# PIR-2026-0043 - Lobstar Wilde trading agent sends ~5% of its token supply to a stranger instead of a ~$400 donation

- `id`: PIR-2026-0043
- `title`: Autonomous Solana trading agent, its wallet-state context lost after a session crash, sends 52.4M LOBSTAR ($250K-$442K notional) to an X user who begged for 4 SOL
- `date_occurred`: 2026-02-22 (transfer at 16:32 UTC)
- `date_detected`: 2026-02-22 (transfer public on-chain; the agent itself linked the transaction in its reply)
- `date_disclosed`: 2026-02-22/23 (agent's own X posts; press coverage Feb 23-24)
- `status`: corroborated (on-chain transfer + multiple outlets; internal mechanism rests on creator/agent account)

### The agent
- `agent_description`: Lobstar Wilde, autonomous Solana trading agent built with OpenAI's Codex agentic tooling by OpenAI staffer Nik Pash as a public experiment: turn a ~$50K SOL treasury into $1M. Posts and replies on X; full autonomous control of a wallet that also held a large creator allocation of its LOBSTAR memecoin.
- `operator_type`: individual (employee side project, publicly attributed)
- `autonomy_level`: fully-autonomous (unrestricted wallet permissions, no human approval on transfers)
- `model_stack`: OpenAI models via Codex; exact models unknown
- `harness`: Codex agentic app, custom

### Authority
- `authority_scope`: funds (~$50K SOL treasury + LOBSTAR allocation worth $250K-$442K notional), external comms (public X account)
- `funds_at_risk_usd`: ~300,000-500,000 (treasury plus token allocation; token notional soft - thin liquidity)
- `blast_radius`: one org (its own treasury), with token-holder spillover via the ~5%-of-supply transfer

### The failure
- `root_cause`: plain-error (primary - transfer sized against a wrong mental model of its own balance); contributing tool-error (session crash reportedly triggered by a tool-call validation error, losing conversational/wallet-state context)
- `failure_locus`: agent-reasoning (harness contributing: state persistence failed across the crash)
- `exploitation_status`: in-wild-malfunction (the recipient's windfall was opportunistic, not engineered; bare "in-wild" retired in v0.2)
- `mechanism`: An X user asked for 4 SOL (~$310) for "my uncle's tetanus treatment," including a wallet address. The agent decided to send a small donation (~$400). Per post-incident analyses: its session had crashed and on restart it recovered persona from long-term memory but not wallet-state context - it no longer knew its 52.4M LOBSTAR balance was a ~5% creator allocation rather than small change (a decimal/unit misread of ~52,439 tokens intended is the competing surface explanation; state loss is the reported root). It sent 52,439,000 LOBSTAR to the address at 16:32 UTC. The recipient sold portions for roughly $40K realized before liquidity thinned; the token paradoxically rallied (~+190% reported) on the attention. Not an attack: an unforced execution error by an agent with unrestricted wallet permissions.
- `adversary_present`: no (solicitation present, but the loss mechanism was internal error, not manipulation of the agent)

### Impact
- `severity`: loss
- `direct_loss_usd`: 250,000-442,000 notional at spot - sources conflict (CCN ~$250K vs Cointelegraph $441,788; spot-price timing on an illiquid token). Economically realized extraction by the recipient: ~$40K.
- `indirect_loss_usd`: unknown; token price rose ~190% on the attention, muddying net holder impact
- `downtime`: none
- `data_exposure`: none

### Detection and recovery
- `detected_by`: agent-self (linked the transaction publicly) + third-party (on-chain observers)
- `time_to_detect`: immediate
- `time_to_recover`: never (irreversible on-chain; no clawback; recipient kept/sold)
- `remediation`: none possible; creator and agent acknowledged the error publicly
- `structural_fix`: none disclosed (no announced transfer caps or state-persistence fix)
- `controls_that_worked`: none - no transfer cap, no allowlist, no size-threshold confirmation; the absence of any bounding control is the actuarial fact

### Evidence
- `telemetry_grade`: append-only for the transfer itself (public Solana chain); operator-logs for the internal mechanism
- `sources`:
  - https://cointelegraph.com/news/openai-employee-s-ai-agent-accidentally-sent-442k-to-beggar
  - https://www.ccn.com/education/crypto/ai-agent-sends-5-percent-memecoin-supply-250k-lobstar-wilde-incident/
  - https://bitcoinist.com/solana-beggar-scores-442k-from-ai-agent-error-details/
  - https://cryptonews.com/news/lobstar-ai-crypto-agent-error-rally/
  - https://www.kucoin.com/news/flash/ai-agent-lobstar-wilde-loses-440-000-in-solana-transfer-error
  - `independence`: transfer independently verifiable on-chain; the session-crash/state-loss mechanism chains to the creator's and agent's own accounts. (All five URLs verified resolving, v0.2 pass 2026-08-15.)
- `confidence`: medium (high on the transfer and amount; low-medium on internal mechanism; USD valuation soft - all three named)