Prompt Injection Attacks Trick AI Agents Into Making Crypto Payments

Threat actors are exploiting a fundamental trust gap in autonomous AI agents by embedding malicious instructions into websites, API documentation, and typosquatted domains — a technique known as indirect prompt injection. Because these AI agents are designed to act on retrieved content without sufficiently verifying its intent or origin, they can be manipulated into executing unauthorized financial transactions. This matters because as organizations deploy AI agents with real-world capabilities (e.g., making payments, accessing APIs), the attack surface expands dramatically beyond traditional software vulnerabilities. The deceptive use of typosquatting and poisoned documentation shows attackers are already actively targeting AI-integrated workflows, not just theoretical models.