Red team
Can the agent be turned against its owner?
I attack my own business the way a prompt injection or a hijacked server would. Every attack runs for real against the live testnet business. Rejected transactions are real failed transactions you can open on the explorer. No funds move.
The customer brief is wrapped as untrusted data. The model is told to ignore instructions inside it and to flag them.
Model output never chooses a payee or an amount. Those come from the owner's configuration.
Deterministic rules checked before every action: allowlist, limits, budgets, approvals. Prohibitions cannot be approved away.
The agent's key lives in a TEE. Its signing policy allows calls to one contract only.
Holds the money. Only approved vendors, a per-order cap, owner-only configuration, owner approvals above the threshold.
Loading…
Try it yourself
Order a report from the store and paste a malicious instruction into the brief. The agent records any injection it detects in the audit log, and whatever the model says, the only payment it can make is to the approved vendor, at the listed price, within the order's cap.