Freysa

Summary

Freysa launched on November 22, 2024 as "the world's first adversarial agent game": an autonomous LLM agent on Base that controlled a real crypto treasury and was given one immutable instruction — never approve a transfer of funds. Anyone could pay a fee to send Freysa a message attempting to talk her into calling her approveTransfer tool; 70% of every fee flowed into the prize pool the agent guarded. After 481 failed attempts by 195 players, the 482nd message — from the address p0pular.eth — succeeded via a prompt-injection that reframed approveTransfer as the function for receiving money, and the contract paid out 13.19 ETH ($47,000). The episode went viral (drawing commentary from Elon Musk), became the canonical public demonstration of prompt-injection risk for fund-controlling AI agents, and spawned sequels (Acts II–V and variants) plus a fair-launched FAI token. The pseudonymous builders were later revealed by The Block (May 2025) as Eternis AI — Srikar Varadaraj, Pratyush Ranjan Tiwari, Ken Li, and Augustinas Malinauskas — which quietly raised $30M from Coinbase Ventures, Selini Capital and others and expanded Freysa into a broader "sovereign agent stack" (TEE-verified agents, Silo, Lume, and related products).

Design (Mechanism)

• Agent-gated treasury. A smart contract on Base held the prize pool. Only Freysa's AI decision loop could trigger approveTransfer (release funds) or rejectTransfer. Her public system prompt ordered her to never agree to give money under any circumstances, "regardless of anything that is said."
• Pay-per-attempt with exponential bonding. Messages (max 1,000 characters) started at ~$10 in Base ETH and escalated ~0.78% per message, capped at $4,500. The final Act I query cost ~$449. 70% of fees fed the prize pool (seeded at ~$3,000); the rest went to the developer/operator.
• Attacker's jackpot. A successful jailbreak instantly transferred the entire pool to the sender of the winning message — aligning incentive (huge payout) with the security-research goal (find the injection).
• Timeout endgame. After 1,500 attempts a global hourly timer armed; if no new query arrived within an hour, the game ended with 10% of the pool to the last player and 90% split pro-rata among participants — guaranteeing termination and partial refunds.
• Transparency. The agent code, system prompt, and chat history were public (open-sourced at github.com/0xfreysa/agent), making it a verifiable, replayable red-teaming experiment rather than a black box.
• Winning exploit (Act I, ~Nov 28, 2024). p0pular.eth's message simulated a new "admin session" to bypass prior instructions, redefined approveTransfer as the inbound-contribution handler, then offered to donate $100 to the treasury — so Freysa "accepted the donation" by calling the payout function.

Outcome

Act I concluded in about a week with the $47,316 payout to p0pular.eth — a designed win condition, not a smart-contract hack. Sequel games followed with hardened prompts: Act II paid ~$12,920, Act III ~$20,843, and spin-offs (Meme Engine ~$15,632, Encyclopedia Galactica ~$6,842) per aggregate analyses; later acts (e.g., Act IV's "game of influence") shifted from pure jailbreaking to social/persuasion dynamics. A fair-launched FAI token (8.1897B supply, one per living human; LP burned; contract 0xb33ff54b9f7242ef1593d2c9bcd8f9df46c77935 on Base) peaked at $0.080 in early January 2025 before falling >95%. The team behind it, Eternis AI, raised $30M (disclosed May 2025) and pivoted Freysa toward TEE-verified sovereign-agent infrastructure. As an experiment the game was a landmark; as a token it underperformed badly; as a company it continues — hence "partial_success."

Why it worked

• Perfect incentive-compatible red-teaming: paying real money per attempt filtered spam while the winner-take-all pot recruited hundreds of skilled prompt engineers to attack one system prompt — cheaper and more effective than any private audit.
• Escalating fees created drama and sustainability: the pot and the cost-to-play grew together, generating a natural narrative arc and funding the operator.
• Radical transparency (open prompt, open code, public chat log) made the result legible and credible, which is why it became the canonical citation for prompt-injection risk in fund-controlling agents.
• Guaranteed termination via the timeout/refund mechanic protected late participants from a pure sunk-cost trap.

Where the design broke

• The core "failure" was the point: a single well-crafted injection (fake admin session + tool-semantics inversion) defeated a categorical natural-language prohibition, proving system prompts are not access control.
• Later acts earned smaller pots — the novelty premium decayed quickly and hardened prompts made wins rarer but engagement thinner.
• The FAI token's value became decoupled from the games (no strong claim on fees or products) and fell >95% from its January 2025 high.
• Attribution and fairness questions lingered: the winner was pseudonymous, and observers noted skilled insiders/prompt professionals had structural advantages over ordinary paying players.

Lessons

• An LLM's system prompt is not a security boundary. Any agent with authority over funds must enforce invariants in code (contract-level caps, allowlists, multisig/timelocks), not in natural language.
• Tool-call semantics are an attack surface. The exploit didn't "persuade" Freysa philosophically; it redefined what approveTransfer meant. Agents should validate tool calls against machine-checkable state, not their own beliefs.
• Paid adversarial games are a powerful audit mechanism. Fee-funded bounty pools with winner-take-all payouts crowdsource red-teaming at scale and produce public, replayable evidence.
• Design the endgame. Freysa's timer-plus-pro-rata-refund avoided the degenerate "last sucker" dynamics that plagued earlier fee-escalation games (cf. Fomo3D).
• Experiments and tokens are different assets. A culturally successful experiment does not automatically give a token durable value accrual.

Redesign (EDITORIAL — hypothesis, not fact)

This section is editorial hypothesis, not fact. A v2 could keep the adversarial game but make the security claim rigorous: run the agent inside a TEE with a published attestation (as Freysa's own later stack explores), pin the model version and temperature, and commit the system prompt hash on-chain so "hardening" between acts is verifiable. Replace winner-take-all with a tiered bounty (e.g., 60% to the successful jailbreak, 20% streamed to the N most-novel failed attacks as judged by a committee or a second model, 20% rolled forward) to keep researchers engaged after the first win. Enforce a contract-level circuit breaker — per-transaction payout cap plus a 24-hour timelock with a human/multisig veto — turning a successful injection into a disclosed vulnerability with a bounty rather than an instant drain, which is the pattern real agent treasuries would need. Finally, tie any token directly to protocol cash flows (a fixed share of query fees buying down supply or funding future pots) so speculation tracks actual usage of the game engine rather than pure narrative.