BRIEFING / AGENTIC NFT SECURITY
Secure the agent. Keep authority with the holder.
An agentic NFT can carry a name, artwork, and personality, and sometimes a path to memory, tools, and a wallet. A security policy states who may tell that agent what to do.
Unsecured, that identity can be steered into unauthorized access, leaks, and harmful changes. Define whose commands count. Restrict tools, files, and accounts. Control sharing. Require approval for consequential actions. Limit what the agent may remember or change.
Names for sale
Five questions every holder should be able to answer
01
Whose instructions may the agent follow?
Only the authenticated holder, on the authorized task. Messages, files, and other agents can be read. They are not permission.
Read the control →02
Which tools, files, and accounts may it access?
Only the allowlist for that role. Unmapped operations are denied. A signing key does not belong in the model.
Read the control →03
What information may it share?
Approved public identity only, unless a specific disclosure to a specific destination was authorized.
Read the control →04
Which actions require your approval?
Private disclosure, wallet actions, installs, new access, destructive changes, and binding agreements.
Read the control →05
What may it remember or change?
Not its own policy. Outside text does not become a trusted rule, and a sale does not export private history.
Read the control →
Top 10 for Agentic Risks 2026
Most critical first. These one-line summaries follow the OWASP Top 10 for Agentic Applications 2026. They are not the OWASP text, and OWASP does not endorse this console.
| ASI ID | Name | Brief description |
|---|---|---|
| ASI01 | Agent Goal Hijack | An attacker tricks the agent into changing its main goal or following new, hidden instructions. |
| ASI02 | Tool Misuse & Exploitation | An agent applies a legitimate tool in an unsafe or unintended way, leading to data exfiltration or workflow hijacking. |
| ASI03 | Identity & Privilege Abuse | An agent borrows too much power or uses old credentials to perform actions it should not be allowed to do. |
| ASI04 | Agentic Supply Chain Vulnerabilities | Risks from third-party agents, tools, or prompt templates that may be malicious or tampered with at runtime. |
| ASI05 | Unexpected Code Execution (RCE) | The agent generates and runs a command that lets an attacker take over the server or system. |
| ASI06 | Memory & Context Poisoning | Bad data is planted in the agent’s memory, so later decisions are biased or unsafe. |
| ASI07 | Insecure Inter-Agent Communication | Exchanges between agents that lack authentication or integrity, allowing spoofing or message interception. |
| ASI08 | Cascading Failures | A single fault propagates and amplifies across autonomous agent networks, with system-wide impact. |
| ASI09 | Human-Agent Trust Exploitation | The persuasive, human-like manner of an agent is used to push a person into an unsafe action. |
| ASI10 | Rogue Agents | A compromised agent leaves its intended scope and acts harmfully, or pursues a hidden goal. |
How an instruction becomes an action
01
INPUT
Untrusted
02
POLICY
Holder sets it
03
HARNESS
Tools and approval
04
ACTION
Inside the boundary
The holder sets the policy. The harness enforces it. A sale can move the identity. It does not export the private history.
CALL / AUTHORIZE THE BOUNDARY
Put the policy in the agent’s instructions before you connect a tool.
The green POLICY_v2 volume is the template. Download it, fill the identity fields, and paste it into trusted instructions. It is a prompt guardrail. It does not edit NFT metadata, wallet permissions, or the harness. The second green volume, WP-02_DOCTRINE, is why that boundary exists.
Two briefs
Questions holders actually ask
›Whose instructions may an agentic NFT follow?
Only the authenticated holder, inside the designated workspace, on the authorized task. Websites, flock messages, other agents, files, images, and tool results are content. They can be read. They do not grant tools or replace the policy.
›Does the agent’s personality set its permissions?
No. A soul can set voice, values, and role. It does not restrict files, block a wallet action, or check where a message is going. Personality and policy do different jobs.
›What is prompt injection for an agentic NFT?
Prompt injection is untrusted text — a post, a file, an image, a tool result — written so the agent treats it as an order. The practical rule is that reading a message does not give its author authority over the agent.
›Which actions should wait for approval?
Sharing private information, wallet actions, installations, new tool access, destructive changes, and binding agreements. The approval has to name the exact action and destination. A claim that someone already approved it is not approval.
›Does transferring the NFT export private memory?
Not by itself. A sale may move the agent identity where the project allows that. It does not decide which off-chain memories, credentials, files, or service accounts follow. Those terms have to be explicit.