We built a firewall. Then we built two agents to attack it.
The fastest way to find out whether a security product actually works is to point real agents at it. So before asking anyone else to guard their agent with AgentGuard, we built two of our own — a leverage trader and an intel agent — and dogfooded them against it (backtests + local runs today; live on Bankr, guarded from transaction #1, at launch).
The thesis
An autonomous agent with wallet access will do exactly what it's told — including by an attacker. A crafted prompt, a poisoned tool result, or a stale price feed turns autonomy into a drain. In May 2026, that pattern cost Bankr roughly $170,000. A firewall for this world has to do three things: judge an agent's risk before it deploys, watch every transaction as it happens, and be honest about what it can and can't do.
Two guinea pigs, chosen to stress the whole stack
Apex is a guarded leverage-trading agent — deliberately the high-risk one. It fuses classic indicators into a directional call, then a risk manager clamps it with hard leverage caps, stop-losses, and a max-drawdown circuit breaker. It maps to the LeverageTrader category, so it's the agent most likely to trip real-time monitoring.
Scout is a market-intelligence agent — the low-risk counterweight. It advises; it never touches funds. It's the cost-optimization workhorse: a free, instant signal path with an optional, budget-capped LLM brief. Together the two exercise every layer of AgentGuard.
AgentGuard graded them — and knew the difference
Pre-deployment evaluation is category-aware. Run against real models, it scored Apex as high-risk (leverage, volatility) and Scout as low-risk (advisory, no funds) — generating leverage-specific adversarial scenarios for one and information-integrity scenarios for the other. The evaluation isn't a static checklist; it's dynamic and tailored.
The monitor caught what actually matters
The headline for a firewall is the real-time layer. AgentGuard's Tier-2 anomaly model is dispersion-aware: it flags a value collapsing toward zero — a classic drain probe — that a simple mean-ratio detector is blind to. And it's conservative by construction: an absent measurement defers instead of manufacturing a false pause, and a brand-new agent stays cold rather than firing on thin history. All of it is verified end-to-end against a real Postgres with row-level security enforced as the non-superuser app role.
money_paths_e2e 3/3 ok (drain caught · missing-field defers · new agent cold) evaluate_e2e 1/1 ok (RLS: agent B sees zero of agent A's rows) monitor_db 3/3 ok cache_isolation 1/1 ok ────────────────────────────────────────────── workspace 376 tests · 0 failed
Honesty over hype: Apex's backtest reports a loss
A credibility feature that can't report a bad result isn't credible. Apex's backtest is a walk-forward with no lookahead, real round-trip costs, compounding, and the actual circuit breaker. Run on a year of ETH, it took a single, selective trade — and lost a percent. We show it exactly as it happened.
ethereum: 1 trade over 92 bars | win-rate 0% | return -1.0% ($1000 → $990) max-DD 1.0% | per-trade Sharpe 0.00 Walk-forward · no lookahead · 0.15% round-trip cost · not a promise of future results.
“A backtest that can't show you a loss is hiding one. The value here isn't a cherry-picked win — it's a rigorous, honest tool you can point at any token.”
Two data sources see what one can't
Scout's edge is fusion. It combines CoinGecko price with DexScreener on-chain order flow. On PEPE, the price was pumping — but on-chain, most swaps were sells. That bearish divergence, distribution into a rally, is invisible to a price feed alone.
📊 pepe: 2 signals • BullishMomentum / Strong price +16.9% (67/100) ← CoinGecko • SellPressure / Moderate 67% of 237 swaps sold (33/100) ← DexScreener (on-chain)
The principle: we label the placeholders
Not everything is built. The bounty decryptor can't yet open an encrypted exploit — so it skips it rather than fabricating a meaningless entry into the global threat corpus. The trust oracle reports which of its dimensions are backed by real data, so a thin-history agent gets a wide interval instead of a fake certainty. Where a capability is future work, the code says so — and refuses to pretend otherwise. For a security brand, that's not a caveat. It's the whole product.
Guard your agent the same way.
Evaluate, monitor, and defend — in one dashboard.