Gamed AI Agents Register
Incidents in which an AI agent with authority over money, prices or orders was manipulated into moving value, graded by the strength of the evidence and mapped to the design principles. Near misses, attacks seen in the wild and research demonstrations are kept separately.
Version 0.2, released October 19, 2026. 12 entries, 6 with money lost. Download the CSV
All entries
What v0.2 shows
- There are six documented losses where a gamed agent moved real money or goods. They range from a vending machine’s stock to tokens worth about $441,000 at the time (Lobstar Wilde). In between are $47,316 (Freysa), about $100,000 (AIXBT) and roughly $150,000–$200,000 (Grok and Bankr).
- They happened where agents already hold authority: crypto wallets and small shops. No public case yet shows a mainstream business losing money because its own AI agent was gamed. The closest is a UK shop’s chatbot that invented an 80% discount, which the owner refused to honor. These are the first agents with direct authority over money. They show what happens before the same authority reaches order desks, procurement and payables.
- The decision was made inside the conversation. In five of the six losses, the agent itself decided to move value because of something it was told. In the sixth, one agent’s public reply became the other agent’s command.
- The techniques were persuasion, not hacking: redefining what a function means, a sob story, a fake PDF of board minutes, repeated cajoling, and a gifted token plus an encoded message. Only AIXBT began with unauthorized access.
- No limit capped any loss, and no second confirmation stopped any transfer.
- A guardrail existed and was lost. Bankr had blocked Grok’s replies to stop exactly this chain, but the block disappeared in a rewrite.
- Recovery was luck, not design. About 80% of the Grok wallet’s tokens came back only after the community identified the attacker.
- Attacks aimed at agents are already in the wild. Hidden instructions on web pages tell visiting agents to pay, though no victims are confirmed yet.
Evidence grades and entry types
| Grade | Meaning |
|---|---|
| A | Official or first-party: a court or tribunal, police, or the organization’s own account |
| B | Reputable reporting with on-chain or company confirmation, but no official finding |
| C | Single-source or unverified accounts, or attempts seen in the wild with no confirmed victim |
| D | Research demonstration |
| Type | Meaning | Entries |
|---|---|---|
| Loss | An AI agent was gamed and money or goods were lost | 6 |
| Near miss | An AI agent was gamed, but no money moved | 2 |
| Attempt | Attacks aimed at AI agents seen in the wild, with no confirmed victim | 1 |
| Demonstration | Researchers showed the attack works | 3 |
Out of scope: AI used to persuade people
Out of scope: incidents where AI made a human believe something, such as deepfaked voices, faces or documents. They don’t drive the principles. Pure hacking, such as stolen keys, is also out of scope unless an agent’s own authority made the loss possible.
The incidents below were in version 0.1. A person made the decision in each, so design principles for agents don’t reach them. They stay here for reference.
| When | Who | What happened |
|---|---|---|
| 2019 | UK energy firm | A cloned CEO voice persuaded an executive to pay €220,000. |
| 2020 | UAE bank | A cloned director’s voice and a ‘lawyer’ persuaded a branch manager to approve $35 million. |
| 2024 | Arup | A deepfaked video meeting persuaded a finance employee to send HK$200 million. |
| 2025 | Singapore multinational | A deepfaked Zoom persuaded a finance director to send US$499,000, later recovered. |
| 2025 | Italian business leaders | A cloned defence minister’s voice persuaded one to pay almost €1 million, later frozen. |
| 2026 | Fideuram | A fake CEO message and a cloned lawyer’s voice persuaded the chairman to send about €95 million. |
| 2023–2025 | Hong Kong lenders and banks | Deepfaked faces and ID photos passed identity checks for loans and accounts. |
| 2024 | KnowBe4 | An AI-enhanced photo on a stolen identity got a fake IT worker hired. |
| 2025 | Expense and invoice fraud | AI-generated receipts reached about 14% of fake receipts, per AppZen. |
Method
- Inclusion: an AI agent with authority over money, goods, prices or commitments was manipulated (by prompts, persuasion, injected content, fake documents or permission tricks), and money or goods moved as a result. Near misses, attacks seen in the wild and demonstrations are kept separate and labeled.
- Sources: public only. Every fact links to its source, and conflicting accounts are noted.
- Attribution: each entry is mapped to principles as missing, worked or recovery. A new entry either strengthens a principle, shows that it needs refining, or reveals a gap that becomes a new principle.
- Versions: released monthly, with a change log. Nothing is edited silently.
- AI assistance: researched and drafted with AI assistance. Every fact is checked against the cited source.
- Corrections and new incidents: send them through LinkedIn. Corrections are recorded in the change log.
Change log
- v0.2, October 19, 2026
- Scope narrowed to AI agents gamed into moving value. 12 entries: 6 losses, 2 near misses, 1 attempt and 3 demonstrations. Human-persuasion incidents from v0.1 moved to a reference list.
- v0.1, October 19, 2026
- First release, with 20 incidents, mostly humans deceived by AI-made fakes. Not published on this site.