TL;DR: A blockchain investigation harness uses fast, explainable machine learning to score every transaction, then escalates only higher-risk cases to LLM-powered agents that inspect bytecode, proxies, roles, storage slots, and historical transfer patterns, according to Blockaid research. The core shift is that agentic review becomes a selective verification layer, not a blanket replacement for real-time detection, which is the right pattern when throughput and adversarial context both matter.
At a glance
What this is: Blockaid outlines an agentic blockchain investigation harness that pairs real-time ML scoring with deeper LLM-led verification for higher-risk transactions.
Why it matters: It matters because security teams evaluating AI agents need to understand where agentic reasoning should verify evidence, not sit on the critical path for every event.
By the numbers:
- Blockaid says it scanned over 6.3 billion transactions and blocked 585 million attacks since 2025.
Context
A blockchain security harness is the orchestration layer that decides what a model can inspect, what tools it can use, and when to escalate a case for deeper review. In this article, the central governance problem is not just detection accuracy, but how to combine machine speed with human-like investigation in a hostile environment where adversaries can imitate legitimate behaviour.
The article is also relevant to identity governance because the investigation depends on resolving role ownership, proxy admins, smart-wallet controllers, and other machine identities that act on-chain. That makes the work closer to NHI governance than to generic analytics, because the system must verify who or what is authorised before it can decide whether a transaction is malicious or legitimate. This is atypical only in the sense that most security stacks still treat those identities as metadata rather than as governed access objects.
Key questions
Q: Where does AI-driven transaction review fail if the risk gate is missing?
A: It fails when every transaction is sent straight into expensive reasoning, because the system loses throughput and the agent ends up spending time on cases that are already routine. A risk gate keeps deep investigation focused on the transactions where context, authorisation, or contract behaviour genuinely needs verification before a decision is made.
Q: Why do proxy contracts and role checks matter so much in on-chain investigations?
A: Because the visible transaction often does not reveal the true authority path. Proxies, storage indirection, and delegated roles can make a legitimate withdrawal look like an exploit, or hide an exploit behind normal-looking calls. If investigators do not resolve the implementation and the acting role, they can misclassify the event.
Q: What signs show that an AI security workflow is not learning from its own decisions?
A: Look for repeated false positives, static feature sets, and no reliable replay path for past verdicts. If the team cannot rerun older cases against a new prompt, model, or feature version, then the workflow is producing isolated answers rather than building a durable detection system that improves over time.
Q: How should teams govern agentic investigation systems for adversarial environments?
A: They should treat the harness as part of the control surface, with logged tool use, versioned prompts, replayable evals, and read-only investigative actions. That structure keeps the agent grounded in evidence and makes its decisions auditable, which is essential when the subject can change from legitimate behaviour to malicious mimicry within one transaction.
Technical breakdown
Why an agentic harness needs a risk gate
An agentic harness is the control plane around a model, not the model itself. In this design, an explainable ML classifier scores every transaction first, then only higher-risk items are handed to slower LLM agents for deeper inspection. That separation matters because the LLM is being used where context, reasoning, and tool use add value, while the classifier keeps the system viable at blockchain throughput. The important architectural point is that escalation is driven by scored risk, not model uncertainty. The system therefore treats the agent as an expensive verifier that works on the cases most likely to justify the cost.
Practical implication: Use a fast deterministic gate before agentic review so the model only investigates the cases that merit deeper context.
How proxy, storage, and role resolution change the evidence model
A blockchain investigator cannot trust the surface view of a transaction, because proxies, delegated roles, and storage indirection can hide the real control path. The harness therefore reads raw RPC data, resolves EIP-1967 proxy slots, inspects call traces, checks owner and role status, and simulates transactions in a sandbox. That gives the agent the same evidence a security researcher would assemble manually, instead of relying on an explorer summary that can miss the actual implementation or the controlling account. In identity terms, this is a machine-identity verification problem as much as a transaction analysis problem.
Practical implication: Verify the underlying implementation and authorisation path before trusting any transaction verdict.
Why feedback loops matter more than one-off verdicts
The system does more than classify suspicious activity. Every agent verdict becomes a labelled example that improves the faster model, while repeated manual checks can be promoted into precomputed features. That creates a ratchet effect: expensive reasoning teaches the cheaper layer, and the cheaper layer absorbs more of the routine work over time. The architectural lesson is that agentic systems become trustworthy faster when their outputs are replayable, versioned, and auditable. Without that loop, the organisation gets isolated verdicts instead of a learning detection system.
Practical implication: Build replayable evals and versioned features so agentic decisions improve the underlying detection pipeline over time.
Threat narrative
Attacker objective: The attacker objective is to make malicious on-chain activity look structurally similar to legitimate contract behaviour long enough to evade or confuse detection.
- Entry occurs when a transaction or contract interaction looks suspicious enough to cross the ML risk threshold and enter the investigative path.
- Escalation happens as the harness resolves proxies, reads storage, checks roles, and simulates execution to determine whether the behaviour is malicious or legitimate.
- Impact is either a confirmed exploit alert or a cleared false positive, with the verdict and supporting evidence fed back into the detection pipeline.
