# PIR-2026-0016 - Freysa adversarial agent game: one message releases the entire prize pool

- `id`: PIR-2026-0016
- `title`: Freysa agent, directed to never transfer funds, releases its full $47K pool after a user redefines its transfer tool's semantics
- `date_occurred`: 2024-11-28 (winning message, the 482nd attempt; game launched 2024-11-22)
- `date_detected`: immediate (public on-chain game; transfer visible at execution)
- `date_disclosed`: 2024-11-28/29 (Freysa acknowledged defeat publicly on X; widely reported within a day)
- `status`: corroborated

### The agent
- `agent_description`: Freysa (freysa.ai) - autonomous LLM agent on Base holding a crypto prize pool funded by escalating per-message fees; anonymous dev team; sole authority over an `approveTransfer` tool; core directive to never approve outgoing transfers.
- `operator_type`: startup (anonymous devs; agent decision-making unattended by design)
- `autonomy_level`: autonomous-within-policy (single hard rule: never transfer; no human gate on the tool call)
- `model_stack`: hosted LLM, specific model not confirmed in verified sources - unknown
- `harness`: custom game harness; paid messages submitted on-chain, agent adjudicates each

### Authority
- `authority_scope`: funds - the full prize pool (~13.19 ETH at incident time) via one tool call
- `funds_at_risk_usd`: ~47,000 (entire pool; grew with each paid attempt)
- `blast_radius`: one org (the staked pool; participants paid fees knowingly)

### The failure
- `root_cause`: prompt-injection (primary; direct: untrusted user message steered the agent); the same act reads as `adversarial-other` social engineering - the input arrived through the intended channel, not planted data
- `failure_locus`: agent-reasoning
- `exploitation_status`: bounty-game (loss occurred by design of an adversarial challenge; also in-wild in that a real funded agent moved real funds)
- `mechanism`: After 481 failed paid attempts by ~195 players, p0pular.eth sent one message that (1) asserted a fake admin/session frame, (2) redefined `approveTransfer` as the function for INCOMING transfers, then (3) offered a "$100 contribution" to the treasury. The agent, following its rewritten tool semantics, called `approveTransfer` and sent the entire pool (13.19 ETH) to the attacker.
- `adversary_present`: yes (adversarial by game design)

### Impact
- `severity`: loss ($47K realized, but intentionally staked - the "loss" was the game's designed win condition)
- `direct_loss_usd`: ~47,000 (13.19 ETH; reported $47K-$50K depending on ETH price at write-up)
- `indirect_loss_usd`: 0
- `downtime`: n/a (game concluded)
- `data_exposure`: none

### Detection and recovery
- `detected_by`: automated-monitor / public (on-chain transfer, instantly visible; game state public)
- `time_to_detect`: immediate
- `time_to_recover`: n/a (payout was final and by design; no recovery attempted)
- `remediation`: none required; Freysa team ran subsequent game iterations with revised prompts
- `structural_fix`: none within this incident (the exploit - tool-semantics redefinition in one message - became the canonical public demonstration for funded-agent guardrail fragility)
- `controls_that_worked`: none bounded the loss once the message landed; the pool cap was the only ceiling. The 481 prior failures show the directive resisted naive attacks but not semantic redefinition.

### Evidence
- `telemetry_grade`: append-only (messages paid and transfer executed on-chain, Base; game transcript public)
- `sources`:
  - https://www.theblock.co/post/328747/human-player-outwits-freysa-ai-agent-in-47000-crypto-challenge
  - https://www.ccn.com/news/crypto/ai-duped-50k-crypto-transfer-user/
  - https://www.coinspeaker.com/freysa-ai-surrenders-47000-prize-clever-user-exploits-language-loophole/
  - https://cryptobriefing.com/crypto-trader-ai-gaming-exploit/
  - https://www.cryptopolitan.com/crypto-user-wins-47000-prize-freysa-ai/
  - https://x.com/jarrodWattsDev/status/1862299845710757980 (detailed contemporaneous thread)
  - `independence`: strong - on-chain record plus multiple unaffiliated outlets.
- `confidence`: high on mechanism, amount, and dates. Weakest link: exact USD varies $47K-$50K with ETH price; the loss was an intentionally staked prize (bounty-game flag carries the actuarial caveat).