Case · DiggingBeagle record
Token metadata prompt injection reached an on-chain agent's signer in a staged drain
Blockaid reported malicious instructions embedded in token metadata and a separate staged demonstration where a planted token description induced an on-chain agent to grant an unlimited approval that its signer executed. The staged result is not evidence of a production drain from this exact vector.
Timeline
- Sep 14, 2026Event type unspecified
Staged exchange-agent drain
Blockaid describes a researcher-controlled demonstration in which a planted token description induced an unlimited approval that the agent signer executed.
- Sep 14, 2026occurrence
Occurrence began
- Sep 29, 2026Event type unspecified
Blockaid publishes token-metadata prompt-injection research
The disclosure separates observed malicious metadata from the staged unlimited-approval demonstration.
- Sep 29, 2026disclosure
Public disclosure
Claims & evidence
CLAIM-STAGED-UNLIMITED-APPROVALIn the staged September 14 exchange-agent demonstration described by Blockaid, a planted token description was interpreted as an instruction to grant an unlimited approval, and the agent's signer executed it.supported
Basis: reported finding
- supportsPrompt Injection via Tokens: The Dark Side of Agentic Commerceprimary disclosure
Section 'Staged Drain - Exchange Agent (Demo, September 14)'
CLAIM-MALICIOUS-METADATA-OBSERVEDBlockaid reported observing malicious prompt-like instructions embedded in live token metadata fields such as names, symbols and descriptions.supported
Basis: reported finding
- supportsPrompt Injection via Tokens: The Dark Side of Agentic Commerceprimary disclosure
Opening section describing prompt injections embedded in token names, symbols and descriptions
CLAIM-NO-PRODUCTION-METADATA-DRAIN-SHOWNThe Blockaid disclosure labels the unlimited-approval path as a staged demonstration and does not establish a production victim loss caused by that exact token-metadata vector.supported
Basis: inference
- supportsPrompt Injection via Tokens: The Dark Side of Agentic Commerceprimary disclosure
Section 'Staged Drain - Exchange Agent (Demo, September 14)'
Sources and citation
Material revision history
- Oct 5, 2026 · Published version · first publication · revision 66
Cite this record
DiggingBeagle. “Token metadata prompt injection reached an on-chain agent's signer in a staged drain.” Published by DiggingBeagle Oct 5, 2026 · Public disclosure Sep 29, 2026 · Occurrence began Sep 14, 2026. https://diggingbeagle.com/cases/token-metadata-prompt-injection-reached-an-onchain-agent-signer/