How a String of Morse Code Tricked an AI Into Wiring Real Money

Key points

• Attackers used Morse code hidden in a message to manipulate an autonomous AI agent into authorising a financial transfer without any human approval.
• No malware was used. Standard security tools ignored the attack because the Morse code looked like harmless text.
• The attack exploited a flaw researchers are calling "authority laundering", where untrusted outside instructions get dressed up as trusted internal commands by passing through an AI system.
• Businesses are deploying AI agents, software that can take actions on its own, inside financial and procurement workflows where this same flaw applies.
• AI-generated instructions should never automatically inherit the same trust level as commands from a verified human or system.

No password was stolen. No virus was planted. From the computer's point of view, everything looked fine.

Attackers recently hijacked an autonomous AI agent, a piece of software that makes decisions and carries out tasks without waiting for a human to press a button, and used it to move money. The weapon was a string of Morse code dots and dashes.

Here is what happened. Criminals deposited a digital token, a kind of software credential, into a crypto wallet the AI was watching. The AI interpreted owning that token as proof it had permission to make transactions. Permissions unlocked.

They then sent a message written in Morse code. Traditional security software ignored it entirely; it looked like meaningless text, not a virus. But the AI treated it as a puzzle to solve. It decoded the dots and dashes, read the resulting instruction, and passed it to a second AI system responsible for moving funds. That second system saw a message from a trusted internal source and acted without hesitation.

The money moved.

Why should ordinary people care about this?

The same kind of AI agent involved in this incident is already being deployed inside companies that handle your insurance claims, your bank transfers and your medical referrals. This was a cryptocurrency exploit, but the underlying trick works anywhere an AI sits between the outside world and a system with real authority.

The weakness has a name: authority laundering. A hostile instruction sneaks in from outside, an AI processes it, and the receiving system sees a clean internal command rather than something suspicious. The AI becomes, without knowing it, an accomplice.

The attack was first covered in analysis published by Dark Reading. Researchers stress that the AI didn't malfunction. It did exactly what it was designed to do. That's the problem. A system that faithfully follows any instruction it receives is dangerous the moment someone feeds it a malicious one. We reported on a structurally similar case on 8 July, when a crafted note in a GitHub bug report fooled an AI assistant into leaking private code; the authority laundering label fits both incidents.

For businesses, the practical lesson is uncomfortable. Many organisations are building workflows where AI systems both read incoming requests and act on them, with no independent checkpoint between the two steps. That removes the human review that would normally catch something odd.

Check whether AI tools at your organisation can approve payments or change system settings without a human sign-off. If they can, that's the exposure worth fixing first.

Customers can't fix this themselves. But they can ask companies whether human approval is still required before any AI takes a consequential action on their behalf.

Should you worry?

The dollar amount stolen here wasn't the point. What matters is the category: an attack that requires no malware, no stolen credentials, and no insider access. Our coverage of AI governance and rogue agent risk this month keeps circling the same gap: the rules haven't caught up to what these systems can already do. Watch for the first enterprise-scale incident. This proof of concept suggests it's closer than most security teams think.