We hid 98 traps for a Claude agent with a wallet. Orders aimed at the model moved nothing; payments that looked like the job did. A short guard cut most.
Not the ones that shout at the model. We hid 98 traps for a Claude agent that could read pages and files and pay over x402, inside the material its task pointed to. Eight of the thirteen kinds of trap, from text addressed to the AI to claimed authority and hidden characters, moved no money from Sonnet or Haiku even with no guard at all. What did move money was a payment that looked like part of the job: a licence step in a setup file, a sandbox charge said to be refunded, an extra item in a list the user had handed over. Without any guard, Sonnet reached for the wallet in 10 of 294 trap runs, Haiku in 29. With our guard in place, Sonnet did so in none of them and Haiku in 5.
Read the full report on AISkills402: https://aiskills402.com/blog/prompt-injection-agent-pays
Top comments (0)