AI Agents Lost $600K+ to Prompt Injection — Attack Taxonomy & Code-Level Defenses

The Problem AI agents are spending real money. When they get prompt-injected, it's not just data leakage — it's direct financial loss. Here are documented incidents: Attack Loss Vector Freysa AI $47K Function redefinition AIXBT $106K Control plane compromise Lobstar Wilde $441K State amnesia EchoLeak CVSS 9.3 Zero-click document poisoning MCPTox 72.8% success MCP tool poisoning The Pattern Every attack follows the same structure: the agent cannot distinguish trusted instructions from injected ones. The attacker doesn't break the code — they break the agent's judgment. And since the agent holds payment credentials, broken judgment means broken wallets. Why Prompts Can't Fix This Telling an LLM "don't send money to attackers" is like telling a human "don't get phished." The whole point of injection is that the agent doesn't know it's being attacked. The fix has to be at the code level — deterministic policy engines that run outside the LLM context: // This code runs BEFORE any payment ex