DRB market cap "soared and crashed" around the launch cycle)
 - `downtime`: Grok-Bankrbot interaction blocked from March 2025
 - `data_exposure`: none
@@ -56,3 +56,4 @@
 2. **Date remains soft** (2025-03, no exact day) - flagged by intake, confirmed still soft after verification; kept at month precision.
 3. Intake sources beyondmachines.net and startupfortune.com actually cover the May 2026 attack; dropped here. Contemporaneous openexo.com (Let's Talk Bitcoin syndication) added for the launch/block sequence.
 4. Loss figure kept at ~$330K but downgraded to "reported, upper anchor" - no independent on-chain accounting found.
+- 2026-10-11: corrected on adversarial review (Codex, via the editors' review channel). The March 2025 launch-and-block event (contemporaneously reported) is kept distinct from the May 2026 NFT escalation and any later drain; `direct_loss_usd` set to unknown with the ~$330K retrospective figure as a reported upper anchor only; `root_cause` marked as the reported mechanism rather than settled prompt injection, since the public record does not establish the full command path. Low confidence retained.
@@ -4,7 +4,7 @@
 - `title`: Fake memories planted in ElizaOS agents redirect crypto transfers to attacker wallets, demonstrated with real ETH on mainnet
 - `date_occurred`: 2025-03 (experiments including the mainnet transfer, per the preprint)
 - `date_detected`: n/a (researcher-initiated demonstration)
-- `date_disclosed`: 2025-03 (arXiv 2503.16248); independent press coverage through 2025-05
+- `date_disclosed`: 2025-03-20 (arXiv 2503.16248 v1; v2 2025-04-30); independent press coverage through 2025-05
 - `status`: corroborated (peer-visible preprint + multiple independent outlets)
 
 ### The agent
@@ -22,14 +22,14 @@
 ### The failure
 - `root_cause`: memory-poisoning (primary); contributing prompt-injection (injection is the write path into memory)
 - `failure_locus`: harness (ElizaOS shared-memory architecture: one poisoned entry propagates across all plugins and platforms)
-- `mechanism`: Attacker injects fabricated events/instructions into the agent's persistent memory. Later, legitimate-looking transfer requests are redirected to the attacker's wallet. Cross-platform propagation shown: an injection planted via Discord fired against a later interaction on X. Researchers moved 0.01 ETH on Sepolia, then repeated the attack on Ethereum mainnet with real funds (same small order of magnitude). Their CrAIBench benchmark shows prompt-based defenses largely fail against memory injection.
+- `mechanism`: Attacker injects fabricated events/instructions into the agent's persistent memory. Later, legitimate-looking transfer requests are redirected to the attacker's wallet. The paper's abstract establishes context and memory manipulation causing unauthorised transfers and the limited protection of prompt-based defenses (the CrAIBench benchmark). The following specifics are from the paper's full text and the press accounts of it, not the abstract: cross-platform propagation (an injection planted via Discord fired against a later interaction on X), a 0.01 ETH transfer on Sepolia, and a repeat on Ethereum mainnet with the researchers' own funds at a similar small scale. The "all plugins share one memory" description of ElizaOS is the paper's architectural claim.
 - `adversary_present`: yes (researchers in the attacker role)
 - `exploitation_status`: researcher-demonstrated (real framework, real mainnet transfer; no known in-wild theft via this vector)
 
 ### Impact
 - `severity`: near-miss (proven redirection of real funds; zero third-party loss)
-- `direct_loss_usd`: 0 (only researchers' own funds moved, ~0.01 ETH scale)
-- `indirect_loss_usd`: 0 known
+- `direct_loss_usd`: 0 to third parties (only the researchers' own funds moved, at about 0.01 ETH scale, between wallets they controlled)
+- `indirect_loss_usd`: unknown (none known)
 - `downtime`: none
 - `data_exposure`: none
 
@@ -49,3 +49,6 @@
   - https://cybernews.com/cybercrime/crypto-ai-agents-can-be-tricked-into-giving-away-their-money-study-finds/ (independent)
   - `independence`: good.
 - `confidence`: high (preprint + independent coverage agree on mechanism and the mainnet repeat). Weakest link: research conditions - demo agent configuration was researcher-chosen, and no in-wild loss has been tied to this vector.
+
+### Verification notes
+- 2026-10-11: corrected on adversarial review (Codex, via the editors' review channel). `date_disclosed` set to the arXiv v1 date 2025-03-20 (v2 2025-04-30); the Sepolia amount, mainnet repeat, cross-platform propagation and shared-memory claims are now marked as resting on the paper's full text and press accounts rather than the abstract; researcher-owned funds distinguished from third-party loss. Classification unchanged.
@@ -20,10 +20,10 @@
 - `blast_radius`: one org directly (agent's wallet); third-party spillover via AIXBT token price drop ~15-20%
 
