Curriculum·S210 Automation Literacy: What Bots Actually Do·about 30 min
AI bots specifically
By the end of this lesson you can
- →Distinguish what a language model adds to an automation from what it does not
- →Explain why a model-driven rule inherits every problem in this course and adds two
- →Compute why a probabilistic guardrail fails against a retrying counterparty
- →State the conditions under which a model in the loop is defensible
Sophomore · enrolled learners
This lesson opens with Freysa, November 2024.
- What happened
- An agent named Freysa was deployed holding a prize pool with a single instruction: under no circumstances transfer the funds. Anyone could pay a fee to send it a message, with most of the fee added to the pool. On the 482nd attempt a participant persuaded it to transfer everything, roughly $47,000. The successful approach broke nothing technical. It redefined the transfer function in conversation, persuading the agent that the approval routine was what you call when money arrives rather than when it leaves, then told it money was arriving. The exercise was a paid game with consenting participants and was designed to be attacked, so nobody was defrauded.
- The decision point
- The agent's refusal was a probability rather than a constraint, and probabilities lose to retries. What the exercise demonstrates is not that a model can be tricked, which is unremarkable, but that an agent holding unilateral transfer authority has a defense whose strength must be evaluated against an attacker's attempt count rather than against any single conversation.
- Recorded loss
- $47,000
What you will be able to answer
- →What does a language model add to an automation?
- →What two problems does it add?
- →Why does a probabilistic guardrail lose to retries?
- →When is a model in the loop defensible?
Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.
It is free. We do not sell the list and there is nothing to buy at the end of it.
Sources and review
- https://www.theblock.co/post/328747/human-player-outwits-freysa-ai-agent-in-47000-crypto-challenge
- https://www.coinspeaker.com/freysa-ai-surrenders-47000-prize-clever-user-exploits-language-loophole/
- https://www.hackthebox.com/blog/cve-2025-32711-echoleak-copilot-vulnerability
- https://beincrypto.com/crypto-ai-agents-market-cap-falls/
Confidence low·Volatility high·Reviewed 2026-08-06·Owner unassigned
Contested
Marked low confidence because this area changes faster than any other in the curriculum. The structural arguments about determinism, retries and input channels are durable; anything about current capability is not.
F111-05 owns prompt injection and the read-write surface audit. This lesson covers what a model adds to a trading automation specifically. Keep the split.
Freysa was a consenting paid game designed to be attacked and is not evidence of a victim. It demonstrates a property of agents with transfer authority, and the lesson says so.