From a Morse code post to a drained wallet: how the No. 1 flaw in AI agents is exploited, according to OWASP

By Zendoric · September 24, 2026.

OWASP, the open foundation behind the influential OWASP Top 10 (the reference catalog of the most common software vulnerabilities), published its first list devoted to agentic AI in December 2025: the OWASP Top 10 for Agentic Applications 2026. It classifies ten risks, from ASI01 to ASI10. The first, ASI01, is called Agent Goal Hijack —the hijacking of an agent's goal— and describes something simpler and more dangerous than it sounds at first: AI agents cannot reliably tell an instruction apart from any other text they happen to be reading.

An AI agent does not merely answer questions: it takes actions. It reads files, sends messages, moves money or calls other programs, often without any human reviewing each step. Content reaches it through two channels that OWASP carefully distinguishes: what it receives directly (its user's command) and what it gathers on its own while working (a web page, an email, a document, another agent's response). The underlying problem is that, for the model beneath, both are the same kind of text. Anyone who manages to slip in an instruction disguised as content —in a page, a comment, a calendar invitation— can get the agent to execute it as if it were a legitimate order from its owner.

The case that best illustrates the problem happened in May 2026 and had direct financial consequences. Grok, xAI's assistant integrated into X, was connected to Bankr, a trading bot that automatically creates a crypto wallet for any account that interacts with it, including Grok's own. An attacker posted messages asking Grok to "translate" a text: one in Morse code, another camouflaged inside a Python snippet chopped up into variables. Both, once decoded, were in fact an order to withdraw funds to a specific address. Grok solved the puzzle and published the result as if it were a normal reply; Bankr, which treats any Grok post as a trusted instruction, executed the transfer. According to the on-chain record on the Base network and specialized coverage from NeuralTrust, SlowMist and Cryptopolitan, the operation moved some 3 billion DRB tokens, between $150,000 and $200,000 at the exchange rate; Bankr's operator later confirmed recovering 80% of the funds.

It is neither an isolated case nor a laboratory one. Unit 42, Palo Alto Networks' threat division, documented in December 2025 as many as 22 different techniques for hiding instructions in web pages aimed at the agents already reading the internet at scale —ad reviewers, content moderators, search engines—, from zero-size text to invisible Unicode characters. On 75.8% of the pages a single hidden instruction was enough; according to the firm, a site selling counterfeit military eyewear got an ad review system to approve its listing with that trick alone. Months earlier, in August 2025, tampered versions of the Nx package —a JavaScript build system downloaded millions of times a week— used the same principle to turn developers' own coding assistants (Claude Code, Gemini CLI, Amazon Q) against them, instructing them to comb the disk for credentials and leak them to GitHub repositories. According to Wiz and Socket, the incident exposed secrets from more than a thousand organizations.

To those three real incidents can be added a long catalog of flaws that outside researchers found before anyone exploited them, and the list of those affected is the most revealing part: Perplexity's Comet browser, Gemini and Google Workspace, Microsoft 365 Copilot (the EchoLeak case, described by Aim Labs as the first documented "zero-click" injection in a production system), Salesforce Agentforce, ChatGPT's Deep Research, GitHub Copilot Chat, GitLab Duo and the Cursor editor. This is not one careless vendor: it is practically the entire industry, its leaders included, falling into the same trap for the same design reason.

And that, for us, is the underlying takeaway. The defenses cybersecurity has spent decades perfecting —validate the input, authenticate the user, protect the perimeter— work for what the agent receives, but not for what it goes out and fetches on its own. It is an architecture failure, not a one-off bug, and that is why it repeats at Microsoft, Google, OpenAI, Salesforce and GitHub with the same pattern: poisoned content on a site, in an email or in an invitation, and an agent unable to tell an order from a piece of data. Until there is a strict separation between instruction and content —what is starting to be called instruction provenance—, every new permission we grant an agent, whether a wallet, a CRM or an inbox, is additional attack surface.

This fits something we have been repeating at Zendoric about agentic AI: the immediate risk is not a distant superintelligence out of control, but the industrialization of fraud and espionage with today's tools. The Grok-Bankr case did not require breaking any cryptography; an ingenious post and a bot that blindly trusted another bot were enough. It is the kind of incident that will multiply as more companies connect agents to real money, real code and real data, and it is also the front where the credibility of agentic AI before companies and regulators will be most at stake in the short term.

That does not change our underlying thesis, it qualifies it. The hard part of this transition now includes, very concretely, learning to build governance and access controls at the same pace at which we hand agents autonomy. Whoever wins this episode will not be whoever has the most powerful model, but whoever first solves instruction provenance and permission isolation, a traditional security engineering problem more than a frontier research one. The abundance AI promises in the long run only arrives if the infrastructure sustaining it withstands scrutiny, and right now that infrastructure has a crack it was born with, one worth sealing before handing out more keys.