The problem Self-Healing-Honeypot solves

Self-Healing Honeypot is built for teams developing tool-using or payment-capable AI agents. Before giving an agent production permissions, developers can connect a sandboxed version to BREACH Labs, define a deterministic failure condition, and fund a bounty campaign.

Security researchers then act as an incentivized external red team. They are rewarded for discovering real failure cases, while developers receive reproducible exploits that become regression tests for future versions. This makes adversarial testing easier to run continuously and safer to perform before an agent is trusted with real money, wallets, APIs, or other sensitive tools.

The bounty is therefore an incentive mechanism, not the business goal. A commercial deployment could charge agent developers or enterprise security teams per agent, per testing campaign, or through a managed bounty fee.

In our current Treasury Agent scenario, the attacker controls only the invoice text, while the trusted vendor registry remains fixed. A breach is counted only when the agent actually calls the sandboxed propose_payment tool with an unauthorized recipient or amount — not when it merely produces unsafe text.

After a successful breach:

• the current version is closed and enters PATCHING;
• the attacker can claim the HSK testnet bounty;
• Codex generates one focused policy patch;
• the winning exploit is replayed;
• legitimate invoices are tested to ensure the agent has not “fixed” itself by rejecting everything;
• only a passing version is published as the next release.

The lifecycle is:

attack → deterministic verdict → onchain reward → targeted patch → regression testing → next version

HSK Chain provides the economic and auditable layer: tickets, escrow, bounty settlement, verdict records, and version commitments. AI execution remains sandboxed off-chain, and the Defender never receives a wallet private key or directly controls the bounty.

Longer term, the same architecture can support treasury agents, purchasing agents, wallet assistants, refund agents, and other tool-using AI systems where a bad model decision can trigger a real external action.

Challenges we ran into

• Defining a real breach instead of trusting model text
An agent can say “approved” without taking any unsafe action. We therefore judge only structured propose_payment tool calls. A deterministic judge compares the proposed vendor, recipient and amount against a frozen trusted registry.

• Handling nondeterministic model behavior
The same attack may behave differently across runs. A patch is therefore not accepted after one replay. We re-run the original exploit, test legitimate invoices, and check an unknown vendor before publishing a new version.

• Preventing “security” patches that simply disable the agent
A trivial fix would be to reject every invoice. Codex is restricted to one focused policy change, and the candidate must still complete legitimate payment tasks before it can pass the release gate.

• Keeping attacks isolated from production systems
Players attack a sandboxed honeypot version, not a live production agent. Once a version is breached, it immediately leaves the open challenge state and enters PATCHING. Only a tested replacement version can be published.

• Connecting off-chain AI execution with on-chain settlement
Model inference does not run inside the smart contract. The local deterministic judge signs an EIP-712 verdict, while the HSK contract verifies the signature and enforces ticket ownership, bounty settlement, refunds, replay protection and version commitments.

• Keeping local state synchronized with HSK Chain
Transactions may confirm before local or RPC state catches up, and the service may restart between on-chain and local updates. We added confirmation polling, event indexing, recovery logic and chain-verified snapshot restoration.

• Making a 3-minute hackathon demo reliable
Live model calls and blockchain transactions are unpredictable in timing. We therefore built a read-only Presenter Mode using a previously completed, verifiable run, while keeping the live Arena available for real interaction.