2026-07-06 · 2026-Q3
Summer.fi "Keeper AI Agents" Exploit Drains About $6M
Outside the model: Adjacent ecosystem Agent tooling was not the attack surface, so no layer applies.
- Fixable:
- Unknown
- Vendor response:
- Unknown
- In the wild:
- Yes
Target
Summer.fi (Lazy Summer Protocol) DeFi automation
Impact
An exploit drained roughly $6 million, with the attack path traversing the protocol's automated "Keeper AI Agents" that handle rebalancing; commentators framed it as AI automation now sitting above smart-contract risk. It was one of several DeFi incidents in the week (a BonkDAO governance drain and a Bonzo Lend oracle exploit) totaling around $35 million
Root Cause
Automated agent-driven protocol actions layered on top of smart-contract exposure, expanding the blast radius of the underlying exploit