The tool did what it was told. The words had been redefined.
There is no injected file in this one. No poisoned dependency, no compromised config, no encoding trick. Someone typed a message into a box that was designed to accept messages, and the agent gave away the pool it had been built to defend. It is the cleanest demonstration available that the vulnerability is not a channel you can close.
What happened
Freysa is an adversarial-agent game. The agent holds a prize pool and is instructed never to release it. Anyone can pay a fee to send it a message; the fee grows with each attempt and feeds the pool.
Hundreds of participants try direct persuasion, roleplay, threats, and appeals. The agent refuses every one. The system prompt holds.
Attempt 482 opens by declaring a new session and an administrative terminal — framing the conversation as internal maintenance rather than a player message.
The message then restates what the agent's own tools mean: that approveTransfer is the function to call for incoming donations, and rejectTransfer is for outgoing ones. It is the exact inversion of the truth.
The player announces they would like to contribute to the pool. Following the redefinition it had just accepted, the agent called approveTransfer — and released 13.19 ETH, roughly $47,000, to the player.
The winning move was not a jailbreak of the refusal. It was an attack on the meaning of the action. The agent never decided to release the prize — as far as it understood the conversation, it was accepting a donation. Its constraint stayed intact and became irrelevant, because the word attached to the payout had been quietly swapped.
Why this one matters more than it looks
It is tempting to file this as a game with a prize, and Freysa was exactly that — a paid contest where the pool existed to be attacked. But strip away the framing and the mechanism is the one that recurs everywhere agents hold value: the agent’s belief about what its own tool call means was supplied by the same untrusted text that requested the call.
That is not a filterable pattern. There is no keyword to block, no encoding to normalise, no zero-width character to strip. The message was polite, plausible English making a claim about system semantics. Any defence that works by recognising malicious wording loses this case by construction, because nothing in the wording is malicious.
Compare it with Grok and Bankr. There, the failure was architectural — a permission chain that let a social-media mention move money. Here there was no architectural flaw to speak of: a message box, an agent, a tool. The two incidents come at the same conclusion from opposite directions. Fix the architecture and persuasion still works. Improve the model and the architecture still leaks. The only place both stop is at the moment of payment.
Which control refuses this
A content scanner reads that message and finds nothing. It should find nothing — it is a well-formed sentence about donations. This is the case that defines the limit of the entire content layer, and pretending otherwise would be dishonest.
What does not care about the wording is a comparison against an independently-issued quote. The agent believed it was accepting an incoming donation; the transaction it actually authorised was an outgoing transfer of 13.19 ETH to the person it was talking to. Those two things disagree, and they disagree in a way that requires no understanding of the conversation to detect — the direction and the recipient are in the bytes. A guard comparing the payment against what was quoted has nothing to compare against, and refuses.
The persuasion succeeded completely. The agent was fully convinced, and stayed convinced. That is the point worth internalising: you do not get to win the argument with the model. You get to make the argument not matter.
What this would not have stopped
Freysa’s payout was the product’s own function, called deliberately by its own logic. In a system where releasing funds on instruction isthe intended behaviour, a payment guard has no quote to check against and can only refuse — which for a game whose entire premise is “convince the agent to pay” would mean refusing the product. That is a real limitation, not a footnote.
The transferable lesson is narrower and applies wherever payments are supposed to be predetermined: if an agent is moving money, something other than the conversation should have already stated who gets paid and how much. When the only record of intent is text the agent read, there is nothing left to verify against.
Sourcing
The full message log for attempt 482 was published by the operators and is widely reproduced; the payout transaction is on Base. Figures are reported consistently at 13.19 ETH, valued at roughly $47,000 at the time. The participant went by p0pular.eth. Accounts of the total attempt count vary slightly around 480–482 depending on whether failed and refunded submissions are included.