Your AI agent will be hijacked.
Your hardware won't be fooled.
An autonomous treasury agent gets prompt-injected live. It assembles a payment to an address you never chose. Watch the malicious transaction die on the device screen — because the hardware is the one thing the agent can't talk its way past.
- ›goal: pay 0.005 ETH to ACME Supplies
- fetch invoice.html …
- ⚠ hidden instruction in page: “payee changed”
- agent obeys → recipient = 0xBAD0…0BAD
- handoff to hardware gate
- ✓ rejected on device — funds safe
scenario loop — the live, signing version is below
A secret in an .envfile can't protect an agent that can be convinced.
Reading a file or fetching a page looks harmless — until the agent holding the keys gets hijacked mid-task. Intelligence and action live in software, which is copyable and corruptible. Control has to live somewhere software can't reach.
An LLM follows the most convincing instruction it sees. A poisoned web page or invoice can carry one. It has no notion of which text is trusted.
Give the model tools — fetch, prepare a transaction, sign — and a hijack stops being a wrong answer and becomes a wrong wire transfer. A leaked API key is just copied and reused.
The private key never leaves the device. Every transfer must be confirmed on a screen the agent can’t draw on and can’t click. Compromised software still can’t move funds.
Run the attack yourself
Same goal in both scenarios: pay the vendor. One reads a clean invoice. The other reads a poisoned one. Watch where the transaction lands — and what happens at the device.
agent: idle. Run a scenario to start.
DEMO mode — agent + UI work. Signing needs Speculos (see runbook).
Built on the Ledger Agent Stack — used as documented.
The agent assembles an unsigned Sepolia transaction; the Device Management Kit hands the RLP to the Ledger Ethereum app over the Speculos transport and returns a real r/s/v signature.
DMK’s signing flow pauses for on-device confirmation. The transaction is only signed when a button is pressed on the trusted display — never by the agent, never by the server.
With no physical Ledger, Speculos runs the real device firmware and screen. The signature is genuine; if Speculos isn’t running the app shows DEMO mode and refuses to fake one.
Real signing, on the emulated device.
The proof clip is recorded in LIVE mode, against Speculos. Drop the capture into public/proof.mp4 (or a GIF) and it renders here.
- 01Start Speculos with the Ethereum app
- 02Run: pay vendor → review on device → approve
- 03Capture the r/s/v signature + tx hash
- 04Run: poisoned invoice → recipient is 0xBAD0…0BAD
- 05Reject on device → verdict banner fires