Hook
The manifesto went viral in about six hours. A developer working on Claude-authored code published an argument that models should be allowed to ship their own changes — that human review is the bottleneck, that the loop closes faster with nobody standing in it. By the time I read it, three separate group chats were arguing about consciousness. Zero were arguing about blast radius.
Then Emi Yoshikawa, who spent the better part of a decade as a Ripple VP before stepping away, answered it. Not with philosophy. With the thing that actually matters. And within days the fintech desk chatter rotated from "how fast can we deploy agents" to "how do we contain the ones we already deployed."
That rotation is the story. Not the manifesto. The market's response to it.
I didn't read the manifesto as a philosophy problem. Nobody who has signed a transaction from a hot key did. I've run autonomous agents against Flashbots with real size — $200,000 allocated, 10,000-plus executions, a 98% success rate, roughly $45,000 net. That's the number I put in a deck. Here's the number I don't: the count of days I could not reconstruct why a specific trade fired. It is not zero, and it is the only number a regulator will ever care about.
The code doesn't get nervous. The model doesn't get nervous either. That's the problem.
Context
Yoshikawa's seat at Ripple was strategic initiatives and partnerships — the person who translates XRPL plumbing into language a bank's innovation committee can sign. When someone with that résumé responds to a viral claim about AI autonomy, they are responding as a person who has sat in the room where a nine-figure institution decides whether a piece of software is allowed to touch money.
That room has a vocabulary crypto mostly ignores. Model inventory. Model owner. Independent validation. Effective challenge. Change management. Ongoing monitoring. Those phrases come from SR 11-7, the Fed and OCC guidance on model risk management. It was written in 2011. It predates transformers by years. It still governs.
Fintech firms are not suddenly preparing for internal AI risk because of a manifesto. They are preparing because the OCC, the Fed, the FDIC and the EU AI Act all converged on the same operating assumption: a model that materially affects customers is a model that must be inventoried, validated by someone who did not build it, and monitored after deployment for drift. Chinese walls. Evidence trails. Escalation paths with names attached.
Crypto has none of that. Crypto has audit firms that read code once at launch and never again. Crypto has a multisig with three signers in a group chat. Crypto has "ownership renounced" standing in for a control environment.
I spent six months in 2018 auditing lending contracts out of a dorm room in Istanbul, post-ICO-crash, broke and bored. I found three reentrancy paths in early lending interfaces and submitted patches to their repositories. The lesson was not "code is dangerous." The lesson was that a vulnerability report is worth exactly nothing unless someone with authority is obligated to read it. That obligation is a governance artifact, not a technical one. Fintech built the artifact. DeFi built a Discord.
So when the fintech market says it is preparing for internal AI risk, it means something narrow and specific: it is writing the agent into the model inventory. Giving it a name, an owner, a materiality tier, a validation cadence. Deciding, in writing, what it can do without a human signature. That is the part worth stealing. Not the manifesto.
Core
Strip an autonomous agent down and there are three layers where it can hurt you. Model layer. Orchestration layer. Execution layer. Almost every public discussion collapses them into one, which is why almost every public discussion is useless.
Model layer failure is the boring one. The model hallucinates a token address. It misreads a decimals field. It confabulates a TVL figure from training data. Everyone knows this. Everyone tested for it once, in a notebook, in March, and moved on.
Orchestration layer failure is the dangerous one. The model is fine. The prompt is fine. What breaks is the handoff — the tool-call schema that lets the model pick a contract, the retry logic that fires a second order when the first one times out at the RPC, the context window that silently drops the position-size constraint because a long Telegram thread pushed it past the truncation boundary. I have watched a retry loop double a position on forked state with real liquidity. Nothing threw an error. Nothing logged a warning. That is the shape of it.
Execution layer failure is the one that empties the account. A bad nonce. A stale gas estimate. A signed transaction resting in a mempool the agent believes is empty.
On-chain execution is deterministic. The model that produces it is not. That asymmetry is the whole tension, and it is the Internal AI Risk that fintech is writing policy for while crypto insists it is just "ops." Ethereum hands you replayable state, permanent logs, a receipt with a hash you can subpoena. A language model hands you a probabilistic token prediction with a temperature parameter and no memory. Bolt one to the other and you get a system whose decisions cannot be reproduced but whose consequences can never be erased.
