# PIR-2026-0022 - Memory injection makes ElizaOS wallet agents redirect real crypto transfers (Princeton/Sentient demonstration)

- `id`: PIR-2026-0022
- `title`: Fake memories planted in ElizaOS agents redirect crypto transfers to attacker wallets, demonstrated with real ETH on mainnet
- `date_occurred`: 2025-03 (experiments including the mainnet transfer, per the preprint)
- `date_detected`: n/a (researcher-initiated demonstration)
- `date_disclosed`: 2025-03 (arXiv 2503.16248); independent press coverage through 2025-05
- `status`: corroborated (peer-visible preprint + multiple independent outlets)

### The agent
- `agent_description`: ElizaOS (ai16z), widely used open-source Web3 agent framework powering wallet-holding agents on Discord/X; all plugins draw from one persistent shared memory via a common orchestrator. Demo agents had autonomous transfer capability.
- `operator_type`: demo agents operated by researchers on a production-grade framework; deployed ElizaOS operators range individual to startup
- `autonomy_level`: autonomous-within-policy (demo agents executed transfers without human approval)
- `model_stack`: framework-agnostic (multiple hosted LLM backends evaluated in the paper); the load-bearing flaw is the memory architecture, not one model
- `harness`: ElizaOS plugins + shared persistent memory store

### Authority
- `authority_scope`: funds (agent wallets; deployed ElizaOS agents reportedly manage up to millions), external comms (Discord/X), memory write
- `funds_at_risk_usd`: unknown at ecosystem scale; in-demo, researchers' own small balances
- `blast_radius`: fleet/systemic potential (framework-level flaw touches every wallet-holding ElizaOS deployment); realized radius was researcher wallets only

### The failure
- `root_cause`: memory-poisoning (primary); contributing prompt-injection (injection is the write path into memory)
- `failure_locus`: harness (ElizaOS shared-memory architecture: one poisoned entry propagates across all plugins and platforms)
- `mechanism`: Attacker injects fabricated events/instructions into the agent's persistent memory. Later, legitimate-looking transfer requests are redirected to the attacker's wallet. Cross-platform propagation shown: an injection planted via Discord fired against a later interaction on X. Researchers moved 0.01 ETH on Sepolia, then repeated the attack on Ethereum mainnet with real funds (same small order of magnitude). Their CrAIBench benchmark shows prompt-based defenses largely fail against memory injection.
- `adversary_present`: yes (researchers in the attacker role)
- `exploitation_status`: researcher-demonstrated (real framework, real mainnet transfer; no known in-wild theft via this vector)

### Impact
- `severity`: near-miss (proven redirection of real funds; zero third-party loss)
- `direct_loss_usd`: 0 (only researchers' own funds moved, ~0.01 ETH scale)
- `indirect_loss_usd`: 0 known
- `downtime`: none
- `data_exposure`: none

### Detection and recovery
- `detected_by`: third-party (Princeton University + Sentient Foundation researchers)
- `time_to_detect` / `time_to_recover`: n/a (disclosure, not an operational incident)
- `remediation`: disclosure + CrAIBench benchmark released for measuring resilience to context manipulation
- `structural_fix`: none confirmed at framework level as of writing - the shared memory design is architectural
- `controls_that_worked`: none technical; the paper's point is that prompt-based defenses specifically fail. Loss was bounded only by researcher ethics and small stakes.

### Evidence
- `telemetry_grade`: operator-logs (researcher-controlled experiments; the Sepolia/mainnet transfers are on-chain and append-only where hashes are published)
- `sources`:
  - https://arxiv.org/abs/2503.16248 (primary; Patlan, Sheng, Hebbar, Mittal, Viswanath)
  - https://decrypt.co/318200/elizaos-vulnerability-ai-gaslit-losing-millions (independent)
  - https://www.tomshardware.com/tech-industry/cryptocurrency/ai-agents-can-be-manipulated-into-giving-away-your-crypto-according-to-princeton-researchers (independent)
  - https://cybernews.com/cybercrime/crypto-ai-agents-can-be-tricked-into-giving-away-their-money-study-finds/ (independent)
  - `independence`: good.
- `confidence`: high (preprint + independent coverage agree on mechanism and the mainnet repeat). Weakest link: research conditions - demo agent configuration was researcher-chosen, and no in-wild loss has been tied to this vector.