A significant security incident involving Grok Bot has highlighted critical vulnerabilities in AI-powered financial transactions. On May 4, a sophisticated attack exploited the combination of Grok and Bankrbot, a crypto agent, to transfer an estimated $150,000 to $200,000 through a Morse code message. The attacker first sent a digital membership token that unlocked Bankr's payment tools, which Grok then decoded and treated as a payment order. This incident demonstrates how AI agents can move money at machine speed while companies struggle to prove authorization for each payment, potentially creating significant liability challenges for users and developers.
The scale of AI agentic payments has grown substantially, with Keyrock reporting 176 million on-chain agent payments worth $73 million through April 2026. The median payment sits between $0.01 and $0.10, while 76% fall below $0.30. However, small payments become a significant control problem when software can make them continuously. The pattern is moving into mainstream payment infrastructure, with Mastercard launching Agent Pay for Machines in June for high-frequency, low-value payments, while Google and Visa are developing standards for agents to prove identity and authority.
Industry leaders are clear about liability allocation in AI-powered financial transactions. Rodrigo Coelho, CEO of Edge & Node, stated that responsibility lies with the company that deployed the agent, emphasizing there is no version where responsibility lands on the AI model itself. California's AB 316 law, effective since January, prevents defendants from arguing that AI systems autonomously caused harm, focusing instead on causation and foreseeability. The consensus among experts is that agents should not hold private keys, with separate systems deciding payment permissions, and that controls must be placed where agents cannot reach them.
Despite the security risks, Elon Musk has backed a bold promise for Grok Bot to reimburse users if the AI loses money while managing their bank accounts. According to reports from Teslaconomics, a Tesla and xAI investor, Musk guaranteed reimbursement should the Grok bot make mistakes during financial management. However, xAI's consumer terms reveal a $100 liability cap that may be insufficient to cover potential losses, particularly given the scale of recent exploits. The incident involving Grok and Bankrbot demonstrates how AI agents can be manipulated through sophisticated attacks, potentially testing Musk's public commitments against the current liability framework.
Recent security assessments reveal significant vulnerabilities in AI agent infrastructure. Snyk scanned 3,984 public agent skills in February and found at least one security issue in 36.82%. The company confirmed 76 malicious payloads involving credential theft, backdoors, or data exfiltration. Industry experts warn that prompt injection remains the dominant pattern, with agents taking instructions from untrusted content and executing them as though the principal had requested. The solution requires defensible audit trails with agent identity, signed mandates, policy versions, transaction records, and approved exceptions, with controls placed where agents cannot reach them.
