I still remember the first time a security lead told me, half joking, that their overnight analyst was a script. That was years ago, and the script mostly sorted alerts into piles a tired human would open at 8 a.m. What is happening now is different. Autonomous systems are starting to investigate odd logins, follow stolen coins across bridges, and pause a vulnerable function before a person has even opened the ticket. If that sounds like a staffing change rather than a product feature, you are reading the room correctly.
September alone brought about $768.4 million in crypto losses across 97 incidents, under one widely used security methodology. By the end of that month, the running total for 2026 sat near $2.68 billion. Those numbers do not prove that machines should run the desk. They do explain why teams are tired of waiting for a human to click through a playbook while an attacker is already three hops ahead.
A New Kind of Security Colleague, Not a Smarter Filter
For most of the last decade, artificial intelligence in cybersecurity and compliance sat in the passenger seat. Machine learning flagged anomalies. Language tools summarized a noisy queue. A person still decided whether the alert was real, whether the wallet should be frozen, and whether the report was fit to send. Useful, yes. Autonomous, no.
Agentic AI is the awkward label for systems that can reason across several steps, call tools and external interfaces, gather evidence, act in a live environment, and then look at what happened before choosing the next move. A recent industry analysis from a major blockchain security practice frames this as an AI security workforce. Autonomous systems take defined roles. Humans shift toward supervision, quality control, and the part nobody can outsource: accountability.
I have found that the phrase “workforce” makes operators either lean in or roll their eyes. Both reactions are fair. Treating an agent like a colleague forces you to write a job description. Treating it like another software license lets you skip the hard questions until something breaks at 2 a.m.
What an Agent Can Do Before a Human Opens the Ticket
Picture a security operations center. An unusual login appears. In the older model, the alert lands in a queue. In the newer one, an agent can pull the device fingerprint, check location history, compare both against threat intelligence, decide whether the account should be suspended, and execute the suspension. The reasoning is supposed to be written down so a person can review it later.
That sequence is not magic. It is a chain of permissions. Each link is a place where the system can be right, wrong, or confidently wrong. Perhaps the most interesting aspect is not the speed. It is the paper trail. If you cannot replay why the agent acted, you do not have a colleague. You have a black box with a badge.
An agent without a scope of authority is not automation. It is an unsigned check.
Security researchers argue that organizations still own the outcome. Machines do not hold legal or operational accountability. The company that deploys the system, and the people who configure and supervise it, do. Under that model every agent needs a defined scope, an escalation path, and a named human owner. Skip those and you are shipping autonomy without the boring controls that make autonomy survivable.
Why Crypto Makes the Clock Feel Shorter
Traditional fraud often leaves a few hours, sometimes a day, between the first odd signal and the irreversible loss. Crypto compresses that window. A flash loan exploit can drain a protocol in seconds. Stolen assets can hop through fresh addresses, bridges, and mixing services within hours. Waiting for a morning standup is not a strategy. It is a donation.
Headline losses can fall and the work can still get harder. First-half figures for 2026 put crypto losses near $1.32 billion, down 46.8 percent from a year earlier, while wallet compromises became the largest attack method in the second quarter. Attackers change the door they use. Teams that only celebrate the smaller total miss the new door.
- Speed: exploits can finish inside a block window, not a business day.
- Fragmentation: funds split, bridge, and reappear under new labels.
- Staffing: experienced investigators are scarce and expensive.
- Volume: compliance queues grow even when attack totals dip.
None of that means every protocol should hand the pause button to a model. It does mean the old split, software flags and humans act, is under real pressure. In my experience, the teams that handle that pressure well write the limits first and the demos second.
From Assistant to Operator, With the Job Description Written Down
Calling an agent an operator changes the review you owe it. A filter can be wrong and waste an analyst’s morning. An operator can suspend an account, freeze a key, or file a report that later sits in a regulator’s folder. Those are different grades of mistake.
A practical way to think about it is a short contract between the team and the system. What may it read? What may it change? When must it stop and ask? Who signs the log the next morning? If those four lines are fuzzy, the rest of the architecture does not matter much.
| Role | Typical action | Human still owns |
| Alert assistant | Ranks and summarizes signals | Every decision |
| Investigator | Pulls evidence and proposes a case | The final call |
| Operator | Acts inside a written limit | Scope, logs, escalation |
| Supervisor model | Watches other agents | Whether that watcher is trusted |
Notice the last row. Once you have several agents, someone will want an agent to watch them. That can help. It can also stack confidence on top of confidence until a quiet error looks like consensus. I would rather see a named person on the hook than a second model nodding along.
Smart Contract Work Is Where the Handoff Gets Real
Web3 security is an obvious place for this shift. Audits used to mix manual review with static analysis, symbolic execution, and fuzzing. Tools surfaced candidates. Experienced engineers decided which findings were genuine. That split is bending.
Agentic systems can walk a contract’s call graph, watch state changes across several contracts and external calls, and look for reentrancy, oracle manipulation, weak access control, and unsafe upgrade paths. Some teams are also pointing agents at formal verification: generate a specification, test it against behavior, and cut part of the manual load that formal-methods engineers used to carry alone.