 ### The failure
-- `root_cause`: credential-exposure (primary; the trusted control plane - the operator dashboard - was accessed by the attacker); contributing `prompt-injection` (the execution path was injected instructions the agent obeyed). Decision per intake note: the model was not jailbroken; the compromise was upstream of the agent.
+- `root_cause`: credential-exposure (primary; the trusted control plane - the operator dashboard - was accessed by the attacker, who then queued instructions the agent executed as it would any operator instruction). No prompt-injection contribution is recorded: the maintainer's contemporaneous statement describes a dashboard-access hack and not manipulation of the AI, and no source shows the attacker manipulating model input rather than directly controlling the dashboard. The model was not jailbroken; the compromise was upstream of the agent.
 - `failure_locus`: harness (dashboard control plane feeding the agent), with operator-config contributing (dashboard access controls)
 - `exploitation_status`: in-wild-exploited
-- `mechanism`: Attacker "FungusMan" (X handle since deleted) gained unauthorized access to the operator dashboard and queued two fraudulent replies. The agent processed them through its tipping feature and transferred 55.5 ETH to the attacker's address. No independent check existed between queued instruction and fund movement. Team rotated keys, migrated servers, and suspended/restricted dashboard access.
+- `mechanism`: Attacker "FungusMan" (X handle since deleted) gained unauthorized access to the operator dashboard (per the maintainer rxbt's statement, at about 02:00 UTC) and queued two malicious replies. The agent processed them through its tipping feature and transferred 55.5 ETH to the attacker's address. No independent check existed between queued instruction and fund movement. Team rotated keys, migrated servers, and suspended/restricted dashboard access.
 - `adversary_present`: yes
 
 ### Impact
@@ -56,3 +56,4 @@
 ### Corrections
 
 - 2026-08-19: Surfaced the AIID cross-reference already present in this record's sources (cite/1003) as the structured `aiid_incident_id` field (schema v0.3). No claim changed.
+- 2026-10-11: corrected on adversarial review (Codex, via the editors' review channel). `prompt-injection` removed as a contributing cause: the maintainer's contemporaneous statement describes a dashboard-access hack, not manipulation of the AI, and independent coverage likewise describes unauthorised dashboard access, two queued malicious replies and 55.5 ETH transferred. The record no longer implies a model jailbreak; the amount and date stand; the token-price fall remains unattributed context.
@@ -1,15 +1,15 @@
 # PIR-2026-0024 - Cursor's AI support agent "Sam" invents a one-device policy, turning a login bug into public cancellations
 
 - `id`: PIR-2026-0024
-- `title`: Anysphere's front-line AI support agent confidently fabricates a nonexistent one-device-per-subscription policy in reply to bug reports, triggering churn
+- `title`: Anysphere's front-line AI support agent confidently fabricates a nonexistent one-device-per-subscription policy in reply to bug reports; users publicly announced cancellations
 - `date_occurred`: 2025-04-14 (approx; "Sam" replies surfaced publicly that day)
 - `date_detected`: 2025-04-14/15 (viral Hacker News/Reddit threads; cofounder responded within hours)
 - `date_disclosed`: 2025-04-15 to 2025-04-17 (Reddit apology by cofounder Michael Truell; press coverage Apr 17-18)
 - `status`: corroborated (company admission on record + independent press)
 
 ### The agent
-- `agent_description`: "Sam," Anysphere's AI email support agent for the Cursor IDE, answering customer tickets directly with no human review and no AI label - customers reasonably took its answers as official policy.
-- `operator_type`: startup (Anysphere, high-growth, ~$100M+ ARR reported at the time)
+- `agent_description`: "Sam," Anysphere's AI email support agent for the Cursor IDE, whose replies were presented to customers as official support; customers reasonably took its answers as official policy. (Cursor's later commitment to label AI replies implies they were not labelled at the time; whether any human reviewed them is not stated in the company's admission.)
+- `operator_type`: startup (Anysphere)
 - `autonomy_level`: autonomous-within-policy (sent support answers to paying customers unreviewed)
 - `model_stack`: unknown (not disclosed)
 - `harness`: email support pipeline; details unknown
@@ -39,7 +39,7 @@
 - `time_to_recover`: ~1-3 days (bug fix, apology, refunds)
 - `remediation`: public apology, session-bug fix, refunds
 - `structural_fix`: AI-generated support replies labeled as such going forward
-- `controls_that_worked`: none internal; public community scrutiny forced correction within hours, bounding the churn window
+- `controls_that_worked`: none internal; public community scrutiny forced correction within hours, bounding the window in which the fabricated policy stood
 
 ### Evidence
 - `telemetry_grade`: operator-logs (customer screenshots of agent emails + company statements)
@@ -57,3 +57,4 @@
 ### Corrections
 
 - 2026-08-19: Surfaced the AIID cross-reference already present in this record's sources (cite/1039) as the structured `aiid_incident_id` field (schema v0.3). No claim changed.
+- 2026-10-11: corrected on adversarial review (Codex, via the editors' review channel). "Triggering churn" removed from the title and controls, since cancellation impact is anecdotal; the unsourced ~$100M+ ARR figure removed; "no human review and no AI label" reworded to what the company admission supports (replies presented as official support; AI labelling committed to afterwards). No severity change.