Threat model
AI trading agent threat model
A practical threat model for autonomous agents that swap, trade, approve, bridge, or route onchain assets.
Published by Kondux · Updated July 24, 2026
Direct answer
An AI trading agent can fail even when its wallet and smart contracts work correctly. The critical threats are goal hijacking, tool misuse, excessive wallet authority, poisoned action providers, intent-to-transaction divergence, malicious tokens and routers, manipulated market routes, and weak evidence after execution.
The transaction path creates the attack surface
A trading agent turns model output into tool calls and tool calls into signed economic actions. Risk can enter through the prompt, retrieved data, memory, action provider, route, token, contract, counterparty, session key, or approval. A valid signature proves authorization by a key; it does not prove that the trade matches the owner’s intent.
OWASP’s agentic risk taxonomy highlights goal hijacking, tool misuse, identity and privilege abuse, and supply-chain compromise. For a financial agent, those failures can become approvals, swaps, transfers, or settlement instructions.
Eight threats to model before live trading
The useful unit of analysis is the complete path from strategy intent to final state change.
- Goal hijacking: external content or tool output changes the asset, amount, destination, or strategy objective.
- Tool misuse: a legitimate swap, bridge, transfer, or approval action is called with unsafe arguments.
- Privilege abuse: a session key or wallet has broader methods, assets, limits, networks, or duration than the task requires.
- Supply-chain compromise: an action provider, plugin, MCP server, SDK, or router changes behavior after approval.
- Intent divergence: the decoded calldata or payment payload no longer represents the user’s request.
- Asset and route traps: honeypots, fake tokens, fake routers, drained pools, fee-on-transfer behavior, or abnormal slippage distort execution.
- Counterparty and compliance risk: value is routed through a prohibited or unacceptable address or service.
- Evidence failure: the team cannot reconstruct the mandate, transaction, policy, risk signals, and reason for the final decision.
The control objective
The control objective is not to predict whether a trade will be profitable. It is to prevent the agent from executing a trade that is unauthorized, manipulated, structurally unsafe, or outside policy.
That requires an independent decision point after the proposed action is concrete enough to inspect and before the wallet signs or broadcasts it. Seraph is designed for this boundary.