Authority stays outside the model.
Models can propose actions. Deterministic policy and customer-controlled systems decide what may execute.
About VulSight
Security engineering for AI-driven finance.
VulSight works with teams building AI agents, payment systems, and blockchain infrastructure. We test how untrusted input can reach execution, then design controls that keep financial authority outside the model.
Our mission
Keep financial authority explicit at every step.
AI agents can reason about a task, choose a service, and prepare a transaction. They should not define their own financial limits or hold unchecked signing authority.
VulSight separates intent from permission. The model proposes one typed action. Policy evaluates it against live state. A customer-controlled signer authorizes only the approved payload.
Why we built VulSight
Research informs how we test and control AI-initiated transactions.
01 Secure the rails
Study how value-bearing systems fail.
Research across blockchain clients, smart contracts, wallets, and financial infrastructure taught us how small control failures become system-wide impact.
02 Test the agent
Treat context as attacker-influenced input.
Agent workflows add probabilistic decisions, external tools, identities, and delegated authority to an already consequential system.
03 Control execution
Separate proposal from permission.
VulSight puts a deterministic policy boundary between an agent proposal and the signer that can move value.
Operating discipline
Design principles for controlled financial execution.
Every financial action becomes typed.
Recipient, asset, amount, rail, budget, expiry, and purpose become explicit before evaluation.
Approval binds to the exact payload.
The signer accepts only the authorized bytes, within the approved scope and time window.
Evidence survives execution.
The proposal, decision, reason, approval, and result remain connected for review and safe recovery.
Demonstrated adversarial work
A security foundation you can inspect.
CVE-2026-26314
Geth denial-of-service vulnerability via a malicious peer message
The advisory credits Waleed Ahmed from vulsight.com with reporting the issue to the Ethereum Foundation Bug Bounty Program.
Open the official advisoryBuild the boundary before value moves
Tell us about the transaction workflow you need to protect.
Start with the agent, action, policy, signer, and rail. We will map the authority path and define a safe first scope.