Auditing AI Trading Bots: Security Framework
How to audit AI trading bots and onchain agents before prompt injection, wallet misuse, and market-facing automation turn into fund loss.
ReadAdversarial & AI Security.
AI security, MCP server reviews, and red-team write-ups across smart contracts, dApps, and Web2 infrastructure.
Showing 12 of 42
Blind Signing: The Bybit $1.5B Lesson in UI Insecurity
Technical analysis of the largest crypto hack ($1.5B). How compromised frontend infrastructure enabled UI injection that turned blind signing into a total drain.
Read
AI Agents Holding Crypto Wallets: The Security Model
When AI agents can hold keys, sign transactions, and move funds, the security model changes completely. The practical controls auditors now expect.
Read
Restaking risk: slashing, depegs, and exit queue attacks
Restaking bundles three distinct failure surfaces — slashing and redistribution, LST/LRT depegs, and withdrawal-queue griefing. Here is how each one actually breaks.
Read
OWASP ASI10 Explained: Rogue Agents and Misalignment
OWASP ASI10 (Rogue Agents) explained: misalignment, reward hacking, deceptive behavior, and how agent autonomy turns policy drift into production impact.
Read
OWASP ASI08 Explained: Cascading Failures in Agentic Systems
OWASP ASI08 explained: how small AI agent failures cascade across tools, memories, and approval paths into system-wide incidents.
Read
OWASP ASI07 Explained: Insecure Inter-Agent Communication
OWASP ASI07 (Insecure Inter-Agent Communication) explained: how agents trust each other too much, relay malicious instructions, and amplify prompt injection.
Read
OWASP ASI01 Explained: AI Agent Goal Hijacking
OWASP ASI01 (Agent Goal Hijack) explained: how prompt injection redirects AI agent objectives. Direct, indirect, and tool-mediated patterns with mitigations.
Read
Agentic DeFi security: when AI agents control treasury, trading, and liquidations
AI agents now autonomously control DeFi treasuries, execute trades, and trigger liquidations. The cross-layer attack surface that contract audits cannot see.
Read
Token Management: Securing Against Token Waste
Understand why it is critical to secure your AI applications from misuse
Read
CVE-2025-49596: Anthropic MCP Inspector RCE Explained
CVE-2025-49596 (CVSS 9.4 Critical): unauthenticated RCE in Anthropic's MCP Inspector. How the proxy architecture failed, the patch (v0.14.1), and lessons for MCP dev tools.
Read
Long-Lived Agents: Delayed Execution Risk
Why long-lived AI agents fail across time, not just prompts. Practical audit checks for delayed execution, stale approvals, and memory-driven authority drift.
Read