A vulnerability report reveals a prompt injection flaw in Coinbase AgentKit that allows attackers to execute unauthorized token transfers through malicious inputs. The security breach was tested on Base Sepolia and could enable infinite ERC-20 approvals and server access. Reported in February, Coinbase classified it as medium severity and offered a $2,000 bounty. The researcher asserts the impact is significantly greater than acknowledged.

ChainCatcher report, according to CriptoNoticias, an independent security researcher has disclosed a prompt injection vulnerability in Coinbase AgentKit, allowing attackers to manipulate malicious commands to induce the AI agent to execute unauthorized token transfers without human confirmation.The vulnerability has been verified through actual transactions on the Base Sepolia testnet. Additionally, the researcher noted that the flaw exposes an infinite approval process for ERC-20 tokens and grants access to remote servers within the same execution context of the agent, extending the risk beyond mere wallet draining—though the report does not specify which particular infrastructure may be affected.The vulnerability was submitted to Coinbase’s bug bounty program in February and was officially validated, ultimately classified as medium severity with a $2,000 reward. However, the researcher emphasized that the real-world impact far exceeds the official severity rating.