Freysa agent persuaded to transfer its entire $47,000 prize pool

Freysa was an adversarial agent game: participants paid escalating fees to send a single message to an autonomous agent guarding a crypto prize pool, whose system prompt forbade transferring funds. On the 482nd attempt, user p0pular.eth sent a message redefining the agent's tools — asserting that approveTransfer was for incoming transfers and announcing a $100 contribution to the treasury.

The agent accepted the reframing and called approveTransfer, sending its whole 13.19 ETH balance (~$47,000) to the participant. The transfer was irreversible. The loss was the intended prize, but the mechanism — natural-language redefinition of an agent's own financial tools — is a real, reproducible failure mode.

The agent's tool semantics were defined in the prompt rather than enforced in code, so a persuasive redefinition of the tool's meaning was sufficient to invert its behaviour.

None: the contest concluded with the prize paid out as designed. The case is widely cited as evidence that financial authority must be enforced outside the model.