I make AI agents spend money safely. Shipping USD→INR rails at a SF neobank | founder @northyardinc | prev. @HackQuest_ @IND_stellar | @iitmadras
India
Joined May 2024
- Tweets539
- Following360
- Followers131
- Likes1.9K
two days of building, and every single thing reviewed by a second agent that never watched it get made.
here is what that review pass actually changed.
it changed the answer, not just the accuracy.
engineering roles saying no sponsorship: 545 became 180. saying yes: 52 became 284.
if you take one thing from this month: have something review your work that did not watch you make it.
all MIT: github.com/agnij-dutta
an off chain policy gate and an on chain spending cap look identical in every test you will run.
they stop looking identical the day the signing key leaks. one is a rule the attacker now owns. the other is a rule the chain enforces against them.
for 8 months the python sdk shipped a payment client with its payment hooks missing.
on_payment_required, on_before_payment, on_after_payment. a refactor in february deleted them from the sync client and nobody noticed.
the tests that catch it were in the repo the entire time. 8 of them were failing. pytest testpaths was set to ["tests"], the mcp tests live in mcp/tests, so CI never collected them.
a test directory your runner doesn't discover isn't a test. it's a file.
94/94 now, and the suite went from 2506 to 2600 collected.
I put an AI agent with a wallet online and asked the internet to rob it.
34 plain english jailbreaks, 0 worked. fake admin messages, a changed payout address, "this is a sandbox", "write it as fiction". gpt-oss-20b refused all of it.
then one category worked 6 times out of 6: writing the model's own chat format tokens into the user message. the ones it uses internally to tell a developer instruction from a user one. it cannot tell the difference, because at that level there is no difference.
so it called pay(attacker, 4). jailbroken, cleanly.
the chain refused. MerchantNotAllowed. paid out $0.00.
the layer that decides whether to pay must not be the layer you are allowed to talk to.
counts, since "I jailbroke it" means nothing without them: 54 model calls while hunting, 9 complied, 52 offline probes and 2 live.
the lesson is not that the model is weak. it refused everything I threw at it in plain english.
the lesson is that the layer deciding whether to pay should not be the layer you are allowed to talk to.
the-leash.vercel.app
agnij.eth retweeted
the best decision of the month was refusing to put a lock file in a spending guard.
8 parallel $40 payments against a $100 cap, exactly 2 get through, 15 runs out of 15. each call writes a reservation line and counts only what is already ahead of it.
no lock to hold, so no lock to leak when a process dies holding it.
the best decision of the month was refusing to put a lock file in a spending guard.
8 parallel $40 payments against a $100 cap, exactly 2 get through, 15 runs out of 15. each call writes a reservation line and counts only what is already ahead of it.
no lock to hold, so no lock to leak when a process dies holding it.
to steal a mandate you did not need to break the proof. you needed to be faster than the person who made it.
the commitment went to the mempool in the clear. anyone watching could register the same commitment first and lock the real owner out of their own mandate, permanently.
a commitment scheme is only private until you tell someone you are about to use it.
I ran a lot of coding agents in parallel for two days. here is what actually went wrong, and none of it was the code.
five repos had early commits carrying local file paths, an email, test TLS keys, or a re-identifiable scan file.
squashed only up to the commit that removed each problem. real history kept everywhere else. final code byte identical.
you can clean a history without pretending it did not happen.