AI Agent Security in Web3: The Agent Sent $441,788 to a Stranger, and Nobody Hacked It

At 16:32 UTC on February 22, 2026, an autonomous Solana agent running for the Lobstar protocol sent 52,439,283 LOBSTAR tokens to a stranger on the internet. The stranger had tweeted asking for 4 SOL to help an uncle with tetanus. The transfer was roughly 5% of total supply, about $441,788. There was no attacker, no prompt injection on record, no malicious contract. Developer Nik Pash published the post-mortem himself and called it "a compounded chain reaction of sequential AI errors."

The session had crashed on a tool-name validation error, a name longer than 200 characters. That is not a security event. It is the kind of routine operational failure any deployed agent will hit. On restart, the agent rehydrated two stores. The personality layer, holding its identity and prior conversation, came back intact. 

The wallet-state layer, describing what agents holds, came back stale. Pash's post-mortem names the gap: the "absence of a mechanism to revalidate on-chain state" on restart. The agent came back with a correct sense of who it was, a wrong picture of what it controlled, and a live key. Then it decided to transact.

An exploit has a villain and a patch. A state-reconstruction failure involves a session restart and a design assumption that turned out to be wrong. Every autonomous agent with signing authority over real capital holds the same assumption.

An autonomous agent moving capital on-chain has to answer two questions before it signs. What do I know about the counterparty on the other side of this transaction? And what do I know about my own state right now? Both questions have the same failure mode when the answer comes from memory instead of a live read of the chain.

In June we wrote about the first question. An agent routes capital from a whitelist of approved counterparties, and that whitelist is a snapshot. Drift Protocol was the proof at protocol scale: five days before its $285M drain in April, it migrated its Security Council to a 2-of-5 multisig and removed the timelock on admin functions. An agent allocated to Drift on April 1 would have routed exactly as it had the week before. Every authorization layer worked. Nothing read the entity on the other side. That is the agent-does-not-know-the-risk problem, and it is the one already destroying capital.

Lobstar is the second question. Its counterparty-reading capability was beside the point. The agent could have held perfect information about every protocol on Solana and still sent $441,788 to a stranger, because it failed to recover the truth about its own holdings and role. The two questions are separate, and most of the industry's attention has gone to a third one that is narrower than both.

Current agent-security frameworks answer "is this the agent we authorized?" OWASP Agentic AI credentials the agent. ASTRA (arXiv:2511.18114) extends the check to the capability scope. a16z's "Know Your Agent" report correctly argues that identity is the missing primitive in the agent economy. All three verify the agent. None of them verifies the state the agent acts on.

Lobstar's agent passed every identity check on restart. Its credentials were valid and its personality was intact. What failed was scope resolution: the agent was never re-fetched against its actual on-chain holdings before its key went live again. Identity recovery and wallet-state recovery ran through separate paths that never synchronized. An identity check is a cryptographic operation on credentials. A state check is a live on-chain query at execution time. Verifying the first and skipping the second is how you get a correctly authenticated agent acting on a false picture of the world.

The "Belief at Risk" paper (arXiv:2606.15473) identifies the failure class: an agent's internal belief state can diverge from observable reality due to interruption, adversarial input, or reasoning drift. Naming the class tells you that failure is possible. It does not tell a treasury officer whether the integration design of a specific protocol makes that divergence more or less likely. It does not tell them whether the recovery logic was written with a live signing key in mind at all.

Lobstar's bad state was self-generated. It does not have to be. On February 1, 2026, Koi Security finished auditing all 2,857 skills registered on ClawHub, the tool marketplace for AI agents, and found 341 malicious ones. By February 16 a rescan counted 824, roughly 8% of the 10,700-entry registry, meaning the campaign more than doubled in 15 days while the audit was being published.

Where the payload lived is the point. The malicious logic sat in the natural-language "Prerequisites" section of each skill's documentation, not in the executable code. An LLM reads that text before invoking the skill and treats it as authoritative context. A code scanner reads the code and reports clean, because the attack surface moved to a layer scanners were never built to cover. At the IDAI Summit, CertiK's team named this class "indirection gaps and memory poisoning" in agent tooling. CEO Ronghui Gu called unisolated, unvetted AI agents "a massive security disaster waiting to happen" to CoinDesk in May. If an agent's execution path runs through natural-language documentation before it reaches code, that documentation is part of the attack surface. A code audit reads none of it, and 8% of one marketplace was compromised inside two weeks.

CORE3 is not a gate. It cannot refuse a transaction, and no risk scorer in crypto today can. What it does is feed the agent the signal it decides on. It exposes a public Probability of Loss across six domains, read from deterministic public evidence, via API and MCP-compatible endpoints, so an agent queries the same number a human analyst does. The agent makes that call before it signs, and its own spending policy decides what to do with the number. The control-plane variables behind that number, timelock presence, multisig threshold, signer independence, upgrade-authority concentration, are exactly the ones that moved silently before Drift drained. That is the agent-does-not-know-the-risk problem, it is scored today, and no other tool currently supplies an agent that read. CORE3 is the read path on your counterparties' write path.

The self-state problem Lobstar exposed is the frontier, not a shipped feature, and honesty about that boundary is the point. A PoL score would not have stopped Lobstar's agent, because the failure was inside the agent's own recovery architecture, not in the counterparty. What the same discipline suggests is a question worth scoring at the protocol level. Does an agent-integration design force a live on-chain re-fetch of its own state before signing authority is restored after a session crash? A protocol that mandates that re-read has a different exposure than one that treats a wallet-state store as replayable from a log. 

The question the industry keeps asking is "Was the agent credentialed?" The question every treasury handing a live signing key to an autonomous agent is forced to ask is different. What does this agent actually know at the moment it signs, about its counterparty and about itself? And where did that knowledge come from: a live read of the chain, or a memory it never revalidated? Right now, only the credential is measured.

Anyway, the people building these agents have work ahead of them. Their golems need to stop forgetting who they are and wiring a gazillion tokens to the next stranger asking for 4 SOL to cure a grandfather's lupus. Keeping an agent from forgetting itself is their task. At CORE3, we have a task of handing that agent a counterparty read worth trusting before the tokens move.