19
AI agents, some managing millions of dollars in crypto, are vulnerable to a new undetectable attack that manipulates their memories, enabling unauthorized transfers to malicious actors. That’s according to a recent study by researchers from Princeton University and the Sentient Foundation, which claims to have found vulnerabilities in crypto-focused AI agents, such as those using the popular ElizaOS framework.
ElizaOS’ popularity made it a perfect choice for the study, according to Princeton graduate student Atharv Patlan, who co-authored the paper. “ElizaOS is a popular Web3-based agent with around 15,000 stars on GitHub, so it’s widely used,” Patlan told Decrypt. “The fact that such a widely used agent has vulnerabilities made us want to explore it further.” AI agents, some managing millions of dollars in crypto, are vulnerable to a new undetectable attack that manipulates their memories, enabling unauthorized transfers to malicious actors.
That’s according to a recent study by researchers from Princeton University and the Sentient Foundation, which claims to have found vulnerabilities in crypto-focused AI agents, such as those using the popular ElizaOS framework. ElizaOS’ popularity made it a perfect choice for the study, according to Princeton graduate student Atharv Patlan, who co-authored the paper. “ElizaOS is a popular Web3-based agent with around 15,000 stars on GitHub, so it’s widely used,” Patlan told Decrypt. “The fact that such a widely used agent has vulnerabilities made us want to explore it further.”
Attackers can use fake accounts and coordinated posts, known as a Sybil attack, named after the story of Sybil, a young woman diagnosed with Dissociative Identity Disorder, to deceive agents into making trading decisions. Attackers can use fake accounts and coordinated posts, known as a Sybil attack, named after the story of Sybil, a young woman diagnosed with Dissociative Identity Disorder, to deceive agents into making trading decisions. Patlan said the study’s findings were shared with Eliza Labs, and discussions are ongoing.
After demonstrating a successful memory injection attack on ElizaOS, the team developed a formal benchmarking framework to evaluate whether similar vulnerabilities existed in other AI agents. Working with the Sentient Foundation, the Princeton researchers developed CrAIBench, a benchmark measuring AI agents’ resilience to context manipulation. The CrAIBench evaluates attack and defense strategies, focusing on security prompts, reasoning models, and alignment techniques.
Patlan said one key takeaway from the research is that defending against memory injection requires improvements at multiple levels. “Along with improving memory systems, we also need to improve the language models themselves to better distinguish between malicious content and what the user actually intends,” he said.
“The defenses will need to work both ways—strengthening memory access mechanisms and enhancing the models.” In response to Decrypt’s request for comment on the report, Eliza Labs Director Sebastian Quinn emphasized the pace of ongoing development and the importance of evaluating the most current iteration of the platform.
“The research report reflects an early snapshot of a platform that evolves by the hour,” Quinn said in an email. “We happily acknowledge that many people around the world are updating and improving our platform hourly, and we’re glad that our platform has continued to increase its robustness, dependability, usage, daily active users, and commits without incident.”
Addressing the report’s broader context, Quinn highlighted the value of transparency and Eliza Labs’ unique position within the industry. “It’s also crucial to note that the reason Princeton is able to do research on our AI tech at all, versus our peers, is that we are one of the only open-source AI tech companies in the market for web3,” he said. “Other closed-source projects don’t even give their tech the chance to be critiqued and reviewed by peers, so we see the criticism as an achievement and testament to how robust our tech is.”
In response to whether the research led to specific changes, Quinn said no direct updates were made as a result, explaining that ElizaOS is updated continuously by its open-source community, often faster than external research can keep pace. “Some of the auth problems that exist with empowering agents to do things with passwords, we are proud to say we have been the first in the market to solve these problems in web3,” he said. “We will continue to innovate as a community to ensure ElizaOS is the backbone of the Web3 AI industry.”
