Over the past 60 days, my team catalogued 41 on-chain "agent vaults" — contracts where an off-chain model emits a decision and an on-chain executor turns it into settlement. Twenty-nine route execution authority through a single externally owned account or a 2-of-3 multisig. Eleven use a session key with no expiry. Four allow the agent to rewrite its own permissions.
In the same window, OpenAI published its call for mandatory AI safety measures following a series of rogue agent incidents. Neither document names the other's problem. Read side by side, they describe one failure at two altitudes. One treats intelligence as the attack surface. The other treats capital as the prize. Both point at the wrong layer.
An agent vault is a four-layer system. A planner, usually an LLM, receives state and context. A tool router converts the planner's intent into a concrete action — swap, borrow, rebalance, bridge. A signer authorizes that action. Settlement executes on-chain. Three of those layers are well understood. The fourth is not, and it is the one holding the keys.
The OpenAI framing is legible. Rogue agent incidents are real: jailbreaks that escape constraint, tool misuse, planning drift across long horizons. The remedy is equally legible. Mandatory red-teaming. Mandatory logging. Mandatory attestation. Certification before deployment. It is the standard reflex — when a system fails, regulate the visible layer. The EU AI Act is already phasing in obligations for general-purpose models. NIST has draft guidance sitting in review. What none of them specify is who owns the signing key.
Crypto has run this play before. In 2018 I spent four hundred hours inside EtherDelta's matching engine, during the post-ICO correction. The exploit that mattered was not strategic. It was an integer overflow, arithmetic at the edge of a uint, twelve reproducible bug reports with proof-of-concept code attached. The market was arguing about volume and decentralization. The code was arguing about a carry bit. The carry bit won. My report went to GitHub before the acquisition closed.
That pattern is why the current agent safety conversation, in Washington and on-chain alike, is aimed at the wrong altitude. Based on my audit experience, the failures that drain capital are almost never the ones the whitepaper anticipates. They sit at the boundary where a human stops reading and a machine starts signing.
The verification layer proves the wrong thing. In 2025 I sat with four cryptographers auditing the first AI-inference ZK protocol. The constraint system worked. It generated proofs that a specific model, given specific inputs, produced specific outputs. We stripped 15% computational overhead from inefficient constraints and proposed a recursive aggregation method that cut gas 40%. The work was cited in three regulatory whitepapers.
It also proved nothing about safety. A ZK proof of inference is a computation receipt. It does not grade judgment. It cannot tell you whether an output is correct — only that it is authentic. You can verify that the agent ran. You cannot verify that the agent should have. Every mandatory attestation regime I have read quietly assumes that gap away.
The router is where intent becomes calldata. This is the layer nobody audits. The planner emits language. The router translates language into ABI-encoded calls. If the router validates types but not semantics, a poisoned retrieval context produces well-typed, catastrophic calldata — a valid transfer, a valid approve, a valid withdraw to an address the agent was never meant to trust. I reproduced exactly this on a staging fork in under an hour: one injected document in the retrieval index, one unexpired session key, one signed transaction. The model was not rogue. The context was. That is a far cheaper attack than alignment failure, and it does not require a breakthrough in anything.
And the parameters it optimizes are arbitrary anyway. In one lending integration I reviewed last quarter, the agent's "risk appetite" was a hardcoded float chosen by a developer in a private Notion doc. The interest rate curve it targeted was set by a governance vote, not by supply and demand. The model learned, efficiently and correctly, to optimize a number someone drew by hand. The code doesn't care where the number came from.
The signer is a multisig with two keys in one pocket. Every agent vault I have inspected carries an upgrade function and a pause function. The pause function — the kill switch — is itself permissioned, usually 3-of-5, and in two cases two of the five keys were held by the same operator. "Code is law" survives exactly until the admin slot is called. The autonomous agent is autonomous within a boundary drawn by a handful of addresses, and those addresses are the real governance layer. No AI safety framework I have read audits them.
The monitoring cost is not free. Real-time anomaly detection on every agent action means running a second model in parallel, or a rules engine, or an auditor contract that re-checks state after the fact. That doubles inference cost and adds latency to every settlement. The bottleneck isn't the infrastructure. It is the schema — the question of what "anomalous" even means for calldata that is technically valid.
Here is the contrarian read. Mandatory safety measures will not touch any of this. Certification is a checkbox, and audits did not stop DeFi exploits — they redistributed blame after the fact. The standards being drafted will be captured by the largest labs, because compliance is cheapest at scale, and safety will become a moat rather than a floor. The industry will get an audit badge on a dashboard. The session key with no expiry will still be there, and it will still sign whatever the router hands it.
The blind spot is simple and unglamorous. Everyone is modeling the rogue agent as a mind. The dangerous one is not a mind at all. It is a valid signature on a wrong transaction, produced by a system that was never asked whether it should.
Within twelve months, a top-tier agent vault will suffer a systemic loss. The post-mortem will not read model misalignment. It will read permission misconfiguration — an unexpired key, a router that trusted its input, a signer that did what it was told. Resilience isn't audited in the winter. It is audited at the boundary, before the first call is signed. The question is not whether AI agents are safe enough to hold capital. It is whether anyone has audited the thing that actually moves it.