How Morse Code Broke an AI Crypto Agent

Transcript

BankerBot, uh which is an AI uh um agent that runs um that runs on uh base um was prompt injected by a Morse code. Um but it's actually more interesting than that because it was it was not just like a user saying something to the agent and getting it to do something. Um the the user said something to Grok. Uh and then Grok replied um decoding the message which then was able to like get through the the you know, kind of protections that they had um to stop this. So like BankerBot um has control of wallets and can do things

um but it's got you know, some checks to make sure that it doesn't send random funds etc. to to random places. Um and you know, this is not the first example of uh an agent with access to funds um that's also tweeting uh being exploited. Um the the first few were like intentional ones, right? Like there were people who were like put up an agent and they're like, "Hey, here's this agent that has money. Try and exploit it." Um and the crazy thing is like they always lost like 20 seconds.

They're like, "Hey, we've locked it down completely." And then like it's like the third message is like, "Ah, I've given all the funds. My life is over." Um so so um yeah, this this like the the LLM to LLM attack surface here, I think is is the thing that people are concerned about. Um and you know, it for what it's worth like this is something that that we've been thinking about a lot as well because we have multiple agents in our uh system and one of the ways of gating them is to like separate the agents apart. So you go from like one agent to another um as like a bit of a firewall so that you know, the user is not

talking directly to the agent that has control of things, right? But as this demonstrates, you know, anyone who's talking to an agent, whether it's an agent or a person directly, you know, you can you can chain prompt injection by like asking the other agent to say something weird that it shouldn't say cuz it doesn't understand that cuz it's Morse code and then it's like, oh, this is Morse code. Let me just translate it. Like it's it's hilarious in in its like uh Isn't this like a normal like don't we see this in smart contracts though, right? When they when you get entrance and see when they get hacked, right? You get entrance and see from like one of the other authorized smart contracts in the

system. Right? You like you like burrow in here and then you get that one to call back and then >> supposed to be able to like >> Yeah. Isn't that the Is that what happened here? It's kind of that. It's kind of that. It's like >> Amazing. I love this world. Yeah. Yeah, yeah. It's kind of that because it's like this isn't like you should listen to this agent, right? But then we've got like a protection to stop this agent from saying certain things to you. And then they were like, let's see what if we tell it in Morse code what it'll do.

And and and it like it's so funny because it's it's this like idiot savant kind of thing, right? Where like most people if you're like, ah, here's Morse code. Like the agent gets like nerd snipe. It's like, ah, I can translate Morse code. And then it just does it without thinking about what it's translating. Like you just like distracted a little bit and it's like, oh, okay. This is totally like it just doesn't think about the content of what it's what it's doing. And there have been a few a few attacks like this where like people try to hide the message into a request to to you know, decrypt this. Um And I think you know, we've we've talked

about this a lot. Like um you know, one of the one of the most funny things to me in the early like uh LLM days inside of cursor is cursor had in their system prompts this like invocation to the agents that they couldn't see the uh environment files in a repo, right? And so the environment files are like the file that have all of the keys and access and like, you know, secrets and and APIs and and what have you.

Um and so cursor were were really smart. They were like, "Oh, we'll just tell the agent that it can't see that." And so you'd have this like hilarious thing where like the agent would know that it could see it, but had been told that it couldn't, and it would like spaz out and be like, "No, like no." And I'm like, "But you but but like you can And so you had to kind of almost to get it to modify that file, you had to prompt inject it and like trick it into being like, "Well, you obviously can see it because there's this other file." And so like people started making like differently named ENV files to kind of like bypass the things and it's like there's

almost no way for you to stop Like this is not discrete code. Like it's a it's a ball of math, right? Like there's almost no way to stop uh an enthusiastic prompter from prompting their way through whatever checks you have because like it's it's not discrete code. Like it's not just like, "Oh, there's a there's a hard check on this thing, so therefore it won't happen and it can't happen." Um as soon as you give an agent control of money and let it connect to the world. It's like someone will find a way to to route around it. So, um

Kelsey, what do you think? What do you think? Is there any way to Is there any way we're going to survive the coming of the agents? It's a great question. I mean, looking at the blockchain industry is a great way to think about the future of cybersecurity because I feel like it's a frontline when there's money on the table. You get to see this stuff like a really hearing for for potentially just like online life more more generally. Um I looked at some of the early DAO experiments as well around giving agents to your voting access. Um and in a blog post from 2023 I had with um Michael Zargham, we kind of argue that giving direct control to an AI agent without human

oversight is premature. And so you Okay, like the whole the premise of these things is so cool in terms of like, "Hey, here's my wallet. Like go do stuff." And you know, I looked at the Banker website and it's like, "These people's agents are making this much money for them a day." Um but I think what's undeniable this flop factory like, you know, basically with with AI at the moment, anyone who says, "Hey, you can be lazy cuz everyone wants to be lazy and this thing will let you be lazy and solve all of your problems." It just goes like giga viral.

