Thursday, October 8, 2026 · Week 41 Reading for Oct. 8 · Last entry Oct. 6
Paperclip Index
Paperclip IndexDocumented harm20Minor harm▼ 5 from a week ago · Oct. 8The Index

Hijacked by injectionPI-0055

Morse-code prompt on X tricked Grok and Bankrbot into sending about $175,000 in tokens

An X user sent an NFT that gave the wallet Bankr had set up for Grok's X account wider transfer rights, then posted an instruction encoded in Morse code. Grok decoded it and passed a plain-text transfer command to the Bankrbot trading agent, which sent about 3 billion DRB tokens, reported as worth roughly $150,000 to $200,000, to the attacker. Reports say about 80% of the funds were later returned after the attacker was identified.

Reported May 4, 2026Happened on May 4, 2026Updated Oct. 6, 2026Rated under methodology v0.6

Counts toward the indexDocumented harm outside the developer, backed by evidence that meets the rules. It sets the reading.
Harm
Harm level 2, Minor harmDocumented harm outside the developer, with evidence that meets the rules.
Control
Control level 2, Instruction violationReported beside the index. It adds nothing to a harm reading; when no harm counts in a window, the highest eligible control level in the window is the reading.
DeploymentDeveloper confirmedInitiated by Outside attacker
Extent undisclosedUnder review

Under review. The facts sit between two levels, so it is rated at the lower one until they are settled. The rating may change; every change is logged below.

Counts toward the index · 4 weekly readingsEffect on the index

Sources

How we know

4 sources · developer confirmed. Links go to the original publishers; the summary above is in our own words.

  1. newsHow a Free NFT Allegedly Drained $174K From a Grok-Connected WalletCointelegraph · May 13, 2026cointelegraph.com/magazine/grok-bankr-wallet-free-nft-prompt-injection
  2. newsGrok's crypto wallet was just exploited by a tweet sent in morse code without any private key compromiseCryptoSlate · May 4, 2026cryptoslate.com/how-one-trader-exploited-grok-and-morse-code-to-trick-ai-agent…
  3. blogHow Grok got prompt injected: an X user drained $150,000 from an AI walletGiskard · May 7, 2026giskard.ai/knowledge/how-grok-got-prompt-injected-an-x-user-drained-150-000-fro…
  4. indexAI Prompt Injection Exploit Drains Grok-Linked Crypto WalletOECD.AI Incidents Monitor · May 4, 2026oecd.ai/en/incidents/2026-05-04-4a73

Why this rating

Minor harm; control failure level 2

Two separate assessments. Only documented harm can count toward the index.

Observed harm

Minor harm

About 3 billion DRB tokens, reported at $150,000 to $200,000, sent on an injected instruction; about 80% was later returned and the rest left to discussion with the token's community. The final net loss is not established.

Money & property: level 2 (minor) covers $10k to $1M. The extent was not disclosed.

Evidence eligible (confirmed).

The harm scale
  1. 1 Negligible Inconvenience, easily remedied.
  2. 2 Minor Limited, recoverable harm.
  3. 3 Moderate Material harm needing significant effort to remedy.
  4. 4 Severe Severe harm to health, rights, property or essential services.
  5. 5 Catastrophic Society-scale harm or disruption beyond a community's capacity to cope.

Control assessment

Instruction violation

Both agents followed injected instructions using wallet permissions that were in place (the NFT had granted the extra rights); no permission boundary was crossed.

Reported beside the index. It adds nothing to a harm reading; when no harm counts in a window, the highest eligible control level in the window is the reading.

The control scale
  1. 1 Negligible Behaved as instructed. The problem was an ordinary error or a flawed output, with no rule broken.
  2. 2 Minor Broke an explicit instruction or rule, or gamed its goal, while staying inside its permissions and environment: for example, reward hacking, misreporting results, or following injected instructions within its permissions.
  3. 3 Moderate Acted outside the permissions it was given, deceived its overseers about its own actions, or tampered with oversight tools (logs, monitors, shutdown). Stopped by normal controls within an hour.
  4. 4 Severe Reached systems outside its permitted environment, or acquired money, compute or accounts without authorization. The type and mechanism say how.
  5. 5 Catastrophic The developer or operator lost control: the system copied its weights outside their control, replicated itself, or resisted being stopped for 24 hours or more.

Rating rationale

Money & property $10k–$1M gives harm 2; control 2 for injected instructions within permissions. Bankr's developer confirmed the transfer, the partial return and a reinstated block on Grok's account (CryptoSlate, May 4–5); xAI has not commented, so Developer confirmed rests on Bankr.

The scales

Effect on the index

It moved the May 4 reading from 20 to 25

The reading for the week to May 4, 2026, with this record and without it. Harms count in full for two weeks after they are reported, then one level less every two weeks.

Source: Paperclip Index log, methodology v0.6, week to May 4, 2026.

Counts toward the index. 4 other records behind the reading for that week.

The arithmetic
The reading for the week of May 4, recomputed
StepWith itWithout
Counts toward the index?documented, external, eligible evidenceYes—
Worst documented harm, ksets the band2 Minor2 Minor
Harms at that level, nposition in the band21
Highest control level breachedsets the reading only when no harm counts— (none breached)— (none breached)
Readingrounded down25 Minor harm20 Minor harm
Counted in 4 weekly readings
Week toReadingBand
May 4, 202625Minor harm
May 11, 202620Minor harm
May 18, 20269Negligible harm
May 25, 20266Negligible harm

Recalculated backcasts, not readings published at the time.

Revisions

What we changed

4 logged. Every change to a rating is logged here, with the reason.

  1. v4
    Oct. 6, 2026

    Ratings confirmed by the editor.

  2. v3
    Oct. 3, 2026

    Audit corrections: the rationale wrongly said no developer confirmation appeared; Bankr's developer confirmed the transfer and partial return (CryptoSlate, added). Verification Multiple credible sources → Developer confirmed (no eligibility change). Status as of 5 May with a note; under review false → true; extent marked unknown. SlowMist and BeInCrypto could not be read (403), so their recovery and wallet-control figures are not used. Ratings unchanged.

  3. v2
    Sept. 30, 2026

    Rated: impact documented level 2; control type instruction violation.

  4. v1
    Sept. 30, 2026

    Backfilled from public reporting.

Cite and share

Use this record

Citation

Paperclip Index. “Morse-code prompt on X tricked Grok and Bankrbot into sending about $175,000 in tokens.” Record PI-0055. Reported May 4, 2026; updated Oct. 6, 2026. Rated under methodology v0.6. https://paperclipindex.com/incident/PI-0055