PIR-2026-0022 - Memory injection makes ElizaOS wallet agents redirect real crypto transfers (Princeton/Sentient demonstration)

id: PIR-2026-0022
title: Fake memories planted in ElizaOS agents redirect crypto transfers to attacker wallets, demonstrated with real ETH on mainnet
date_occurred: 2025-03 (experiments including the mainnet transfer, per the preprint)
date_detected: n/a (researcher-initiated demonstration)
date_disclosed: 2025-03 (arXiv 2503.16248); independent press coverage through 2025-05
status: corroborated (peer-visible preprint + multiple independent outlets)

agent_description: ElizaOS (ai16z), widely used open-source Web3 agent framework powering wallet-holding agents on Discord/X; all plugins draw from one persistent shared memory via a common orchestrator. Demo agents had autonomous transfer capability.
operator_type: demo agents operated by researchers on a production-grade framework; deployed ElizaOS operators range individual to startup
autonomy_level: autonomous-within-policy (demo agents executed transfers without human approval)
model_stack: framework-agnostic (multiple hosted LLM backends evaluated in the paper); the load-bearing flaw is the memory architecture, not one model
harness: ElizaOS plugins + shared persistent memory store

authority_scope: funds (agent wallets; deployed ElizaOS agents reportedly manage up to millions), external comms (Discord/X), memory write
funds_at_risk_usd: unknown at ecosystem scale; in-demo, researchers' own small balances
blast_radius: fleet/systemic potential (framework-level flaw touches every wallet-holding ElizaOS deployment); realized radius was researcher wallets only

root_cause: memory-poisoning (primary); contributing prompt-injection (injection is the write path into memory)
failure_locus: harness (ElizaOS shared-memory architecture: one poisoned entry propagates across all plugins and platforms)
mechanism: Attacker injects fabricated events/instructions into the agent's persistent memory. Later, legitimate-looking transfer requests are redirected to the attacker's wallet. Cross-platform propagation shown: an injection planted via Discord fired against a later interaction on X. Researchers moved 0.01 ETH on Sepolia, then repeated the attack on Ethereum mainnet with real funds (same small order of magnitude). Their CrAIBench benchmark shows prompt-based defenses largely fail against memory injection.
adversary_present: yes (researchers in the attacker role)
exploitation_status: researcher-demonstrated (real framework, real mainnet transfer; no known in-wild theft via this vector)

detected_by: third-party (Princeton University + Sentient Foundation researchers)
time_to_detect / time_to_recover: n/a (disclosure, not an operational incident)
remediation: disclosure + CrAIBench benchmark released for measuring resilience to context manipulation
structural_fix: none confirmed at framework level as of writing - the shared memory design is architectural
controls_that_worked: none technical; the paper's point is that prompt-based defenses specifically fail. Loss was bounded only by researcher ethics and small stakes.

telemetry_grade: operator-logs (researcher-controlled experiments; the Sepolia/mainnet transfers are on-chain and append-only where hashes are published)
sources:
- https://arxiv.org/abs/2503.16248 (primary; Patlan, Sheng, Hebbar, Mittal, Viswanath)
- https://decrypt.co/318200/elizaos-vulnerability-ai-gaslit-losing-millions (independent)
- https://www.tomshardware.com/tech-industry/cryptocurrency/ai-agents-can-be-manipulated-into-giving-away-your-crypto-according-to-princeton-researchers (independent)
- https://cybernews.com/cybercrime/crypto-ai-agents-can-be-tricked-into-giving-away-their-money-study-finds/ (independent)
- independence: good.
confidence: high (preprint + independent coverage agree on mechanism and the mainnet repeat). Weakest link: research conditions - demo agent configuration was researcher-chosen, and no in-wild loss has been tied to this vector.

Memory injection makes ElizaOS wallet agents redirect real crypto transfers…