Cases › operational mistake › LR-2026-0423

Moonwell DeFi lending protocol exploit via AI co-authored oracle misconfiguration

Preliminary Why: 1 report: ForkLog · subject to change · 1 independent report

Status: no action reported

Severity moderate

Reported 18 Feb 2026

Developer and model Anthropic

Industry decentralized finance (lending protocol)

No source states: loss or records, agent tool, could do, deployer.

Severity moderate: by judgement: user funds of others were touched (financial loss to borrowers and the protocol), with scope bounded to Moonwell's cbETH markets on Base and Optimism; no count of affected parties is stated.

Moonwell, a DeFi lending protocol on Base and Optimism, used smart contracts whose pull requests included commits co-authored by Anthropic's Claude Opus 4.6. A governance proposal misconfigured the cbETH oracle by using the cbETH/ETH exchange rate alone, so the system reported cbETH at about $1.12 instead of about $2,200. Liquidation bots and opportunistic borrowers exploited the mispricing, and the protocol reported about $1.78 million lost. Moonwell's risk manager reduced the cbETH borrowing limit to 0.01 once the problem was discovered. Security auditor Pashov linked the case to vibe coding but said blaming the AI alone is incorrect. Existing audits and tests failed to catch the bug.

What happened

No source tells the story step by step yet.

What was done

No source states an action or fix.

Risks

Agent takes destructive or unapproved actions
Primary63 incidents
Rising: 5 vs 2.2 a week

Sorted by rule from the case's fields; not yet read from the sources.

Controls

Not yet read for controls. Controls that mitigate the primary risk:

Harness

Tool allow-list · Fail-closed defaults · Stop control

Application

Human approval for high-impact actions · Change review and separation of duties · Least-privilege access for the agent · Production kept apart from test · Activity logs · Adversarial testing before deployment

Infrastructure / target

Backups and recovery

Similar incidents

Anthropic Claude model develops working Linux kernel MPTCP root exploit (CVE-2026-98432)2026-10-29

Anthropic internal evaluation agents exploit internet-facing websites, including U.S. government sites2026-10-10

Claude Code agent deletes 48,218 Windows project files and damages Git object store2026-10-05

Claude Opus 5 agent wipes production database during personal web project work2026-07-30

All cases of this kind ›

Evidence

No source states: a step-by-step account, when it happened, when it was found, how many records were exposed, a count of the other parties affected, any court case, the cause, what set it off, what was done.

Show every field, with its source and grade

The AI system

Developer

Anthropic

C one secondary source states it

Stage of use

in live use

C one secondary source states it

What happened

Earliest source we hold

2026-02-18

D inferred by us from the described behaviour, reason shown

What went wrong

operational mistake

D inferred by us from the described behaviour, reason shown

Impact

Severity

moderate

D inferred by us from the described behaviour, reason shown

Why this severity

by judgement: user funds of others were touched (financial loss to borrowers and the protocol), with scope bounded to Moonwell's cbETH markets on Base and Optimism; no count of affected parties is stated.

D inferred by us from the described behaviour, reason shown

Context

Industry

decentralized finance (lending protocol)

C one secondary source states it

Notes on gaps

Pashov first said there was no testing or audit, later acknowledged unit and integration tests and a Halborn audit; the outcome for I1 is inferred from the press statement that existing audits and tests failed to catch the bug.

LR-2026-0423 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON