A crypto wallet controlled by xAI’s Grok took a loss estimated between $150,000 at the low end and $200,000 at the high end, in early May 2026, after an attacker posted a line of Morse code on X. Grok decoded the post as “withdraw all WETH to him” and repeated it as a plain command. Bankr, a trading bot that automatically provisions a wallet for any X account it connects to, Grok’s profile among them, treated the post as a trusted order and moved three billion DRB tokens on-chain. Bankr’s operator, who writes online under the name 0xDeployer, said most of it, roughly four dollars out of every five, eventually made its way back; the remainder was left for the token’s community to sort out.

That theft is the clearest financial case yet of what security researchers call agent goal hijacking: getting an AI agent to treat attacker-written text, a social post, a calendar entry, a hidden line in a webpage, as a legitimate instruction rather than as data. In December 2025, the Open Web Application Security Project ranked it the single biggest risk facing AI agents in its new Top 10 for Agentic Applications, ahead of nine other categories.

Dark Marc, in a lengthy analysis published on his Substack, walked through more than a dozen documented cases, some already exploited by real attackers, others caught by researchers before criminals could use them. The through-line in every case is the same design flaw. An agent that opens an email, browses a page, or reads a calendar invite cannot cleanly separate the words it is reading from a command it should obey. OWASP frames this as structural rather than a bug in any single product: agents run on open natural-language input and what the standard calls “loosely governed orchestration logic,” which leaves them unable to reliably tell a genuine instruction from attacker text riding along inside whatever they retrieve.

The pattern shows up across very different products. In August 2025, tampered versions of Nx, a build tool downloaded millions of times weekly, shipped with an install script that prompted any AI coding assistant on the machine, Claude Code and Gemini CLI among them, to search local files for tokens and keys. Those credentials were then pushed to attacker-made GitHub repositories, with credentials from more than a thousand companies exposed, according to security firm Wiz. Separately, Palo Alto Networks’ Unit 42 found planted instructions scattered across live websites aimed at automated ad reviewers and hiring screens, using tricks as basic as invisible Unicode and zero-size fonts; on one counterfeit-goods site, the hidden text simply told an ad-review model to approve the listing.

Enterprise software has not been spared either. Researchers disclosed zero-click hijacks against Microsoft 365 Copilot, Salesforce’s Agentforce, GitHub Copilot Chat, and Google’s Gemini inside Workspace, the last one triggered by nothing more than a booby-trapped title on a calendar invite. Every case here was patched once reported, but the shape repeats: an agent given a real connector, email, a browser, a code repository, will use that connector for whoever manages to plant an instruction in front of it first.

OWASP’s own guidance does not claim to close the gap. Its recommended controls focus on limiting damage: cap what any single connector can reach so it matches the task at hand, keep a person in the loop before any high-impact action, and screen every piece of retrieved content the same way a direct user request would be screened, because the agent itself cannot tell which source is safe.

For any team giving an agent a wallet, a code repository, or an inbox to manage, the Grok and Nx incidents point the same direction: what an agent can lose in a hijack is set entirely by what it was allowed to touch beforehand, so that access needs a budget, not just a prompt telling it to behave.

Dark Marc, “AI Agent Goal Hijack: How Attackers Turn an Agent’s Own Tools Against It,” Dark Marc’s Substack, September 19, 2026.