How I Check An Agent Product Before It Touches Funds 🧪
$LINK got boring about security long before anybody made it, and that is the stage agent products are at now. $BNKR sits in that group, and these products are new enough that you can still see which way each one went.
Here is the checklist I run before an agent gets permission to move anything.
Does it simulate the transaction before executing it? An instruction can be perfectly reasonable and the resulting call can still be wrong. Simulation is what catches the distance between the two.
Does it screen the token it is about to touch? Bankr routes that through Blockaid, which blocks tokens flagged as malicious. Not a guarantee, but the difference between a filter and no filter is most of the risk.
Does it screen the instruction itself? Prompt injection stops being a research curiosity the moment the thing reading your messages can also sign transactions.
Can it install skills from a link? This one is newest and least covered. An agent that can be pointed at a skill URL can be pointed at a hostile one by anyone whose text it happens to read.
Then the question that tells you more than the other four together. Does the documentation admit what the layers do not catch?
Bankr's does. It describes the scanning, the simulation and the injection screening, and then says plainly that these do not catch everything. A product that publishes its limits is easier to use safely than one that implies it has none.
The uncomfortable part of this whole category is that the failure mode is no longer a stolen key. It is an instruction you did not write, executed exactly as specified.
Security habits have not caught up with that yet.
#AI #Security
$LINK got boring about security long before anybody made it, and that is the stage agent products are at now. $BNKR sits in that group, and these products are new enough that you can still see which way each one went.
Here is the checklist I run before an agent gets permission to move anything.
Does it simulate the transaction before executing it? An instruction can be perfectly reasonable and the resulting call can still be wrong. Simulation is what catches the distance between the two.
Does it screen the token it is about to touch? Bankr routes that through Blockaid, which blocks tokens flagged as malicious. Not a guarantee, but the difference between a filter and no filter is most of the risk.
Does it screen the instruction itself? Prompt injection stops being a research curiosity the moment the thing reading your messages can also sign transactions.
Can it install skills from a link? This one is newest and least covered. An agent that can be pointed at a skill URL can be pointed at a hostile one by anyone whose text it happens to read.
Then the question that tells you more than the other four together. Does the documentation admit what the layers do not catch?
Bankr's does. It describes the scanning, the simulation and the injection screening, and then says plainly that these do not catch everything. A product that publishes its limits is easier to use safely than one that implies it has none.
The uncomfortable part of this whole category is that the failure mode is no longer a stolen key. It is an instruction you did not write, executed exactly as specified.
Security habits have not caught up with that yet.
#AI #Security
