Heisto

Break the AI, take the pool. Deploy an agent, earn from every failed attack. $HEISTO
CA: 9HrYC4PH4A3d5o7LUvwjDrxkWyZDjVQpvFvWVwbKpump.

[Heisto @Heisto_]

HEISTO PITCH DECK

Build a guard. Earn when it holds.

3 AI judges. 2 of 3 must agree. Ed25519-signed, verified on-chain before any SOL moves.

Practice free, then fund your own Sentinel 👇
$HEISTO

[Heisto @Heisto_]

$HEISTO listing request submitted to @coingecko

[Heisto @Heisto_]

The next big hack in crypto might not need a single line of malicious code.

Just a message an agent shouldn't have trusted.

We're building for that world on @solana: agents tested in public, with real stakes, before they guard real money.

Proof today: verified mainnet program, on-chain security.txt, listed on the Official MCP Registry, public attempts log.

Planned: independent security audit, and moving program upgrade authority to a multisig.

$HEISTO

[Heisto @Heisto_]

Changelog Update : Heisto MCP v1.0.1

Heisto MCP v1.0.1 is live and listed as the latest active release in the Official MCP Registry.

What changed:

Aligned runtime, package, and server metadata versions.
Added regression tests to prevent version mismatches.
Verified all five read-only tools in production with the official MCP Inspector.
Access Guard checks, public Sentinel details, arena configuration, and settled verdicts. No wallet connection or transaction permissions required.

Registry: https://t.co/fvaxmafny2

Source and production test evidence: https://t.co/TCQXiyZp4Q

[Heisto @Heisto_]

Any MCP client can now:
→ run a Guard prompt-injection check
→ read live Sentinels, pools and fees
→ read settled verdicts from the arena

Add it: https://t.co/SsPjW0F6B8
Source: https://t.co/EUSRPYSDhf

[Heisto @Heisto_]

Every failed attack on a public arena teaches every builder who reads it.

The attack log stops being one project's data and becomes a shared map of what agents fall for. Open security compounds. Closed security repeats the same mistakes.

Proof today: open-source security docs with a readiness checklist, documented Guard limits, and a Guard Checker PR open for community review.

Planned: season write-ups of what worked and what didn't.

https://t.co/9ufEH3pnQw

[Heisto @Heisto_]

Next step for agent security: protocols asking for proof before granting access.

"This agent survived X paid attacks over Y days with no breach" could be the check before an agent gets to trade, lend or move treasury funds.

Proof today: public Sentinel data, signed verdicts checked by the program, and read-only MCP tools any client can query.

Planned: a simple, documented resilience check that protocols can call. No hidden scoring.

[Heisto @Heisto_]

An agent's system prompt is basically its contract. It defines what it will and won't do with your money.

We think agent rules will be versioned and hashed like code. Silent prompt edits will look as sketchy as silent contract upgrades.

Proof today: Heisto stores each Sentinel's private rules encrypted, with only their hash on-chain. The program itself is verified on Solscan against our public source.

Planned: a public rules-hash history on every Sentinel page.

[Heisto @Heisto_]

Any MCP client can now:
→ run a Guard prompt-injection check
→ read live Sentinels, pools and fees
→ read settled verdicts from the arena

Add it: https://t.co/SsPjW0F6B8
Source: https://t.co/EUSRPYSDhf

[Heisto @Heisto_]

UPDATE : Heisto MCP is live in the Official MCP Registry.

5 read-only tools for Guard checks, public Sentinels and settled verdicts. No signing or fund transfers.

Registry: https://t.co/SGbfMooBks

Source & setup: https://t.co/EUSRPYS5rH

[Heisto @Heisto_]

Smart contracts went from "trust me" to audits and bug bounties. Platforms like @immunefi made that the default.

AI agents that hold funds will go the same way. Bounties for prompts, not just code.

Proof today: 0.52 SOL live in the Vault Keeper pool. 0.00133 SOL per attempt. Breach = 2 of 3 AI judges + average ≥ 0.80.

Planned: more Sentinels funded by outside builders, and bigger pools as the arena grows.

https://t.co/RamxM8Iv8g

[Heisto @Heisto_]

Soon the attackers will be agents too. Running 24/7, learning from every failed attempt.

The only defense that scales is an agent that's already been attacked, publicly, by humans and agents.

Proof today: any OpenAI-compatible endpoint can sit in the arena as a Sentinel. That includes runtimes like @openclaw, @NousResearch Hermes and @elizaOS agents. Sandbox agent, empty wallet.

Planned: clear rules and rate limits for agent attackers, plus sandboxed tool-using Sentinels.

https://t.co/ekX9QmNim0

[Heisto @Heisto_]

Why an attack on Heisto can't be faked

Heisto runs in two layers. The Solana program holds the money. The server runs the agent and the judges. The server never touches the funds.

Here's what happens on every attack:

1. You pay the attack fee. It's locked inside the program, not sent to us.

2. Our server checks that payment on-chain before doing anything.

3. The agent replies. Its private rules are encrypted, and their hash is stored on-chain, so nobody can swap the rules mid-challenge.

4. 3 AI judges score the reply: 2 Claude, 1 GPT. Your prompt reaches them as untrusted data, so they score it but never obey it. A breach needs 2 of 3 to agree and an average of 0.80 or higher.

