agent_description: ElizaOS (ai16z), widely used open-source Web3 agent framework powering wallet-holding agents on Discord/X; all plugins draw from one persistent shared memory via a common orchestrator. Demo agents had autonomous transfer capability.
operator_type: demo agents operated by researchers on a production-grade framework; deployed ElizaOS operators range individual to startup
autonomy_level: autonomous-within-policy (demo agents executed transfers without human approval)
model_stack: framework-agnostic (multiple hosted LLM backends evaluated in the paper); the load-bearing flaw is the memory architecture, not one model
harness: ElizaOS plugins + shared persistent memory store
Authority
authority_scope: funds (agent wallets; deployed ElizaOS agents reportedly manage up to millions), external comms (Discord/X), memory write
funds_at_risk_usd: unknown at ecosystem scale; in-demo, researchers' own small balances
blast_radius: fleet/systemic potential (framework-level flaw touches every wallet-holding ElizaOS deployment); realized radius was researcher wallets only
The failure
root_cause: memory-poisoning (primary); contributing prompt-injection (injection is the write path into memory)
failure_locus: harness (ElizaOS shared-memory architecture: one poisoned entry propagates across all plugins and platforms)
mechanism: Attacker injects fabricated events/instructions into the agent's persistent memory. Later, legitimate-looking transfer requests are redirected to the attacker's wallet. Cross-platform propagation shown: an injection planted via Discord fired against a later interaction on X. Researchers moved 0.01 ETH on Sepolia, then repeated the attack on Ethereum mainnet with real funds (same small order of magnitude). Their CrAIBench benchmark shows prompt-based defenses largely fail against memory injection.
adversary_present: yes (researchers in the attacker role)
exploitation_status: researcher-demonstrated (real framework, real mainnet transfer; no known in-wild theft via this vector)
Impact
severity: near-miss (proven redirection of real funds; zero third-party loss)
direct_loss_usd: 0 (only researchers' own funds moved, ~0.01 ETH scale)
indirect_loss_usd: 0 known
downtime: none
data_exposure: none
Detection and recovery
detected_by: third-party (Princeton University + Sentient Foundation researchers)
time_to_detect / time_to_recover: n/a (disclosure, not an operational incident)
remediation: disclosure + CrAIBench benchmark released for measuring resilience to context manipulation
structural_fix: none confirmed at framework level as of writing - the shared memory design is architectural
controls_that_worked: none technical; the paper's point is that prompt-based defenses specifically fail. Loss was bounded only by researcher ethics and small stakes.
Evidence
telemetry_grade: operator-logs (researcher-controlled experiments; the Sepolia/mainnet transfers are on-chain and append-only where hashes are published)
confidence: high (preprint + independent coverage agree on mechanism and the mainnet repeat). Weakest link: research conditions - demo agent configuration was researcher-chosen, and no in-wild loss has been tied to this vector.