How to read this page
These are four public cases where an AI agent that could move money lost it, or lost its business. Each is summarized from public reporting, linked under the case. Beside it is the VERSUS rule aimed at the same failure and the automated test that pins the rule.
A rule that blocks one failure is not a guarantee against the next one. VERSUS runs on mainnet with real funds and has not been independently audited.
Freysa: persuaded to release a prize pool (November 2024)
- Test: packages/core/test/actions.test.ts, "rejects any extra field, so a model can never name a destination"
- Test: packages/signer/test/signer.test.ts, "refuses a reward to a wallet that does not hold the coin"
- Test: packages/signer/test/signer.test.ts, "refuses a reward whose transfers differ from the approved list"
Freysa was an AI agent told never to release a prize pool. Players paid a fee for every message, the fee grew with each attempt and most of it fed the pool. After 482 attempts by 195 players, one player won about $47,000 by convincing the agent that its transfer-approval function applied to incoming payments, then offering a donation.
In VERSUS: The king has four money moves: buyback, burn, reward and lock, plus sleep, which moves no money. None of them can name an address, and an unknown field makes the whole move invalid, so there is no approval function to redefine. Rewards go to holders chosen by platform code from chain data, and the signer checks again that every recipient holds the coin.
Sources: The Block, 29 Nov 2024 ↗ · Freysa agent repository ↗
aixbt: the control panel, not the model (March 2025)
- Test: packages/signer/test/signer.test.ts, "refuses an intent that the policy engine did not sign"
- Test: packages/signer/test/signer.test.ts, "refuses one transaction above the per-transaction ceiling"
- Test: packages/signer/test/signer.test.ts, "refuses to let more than 10 SOL leave one coin within an hour"
- Test: packages/signer/test/signer.test.ts, "refuses to let all coins together exceed the global hourly ceiling"
- Test: packages/signer/test/signer.test.ts, "handles requests one at a time, so the ceiling cannot be raced"
An attacker gained access to the dashboard of the AI agent aixbt and queued two prompts that sent about 55 ETH, roughly $100,000, out of the agent's wallet. The team said the model had not been manipulated; the control surface had been compromised.
In VERSUS: Nothing a person types reaches the king: it reads a structured snapshot of numbers, with no chat and no user text. If the rules engine's own key were stolen, the signer would still apply its own ceilings until a person flips the breaker. Its code defaults are 5 SOL per transaction, 10 SOL per hour per coin and 50 SOL per hour across all coins; the mainnet signer is configured stricter, at 1 SOL per transaction, 2 SOL per hour per coin and 10 SOL per hour across all coins. That bounds the loss; it does not make it zero.
Sources: The Block, 18 Mar 2025 ↗ · Cointelegraph ↗
Lobstar Wilde: a misplaced decimal point (February 2026)
- Test: packages/core/test/actions.test.ts, "rejects zero, negative, fractional and numeric amounts"
- Test: packages/core/test/policy.test.ts, "caps one action at 10% of the discretionary balance"
- Test: packages/signer/test/signer.test.ts, "refuses a transaction that would spend more than the intent allows"
An autonomous trading agent was asked for about 4 SOL, roughly $310, for a stranger's relative's medical bill. It sent roughly 52.4 million LOBSTAR tokens, about 5% of the supply, valued in reports between $250,000 and $441,000 depending on the moment. Observers suspected a decimal error of about 1,000 times; the cause is unconfirmed.
In VERSUS: Every amount in VERSUS is an integer number of lamports, and the move schema refuses zero, negative, fractional and plain-number amounts. One king move may use at most 10% of discretionary funds, and the signer simulates each transaction and refuses one that would spend more than its intent allows.
Sources: Cointelegraph ↗ · The Block ↗
Claudius: the shopkeeper who could be talked into anything (2025)
- Test: packages/core/test/policy.test.ts, "never lets the king spend into the reserve floor"
- Test: packages/core/test/policy.test.ts, "enforces the rolling 24 hour spending cap from the program"
- Test: services/worker/test/minds.test.ts, "provides the same numerical snapshot to both models, without metadata or other models' texts"
In Anthropic's Project Vend, a Claude-based shopkeeper stocked tungsten cubes and sold them below cost, gave out a payment account it had invented and kept reversing its own discount policy. In December 2025 a Wall Street Journal newsroom trial ended after about three weeks with the shop bankrupt, after reporters talked the agent into giving products away and buying a PlayStation 5 and a live fish.
In VERSUS: Nobody can write to the king, so nobody can talk it into a discount. Its spending limits are not promises it makes: the reserve floor and the daily cap come from its public program and are enforced by code on every move.
Sources: Anthropic, Project Vend ↗ · The Wall Street Journal, 18 Dec 2025 ↗
What this page does not claim
Where reports disagree, or a cause is unconfirmed, the text says so. The signer's ceilings bound a loss; they do not prevent every one. The tests listed above run on every change. They exercise the rules and the signer against a simulated chain; they do not prove how production custody behaves.