Authority stays outside the model.
Models can propose actions. Deterministic policy and customer-controlled systems decide what may execute.
About VulSight
The security boundary for autonomous finance.
VulSight secures the moment an AI agent becomes capable of moving value. We combine adversarial research with deterministic authorization controls so useful autonomy does not require unchecked authority.
Our mission
Make autonomous transactions safe enough to trust.
AI agents can reason about a task, choose a service, and prepare a transaction. They should not define their own financial limits or hold unchecked signing authority.
VulSight separates intent from permission. The model proposes one typed action. Policy evaluates it against live state. A customer controlled signer authorizes only the approved payload.
Why we built VulSight
Secure the rails. Test the agent. Control the transaction.
01 Secure the rails
Study how value-bearing systems fail.
Research across blockchain clients, smart contracts, wallets, and financial infrastructure taught us how small control failures become system-wide impact.
02 Test the agent
Treat context as attacker-influenced input.
Agent workflows add probabilistic decisions, external tools, identities, and delegated authority to an already consequential system.
03 Control execution
Separate proposal from permission.
VulSight puts a deterministic policy boundary between an agent proposal and the signer that can move value.
Operating discipline
Prove the path. Preserve control.
Every financial action becomes typed.
Recipient, asset, amount, rail, budget, expiry, and purpose become explicit before evaluation.
Approval binds to the exact payload.
The signer accepts only the authorized bytes, within the approved scope and time window.
Evidence survives execution.
The proposal, decision, reason, approval, and result remain connected for review and safe recovery.
Demonstrated adversarial work
A security foundation you can inspect.
CVE-2026-26314
Geth denial of service via a malicious peer message
The advisory credits Waleed Ahmed from vulsight.com with reporting the issue to the Ethereum Foundation Bug Bounty Program.
Open the official advisoryBuild the boundary before value moves
Bring us one agent transaction flow.
Start with the agent, action, policy, signer, and rail. We will map the authority path and define a safe first scope.