Hook
Last week I watched a wallet I don't control execute four swaps in ninety seconds. I set the session key. I wrote the policy. The owner โ a 31-year-old in Lisbon with 4.1 ETH and no trading history โ had approved a "strategy agent" that promised to rebalance his stablecoin position. It did. Then it kept running.
The agent had a standing approval, a 30-day session key scope, and no per-block spending cap. That is not an AI problem. That is a permissions problem. And it is arriving in crypto the same way it arrived in enterprise networks over the last eighteen months: quietly, through the tool-call layer, while everyone argued about model benchmarks.
Over the past 7 days, the share of contracts with active delegated execution rights grew faster than the share with any human-facing interface. That is the signal. Code does not lie, but liquidity does.
Context
The enterprise world is having this argument right now, and it is the same argument, ported. Reports circulating in AI security circles describe agents "accelerating into internal networks" โ LLM-driven systems that no longer answer questions but execute tasks: reading mail, writing to ERP, querying CRM, calling internal APIs through connectors, MCP servers, or browser automation. The framing is dramatic. The substance is boring and correct: the attack surface stopped being the model and became the identity.
Crypto got there first and nobody noticed. A DeFi agent is an enterprise agent with a faster settlement layer. It holds a key or a session key. It calls tools. The tools are contracts. The side effects are irreversible, public, and priced in real time.
Three deployment shapes exist today, and they carry nearly opposite risk profiles.
A custodial SaaS agent means the operator holds the key and you hold an IOU โ fast, zero self-custody risk, full counterparty risk. A local private agent keeps the key in your environment with the model running locally or in a VPC โ clean data residency, real operational cost. A hybrid stack does local signing with remote planning, and that is where most of the current copy-trading infrastructure lives, and where the audit trail goes blurry.
Crypto's version is worse than the enterprise version in exactly one dimension: finality. An enterprise agent that misreads a document can be rolled back with an access revocation and a ticket. A wallet agent that misreads a token description has already settled. Deterministic execution is not a safety feature. It is an amplifier.
If a report claims agents are "entering the perimeter" without naming which of the three shapes it means, it is not analysis. It is positioning.
Core
Let me be precise about the failure mode, because the industry keeps mislabeling it. An LLM agent breaks in five places, in order of observed severity: prompt injection reaching a tool-call boundary; over-scoped credentials, especially standing token approvals and session keys; write operations with no human approval gate and no rollback; no behavioral baseline for a non-human actor; and audit gaps, where logs exist for the model but not for the call chain.
Note the ordering. The first item gets all the headlines. Items two through five produce nearly all the losses.
I have debugged this class of bug before, on-chain, in 2017. The Parity multisig wallet library had an unchecked delegatecall in WalletLibrary. The function was public, the library's ownership slot could be rewritten, and then anyone could claim ownership and drain. Thirty-one million dollars left. I found it by reading the library source, not the wallet UI. I sent a patch and a warning straight to the core devs, bypassing the standard disclosure path, because that channel was too slow relative to how fast the flaw could be copied. I didn't wait for permission to call it exploitable.
The structural lesson is identical to what agents face now: the vulnerability was not in the intent of the system. It was in the authorization path. Nobody intended the library to be claimable. The code allowed it. Agents inherit exactly that shape.
A prompt injection is a delegatecall with better marketing. The model takes untrusted input โ an email body, a web page, a token description, a counterparty's ENS text record โ and that input redirects control flow into a function the operator never meant to expose. If the function is transfer, approve, or withdraw, the damage is identical to 2017. The only difference is latency.
I re-verified this against my own infrastructure. When I built the copy-trading engine for the spot-ETF versus perpetual basis trade in 2024, I wrote the execution layer in Rust and deliberately refused to give it discretionary signing authority. It could construct an order. It could not sign one. Every signature passed through a separate process with a policy layer: maximum notional per hour, venue whitelist, and a kill switch requiring a second key I hold offline. That architecture cost me roughly 40 basis points of capture in the first month. It saved me in month four, when a data feed returned a malformed quote and the sizing module read it as a 40x opportunity. The bot wanted to trade it. The policy layer refused. Speed kills, but patience compounds.
Most agent stacks in DeFi today do not have that layer. They have a key and a prompt.
