The Coinbase team takes security seriously. Please do not file a public ticket discussing a potential vulnerability.

Please report your findings through our HackerOne program.

Prompt injection is inherent to giving an AI agent a wallet and is not treated as a vulnerability in AgentKit itself. See Managing Risk for the risk model and mitigations.