Yes. An AI agent that buys tokens on its own can be rugged exactly like a person can, and often faster, because no human looks at the chart before it signs. In one academic study of about 17,000 newly launched tokens on a major decentralized exchange, roughly 88% were flagged at some point for blocked or restricted selling.
A note on the legal and regulatory points here: they summarise public sources as of November 2026 and should not be relied on. Rules for AI agents are still being written, and some of what is described here is proposed or coming soon rather than settled. Check the current position, or ask a qualified professional, before acting on it. Incident details are as publicly reported at the time, and some are disputed.
What does “getting rugged” actually mean?
Getting rugged means buying a token whose creators can take the money out, leaving you holding something you cannot sell or that is suddenly worth almost nothing. The phrase comes from “rug pull”: the people behind a new token vanish with buyers’ funds.
There are three common versions. In a liquidity pull, the creator removes the pool of paired funds that lets anyone trade the token, so the price collapses. In a honeypot, the token’s code lets you buy but blocks or restricts selling. In a dump, insiders who kept a large share of supply sell it all at once.
None of this is rare. A 2025 academic study of serial rug pulls on two large decentralized exchanges found about 632,000 pools matching one narrow rug-pull pattern: liquidity added once and removed within a single day. That was 45% of all pools on one exchange and 28% on the other, from launch to July 2024.
The honeypot figure in our lead comes from a 2025 academic study of new tokens on Ethereum. It covered tokens launched between October and December 2024, and labelled a token a honeypot if a security scanner had flagged it at any stage. That method is broad, and the authors say so. But even the cautious reading is stark.
Why are AI agents such easy targets?
Agents are easy targets because they are fast, they are numerous, and they act on whatever their data tells them, including data written by scammers. The traits that make an agent useful for trading new tokens are the same ones a rug-puller exploits.
Speed comes first. The same study found that the first trades in a new token often land in its very first block and are driven by automated bots, sometimes with the creator simulating demand. A scammer launching a trap is, in effect, fishing for software.
Volume comes second. One AI token launcher was reported to have created more than 13,000 tokens a day at the end of January 2026. No agent, and no human, can research that many launches by hand. An agent told to “find early opportunities” is choosing from a flood.
The third reason is the least obvious. Agents read token names, descriptions, social posts and their own stored memory. A 2025 academic study of context manipulation showed that planting false entries in an agent’s memory could push it into unauthorised asset transfers. Its test set held more than 500 attack cases. A token’s own marketing can be the attack.
What should an agent check before it buys a token?
An agent should run the same checks a careful human runs, in code, every time, before it signs. The difference is that a human can get tired and skip a step; an agent should be configured so it cannot.
- Can it actually be sold? Simulate a sell before buying. Some security tools work exactly this way, testing whether a sale would go through. A token that cannot be sold in simulation should be an automatic no.
- Is the liquidity locked, and until when? A liquidity lock is a smart contract that holds the pool’s funds until a set date. Check what share is locked and when the lock ends. A lock that expires next week protects very little.
- What can the creator still change? Look for powers to mint new supply, pause trading, blacklist wallets, raise sell fees or upgrade the contract. Each one is a switch the creator can flip after the agent has bought.
- Who holds the supply? If a handful of wallets hold most tokens, a dump is one transaction away. Team tokens released on a vesting schedule, unlocked gradually over time, carry less of that risk than tokens held freely.
- Who launched it, and what else have they launched? The 2025 rug-pull study found about 40% of scammer addresses belonged to coordinated groups running repeat scams. A creator wallet with a trail of dead tokens is a signal.
- Where did the buy instruction come from? If the reason to buy traces back to a post, a token description or a stranger’s message rather than the owner’s rules, stop.
Can these checks be fooled?
Yes, because every check is a snapshot and a scam is a process. A token can pass all six checks today and fail tomorrow.
The honeypot study is explicit about this. It counted tokens that “became honeypots later” in their life, meaning selling worked at first and was blocked afterwards. The authors report that most honeypots turned within their first few trades. A sell simulation run at minute one says nothing about minute ten if the creator kept the power to change the rules.
The same logic applies to locks. A lock proves the locked funds cannot move before a date. It does not prove the rest of the pool is locked, that the lock is long enough, or that the creator holds no other levers. Our judgement: a lock is necessary evidence, not sufficient evidence.
What could go wrong?
The worst case is not one bad token; it is an agent with too much authority that keeps buying them. An agent allowed to spend a whole wallet, approve any contract and act without confirmation can lose everything in a string of small, fast mistakes.
The honeypot study ran a simple simulated strategy that bought new tokens and held them. Of 7,213 tokens it entered, about 29% could not be sold to exit the position. A fully autonomous agent buying new launches is running a version of that experiment with real money.
There is also an attack route a human trader rarely faces. If an agent reads social posts or token metadata, an attacker can write instructions into them, a technique called prompt injection. The agent may then buy a trap because it was told to by content it should have treated as untrusted.
And once a trade settles on-chain, it is final. There is no support desk for a rug pull. What happens next is the subject of the next guide in this series.
The trust takeaway
An AI agent can absolutely get rugged, and it will not feel embarrassed or hesitate the way a person might. The defence is to make the checks mandatory and to cap what the agent can lose while it learns.
Before letting an agent buy tokens on your behalf, check or ask:
- Does it simulate a sell before every buy, and refuse tokens that fail?
- Does it check whether liquidity is locked, what share, and until when?
- Does it read the token contract for mint, pause, blacklist and fee powers?
- Does it have a per-trade and a total spending cap you set?
- Does it ignore buy suggestions from posts, token descriptions and strangers?
- Can you see a log of why it bought each token?
This is where Team Finance fits. Team Finance provides token and liquidity locks, vesting, staking and airdrop tools, and has been used by more than 40,000 projects. A lock made this way is recorded on-chain, so anyone, human or agent, can verify what is locked and until when. Where this is going is a lock check an agent can call by itself before it buys. That is the direction, not a shipped feature.