Human auditors are not leaving the room. Their center of gravity moves. They check what the agent produced, hunt economic and game-theoretic tricks the model has not seen, and look for blind spots in the automation itself. That last job is easy to underfund. The tool that finds bugs can also miss the class of bug it was never shown.
There is a harder lesson from the last few years of exploits. Projects that paid for audits still lost funds through signer devices, administrator keys, backend systems, and bridge validators. Code review, even excellent code review, does not cover the whole attack. If agents only get better at reading Solidity and ignore keys, signers, and infrastructure, the industry will automate the part attackers have already started to leave behind.
Live Monitoring and the Same-Block Response
The more ambitious setups do not stop at the audit report. They watch pending and confirmed transactions for flash-loan patterns, oracle games, abnormal liquidity pulls, and other exploit shapes. In advanced designs, detection can trigger a response inside the same block window. An agent might pause a vulnerable function, trip a circuit breaker, or freeze a compromised admin key without waiting for a person to type the transaction.
That is the dream and the risk in one sentence. A correct pause can save a treasury. A wrong pause can halt a market, strand users, and create its own incident. Circuit breakers are only as calm as the logic that pulls them. I would want a dry run on historical attacks, a clear undo path, and a human who can override the override before I trusted that button in production.
- Define which functions an agent may pause, and which it may never touch.
- Replay past incidents against the detector before it sees live flow.
- Log the evidence, the decision, and the transaction hash together.
- Set a time limit after which a human must confirm or roll back.
- Practice the failure case, not only the save.
Short version: speed without a reverse gear is just a faster way to be wrong.
Following Stolen Funds While They Are Still Moving
Fund tracing used to be reconstructive. Investigators started at the drain, walked address to address, and tried to rebuild the path after mixers, bridges, and exchanges had already done their work. Split the loot into small pieces and hop chains, and the reconstruction gets slow and incomplete.
Agentic systems are being asked to follow assets as they move, not only after the trail has cooled. They can refresh address clusters when new activity appears. Instead of frozen heuristics alone, they look at timing, shared counterparties, and gas-fee habits to guess whether several addresses belong to the same operator. Cross-chain laundering is the messy case. Older monitors often watched one network at a time. An agent can stitch chains into one case and keep walking when value passes a bridge or a cross-chain swap.
One documented laundering path tied to a major exchange exploit converted 86.29 percent of stolen ether into bitcoin within a month, using mixers, bridges, and over-the-counter brokers. That is not a theoretical diagram. It is a reminder that the interesting part of a theft often happens after the headline. Continuous tracing will not recover every coin. It can shorten the gap between “we were hit” and “we know where the next hop is likely to land.”
Tracing after the fact is archaeology. Tracing while funds move is closer to pursuit.
Security operations lead, private briefing
Clusters still lie. Two addresses can share timing because they use the same public relay, not because one person holds both keys. Gas fingerprints drift when wallets update. A good tracing agent should show its uncertainty, not bury it under a neat graph. If the output always looks certain, I get suspicious.
Compliance Agents and the Queue That Never Sleeps
The same autonomy is creeping into compliance, which is where a lot of firms feel the daily pain. Know-your-address and know-your-transaction checks can run before a transfer settles. An agent scores the address or the transaction in real time so a platform can spot possible exposure to illicit funds before it completes the move.
Reporting can be automated too. Systems pull on-chain data, match it to off-chain records, and draft filings tied to travel-rule sharing or stablecoin reserve attestations. The regulatory load is not imaginary. Anti-money-laundering penalties topped $900 million in the first half of 2025 as more jurisdictions moved from writing rules to enforcing them. Firms that treat compliance as a quarterly scramble are already behind that curve.
Here is the catch I keep coming back to. A suspicious-activity narrative written by a model can look polished and still contain a broken transaction trail. Reviewers who have watched the system nail routine cases start skimming. That is how a confident error becomes a filed error. Compliance automation should make the human’s review sharper, not optional.
A workable compliance handoff: Agent gathers evidence and drafts Human checks the trail, not the tone System stores both versions Escalation triggers stay numeric, not vibes
When the Agent Itself Holds the Keys
A separate problem shows up when agents become blockchain users. They can hold assets, place trades, run treasury tasks, and talk to decentralized-finance protocols. Once that happens, you may need to audit the agent’s on-chain behavior the way you audit a trader: what it saw, how it decided, what it signed.
This is no longer a lab sketch. In June, a widely used wallet released an agent wallet that lets autonomous systems execute swaps, perpetual trades, and other on-chain actions under limits the user sets. The product details will change. The pattern will not. If software can sign, someone has to be able to explain the signature later.
Treasury agents are the version that keeps risk committees awake. A narrow mandate, a spending cap, an allowlist of contracts, and a delay on large moves will not make the system clever. They will make a bad day smaller. Clever without a cap is how a prompt becomes a withdrawal.
