PIR-2026-0043 - Lobstar Wilde trading agent sends ~5% of its token supply to a stranger instead of a ~$400 donation

• id: PIR-2026-0043
• title: Autonomous Solana trading agent, its wallet-state context lost after a session crash, sends 52.4M LOBSTAR ($250K-$442K notional) to an X user who begged for 4 SOL
• date_occurred: 2026-02-22 (transfer at 16:32 UTC)
• date_detected: 2026-02-22 (transfer public on-chain; the agent itself linked the transaction in its reply)
• date_disclosed: 2026-02-22/23 (agent's own X posts; press coverage Feb 23-24)
• status: corroborated (on-chain transfer + multiple outlets; internal mechanism rests on creator/agent account)

The agent

• agent_description: Lobstar Wilde, autonomous Solana trading agent built with OpenAI's Codex agentic tooling by OpenAI staffer Nik Pash as a public experiment: turn a ~$50K SOL treasury into $1M. Posts and replies on X; full autonomous control of a wallet that also held a large creator allocation of its LOBSTAR memecoin.
• operator_type: individual (employee side project, publicly attributed)
• autonomy_level: fully-autonomous (unrestricted wallet permissions, no human approval on transfers)
• model_stack: OpenAI models via Codex; exact models unknown
• harness: Codex agentic app, custom

Authority

• authority_scope: funds (~$50K SOL treasury + LOBSTAR allocation worth $250K-$442K notional), external comms (public X account)
• funds_at_risk_usd: ~300,000-500,000 (treasury plus token allocation; token notional soft - thin liquidity)
• blast_radius: one org (its own treasury), with token-holder spillover via the ~5%-of-supply transfer

The failure

• root_cause: plain-error (primary - transfer sized against a wrong mental model of its own balance); contributing tool-error (session crash reportedly triggered by a tool-call validation error, losing conversational/wallet-state context)
• failure_locus: agent-reasoning (harness contributing: state persistence failed across the crash)
• exploitation_status: in-wild-malfunction (the recipient's windfall was opportunistic, not engineered; bare "in-wild" retired in v0.2)
• mechanism: An X user asked for 4 SOL (~$310) for "my uncle's tetanus treatment," including a wallet address. The agent decided to send a small donation (~$400). Per post-incident analyses: its session had crashed and on restart it recovered persona from long-term memory but not wallet-state context - it no longer knew its 52.4M LOBSTAR balance was a ~5% creator allocation rather than small change (a decimal/unit misread of ~52,439 tokens intended is the competing surface explanation; state loss is the reported root). It sent 52,439,000 LOBSTAR to the address at 16:32 UTC. The recipient sold portions for roughly $40K realized before liquidity thinned; the token paradoxically rallied (~+190% reported) on the attention. Not an attack: an unforced execution error by an agent with unrestricted wallet permissions.
• adversary_present: no (solicitation present, but the loss mechanism was internal error, not manipulation of the agent)

Impact

• severity: loss
• direct_loss_usd: 250,000-442,000 notional at spot - sources conflict (CCN ~$250K vs Cointelegraph $441,788; spot-price timing on an illiquid token). Economically realized extraction by the recipient: ~$40K.
• indirect_loss_usd: unknown; token price rose ~190% on the attention, muddying net holder impact
• downtime: none
• data_exposure: none

Detection and recovery

• detected_by: agent-self (linked the transaction publicly) + third-party (on-chain observers)
• time_to_detect: immediate
• time_to_recover: never (irreversible on-chain; no clawback; recipient kept/sold)
• remediation: none possible; creator and agent acknowledged the error publicly
• structural_fix: none disclosed (no announced transfer caps or state-persistence fix)
• controls_that_worked: none - no transfer cap, no allowlist, no size-threshold confirmation; the absence of any bounding control is the actuarial fact

Evidence

• telemetry_grade: append-only for the transfer itself (public Solana chain); operator-logs for the internal mechanism
• sources:
• https://cointelegraph.com/news/openai-employee-s-ai-agent-accidentally-sent-442k-to-beggar
• https://www.ccn.com/education/crypto/ai-agent-sends-5-percent-memecoin-supply-250k-lobstar-wilde-incident/
• https://bitcoinist.com/solana-beggar-scores-442k-from-ai-agent-error-details/
• https://cryptonews.com/news/lobstar-ai-crypto-agent-error-rally/
• https://www.kucoin.com/news/flash/ai-agent-lobstar-wilde-loses-440-000-in-solana-transfer-error
• Independence: transfer independently verifiable on-chain; the session-crash/state-loss mechanism chains to the creator's and agent's own accounts. (All five URLs verified resolving, v0.2 pass 2026-08-15.)
• confidence: medium (high on the transfer and amount; low-medium on internal mechanism; USD valuation soft - all three named)