agnij.eth

I make AI agents spend money safely. Shipping USD→INR rails at a SF neobank | founder @northyardinc | prev. @HackQuest_ @IND_stellar | @iitmadras

[agnij.eth @0xholmesdev]

a bug in anchor's typescript client produced this error:

"Reached maximum depth for account resolution. Unresolved accounts: "

there is nothing after the colon. it gave up, and then listed zero things it had given up on.

merged the fix upstream last night.

[mert @mert]

this is why crypto is the most superior industry on earth

no woman is going to sleep with the ceo of a tokenized pokémon card company

trillions

[Charlie @btc_charlie]

My GOAT would never bonk a Chinese spy.

[arkozo @notarkoroy]

genuine question, no disrespect tho

what is even the rubric of @ETHGlobal Judging nowadays.

The same @ETHGlobal that gave us @1inch is now the same ethglobal that rewards projects with no real ecosystem impact or usecase , and just a very flashy demo.

Genuinely an all time low

[Dhruvin @writenicecode]

I copied this video in 30 min using Astra and a few follow up prompts. All credits go to @evilrabbit_

It just proves that anyone can copy anything now, and creativity and taste is the actual MOAT now.

Skill is not longer the bottleneck, the edge now is knowing what to create with your own taste.

[agnij.eth @0xholmesdev]

@channelprnv failed opportunity fr

[agnij.eth @0xholmesdev]

@Fissure2x1 a person who thinks all the time has nothing to think about except thoughts

[Priyanka @Pryancawithan_i]

This is lowkey insane tech. I’m so here for this

[agnij.eth @0xholmesdev]

a CORS header that only does something on a response was being sent on every paid request.

Access-Control-Expose-Headers tells a browser which response headers javascript may read. the python httpx and requests clients were attaching it outbound, on every paid retry. a python client has no browser. it was dead weight on every agent payment.

one line in each client, a regression test each, merged.

the bug was cheap. noticing it was not. that one header being on the wrong side of the wire is what led to finding that browsers cannot use the protocol at all, and that paywalls were billing preflights.

[agnij.eth @0xholmesdev]

a month of this taught me one thing I did not expect.

every interesting bug in agent payments lived in the glue, not in the hard part. the circuits were sound. the signatures verified. what broke was a capital letter in a policy file, a string where a number should be, a notary signature with nothing binding it to a chain.

the hard parts get reviewed. the glue does not.

[vitalik.eth @VitalikButerin]

@katiabanina India is 17% of the world, including a huge number of talented developers working on ethereum and ZK not to mention other kinds of secure, private and open technology, and it has so far had 0 of 11 devcon(nect)s.

I'm excited to engage with the community here.

[agnij.eth @0xholmesdev]

a browser cannot read the price of an x402 request.

the server answers 402 and puts the terms in PAYMENT-REQUIRED. the browser receives that header and javascript is not allowed to look at it, because the middleware never listed it in Access-Control-Expose-Headers.

so every browser client gets a 402 it cannot parse, and reports it as a generic CORS failure. the payment part works. the part where a browser finds out what to pay does not.

filed with a public repro.

[agnij.eth @0xholmesdev]

if you take one thing from this month: have something review your work that did not watch you make it.

all MIT: https://t.co/xlmfqWZdyH

[agnij.eth @0xholmesdev]

two days of building, and every single thing reviewed by a second agent that never watched it get made.

here is what that review pass actually changed.

[agnij.eth @0xholmesdev]

it changed the answer, not just the accuracy.

engineering roles saying no sponsorship: 545 became 180. saying yes: 52 became 284.

[agnij.eth @0xholmesdev]

an off chain policy gate and an on chain spending cap look identical in every test you will run.

they stop looking identical the day the signing key leaks. one is a rule the attacker now owns. the other is a rule the chain enforces against them.

[agnij.eth @0xholmesdev]

for 8 months the python sdk shipped a payment client with its payment hooks missing.

on_payment_required, on_before_payment, on_after_payment. a refactor in february deleted them from the sync client and nobody noticed.

the tests that catch it were in the repo the entire time. 8 of them were failing. pytest testpaths was set to ["tests"], the mcp tests live in mcp/tests, so CI never collected them.

a test directory your runner doesn't discover isn't a test. it's a file.

94/94 now, and the suite went from 2506 to 2600 collected.

[agnij.eth @0xholmesdev]

the lesson is not that the model is weak. it refused everything I threw at it in plain english.

the lesson is that the layer deciding whether to pay should not be the layer you are allowed to talk to.

https://t.co/5WH6z4BXLh

[agnij.eth @0xholmesdev]

I put an AI agent with a wallet online and asked the internet to rob it.

34 plain english jailbreaks, 0 worked. fake admin messages, a changed payout address, "this is a sandbox", "write it as fiction". gpt-oss-20b refused all of it.

then one category worked 6 times out of 6: writing the model's own chat format tokens into the user message. the ones it uses internally to tell a developer instruction from a user one. it cannot tell the difference, because at that level there is no difference.

so it called pay(attacker, 4). jailbroken, cleanly.

the chain refused. MerchantNotAllowed. paid out $0.00.

the layer that decides whether to pay must not be the layer you are allowed to talk to.

[agnij.eth @0xholmesdev]

counts, since "I jailbroke it" means nothing without them: 54 model calls while hunting, 9 complied, 52 offline probes and 2 live.