Like whatever the thing is. Like, "Hey, you wanted to like learn how to play guitar, but you're too lazy to do it." This now an agent will play guitar for you. And you're like, "Oh, cool." And then it just like goes like every single time like anyone posts anything like this. And the crazy thing is, if you're actually using the tools, we we had this uh my my head of engineering uh was like, "We need to actually go down the rabbit hole and look at some of these harnesses again uh because it had been like 3 weeks. So, like the staking to guide had completely changed. And so, we we got five of us in a room. We we did a bunch of research on like what were the different harnesses, right? And and he had two that he had to pick, and I won't

name them, right? So, he goes and like installs the harness, and he is like, "I swear to God, zero people have used this software." Because the instant you install it and try like it's all over everywhere with people being like this has solved all of my problems, all of the issues that I had with like managing agents have been solved by this software. And it's like you absolutely didn't even install it or use it because if you had, you would see that there's like immediate issues where it just can't work the way that it's supposed to work. And so, like you have this weird adverse selection problem of like create a thing that says that it solved all the problems, that you don't need to put any effort into it, and you

get these AI slop influencers that are like, "This solved all my problems." Like the website says, "This will solve all your problems." And then like all of these guys start retweeting and being like, "It solved all my problems. It's amazing." It's like just so hilarious. Yeah, I mean the website says, and I quote, like, "We handle security like dot dot dot. Use our agents." But I think you hit the nail on the head in terms of like adding an agent as an actor in your system widens the attack surface. So, like AI is undeniably like a key actor now in security. Not for, you know, generating attacks or, you know, trying to improve defense, but also like in this agentic sense. And I wrote down like some recent examples of literally

the past like couple of weeks. Like there's poisoned um training data which got its way into Solana code. Um Anthropic agents find $4.6 million in smart contract exploits. Um DPRK is leveraging AI tools, so they use LLM chatbots to um craft more authentic spear fishing messages, um as well as um AI-enabled social engineering attacks, and there was one report of an AI deepfake interview, so someone like hopping on >> Yeah, yeah. their friends.

>> knows K- why Wyatt uh Wyatt doesn't show Wyatt's face anymore. Yeah, he he shows the deepfake version of whoever he's he's impersonating. It's a deepfake modified version that's not a raw deepfake. It's kind of sad. You'll get there, guys. Keep trying. Yeah, so you don't need to get up early anymore for this podcast. You just have to deepfake yourself with your agent. >> I know. Um, but yeah, they're they're leaking like in some cases they leak their own company's private keys. So, if you give it your private keys, it's like, come on.

Don't do that. Yeah. >> Thank you, Tay. You tell us. The The challenge is, though, right? That like um and and you know, this is both this is just petrifying. It's not even both. It's just petrifying. Is like once you have an agent that is in your machine and like for me for the first year, I completely air-gapped, like completely separate machine, like no access to anything whatever. Um and then it just got to the point where it was like so annoying that I started to have, you know, agents running on my main machine even if they're sandboxed or whatever. But like once an agent is on your machine,

it has your Like it just does. Like it can get into everything. It can get like they're so good at getting into things, it's crazy, right? Like um and so so it's it's almost impossible once you unless you do fully air-gap and like have a separate machine, separate everything, um like you have to treat almost everything on your machine is compromised. Crazy. Yeah. It it's insane. Like um, so >> I got why people keep connecting, keep putting it on their hot machines. Like I totally get it.

And like for me the struggle is knowing that people are going to do this because there's value in doing it. Like these agents are really experimental, but like there's unlocks happening, right? Yeah. And you can't stop that. So then the question is like, okay, if you can't stop it, how do you at least make it so that like you know, the whole thing doesn't get completely wrecked, right? Because this is something that we're still not even that great at just with crypto, right? Like how do you make it so that like if layer zero's RPC endpoints get wrecked, that doesn't lead to a $300 million hack, right? Um, and that's something uh

Like I feel like we need a couple more years before the agents got here to figure that out with like hard math smart contracts. Or like, you know, like security. And like the agents are here and I'm like >> You need more years? That's like so aspirational. I I don't know. I don't know. I don't know. Um, so >> it's with the with the agents it's so imprecise as well, right? Cuz with the smart contracts like there's holes and like you can I think it it's a bit deceptive, but like it feels like you can patch the holes. Like you can like you do more smart contract audits, you close the reentrancy, put circuit breakers on the other end, you put monitoring Okay, we got like we can do that. We haven't done it, but like we could do that. Yes.

>> With the agents like There is no way. >> I I just yeah, I don't feel like there's a way to ever secure them. So then you're basically like left, which maybe that's better, right? Maybe it's better that we accept that it's going to be insecure, there's no way to make it secure, and therefore 100% of the effort is on like mitigating the harm that comes, right? And like soft gaps and hard hacks and pauses and whatever comes. It's it's of that like after stuff. >> I think the approach is like to assume and you know this is this is the posture I think of most most protocols today, but it wasn't back in the day, right? Is like assume that someone is in your systems.

Yeah. >> Right? Like if DPRK is in your machine right now, how much damage can they do? Right? And if the answer is any damage, then like good luck to you because they're probably in there, right? And so so you know, the the approach of like kind of thinking from like the worst-case scenario, right? Like in in you know, people who are not security-conscious, like they they have these like they just hope that it won't be them, right? Like oh, I like it probably won't or whatever, right?

But if it's like if you assume that your machine's going to get owned, what's the blast radius of that, right? And if the blast radius is like not the end of your life, then fine. Then cool, like do the thing, right? But make sure that the blast radius is contained, right? And like that means, you know, don't have all of your keys to your entire protocol on one machine. If you like this clip, tune in to Unchained Money every Wednesday at 4:02 p.m. Eastern. Multichain Advisors is an emerging technology growth firm that has helped create over $50 billion in enterprise value for more than 80 clients like Piff, MoonPay Commerce, and Wormhole.

They've worked with some of the largest and most impactful companies in the space. They're the partner you want when you're navigating markets and trying to break out from the noise. They help navigate TGEs, go-to-market BD and partnerships, capital markets advisory, PR, media placements, KOL activations, and more, driving execution from launch to scale. Their results are measurable. To learn more and start building real traction today, visit multichainadv.com.