Moonwell: The One Incident the Environment Cannot Catch

A February 2026 r/ExperiencedDevs thread claims $2M was stolen from Moonwell, a lending protocol that controlled $100M+ in assets, after an exploitable bug shipped in a commit carrying a Co-authored-by: Claude trailer. The post that brought it to the forum put it this way: "Moonwell, a lending protocol which controlled $100M+ in assets suffered the very first hack based on a bug that was introduced in a commit that was co-authored by Claude. $2M got stolen." (r/ExperiencedDevs, 180 points, 114 comments)

This is the casebook entry that does not motivate an environment boundary. Every other incident here justifies a wall: an egress path that should have been closed, a credential that should have been scoped, a package install that should have been mediated. Moonwell had none of those failures. The bug rode out through a clean perimeter as ordinary, correct-looking code, and the only control in the seven properties that stops it lives in Manage the Work, not in the environment.

The incident matters less for the bug than for how the world learned who wrote it. The same commit trailer that teams spend threads arguing about stripping out is the artifact that attributed a production exploit to an AI co-author. Attribution metadata stopped being repo hygiene and became incident forensics.

Community-sourced. The corpus contains the Reddit threads and verbatim quotes below, with permalinks, and nothing else. No Moonwell postmortem, no chain-analysis report, no exploit writeup, no exact exploit date, and no confirmation of the bug's mechanism appear in the research base. "The very first hack" is the thread author's claim, not an independently verified superlative. Treat every specific below at that confidence level.

The failure chain ended in public git history

1. An AI agent co-authors a change to a lending protocol, according to the thread. The commit carries the Claude trailer, which is how step 5 becomes possible.
2. The bug survives review and ships to a system the thread says controlled $100M+ in assets. The corpus is silent on what Moonwell's review process was, so where exactly the gate failed is unknown.
3. An attacker finds and exploits the bug, according to the public claim. The reported loss is $2M.
4. The community reconstructs authorship from the commit trailer. No log subpoena, no internal investigation needed: the attribution was sitting in public git history.
5. The liability conversation starts immediately, in public, with the trailer as Exhibit A.

Note what is absent. No prompt injection, no stolen credential, no exfiltration channel. The lethal trifecta does not apply here, and neither does any boundary this section builds. This was wrong code that shipped.

Attribution detected; only review could have prevented

Mapped to the seven properties:

This is the cleanest demonstration of a pattern that holds across every incident: attribution and audit are accountability and forensics, never prevention. If the public claim is accurate, Moonwell had, in effect, perfect attribution, and lost $2M anyway.

The prevention burden lands entirely on review as a gate, and the same community describes exactly why that gate sags under AI volume. The top comment on the Moonwell thread, from u/lordnacho666 (173 points): "Vibe coding is a tradeoff between speed and quality... If you're making a wallet, you really want to spend your time checking that the code is right. I suspect the real problem is that reading code is harder than writing it" (permalink). Three months later a senior engineer announced at a company meeting that he would no longer review AI-generated PRs at all, "because the AI generated code look good and plausible, so it will lead to bugs and security issues" (r/ExperiencedDevs, 1560 points). Moonwell is what that failure mode costs when the repo holds other people's money.

The trailer became liability evidence, and both sides noticed

Within days, the same attribution mechanism was being argued over as legal exposure. In the parallel r/cursor fight over vendor-injected trailers, u/muntaxitome observed that "the idea of an AI company trying to convince a judge they are not responsible for some malware that has 'Co-authored by $product_name' in the commit messages sounds funny to me," and a commenter who works "between CSC and LAW dept" reported that "LAW is salivating about all the class actions this will spawn" (r/cursor, 126 points, 164 comments, permalink).

The institutional response runs the other direction: make attribution richer, and keep the human on the hook. The Linux kernel's AI rules, discussed the same spring, allow an Assisted-by: tag recording model and tooling but grant no AI a Signed-off-by: "if your ai generated patch breaks something, thats on you, not the model vendor" (r/ExperiencedDevs, 306 points). That is accountability staying human, encoded as commit metadata. The inverse also appeared: developers asking how to evade per-commit AI-percentage metrics, attribution inverted into surveillance to escape.

The control that matters is the gate, not the trailer

Attribution is worth having precisely because of incidents like this: it turns "who wrote the bug" from an investigation into a query. But Moonwell is evidence, at the confidence level fenced above, that attribution is a forensic property, not a safety one. The trailer reports who wrote the bug after the fact; it cannot stop the bug from shipping. If your AI-authored changes touch anything irreversible, the control that matters is the gate in front of the merge, and the community evidence says that gate is exactly where humans are quietly failing.