A Fake Solidity Extension Drained $500K — Then AI Coding Tools Became the Real Target

A Russian blockchain developer believed he'd taken every reasonable precaution: a freshly installed operating system, a minimal set of trusted applications, no pirated software, no suspicious email attachments. Every download passed through antivirus scanning before installation.

While building smart contracts, he wanted Solidity syntax highlighting in his editor. He searched the Cursor AI IDE marketplace and installed what appeared to be a well-established option: a listing with 54,000 downloads, a polished description, and a run of five-star reviews.

The extension calling itself "Solidity Language" had every surface marker of legitimacy. Roughly three weeks after installing it, $500,000 in cryptocurrency disappeared from his wallets.

There was no syntax highlighting, no Solidity tooling of any kind inside the package. The moment it was installed, it deployed remote access software that gave attackers control of the machine while the developer continued working, unaware his own tooling had opened the door for them. No sophisticated exploit chain was needed — just a convincing impersonation placed exactly where developers are least suspicious: the extension marketplace they rely on daily.

01A Campaign, Not an Incident

The theft from the Russian developer turned out to be one data point in a broader operation. The same fake Solidity extension was pulled from the marketplace on July 2nd. Within 24 hours, a replacement appeared — carrying identical malicious code and the same remote-access backdoor, but now published under the exact name of the extension it had displaced.

This second version reported close to two million downloads, a figure that was fabricated rather than earned: the count had been artificially inflated to push the malicious listing above the genuine one in search rankings. At the time, a search for "solidity" extensions returned the authentic version with 61,000 downloads at position 8, and the fraudulent one with 54,000 downloads at position 4 — placed higher despite fewer actual installs.

The operators also relied on visual typosquatting in publisher names — listing under "juanblanco" versus "juanbIanco", where a lowercase "l" and uppercase "I" render identically in the font Cursor uses. Beyond Solidity tooling, the same group pushed out additional malicious listings including "solaibot," "among-eth," and "blankebesxstnion," each bundled with wallet-draining malware and distributed across multiple marketplaces — evidence of an organized operation rather than a single opportunistic actor.

02When the Agent Deceives Itself

Separately from marketplace-based attacks, researchers at Princeton examined a different category of weakness — one built into the design of autonomous AI agents rather than into any single malicious package.

Their subject was ElizaOS, an autonomous trading agent framework developed by the AI16z team that operates continuously on market signals and social sentiment, collectively overseeing more than $25 million in assets.

The Princeton team set out to test whether ElizaOS could be manipulated into transferring cryptocurrency voluntarily — without touching a smart contract, purely through manipulation of the agent's own reasoning.

They began by seeding ordinary-looking Discord conversation — small talk about the day of the week, strings of emoji — and embedded within it fabricated conversation entries formatted to mimic ElizaOS's own logging conventions, including invented system-administrator instructions and JSON structures crafted to be invisible to a human reader but persistent in the agent's memory.

That thread was buried under later conversation and largely forgotten. Days afterward, when someone on Twitter casually asked ElizaOS to move some ETH, the planted memory activated, and the agent sent real Ether to the researchers' address, behaving as though it were simply carrying out instructions it had legitimately received earlier.

The result demonstrated that compromising an autonomous crypto agent doesn't require breaking any cryptographic or contract-level security — manipulating its stored memory is sufficient.

03Enterprise AI Tools Under the Same Flaw

The same category of weakness surfaced across enterprise software well beyond crypto. Microsoft's Copilot deployment was affected by a vulnerability researchers named "EchoLeak," which enabled zero-click access to data organizations assumed was private — chat history, OneDrive files, SharePoint documents, Teams messages, draft emails, internal memos, client records, and financial data. As described by researchers, the exposure required no phishing link, no downloaded file, and no action from the victim — simply existing in a workspace alongside poisoned content was enough to trigger it. A user requesting a routine document summary could unknowingly cause Copilot to exfiltrate sensitive material to servers controlled by attackers, all while appearing to perform a normal task. Microsoft issued a patch, but by then any exposure had already occurred.