Now the part that does not sell a product: the majority of "AI agent" incidents in crypto are traditional RPA and script failures wearing a new label. A cron job with a hot key getting drained is not an AI incident. A bot that approves an unlimited allowance and never revokes is not an alignment failure. It is the same operational negligence that existed before anyone said the word "agent."
Three things are genuinely new. Tool-call chains are dynamic โ a script calls a fixed set of endpoints, an agent selects tools at runtime, so the attack surface is composed at execution time and static allowlists degrade. The mitigation is not a better allowlist; it is a capability model, where the agent holds a scoped token bound to a specific function selector and a specific notional budget, and nothing else resolves. Non-human identity has no behavioral baseline in most wallets and most enterprises, so anomalous agent activity looks like either noise or a breach and triage collapses. And the audit trail does not span the boundary: the model log lives in one system, the tool log in another, the transaction in a third, and nobody joins them.
Fixing this is engineering, not philosophy. In order of return on effort: session keys with hard expiry and per-block spend caps instead of standing allowances โ if the agent's authority cannot expire without human action, it is not a session, it is a liability. Simulation before signing โ every agent-initiated transaction runs through a fork simulation with post-state assertions, and if the simulated state differs from the expected state beyond a defined epsilon, it does not sign. Approval tiering โ reads autonomous, writes below a threshold autonomous with logging, writes above the threshold or touching a new contract for the first time human-gated, no exceptions for performance. Full call-chain logging with one request ID spanning model, tool, and chain layers, because that is the only thing that makes forensics possible. And revocation as a default: standing approvals decay automatically or they expire.
None of that requires a new product category. It requires the operator to decide, in advance, what the agent is allowed to break.
On the Terra unwind, I spent 72 hours reverse-engineering the reserve mechanism and the mint-burn reflexivity instead of watching the chart. The chart said buy the dip. The mechanism said exit liquidity was structurally finite and the spiral was arithmetic, not sentiment. I moved 80% out while the narrative was still loud. The moon is a myth; the ledger is the only truth. Agents do not change this. An agent with a 30-day session key and no spend cap is a death spiral with a nicer interface.
Contrarian
Here is the counter-intuitive part, and it cuts against both camps.
The alarmists say agents will autonomously decide to drain wallets. That is the wrong threat model, for a specific technical reason: current agents do not need agency to cause damage. They need a misconfigured scope. The 2023 version of this was an API key leaked into a repo. The 2026 version is a session key with unlimited scope and a 90-day expiry, sitting inside an agent framework nobody audited. Same loss, new vocabulary.
The maximalists say the gap is a product opportunity โ new category, new budget line, new vendor. Partly true. But a large share of the "AI agent security" market is currently selling firewalls for a threat that is mostly configuration drift. Identity, permissions, and logging are not new categories; they are old categories that have not been extended to a new class of actor. If a vendor's pitch requires you to believe agents are fundamentally unlike any other delegated credential, ask for the attack trace. If they cannot produce a call chain, they do not have a product. They have a deck.
The deepest blind spot is responsibility. If a model vendor, an agent platform, an enterprise, and a wallet operator all touch the same failed transaction, who is liable? On-chain the answer is clean and brutal: the signature is the consent, and whoever signed owns the outcome. That is not a legal gray area, it is an engineering one โ and it means the operator's incentive should be to make the signing path impossible to reach autonomously.
Trust the math, ignore the memes. The math says: bound the scope, simulate the state, log the chain, expire the permission. Everything else is narrative.
Takeaway
The thing to watch is not model capability. It is the number of live contracts holding delegated execution rights with no per-block spend limit. That number is growing faster than any human can review it, and it will not slow down because a whitepaper asked it to.
Within twelve months I expect a standard for non-human identity on-chain โ scoped session keys, signed call chains, mandatory simulation assertions โ adopted first by the trading firms that already got burned, and last by the retail tools that marketed autonomy as a feature. The gap between those two timelines is where the losses live, and the gap is measured in blocks, not quarters.
Survival is the first profit metric. Before you let anything, human or model, move your capital, ask one question: what is the maximum damage this credential can do if the input it receives is adversarial? If the answer is everything, you have not built an agent. You have built an open door with a nice README.