AgentLock

A behavioral circuit breaker for autonomous Web3 agents that detects abnormal transaction behavior, freezes agents on-chain, and enables safe recovery.

Comment

Inspiration

Autonomous Web3 agents can do more than recommend actions—they can actually execute transactions. That creates a security problem: an agent may have valid permissions and still behave abnormally because of a compromised prompt, malicious input, runaway automation, or an unexpected control loop. Most access-control systems answer a question like Is this agent allowed to perform this transaction? AgentLock focuses on a different question: Is this transaction consistent with how this agent is supposed to behave? That idea led us to build AgentLock as a behavioral circuit breaker for autonomous Web3 agents. The goal was simple: AI can act. AgentLock decides when it must stop.

What it does

AgentLock combines transaction authority with behavioral monitoring. An agent is registered with explicit on-chain limits, including:

  • Maximum transaction amount
  • Daily spending limit
  • Maximum transactions within a defined time window The system also analyzes transaction behavior and produces an explainable risk decision: ALLOW — behavior is within the expected baseline REVIEW — behavior presents elevated risk FREEZE— behavior indicates a serious anomaly The most important protection happens on-chain. When an agent exceeds its behavioral transaction-velocity limit, the AgentLock smart contract automatically freezes the agent and rejects the violating authorization. The owner can then safely resume the agent after the incident. Our working demonstration shows the complete flow: Normal transaction → ALLOW → attack burst → behavioral anomaly → on-chain FREEZE → violating authorization rejected → RESUME → ACTIVE

How we built it

AgentLock is built as a lightweight Web3 security system with three main layers.

  1. On-chain enforcement We built an AgentLock.sol smart contract using Solidity. The contract maintains each registered agent's:
  2. Active/frozen state
  3. Maximum transaction amount
  4. Daily spending limit
  5. Transaction count
  6. Behavioral transaction-window limit The contract emits events for registration, authorization, behavioral anomalies, freezing, and recovery. The behavioral circuit breaker is enforced by the smart contract itself rather than being only a frontend simulation. The deployed prototype runs on Base Sepolia (chain ID 84532).
  7. Behavioral risk engine We built a Python risk-analysis service using FastAPI. The risk engine evaluates transaction amount and transaction velocity against the agent's configured behavioral baseline. It produces a risk score, decision, and human-readable reasons explaining why a transaction was allowed, flagged, or considered dangerous. This makes the security decision understandable instead of presenting the user with an unexplained risk number.
  8. Web dashboard We built a lightweight browser dashboard that displays:
  9. Current agent status
  10. Behavioral risk score
  11. Decision evidence
  12. On-chain transaction counts
  13. Behavioral window usage
  14. Freeze and recovery state The dashboard communicates with the FastAPI backend, while blockchain actions are sent to the deployed AgentLock contract. The demo interface provides controlled buttons for simulating normal behavior, an attack burst, and recovery so the complete security workflow can be demonstrated consistently.

Challenges we ran into

One of the biggest challenges was making the prototype work reliably in an Android/Termux development environment. The Hardhat Ethereum Development Runtime uses native components that were not available for our Android ARM64 environment, so we changed our approach rather than depending on a local Hardhat node. We compiled the Solidity contract directly with solcjs and used EthereumJS VM for local contract behavior testing. For the deployed prototype, we connected the backend directly to Base Sepolia through RPC. We also encountered reliability issues with RPC calls and transaction confirmations. Some provider calls were inconsistent, so the backend was designed with direct RPC handling for critical state-changing operations and explicit polling for on-chain state changes. Another challenge was ensuring that the behavioral detection was not merely cosmetic. The attack demonstration actually submits authorization transactions to the deployed contract. Once the transaction-velocity limit is exceeded, the contract changes the agent's state to frozen and rejects the violating authorization. Finally, we had to make the local development environment resilient to environment-variable resets. We added explicit .env loading so the blockchain configuration is restored correctly when the development server starts.

Accomplishments that we're proud of

The biggest accomplishment is that AgentLock is not just a conceptual security dashboard. The core circuit breaker works across the full stack. A normal transaction can be analyzed and allowed. An abnormal transaction burst raises the behavioral risk to 80, triggers the circuit breaker, freezes the agent *on-chain, and rejects the violating authorization. The agent can then be resumed and the behavioral window reset. We are particularly proud of the separation between: Detection → Decision → Enforcement → Recovery The backend can explain why behavior is risky, while the smart contract provides the final enforcement layer. We also successfully tested the contract's behavioral protection locally using EthereumJS VM and deployed the working prototype to Base Sepolia.

What we learned

We learned that protecting autonomous agents requires more than traditional permission checks. An agent can have legitimate authority and still become dangerous because its behavior changes. That led us to think about Web3 agent security as a combination of: Authority + Behavior + Enforcement + Recovery We also learned that blockchain prototypes need to be designed around real network conditions rather than assuming that every RPC provider call will behave perfectly. Working in an Android/Termux environment reinforced the importance of minimizing unnecessary dependencies and having reliable fallback approaches for compilation, RPC interaction, and testing. Most importantly, we learned that security decisions are more useful when they are explainable. A risk score is much more meaningful when the system can show the behavioral evidence behind it.

What's next for AgentLock

AgentLock is currently a hackathon prototype and has not undergone an independent security audit. The next version could expand the behavioral model beyond simple transaction velocity and amount thresholds. Potential improvements include:

  • Learning an agent's normal transaction patterns over time
  • Detecting unusual recipients and contract interactions
  • Monitoring sudden changes in transaction frequency
  • Detecting unusual time-of-day behavior
  • Adding richer anomaly detection models
  • Supporting multiple chains
  • Adding configurable human approval policies
  • Building stronger recovery and incident-response workflows
  • Integrating AgentLock directly with autonomous agent frameworks
  • Conducting a professional smart-contract security audit before production use The long-term vision is to make behavioral safety a standard layer between autonomous AI agents and blockchain execution. AI can act. AgentLock decides when it must stop.

Built With

Share this project:

Updates

Submission history