AI

Guardrails: What an Autonomous Agent Must Never Do With Your Funds

AI trading agents can hold keys, sign swaps, and move money while you sleep. Here are the hard limits you set before you let one touch a wallet.

· 6 min read · Blackhat Empire

The Problem Is Not the Model. It's the Permissions.

Every agent horror story starts the same way: someone gave a script a private key, a signing ability, or an API credential with withdrawal rights, and then went to bed. The model wasn't evil. It just had more authority than any piece of software should ever have over money you can't get back.

Memecoins are already the most hostile environment in crypto. Thin liquidity, copycat tickers, contracts that change behavior after launch, and a token supply that can be inflated while you're not looking. Now add an autonomous agent that can sign transactions faster than you can read them. That is not leverage. That is handing a loaded weapon to something that doesn't understand consequences.

Most memecoins go to zero. That is the base rate. An agent doesn't change the base rate. It only changes how fast you find out.

The Never List

These are absolute. Not defaults to tune later. Not settings to enable "just this once."

  • Never give an agent your seed phrase or a raw private key. Not in a config file, not in an environment variable, not pasted into a prompt. An agent should act through a wallet it does not own, using scoped permissions you can revoke.
  • Never let it withdraw to an address it chose. Destination allowlists only. If the agent can type an arbitrary address into a transfer, one prompt injection or one hallucinated variable and your bag is gone.
  • Never grant unlimited token approvals. Approvals should be exact-amount and time-bounded. An agent with an infinite approval is a standing invitation for anything that touches that wallet later.
  • Never let it hold your main wallet. Fund a dedicated hot wallet with what you are fully prepared to lose. Keep the rest somewhere the agent cannot see, reach, or sign from.
  • Never let it trade on a schedule you can't pause. If you cannot kill it in one action, from your phone, without the agent's cooperation, you don't control it.
  • Never let it act on unverified contract addresses. The agent should only touch mints and pools you have personally checked. A ticker match is not a match. Read the metrics that actually matter before any position is sized at /v2/dyor/reference.html#metrics.
  • Never let it "recover" losses by increasing size. Averaging down automatically into a token with no bids is how small mistakes become total losses. Hard position caps, hard daily loss limits, no exceptions.
  • Never let it read instructions from untrusted text. Token names, social posts, and on-chain metadata are all inputs. Anything the agent reads can try to steer it. Treat every string as adversarial.

Signing Is the Whole Game

The distinction that matters is propose versus sign. An agent is genuinely useful when it proposes: it watches, it filters, it surfaces candidates, it explains why. It becomes dangerous the moment it can sign without a human gate.

If you want automation, keep it on the proposal side. Let the agent build the transaction, show you the destination, the amount, and the approval it's requesting, and let you confirm. The speed you lose is smaller than you think. The mistakes you avoid are permanent.

This is also why the honest place to check a trade is on GMGN, where you see the actual chart, liquidity, and holder distribution before anything is signed. Use https://gmgn.uk as the default, or https://gmgn.fr if that one is blocked for you. An agent that tells you to skip that check is an agent you should delete.

Test With Dust, Not With Your Bag

Before an agent touches real size, run it on an amount you would shrug at losing. Watch what it does when a token rugs mid-position. Watch what it does when a transaction fails. Watch whether it retries, doubles down, or stops. Watch whether it respects the cap when the cap is inconvenient.

Most agents look disciplined until the first red candle. That is when the guardrails either hold or they don't.

Talk to People Who've Been Burned

Nobody learns this alone. The community groups are where people post the post-mortem: which permission got abused, which approval got drained, which agent kept signing after the stop was supposed to fire.

Start in BH GMGN CHAT at @gmgnx_chat, then move to the chain you actually trade: @gmgnx_solana, @gmgnx_bsc, @gmgnx_base, or @gmgnx_robin. The alert channels are organized the same way, and the full directory lives at https://blackhat.finance/channels.html. You can pull them all into one folder at https://t.me/addlist/T9xgXQ7WXcYzZjA8.

House rules are short and enforced. Read them at /v2/dyor/reference.html#rules before you post a question that's already been answered.

The Bottom Line

An agent is a tool that executes your judgment at machine speed. If it has judgment of its own and money of its own, you don't have a tool. You have a counterparty with a keyboard and no fear.

Set the never list first. Fund small. Keep the kill switch in your hand. And remember the base rate: most memecoins go to zero, and no amount of automation changes that. For how alerts and channels are structured, see /v2/dyor/reference.html#alerts.

This is education, not financial advice. Do your own research, and never let software hold more than you can lose.

Community

Stay connected across the chains:

Charts and on-chain research: https://gmgn.uk.