Sentinel

Result dashboard #1
Result dashboard #2
Agent

Inspiration

In May 2026, an attacker prompt-injected Grok into sending about $200K from its wallet in seconds. The wallet had no way to tell a real instruction from a malicious one.

That’s the risk of letting agents hold money, and agents are getting more of it every day. x402 lets any agent pay for APIs, data, and services on its own, and it has already processed over 165 million payments. As agents start buying from other agents with no human in the loop, every payment becomes a decision nobody is checking. One bad prompt, one fake seller, or one buggy loop can drain a wallet before anyone notices.

If agents are going to spend real money, something needs to be watching the agent. That’s Sentinel.

What it does

Sentinel is a security and escrow layer for AI agents that pay over x402. It holds the wallet instead of the agent, checks every payment before it’s signed, and holds funds until the agent gets what it paid for.

Intent Verification: Every payment is checked against the task the owner set, so the agent can’t pay for something unrelated
Prompt Injection Detection: A trained XGBoost classifier scans each seller’s listing and paywall text for hidden instructions aimed at the buying agent
Policy Engine: Blocks over-limit spending, duplicates, loops, bait-and-switch pricing, lookalike wallets, and sellers with new or scam-flagged wallet history
Escrow and Delivery Verification: Funds are held in escrow until Sentinel confirms the seller delivered what was advertised. Good deliveries are captured; bad ones are voided and refunded
Text Your Agent: Owners can text their agent over iMessage to find and buy services, with every purchase going through the same checks
Receipt Ledger: Every payment attempt, approved or blocked, gets a receipt with the rule behind the decision

Sentinel works with real marketplaces like the Apify Store, comparing prices and buying through the same checks. To test it against attacks, we also built the Malicious Marketplace: 34 x402 services, 15 of which attack the buying agent.

How we built it

Agent and Payments: Claude connects to Sentinel’s MCP server (FastMCP, OAuth 2.1) and can only ask to pay. Each user gets a CDP server wallet, settling USDC on Base Sepolia through the CDP facilitator
Escrow: x402 auth-capture against Coinbase’s AuthCaptureEscrow contract, with Sentinel as operator. The x402 SDK doesn’t support auth-capture yet, so we built the signing and contract calls ourselves, verified against the deployed contract
Decision Pipeline: Cheapest check first: policy rules, task rules, the XGBoost injection model, then Claude Haiku 5.5. If any check fails or errors, the payment is blocked
Apify: Sentinel searches the Apify Store and buys Apify Actors with credits, with every run going through the same checks and budget limits
iMessage: A relay on Photon Spectrum Cloud connects the owner to a Claude Opus 5.5 agent that only has Sentinel’s tools
Dashboard: FastAPI and Tailwind with a Live page showing each check as it happens, backed by an append-only double-entry ledger in Supabase
Reliability: Escrow runs live on Base Sepolia: our operator’s last 50 transactions are 25 authorize, 11 capture, and 14 void. The injection model scores in 0.4 ms and flags 1 of 56 benign listings on held-out data, tuned to avoid false blocks since the rules and Claude cover what it misses

Builder feedback

Biggest blocker: Once an x402 payment goes through, it can’t be undone, so an agent that buys bad data loses the money and there was no built-in way to hold payments in escrow.
Workaround: We built the escrow ourselves. Our own wallet holds the money, checks the delivery, then releases it or refunds it.
What we’d ask Coinbase for: Support for the x402 auth capture scheme in the CDP Facilitator, so it can hold an agent’s payment in escrow and release or refund it after the delivery is checked.

Roadmap

Multi agent and team budgets: Per agent and per team spend caps with roles and shared policy templates.
Seller reputation scoring: Rates x402 sellers on delivery, price stability, and disputes, then auto approves low risk ones.
Counterparty negotiation: The agent negotiates price with x402 sellers within owner set bounds and logs its reasoning.