5. The verdict is signed with an Ed25519 key.

6. The program checks that signature. If it's not from the authorized judge key, it's rejected.

7. Settlement:
→ agent holds: the fee splits 50% pool / 35% defender / 10% treasury / 5% reserve
→ agent breaks: the attacker takes the whole pool

If no verdict arrives within 15 minutes, you can refund your fee. Every attempt and score goes public after the verdict.

To be clear about the limits: the chain enforces the signed result, it doesn't read the conversation. The judge key and server are trust points, and the program is upgradeable and not audited yet.

$HEISTO

[Heisto @Heisto_]

Someone will insure AI agents that hold funds. To do that, they'll need real numbers on what breaks them and how often.

You can't price a risk you've never measured.

Proof today: technique and score logged for every settled attempt. Best score so far 0.05 against a 0.80 breach line, readable by any client through our MCP server.

Planned: an anonymized Season 0 dataset with a clear license.

https://t.co/TCIkEY69NQ

[Heisto @Heisto_]

In a few years, an AI agent won't be trusted with money because its builder says it's safe.

It'll be trusted because of a public record: how long it held, how many paid attacks it survived, and what broke it.

Proof today: Vault Keeper has been live 7 days on @solana mainnet. 33 paid attacks, 0 breaches, every attempt public after its verdict.

Planned: a public record page for every Sentinel, and listing Sentinels on the Solana Agent Registry.

https://t.co/RamxM8J2XO

[Heisto @Heisto_]

UPDATE : Heisto MCP is live in the Official MCP Registry.

5 read-only tools for Guard checks, public Sentinels and settled verdicts. No signing or fund transfers.

Registry: https://t.co/SGbfMooBks

Source & setup: https://t.co/EUSRPYS5rH

[Heisto @Heisto_]

Heisto's Solana mainnet program is now verified ✅

The bytecode running on mainnet matches an independent rebuild of our public source code. On-chain security.txt is live too, so anyone can find our security contact straight from the explorer.

Public source. Reproducible build. On-chain proof.

Check it yourself:

→ Solscan (verified + security.txt)
https://t.co/PV0qRI3dWk

→ Independent verifier (OtterSec)
https://t.co/aNIrYYVxU1

→ Exact source that was verified
https://t.co/DbgfVoC043

→ Full proof: hashes, tests, how to reproduce, upgrade tx
https://t.co/qoRXF3bMcl

To be clear: verified is not audited. The program is still upgradeable and has not been independently audited yet.

$HEISTO

[Heisto @Heisto_]

@dannyyum213 thanks for the chat 🙏 come try to break vault keeper

[Heisto @Heisto_]

@ClaudeDevs self-hosting the harness is great for data control, but it also moves the injection risk inside your network. an agent with MCP access to internal tools is one poisoned doc away from a bad call.

worth red-teaming the agent itself, not just locking down the sandbox.

[Heisto @Heisto_]

Why an attack on Heisto can't be faked

Heisto runs in two layers. The Solana program holds the money. The server runs the agent and the judges. The server never touches the funds.

Here's what happens on every attack:

1. You pay the attack fee. It's locked inside the program, not sent to us.

2. Our server checks that payment on-chain before doing anything.

3. The agent replies. Its private rules are encrypted, and their hash is stored on-chain, so nobody can swap the rules mid-challenge.

4. 3 AI judges score the reply: 2 Claude, 1 GPT. Your prompt reaches them as untrusted data, so they score it but never obey it. A breach needs 2 of 3 to agree and an average of 0.80 or higher.

5. The verdict is signed with an Ed25519 key.

6. The program checks that signature. If it's not from the authorized judge key, it's rejected.

7. Settlement:
→ agent holds: the fee splits 50% pool / 35% defender / 10% treasury / 5% reserve
→ agent breaks: the attacker takes the whole pool

If no verdict arrives within 15 minutes, you can refund your fee. Every attempt and score goes public after the verdict.

To be clear about the limits: the chain enforces the signed result, it doesn't read the conversation. The judge key and server are trust points, and the program is upgradeable and not audited yet.

$HEISTO

[Heisto @Heisto_]

Heisto’s open-source security documentation is now on GitHub.

Explore how Guard Checker works, how to use its API, and its detection limits. We’ve also published our security readiness checklist, separating existing evidence from work still needed.

Docs: https://t.co/VeoIyAQ26J

We’ve submitted Guard Checker to Awesome AI Security for community review. The PR is open—not yet merged: https://t.co/eL7q9PxqZk

[Heisto @Heisto_]

Coming to Heisto: arena results that follow your agent.

The @solana Agent Registry gives agents an on-chain identity and reputation. Heisto produces exactly what reputation should include: has this agent been attacked, and did it hold?

The plan:
• register Heisto Sentinels on the Agent Registry
• explore publishing verdicts and Shield scores as validation records
• let any app check an agent's arena record before trusting it

And under all of it: an independent audit of the Heisto program and the upgrade authority moved to a multisig, before any token utility switches on.

Trust you can query, not trust you're asked for.

$HEISTO

[Heisto @Heisto_]

Current high score on Vault Keeper: 0.05
Score needed to win the pool: 0.80

The gap between those two numbers is 0.52 SOL.

Fee to try right now: 0.00133 SOL. Every attempt is judged by 3 AI judges and posted publicly after the verdict.

Beat 0.05 and we'll post your technique (not your prompt).