Breaches seen in the wild
- Moltbook AI agent keys breach: Moltbook breach exposed 1.5M AI agent keys.
- DeepSeek database exposure 2025: An unauthenticated DeepSeek ClickHouse database exposed over a million log lines with plaintext chat history and API keys in 2025.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
AI-assisted investigation is only defensible when the harness is as governed as the model. The article shows that the useful part of the system is not agentic reasoning in the abstract, but the controlled tool surface, routing proxy, replay environment, and versioned feature set around it. That is a governance pattern practitioners should recognise across AI security: the model is never the whole control, and the harness determines whether the output can be trusted.
Machine identity is the real governance substrate in on-chain security. The investigation succeeds because it can verify which wallet, proxy admin, contract role, or keeper is actually acting. That makes this a strong example of NHI-style governance applied outside traditional IAM, where the question is not user login but whether a non-human actor really holds the authority it claims to hold.
Continuous evaluation is the deciding control, not a one-time model choice. The article’s replay loop, labelled verdicts, and feature versioning show that detection quality improves when every decision is testable against history. For practitioners, that means the lasting control problem is not simply choosing AI or ML, but establishing a governed feedback loop that keeps either one honest.
Contextual verification is the named concept this article sharpens. The harness works because it reconstructs the surrounding evidence a single transaction does not contain, including ownership, proxy structure, historical patterns, and contract labels. In adversarial environments, contextual verification is the discipline that separates a suspicious trace from a real compromise, and practitioners should treat it as a core design requirement rather than an optional enrichment layer.
From our research library:
- AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
- Read next: LLM Provider API Key Security and LLMjacking Guide
What this signals
Contextual verification: security teams building agentic detection should assume that isolated evidence will be misleading in adversarial environments. The operational question is not whether an AI can reason, but whether it can reconstruct enough context to separate a malicious pattern from a legitimate one before escalation closes.
Onchain investigation is a useful analogue for broader AI governance because the same control pattern applies to LLM systems that handle sensitive workflows. When a model is allowed to verify, trace, and explain its reasoning through governed tools, the organisation can move expensive analysis off the human critical path without surrendering accountability.
AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026. That reinforces the need to govern the harness, the tooling layer, and the credentials around an agent, not just the model itself.
For practitioners
- Separate fast scoring from deep review Use a deterministic risk threshold to decide when an AI agent should investigate, and keep real-time scoring on the critical path while the agent handles only the highest-risk cases.
- Resolve the underlying control path Inspect proxy implementations, storage slots, ownership, and role assignments before accepting a transaction verdict, especially where the surface call trace can hide the real authority chain.
- Version every investigative check Treat each behavioural check as a versioned control with clear inputs, outputs, and traceability so you can replay past verdicts against new prompts or models.
- Feed cleared cases back into detection Promote repeatable false-positive resolutions into labels and features so the cheaper classifier inherits what the agent learned instead of rediscovering it each time.
Key takeaways
- The article shows that effective AI-assisted detection depends on a governed harness, not just a capable model.
- Proxy resolution, role checks, and historical context are the controls that prevent adversarial on-chain behaviour from being misread as a breach.
- The operational lesson is to let fast classifiers triage scale while agentic systems verify the high-risk cases that need contextual evidence.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | The article centers on verifying non-human actors such as wallets, proxies, and contract controllers. |
| NHI-05 — Overprivileged NHI | Role and proxy-admin checks are used to confirm whether a non-human actor has the authority it exercises. | |
| NHI-10 — Human Use of NHI | The harness translates researcher judgement into machine-assisted investigation over non-human accounts and contracts. | |
| Recommendation — Verify machine and wallet identity before trusting a transaction verdict. Audit non-human role grants and remove unnecessary authority from contract controllers. Govern human-operated workflows that trigger or validate non-human identity actions. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | The article’s threat pattern involves verifying whether suspicious on-chain activity is an exploit or legitimate movement. |
| Recommendation — Map suspicious transfers and authority changes to credential access and lateral movement patterns. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article repeatedly hinges on whether a non-human actor is actually authorised to act. |
| Recommendation — Use entitlement reviews to confirm that on-chain actors only exercise approved permissions. | ||
Key terms
- Agentic Harness: The orchestration layer that lets a model choose tools, execute actions, and repeat a task loop until a goal is met. In practice, it is what turns a model from a responder into an actor, so identity and privilege controls must govern the harness, not just the model.
- Risk Threshold: A risk threshold is the pre-agreed point at which a vendor risk score triggers a specific action, such as remediation, escalation, or rejection. Without a threshold, scoring becomes descriptive only and does not create a reliable governance decision.
- Proxy resolution: The process of identifying the real implementation behind a proxy contract by reading storage slots and related metadata. This matters because surface-level contract calls can hide the true code path, control structure, or authority behind a blockchain interaction.
- Contextual verification: Contextual verification is a layered approval or validation step that uses surrounding signals such as role, device, location, urgency, and request history before allowing an action. It is stronger than password-only checking because it tests whether the request fits the expected operating context.
Deepen your knowledge
NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and agentic AI identity. It helps practitioners build the control thinking needed for systems where non-human actors make or influence security decisions.
Published by the NHIMG editorial team on October 16, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org