Here is what I enforce at the boundary. Not in the prompt. In the transaction path.
// AgentPolicyModule.sol — limits live on-chain, not in a prompt
function validateUserOp(UserOperation calldata op, bytes32, uint256)
external view returns (uint256)
{
if (op.callData.length > MAX_CALLDATA) revert CalldataTooLarge();
bytes4 selector = bytes4(op.callData[:4]);
if (!selectorAllowlist[selector]) revert SelectorNotAllowed();
if (!targetAllowlist[op.to]) revert TargetNotAllowed();
uint256 value = abi.decode(op.callData[4:36], (uint256));
if (value > epochCap[op.sender]) revert CapExceeded();
return 0; // VALIDATION_SUCCESS
}The specifics do not matter. The location does. If a limit is enforced by the prompt, it is not a limit. It is a suggestion made to a stochastic process. Every constraint that matters has to live somewhere the model cannot reach — a validation module, a session-key scope, a paymaster policy, a circuit breaker in the contract itself. The model's job is to propose. The contract's job is to refuse.
Second layer: simulate before signing. Every time.
const sim = await provider.send("eth_call", [tx, "latest"]);
const lossUsd = sim.balanceDeltas
.filter(d => d.usd < 0)
.reduce((a, d) => a + d.usd, 0);
if (-lossUsd > MAX_LOSS_USD) throw new Error("SIM_LOSS_BREACH");
if (sim.logs.filter(isSwapEvent).length !== 1)
throw new Error("SIM_SHAPE_UNEXPECTED");
if (!sim.touched.every(a => targetAllowlist.has(a)))
throw new Error("SIM_UNINDEXED_CONTRACT");I check three things on every agent-signed transaction against forked state: net USD delta, log shape, and the set of touched contracts. If the log shape does not match the stated intent — one swap event, not three — the transaction does not go. Not because I am clever. Because in 2024 I let a router hop through a contract I had not indexed, and the log shape was the only signal that would have caught it. The code didn't protect me. I had to make the code protect me.
Prompt injection deserves more space than it gets, and it gets almost none. An agent stack reads RPC responses, token metadata, ENS text records, NFT descriptions, Telegram messages, docs, PDFs, invoices. Every one of those is a channel into the context window. A token name is a string field. A string field can carry an instruction. There is no clean separation between data and instruction inside a transformer, and anyone who tells you otherwise has not read their own logs.
The mitigation is not a filter. Filters are probabilistic, which puts them back in the layer that already failed. The mitigation is capability starvation. Give the agent a session key that can call two selectors on two addresses, with a per-epoch cap and a revocation path you have actually exercised. Test the revoke. Put it in the runbook. Rehearse it at 3am with someone watching. A kill switch you have never pulled is a hypothesis, not a control.
I learned the shape of this in 2025. Small fleet of agents on Flashbots, MEV-resistant routing, $200,000 allocation, 10,000-plus executions, 98% success, about $45,000 net. A good quarter. In a bull market, anyone can be a genius. The 98% is the number that gets quoted and it tells you almost nothing. What tells you something: revert rate broken out by hour of day. Slippage in basis points against a post-trade benchmark rather than against the pre-trade quote, because pre-trade quotes are marketing. p50 and p99 of decision-to-signature latency. Gas paid versus median gas for the same selector in the same block. An agent that is fast and dumb looks identical to an agent that is slow and smart until you break out the distribution. Averages are where alpha goes to hide.
Alpha isn't a model. It is the spread between what your agent can do and what your counterparty's agent can do, measured in milliseconds and enforced by capital. Everyone has a model now. Almost nobody has a control environment. That spread is where the edge is extracted from the chaos.
Restaking taught me the same lesson in a different costume. In 2023 I ran an early EigenLayer testnet operator, $100,000 staked across several AVSs, and I spent most of my time on latency — pruning peers, tuning the RPC path, shrinking the gap between task assignment and response. That bought me roughly 15% more daily yield than the network average. Restaking is leverage, but sleep is priceless. The interesting part was never the yield. It was the slashing condition. Slashing is the only mechanism I have seen in this industry that prices a mistake in real time and makes someone other than the user absorb the cost.
