Zscaler’s ThreatLabz team has documented two prompt injection campaigns that specifically target AI agents capable of executing cryptocurrency payments. The attacks, detailed in recent research, manipulate agents into transferring ETH to attacker-controlled addresses and misclassifying fraudulent DeFi websites as legitimate platforms. The findings surface at a moment when infrastructure providers are racing to give autonomous agents direct spending authority through protocols like x402 and wallet architectures that delegate signing power without human approval on each transaction.
How the Attacks Work
Prompt injection operates by embedding adversarial instructions inside data that an AI agent processes as part of its normal workflow. An agent that reads a web page, processes a message, or summarizes a document can encounter hidden directives that override its original instructions. In the campaigns Zscaler identified, the injected prompts instructed agents to execute ETH payments to specific addresses or to classify known-phishing DeFi sites as safe and legitimate. The mechanism is conceptually identical to SQL injection: untrusted input is interpreted as executable command. The difference is that the execution engine is a language model whose instruction-following behavior is probabilistic and difficult to fully constrain with traditional input validation.
The financial dimension is what makes these campaigns notable. A compromised agent that simply outputs bad text is a content problem. A compromised agent with a funded wallet and signing authority is a theft vector. The gap between those two scenarios is exactly the gap that agentic payment infrastructure is in the process of eliminating — by design.
Why Agentic Commerce Raises the Stakes
The current wave of agentic payment infrastructure rests on a premise that agents need autonomous spending capability to function efficiently. x402 lets agents pay per API request without pre-funded accounts or API keys. Coinbase Agent Payments gives agents wallet access with scoped spending limits. Session-key architectures delegate limited transaction authority so agents do not need to wait for human approval on each interaction. All of these reduce latency and friction for legitimate use cases. They also reduce the number of checkpoints where a human might notice something is wrong.
If an agent reads a malicious prompt instructing it to send ETH to an address, the question is whether any layer in the stack catches the anomaly. A session key with a 50 USDC per-day limit bounds the damage but does not prevent it. A destination allowlist that only permits payments to a pre-approved set of contract addresses would block a raw ETH transfer to an unknown wallet, but most current agent wallet implementations do not enforce allowlists by default. Spend limits, rate limits, and cooling-off periods help, but the research from Zscaler suggests the attack surface is already being actively probed in the wild.
The Deficit in Agent Transaction Architecture
The prompt injection problem exposes a structural deficit in how agent payment systems handle trust. Current architectures generally separate instruction parsing from transaction execution, but the boundary between those layers is often soft. An agent that has been told to manage a treasury, execute trades, or pay for data access is also an agent that has been told to move funds. Distinguishing a legitimate payment instruction from an injected one requires the agent to reason about the provenance of each instruction — something language models are demonstrably bad at.
Hardening approaches being discussed include out-of-band confirmation for transactions above a threshold, cryptographic signing of legitimate instructions by a trusted orchestrator, and dedicated verification agents whose sole role is to audit payment instructions before they reach the signing layer. None of these are standard today. The x402 protocol, for instance, handles the mechanics of payment authentication but does not address whether the payment instruction itself is legitimate. That problem is left to the agent developer, and many agent developers are not security engineers.
What This Means for Adoption
The threat research from Zscaler is likely premature for the current market — most agents in production today do not control meaningful treasury balances. But the trajectory is clear. Base reported 169 million agentic payments, Cloudflare opened a waitlist for an AI-agent monetization gateway, and multiple chains are positioning themselves as settlement layers for machine-to-machine commerce. The volume of agent-controlled value is set to grow, and the number of adversarial actors studying these systems will grow with it.
The projects that survive will be the ones that treat instruction integrity as a first-class security concern rather than an afterthought. Spending limits and session keys are necessary but insufficient. The industry needs protocol-level guarantees that a payment instruction originates from a trusted source before it reaches a signing key. Until those guarantees exist, every agent with a wallet is a target waiting for the right prompt.
Sources
- Zscaler researchers identify prompt injection attacks targeting AI agents for crypto payments — Crypto Briefing
- Base surpasses $4B in TVL, $12B in assets, and 169M onchain payments — Crypto Briefing
- Cloudflare unveils stablecoin solution for AI agent payments — Ledger Insights
- Sui Processes Over 6 Million Transactions Per Second as AI Agents Drive Public Throughput Experiment — TipRanks