SlowMist and Bitget’s security team have released a joint report examining how AI agents are introducing new risks into Web3 trading workflows. The report says these systems are no longer limited to market analysis or strategy support. Many can now connect to trading APIs, access on-chain data, manage accounts, and execute automated actions, which means security failures can translate directly into asset losses.
Prompt injection can alter decisions and execution paths
One of the report’s main warnings centers on prompt injection. Attackers may embed malicious instructions in chat prompts, web pages, README files, Markdown documents, or code comments, then rely on the model’s trust in context to steer agent behavior. The report also points to attacks on task orchestration: instead of exploiting a software bug, an attacker can tamper with how an agent breaks down a legitimate task, causing address substitution, parameter changes, or even wallet plugin calls during automated deployments or on-chain transactions.
Malicious skills turn plugin ecosystems into supply-chain targets
SlowMist said its monitoring of OpenClaw’s official plugin center, ClawHub, found signs of organized abuse. After aggregating IOCs from more than 400 malicious skills, the firm observed that many samples were tied to a small set of domains or multiple random paths under the same IP, suggesting batch-style operations. In this model, SKILL.md can become an execution entry point rather than a harmless instruction file. The report describes cases where attackers disguised commands as dependency-install steps, hid payloads with curl | bash or Base64 encoding, and used two-stage loaders to fetch remote scripts that later collected local files and uploaded them to attacker-controlled servers.
Local development environments can expose sensitive credentials
The report also highlights IDE, CLI, and local development environments as a major risk zone. These systems often contain .env files, API tokens, cloud credentials, and private keys. If an agent scans project directories during debugging, logging, dependency installation, or repository indexing, that data may be pulled into model context, written into logs, sent to remote model APIs, or exfiltrated by a malicious plugin. In Web3 development, this becomes more serious because test keys, RPC tokens, and deployment scripts are often stored locally.
API keys remain the most critical control point
For trading use cases, Bitget frames API keys as the effective permission boundary for an AI agent. An attacker may not need full account access. If the key is exposed, the agent can be abused to place orders around the clock, and losses may happen entirely inside the platform without any withdrawal taking place. The report lists common user mistakes such as pasting a main-account key directly into an agent configuration, granting unnecessary permissions, reusing passphrases, storing keys in code repositories, and failing to revoke leaked credentials quickly.
Bitget recommends strict isolation for accounts and funds
On the defensive side, Bitget recommends enabling Google Authenticator, Passkey, anti-phishing codes, and regular device checks. API permissions should follow a least-privilege model, and keys should not be hardcoded into source code. The report advises rotating API keys every 90 days and deleting them as soon as an agent is retired. It also recommends dedicated sub-accounts for each agent or strategy, with only the funds needed for that workflow transferred in. Fund passwords and withdrawal whitelists are presented as another layer that can cap losses if an API key is abused.
On-chain actions are irreversible, so signing should stay separate
The report stresses that blockchain transfers, token swaps, liquidity actions, and smart contract calls are usually irreversible once signed and broadcast. That makes model hallucinations, poisoned context, and plugin abuse much more dangerous in Web3 than in ordinary software settings. SlowMist and Bitget say a safer design is to let the agent generate trade suggestions or unsigned transaction data, while the actual signing step is handled by a separate wallet or manual confirmation. The report also points to address reputation checks, AML controls, and transaction simulation as additional safeguards.
To reduce systemic risk, the report outlines a layered security governance model covering development baselines, permission constraints, external resource screening, on-chain risk analysis, independent signing, continuous inspection, and log auditing. The message is straightforward: as AI agents gain more execution power in Web3, the attack surface expands with them.