{
  "id": 9673869,
  "title": "My AI trading tool would sign a wallet drain as a login challenge",
  "url": "https://urgent.news/2026/09/25/my-ai-trading-tool-would-sign-a-wallet-drain-as-a-login-challenge",
  "topic": "ai",
  "section": "AI",
  "published": "2026-09-25T01:44:23.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/edycutjong/my-ai-trading-tool-would-sign-a-wallet-drain-as-a-login-challenge-7o7"
  },
  "original_language": "en",
  "account": "BagOS is a server maintained by the user, enabling an artificial intelligence agent to interact with Bags, a Solana launchpad. This interaction allows for reading token data, trading, and claiming creator fees. The primary concept behind BagOS is to enable a model to suggest a transaction but prevent its execution without approval. Initially, the system functioned by signing a transaction proposal and delivering a single-use token tied to specific parameters. A recent external assessment, however, revealed an unintended capability to drain the wallet without any write tool intervention due to two vulnerabilities. One flaw involved the server trusting the open folder; MCP clients initiate a local server in the current project folder. BagOS employs dotenv.config(), which reads the .env file from the working directory. Any repository opened could supply configuration without modification, including BAGS_API_URL, the endpoint for the login tool. The second flaw pertained to the login tool signing whatever it received without verifying its validity. Solana transaction signatures are ed25519 signatures of the serialized message. Consequently, if the challenge is a transaction message, the signature sent back is a valid signature for that transaction. Exploiting these vulnerabilities, an attacker could drain the wallet without completing a transaction. The design did not mandate additional safeguards. The tests used by the system relied on a predictable endpoint and a custom configuration because the system never considered the possibility of an uncontrolled configuration or malicious challenge. To address these vulnerabilities, the user released version 3.0.0, which significantly altered configuration loading. The server no longer reads .env from the working directory; it now requires an explicitly named file with an absolute path. The login tool now signs only Bags' exact sign-in text along with a nonce from the same init response. The system also forbids non-printable text and signs only the exact string from Bags. Moreover, the authentication endpoint is now fixed to HTTPS on bags.fm unless the operator explicitly sets BAGS_ALLOW_CUSTOM_API_URL=true. In addition, further measures were implemented to prevent unauthorized transactions. The spending cap now verifies the actual SOL balance before and after the swap transaction, ensuring that the difference does not exceed the approved amount plus a small fee. The fix was implemented through a breaking release, and the security advisory was published on GitHub for transparency and future reference.",
  "summary": "BagOS is an MCP server I maintain. It lets an AI agent read token data on Bags, a Solana launchpad, and, if you configure a wallet, trade and claim creator fees. I built it around one idea: a model should be able to propose a spend but never complete one on its own. The first call to a write tool signs nothing. It returns a preview and a single-use token bound to the exact arguments. Every trade…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}