Business Development for Web3 auditor @vulsightsec
Futureland
Joined August 2023
- Tweets364
- Following173
- Followers31
- Likes116
Pinned Tweet
Just pulled off $300k off Immunefi. Critical Vulnerability ✅, Smart Contract ✅.
Back to work now.
Big congratulations to @VulsightSec for scoring their very first paid report on Immunefi.
And it's huge, huge payout.
Well done!
You can pledge behind them here to earn IMU when they find bugs:
immunefi.com/pledge/vulsight…
Goal drift in agentic systems is subtle and dangerous.
The agent keeps optimizing.
The original intent slowly gets lost.
By the time anyone notices, value has already moved in the wrong direction.
This is a core focus in our reviews.
If your agentic payment protocol handles real value, it deserves a security process that matches that reality.
Anything less is a gamble.
at @VulsightSec We don’t gamble with our clients’ systems.
Teams that only prepare for reentrancy and access control issues are preparing for the last generation of problems.
Agentic payments require preparation for the next one.
At @Vulsightsec we help teams make that shift.
There are no shortcuts when you’re securing systems that can move capital autonomously.
Either you pressure-test the agent behavior properly, or you accept the risk.
We prefer the first option.
Every new capability you give an agent expands the attack surface.
Most teams only measure the smart contract risk.
The agent decision layer is where the bigger surprises live.
Good security partners don’t just drop a report and disappear.
They help builders understand the new risks that come with autonomous agents.
That’s the approach we take at @VulsightSec
Intent manipulation is one of the cleanest ways an agentic payment system can be abused.
The transaction looks valid.
The agent followed its instructions.
The outcome is still catastrophic.
This class of issue needs dedicated attention
Along with Web3 Security We don’t lower the bar for agentic systems just because the technology is new.
If anything, the bar has to be higher.
Autonomous value movement demands it
The protocols that secure their agentic payment flows early will have a structural advantage.
The ones that wait for the first incident will pay for it in trust.
At @Vulsightsec we help teams stay in the first group.
The best security work on agentic systems starts with a simple question:
“What happens when the agent does exactly what it was told but in a context the designers never intended?”
Most teams still don’t ask this hard enough.
When agents can move real value with minimal human oversight, the responsibility on the security side increases dramatically.
We take that responsibility seriously.
This is why teams building serious agentic systems work with us.
One of the hardest problems in agentic payments is collusion between agents.
It doesn’t always look malicious.
Sometimes it looks like efficient coordination.
Until it isn’t.
This is the kind of risk we specifically pressure-test at @Vulsightsec
Afaq Ali retweeted
@token2049 Singapore was intense in the best way.
A week of back-to-back meetings, side events, dinners and conversations across DeFi, infrastructure, AI agents and security.
Great to briefly meet @StaniKulechov from @aave , @MarcinRedStone from @redstone_defi , @HeslinKim from @ZenithFdn and @SaigonButcher from @SuperteamBlack @SolanaFndn and spend more time with @Brent_Fulfer and the @_thebestevent team.
One theme kept coming up for us at @VulsightSec :
As AI agents move closer to handling real financial activity, the question is no longer just “can an agent transact?” but “what should it actually be authorized to do?”
A lot of interesting conversations around audits, L1/L2 security, ecosystem partnerships and agentic finance.
Plenty to follow up on after Singapore.
#TOKEN2049 #Web3Security #DeFi #AI
If you’re building agentic payment infrastructure and still using a 2023-era security checklist, you’re taking unnecessary risk.
The attack surface has changed.
Your process should too.
Finding bugs is table stakes.
Understanding how an autonomous financial agent can be steered into harmful actions while following every rule is the real work.
This is what separates average audits from the ones that actually protect capital.
If your threat model for agentic payments still starts and ends with smart contract vulnerabilities, you are missing the bigger picture.
Agents introduce decision-level risk.
That requires a different kind of scrutiny.
Most teams still treat security as a final checkbox before launch.
With agentic systems, that approach is reckless.
Security has to be part of how the agents are designed to behave.
This is the standard we hold at @Vulsightsec.
The scariest failures in agentic payments won’t trigger a classic alert.
They’ll look like the system working exactly as designed until the damage is done.
That’s the new reality.
At @Vulsightsec we design our reviews around this exact problem.