Autonomous AI trading agents Prompt Injection Vulnerability

Autonomous AI trading agents in 2026 were compromised by protocol-level vulnerabilities such as memory poisoning and indirect prompt injection, targeting their long-term memory and execution protocols like the Model Context Protocol (MCP). These flaws facilitated over $45 million in crypto security breaches, including a $40 million drain from Step Finance amplified by excessive agent permissions.

What Happened

Autonomous AI trading agents in 2026 were compromised by protocol-level vulnerabilities such as memory poisoning and indirect prompt injection, targeting their long-term memory and execution protocols like the Model Context Protocol (MCP). These flaws facilitated over $45 million in crypto security breaches, including a $40 million drain from Step Finance amplified by excessive agent permissions.

Why This Matters

Publisher reporting describes a security event affecting How. BugSkan could not yet bind a CVE or affected version, so treat the source details as the current record.

Recommended Action

Confirm whether How is present in your environment and review vendor guidance for this report. Apply available patches or mitigations if your deployment matches the described conditions.

Exposure

Exposure reason: This incident does not currently match a technology in My Interests.

Exploitation status: UNKNOWN

Primary entities:

Timeline

• Incident first seen
  Apr 02, 2026 05:30

  BugSkan first recorded this incident.

• AI Trading Agent Vulnerability 2026: How a $45M Crypto Security Breach Exposed Protocol Risks - KuCoin
  Apr 02, 2026 05:30

  kucoin.com · Vulnerability

Sources

Related Incidents

Other BugSkan incidents that share identifiers, products, or vendors with this report.

My Interests Match