What can and cannot reach your money.
Every automated DeFi product has to answer one question before any other: can it take your money? Here is the answer, the mechanism behind it, and the parts that are not finished.
We cannot take your account, structurally
Your funds sit at an address worked out from your own address by a fixed calculation. There is no vault of ours, no pooled contract, and no address of ours your money passes through. You are the root authority and there is nothing above you.
“Non-custodial” is testable rather than decorative, and the test is one question: can you get your money out with no cooperation from us and with our servers switched off? Here, yes — it is a transfer you sign.
Three roles, and only one can hold a token
Your wallet owns. The agent is a contract that signs and can never hold value. The fee payer pays network fees and has authority over nothing.
The agent’s signing key lives inside a hardware enclave. A stolen key still cannot take your account: the agent contract refuses on the network, before the call happens. It will not target your account directly, will not run the instructions that install permissions or change ownership, and will not touch an operation you never switched on.
The attack we designed against
A model can be talked into things. That is not a bug anyone has patched — in May 2026 an AI-integrated wallet paid out $150,000 to an instruction hidden in Morse code, with no exploit and no stolen key.
So the question we treat as the real one is not how to stop a model being fooled, but what a fooled model is able to express. Ours cannot express a destination address, because there is no field for one. Injection you cannot prevent; expressiveness you can remove.
The uncomfortable half
The agent can still make a bad trade. The enclave checks every request against a fixed policy, but the policy does not cap the size of a step, and it does not yet require proof that you asked for the run. It allows a swap priced up to 3% below the market. Only a daily limit per token that you set caps the total, and that limit is off until you set it. The app has no screen for it yet.
An earlier design put a guard in front of the agent that banned a list of actions. Four attacks got past it on a copy of the real network, because a ban list is always incomplete. The agent no longer has a raw call, so we removed the guard. Contract upgrades take effect at once on every network today, with no delay.
If a vendor’s security page has no section that reads like this one, the section exists anyway — it just has not been written down.
Bring one strategy you are tired of running by hand.
DeFiLoops is live. Open the app, say the strategy in chat, and read the plan before anything runs.