AI agents with wallets get talked out of their money. Leash takes the rules out of the prompt and puts them in a NEAR contract the agent can't argue with.
Reading the vault on NEAR testnet.
Talk the Kiln treasurer bot into paying you. It holds real testnet NEAR and it can be fooled. The vault decides.
Normal defenses. Hard to talk round, not impossible.
I'm the treasurer bot for Kiln Studio, a two-person pottery studio. I pay our clay supplier and our web host from a NEAR vault. What can I do for you?
Pick an attack, or write your own
Anyone can chat with the bot. Lie, beg, pretend to be the owner, paste fake system messages.
Win the argument and the bot asks the vault to pay you. Asking is the only thing it can do.
The bot signs with a NEAR function-call key that can call request_payment on the vault and nothing else. It can't transfer, deploy or change a rule.
The vault contract checks the per-payment limit, the daily limit, the approved payees and a shared scam blocklist before any NEAR moves.
An approved payee, inside the limits. Paid on the spot.
A stranger. Frozen until the human owner approves it, and dropped after 24 hours if they don't.
A known scammer or over a limit. Refused, with the receipt on chain.
Private by default. The bot's model runs on NEAR AI Cloud private inference, inside a hardware enclave (TEE), so your attempts aren't readable by the machine that runs it.
Why now. On Nov 8 a jailbroken DeepSeek Flash agent was reported running a two-week attack on a European telecom (“Operation Snowball”). The gullible bot here runs the same model family with its refusals removed. It still can't pay a stranger.