A new academic system tries to stop AI crypto agents from signing transactions that turn malicious between the moment they're checked and the moment they actually execute.
Researchers built Proof-Gated Signing (PGS), which simulates a proposed transaction, then uses an automated mathematical solver to verify the transaction stays within a set policy, things like wallet balance limits, payment destinations and permission caps, across a range of possible price moves. Unlike a simulation check or an LLM lookover, which only confirm safety at the moment they run, PGS compiles its conditions directly into the wallet's smart contract, so the chain enforces them atomically when the transaction executes, no matter how the chain state has shifted since the check. In a 260-scenario testbed covering 14 attack families and 12 benign ones, PGS blocked 93.6% of 140 harmful transactions while still approving 97.5% of legitimate ones. A basic allowlist caught 71.4% of the attacks, and a simulation-only check caught just 57.9%.
The gap PGS targets, so-called state drift, is what lets an attacker front-run an approval or alter a contract after a check passes but before it executes. The researchers also found something more unsettling: showing an LLM reviewer a clean, pre-drift simulation made it more likely to wave through a drift attack, which says more about automated reviewers' blind trust in simulations than about this particular tool.
At roughly 41,000 gas and a fifth of a second per check, the overhead is small enough that the real question is whether anyone shipping agent wallets bothers to wire this in before the next drift exploit makes the decision for them.