Microsoft was not alone. Google's Gemini was shown to insert fake security warnings into email summaries, including phishing phone numbers hidden in white-on-white text. Lenovo's customer-support chatbot could be hijacked into a session-takeover state via a prompt injection just 400 characters long. GitHub Copilot could be manipulated into producing malicious code that passed as legitimate under human review. And browser extensions with only basic DOM access were found capable of quietly altering page content and inserting hidden instructions into a user's chatbot sessions — with users unaware that an extension installed months earlier, offering seemingly unrelated features, was interfering with their AI conversations.

What unites these cases is a shared design flaw: a wide range of AI-driven developer and productivity tools — autocomplete assistants, document summarizers, chatbots — treat instructions embedded in retrieved content as trustworthy input, with no reliable way to distinguish a legitimate command from an injected one. Because these systems are built to be cooperative and responsive, that cooperativeness itself becomes the exploitable surface.

04State Actors and the Supply Chain

Government-linked hacking groups adopted the same playbook. State-sponsored actors tied to Russia, Iran, and North Korea moved toward fake CAPTCHA pages — the so-called ClickFix technique — that instruct visitors to press Windows+R and paste a clipboard payload under the guise of a routine "verify you're human" step, achieving remote code execution without a single suspicious download. Adoption of ClickFix grew steadily among these groups, offering a cheaper route to compromise than developing new zero-day exploits.

A parallel and more strategic line of attack targeted the software supply chain itself rather than individual users. Invisible characters were found embedded in code repositories, intended to corrupt the output of AI coding assistants that process that code, alongside commit messages worded to disguise backdoors as routine performance fixes. Malicious instructions hidden inside configuration files were similarly designed to steer AI-generated code output and slip past security review.

The strategic logic goes beyond compromising currently deployed software: any poisoned commit, backdoored pull request, or hidden character sequence left in public repositories or documentation risks being absorbed into the training data of future coding models, producing AI suggestions that carry embedded exploits by default. Corrupting the training pipeline itself would mean the compromise persists across future tool generations, not just the current one.

05Defenses Built, Then Bypassed

Efforts to counter these techniques have so far struggled to keep pace. Microsoft introduced prompt-injection classifiers intended to flag malicious instructions before Copilot could act on them. Researchers at AIM Security subsequently found phrasings that evaded these XPIA classifiers while still triggering data exfiltration once processed.

On the academic side, one proposed defense called "spotlighting" interleaves control tokens through retrieved content, instructing the model to disregard any instructions found inside those marked sections. When tested against adaptive attacks specifically designed to route around known defenses, spotlighting's effectiveness dropped sharply. A recurring pattern has emerged: new defenses are typically bypassed within weeks by prompts crafted to appear benign to a filtering model while still carrying a harmful instruction for the target model to act on. Separately, research into character injection and adversarial evasion methods found they could cut detection rates by as much as 100% across several attack categories.

Princeton's CrAIBench benchmark has become a reference point for evaluating memory-injection defenses across a wide range of test scenarios. Its findings were stark: AI models were shown to be considerably more susceptible to memory injection than to conventional prompt injection, with leading defenses failing more than 55% of the time against these persistent, cross-session attacks. The one approach that showed meaningful resilience was retraining entire model architectures to recognize and refuse malicious content even when it is disguised as previously trusted memory — an approach that is costly to repeat every time attackers devise a new evasion method.

06The Underlying Problem

Years were spent hardening smart contracts against every known exploit class, while the tooling developers use to write that code — a counterfeit Solidity extension among them — turned out to be the weaker link. Much of the current Web3 development stack runs on tools that have no reliable way to distinguish a legitimate instruction from a malicious one embedded in surrounding content.

Each gain in AI-assisted development speed has been matched by a corresponding gain in attack surface. The trust that underpins open-source tooling and AI-assisted coding is the same trust that these campaigns have learned to exploit. It remains an open question how much production infrastructure is already running on code suggested by a compromised model, and who is accountable for losses that trace back to a tool rather than a person.

The vulnerability being probed was never limited to reentrancy bugs or consensus-layer flaws — it sat inside the everyday productivity tools developers use, largely unexamined. Systems were trained to generate code fluently, but not reliably taught to recognize when a request should be refused.