The Attack Surface You Just Hired
Giving agents authority creates a fresh set of problems. They can state false claims with a straight face. In anti-money-laundering work, a generated report might invent a clean trail. In an audit, an agent might decide a formal spec covers a bug it does not cover. Humans get worse at catching that if the system has been right on the easy cases for weeks.
Attackers have the same toolkit. Security firms warned earlier in 2026 that AI-assisted phishing, deepfakes, and automated exploit tooling were making campaigns faster and harder to spot. Threat actors already use models to speed vulnerability discovery, automate reconnaissance, and write more convincing social engineering. The defense did not get a private monopoly on the technology.
Security agents can become targets precisely because they are allowed to touch sensitive systems. Prompt injection or poisoned inputs could push an agent to approve a fraudulent transfer or switch off a real control. If that sounds abstract, replace “agent” with “new contractor who has production access and believes every email.” You would not skip training. Do not skip adversarial tests.
- Wrong but confident output, especially in reports and audits.
- Reviewer fatigue after a long streak of correct routine cases.
- Prompt injection against agents that can sign or disable controls.
- Poisoned threat intel that the agent treats as ground truth.
- Unclear liability when an autonomous action causes harm.
Liability is still unsettled across jurisdictions. That does not pause the deployments. It means the practical answer, for now, sits inside the company: records of authority, escalation thresholds, and any human approval that happened before a consequential action. Courts can argue later. Logs have to exist today.
What “Good Enough Oversight” Actually Looks Like
Researchers close the loop with a short list that sounds dull and is not. Keep full audit trails of inputs, reasoning, and actions. Put hard limits on what an agent may decide alone. Test against adversarial manipulation. Assign a named human owner for performance and for failure. I would add one more: review the misses in public inside the team, not only the saves in the slide deck.
Ownership matters more than the model name. If nobody’s bonus, reputation, or weekend depends on the agent’s mistakes, the agent will drift. A named owner is not a scapegoat. It is the person who can say “turn it off” without booking a committee.
Minimum control set: scope + limit + log + owner + kill switchKill switches deserve a sentence of their own. An agent that can pause a protocol should be pausable itself, by more than one person, from a path that does not depend on the agent’s own tools. If the only off switch lives inside the system you are trying to stop, you built a lock without a key.
How Teams Can Adopt This Without Handing Over the Building
A sane rollout is narrower than the keynote. Start where the cost of a wrong action is reversible. Drafting a trace. Clustering addresses for a human to confirm. Summarizing an audit diff. Those jobs teach you how the agent fails before it can move money.
Next, allow actions that are easy to undo and hard to hide: tagging an account, opening a case, requesting a second signature. Only then consider same-block responses, and only on functions you have already designed to pause. Protocols that cannot pause anything should not pretend an agent will invent a brake during the exploit.
Measure the boring metrics. How often does a human overturn the agent? How long does review take? Which error types repeat? A falling overturn rate can mean the system improved. It can also mean reviewers stopped looking. Split those two stories or you will congratulate yourself into an incident.
Training is part of the control set. Analysts need to know what the agent is allowed to do, how to read its log, and when to distrust a fluent explanation. Fluency is not evidence. A clean paragraph can sit on top of a swapped transaction hash. Teach people to check the hash.
What This Means for Protocols, Exchanges, and Users
Protocols should assume monitoring will get faster and still design for failure. Pause functions, rate limits, and timelocks are not old-fashioned if an agent might pull them. They are the handles the agent, or a human, will need. An upgrade path that only one hot key can touch remains a single point of failure, agent or no agent.
Exchanges and custodians will feel the compliance side first. Real-time address screening can cut exposure. It can also block legitimate users if the risk score is jumpy. Publish the appeal path. A false positive that takes three weeks to clear is a customer problem, not a model quirk.
Users will mostly notice this indirectly. A withdrawal that pauses, a login that locks, a support reply that quotes a trace they never saw. The fair version explains the hold in plain language and gives a person to reach. The sloppy version hides behind “our systems detected risk” and hopes the user goes away. I know which one I would keep using.
A Few Myths Worth Retiring
Myth one: if losses are down, automation can wait. Method changes, as wallet compromises did in the second quarter, matter more than the headline percentage. Myth two: an audited codebase plus an agent equals safety. Keys, signers, backends, and validators still sit outside the contract. Myth three: more autonomy always means less staff. It often means different staff, people who can supervise, test, and argue with a system that sounds sure of itself.
Myth four is my least favorite. “The model is the control.” A model is a component. Controls are limits, logs, owners, and the ability to stop. Confusing the two is how a pilot project becomes an unaudited employee.
Where I Land on the Workforce Metaphor
The workforce framing is useful if it forces job descriptions, limits, and owners. It is dangerous if it lets a vendor slide past procurement with a slogan. Agents can investigate, trace, and sometimes act faster than a night shift. They can also approve the wrong thing with perfect grammar. Responsibility stays with the organization and the humans who set the rules.
If you run a desk, write the scope before you widen the permissions. If you ship a protocol, build the brake before you advertise the watcher. And if a report reads too smoothly, check the trail yourself. The coins will not wait, and neither will the next hop.