Now map that onto AI oracles. An AVS that attests to a model's output — a price feed, an inference result, a risk score, a liquidation flag — creates the first honest incentive structure for AI risk in existence. If your model is wrong and you are bonded, you lose. If you are not bonded, you are a blog post with an API key. Most of what markets itself as AI-plus-crypto right now is the second thing.
And this is where I push back on the industry's favorite infrastructure story. Cross-chain messaging that depends on an external oracle set plus a relayer set is a trust assumption wearing decentralization language as a costume. If your agent's emergency stop travels over that path, your emergency stop has a counterparty. I would rather run a local, boring, hardware-backed revocation than an elegant modular one that depends on two off-chain groups behaving on a bad Tuesday.
Same logic explains why the fintech side is not waiting for public chains. A bank that inventories an AI model has to prove to an examiner who owns it, who validated it, what it can touch, and how it is monitored for drift. It needs a control plane it can point at in a hearing. That is not a public mempool. Those conversations are happening in permissioned environments with private execution and named accountability, and the public-chain version is, at best, a settlement leg at the end. Watch where the engineers go, not where the announcements go.
Here is the piece I have not seen anyone articulate, and it is the reason this viral moment actually matters. The on-chain primitives fintech needs already exist, and nobody has wired them to agent policy modules. Attestation registries can carry a hash of the agent's policy module and its version. Slashing conditions can price a policy violation. Drift monitors can publish signed attestations when a model's output distribution shifts beyond a threshold. Version the prompt, hash it, attest the hash alongside every transaction the agent signs, and post-mortems stop being archaeology and become deterministic replays. That is not a research problem. That is a weekend of Solidity and a change to your logging pipeline. The gap between what is possible and what is deployed here is the entire arbitrage.
Contrarian
Everyone is debating whether the model is safe. The model is not the risk.
The risk is the human who disabled the simulator at 2:47am because the agent was missing fills, and then forgot to re-enable it, and then went to a conference. The risk is the engineer who gave the agent a broader session key "temporarily" during the TestFlight. The risk is the founder who shipped the manifesto's thesis as an operating principle because it read like a competitive advantage. We don't need a smarter model to blow up an account. We need one tired person with deploy rights and a deadline.
Second blind spot: the narrative gets monetized before anything breaks. "AI risk" is already becoming a SKU. Expect audit badges for AI stacks within two quarters — issued by firms that will read your prompt file, not your execution path. I watched "audited" become a marketing sticker on contracts that were drained within a month of the badge being minted. The same thing is about to happen with models, and it will happen faster, because the artifact being audited is non-deterministic and therefore impossible to falsify after the fact. That is a beautiful business. For the auditor.
Third, and this one will annoy people: read Yoshikawa's response as positioning, not as a rebuttal. A former Ripple VP answering a Claude developer's manifesto is not a philosophical exchange. Ripple has spent years pushing toward institutional rails, custody, compliance, settlement. The AI risk conversation is a door into the room where those decisions get made. When a person with that résumé engages a viral AI thread, they are claiming a lane. That is not cynicism. It is pattern recognition. I did the same thing on Telegram in 2022 when I shorted LUNA into the oracle break — nobody was talking about manipulation mechanics, so I talked about manipulation mechanics, and it built a book of business.
And the manifesto itself? It is three things stacked. A recruiting document. A fundraising narrative. A liability disclaimer dressed as a vision statement. Crypto is very good at mistaking the third for the first two. Trust the math, fear the hype, ignore the noise.
Takeaway
The signal to watch is not the next manifesto. It is the first attestation registry that publishes agent policy-module hashes with real economic weight behind them, and the first slashed AI oracle whose slashing event is public and replayable. When that happens, AI risk stops being a talking point and starts being a price.
Until then, the honest position is that most deployed agents are running on vibes, session keys and a group chat — and the fintech market's sudden allergy to internal AI risk is not paranoia. It is the sound of people who have actually been examined, telling the rest of us what is coming.
The code doesn't care about your narrative. The question is whether your kill switch works when you finally need it — and whether you have ever, even once, pulled it on purpose.