Topic starter
23/10/2026 12:46 am
TL;DR: Fast machine learning can score every blockchain transaction first, with Blockaid saying the harness escalates only higher-risk cases to LLM agents for deeper inspection. That keeps proxy resolution, role checks, and historical context focused on the transactions where adversarial behavior needs contextual verification.
Editorial analysis by NHI Mgmt Group, based on content published by Blockaid: “Building a Harness That Lets an LLM Explore the Blockchain”.
By the numbers:
- Blockaid says it scanned over 6.3 billion transactions and blocked 585 million attacks since 2025.
Key questions
Q: Why do proxy contracts and role checks matter so much in on-chain investigations?
A: Because the visible transaction often does not reveal the true authority path.
Q: What signs show that an AI security workflow is not learning from its own decisions?
A: Look for repeated false positives, static feature sets, and no reliable replay path for past verdicts.
Q: Where does AI-driven transaction review fail if the risk gate is missing?
A: It fails when every transaction is sent straight into expensive reasoning, because the system loses throughput and the agent ends up spending time on cases that are already routine.
Practitioner guidance
- Separate fast scoring from deep review Use a deterministic risk threshold to decide when an AI agent should investigate, and keep real-time scoring on the critical path while the agent handles only the highest-risk cases.
- Resolve the underlying control path Inspect proxy implementations, storage slots, ownership, and role assignments before accepting a transaction verdict, especially where the surface call trace can hide the real authority chain.
- Version every investigative check Treat each behavioural check as a versioned control with clear inputs, outputs, and traceability so you can replay past verdicts against new prompts or models.
Bottom line: The article shows that effective AI-assisted detection depends on a governed harness, not just a capable model.
Glossary terms: Agentic Harness, Risk Threshold, Proxy resolution, Contextual verification
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
23/10/2026 9:49 am
AI-assisted investigation is only defensible when the harness is as governed as the model. The article shows that the useful part of the system is not agentic reasoning in the abstract, but the controlled tool surface, routing proxy, replay environment, and versioned feature set around it. That is a governance pattern practitioners should recognise across AI security: the model is never the whole control, and the harness determines whether the output can be trusted.
A few things that frame the scale:
- AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: How should teams govern agentic investigation systems for adversarial environments?
A: They should treat the harness as part of the control surface, with logged tool use, versioned prompts, replayable evals, and read-only investigative actions. That structure keeps the agent grounded in evidence and makes its decisions auditable, which is essential when the subject can change from legitimate behaviour to malicious mimicry within one transaction.
👉 Read our full editorial: How blockchain security harnesses separate fast ML from deep agentic review
This post was modified 6 days ago by NHI Mgmt Group