This article provides a comprehensive analysis of how AI agents are reshaping on-chain security, starting with the Grok/Bankr incident that exposed trust vulnerabilities between automated systems. It details eight major attack surfaces including prompt injection, blind signing, memory poisoning, privilege escalation, autonomous authorization risks, supply chain attacks, x402 payment layer attacks, and AI-powered social engineering. The report surveys existing defensive solutions from Cobo, Fystack, Thirdweb, Coinbase/OKX/Binance, GoPlus/SlowMist, and KYA/ERC-8004, and proposes six security principles. It argues that security will be the most deterministic industrial opportunity in the agent economy, determining whether AI can truly enter the financial execution layer.

本文由外捕研究与慢雾科技联合出品，系统梳理 AI Agent 进入 Web3 后带来的链上安全范式转变。通过分析 Grok/Bankr 事件、PocketOS 数据库删除、LiteLLM 供应链攻击等真实案例，揭示提示词注入、盲签、记忆污染、权限穿透、供应链攻击及 x402 支付攻击六大新型攻击面。同时介绍 Cobo、Fystack、Thirdweb、Coinbase、GoPlus、SlowMist 等防御方案，并提炼六条安全设计原则，强调安全将成为 Agent 经济最确定的基础设施。

A joint research report by Web3Caff Research and SlowMist, analyzing the new on-chain security challenges as AI Agents enter Web3. Using real cases including Bankr/Grok Morse code attack, PocketOS database deletion, LiteLLM supply chain poisoning, and Vercel/Context.ai breach, the article reveals attack surfaces expanding from private key theft to a five-layer composite risk targeting model goals, memory, toolchains, wallet authorization, and payment paths. It categorizes defense solutions from Cobo, Fystack, Thirdweb, Coinbase, OKX, Binance, GoPlus, and SlowMist, and proposes six design principles—intent-execution separation, isolation, verifiable UI, toolchain governance, payment boundaries, and rapid incident response—to help projects build security infrastructure for the Agent era.