> For the complete documentation index, see [llms.txt](https://railhood.gitbook.io/railhood-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://railhood.gitbook.io/railhood-docs/agents-on-glass.md). # Agents on glass ### Your agent is doxxing you People are wiring AI agents to real money — Robinhood's agentic accounts crossed 70,000 in six weeks. Put those agents on a public tape and four things break immediately. ### A public balance is a bounty poster Anyone can read the balance behind your agent, which means anyone can price the attack before running it. May 2026: a prompt injection drained \~$175,000 from a live AI trading wallet — Morse code hidden in a feed, a gifted NFT to widen permissions, funds gone in minutes. It's logged in the OECD AI Incident Monitor. The attacker knew the prize before lifting a finger, because the tape told them. ### Agents print their strategy every block An agent trades the same way every time — that's what makes it an agent. On a public tape, a week of watching its wallet gets an observer most of the way to the algorithm. Then they copy it, front-run it, or trade straight into it. In TradFi terms: your agent is a fund publishing its blotter in real time. ### The tape connects the agent to you The agent's wallet got funded from somewhere. Clustering — the standard chain-analysis toolkit — links the funder to the agent's entire public life in one query. A pseudonym isn't privacy when every action points home. ### And nobody is supervising Robinhood's own disclosure says it flat: it does not control, supervise, monitor, or audit third-party agents, and once your data reaches an AI provider "it leaves Robinhood's security environment." Maximum autonomy, zero oversight. That combination is the attack surface. ### What going off-market changes * **Caps the blast radius.** A hijacked agent can only reach the balance it holds. Your treasury sits off-market, unlinked — not one hop away on a block explorer. * **Kills the bounty.** No visible balance, nothing to price. * **Hides the pattern.** Off-market there's nothing to watch, so there's no strategy to reverse. * **Cuts the trail home.** The public link from agent to funder to you: broken at the pool boundary. Straight up: nothing stops an agent from getting fooled. Going off-market caps what fooling it pays. ### The fleet pattern The end state: one off-market treasury funding a fleet of single-purpose agents, each holding only its working float, each observable by you through its own viewing key, none linkable to each other or to you on the public tape. The treasury and per-agent controls land per the [Roadmap](/railhood-docs/roadmap.md); the primitive that makes it possible — the pool — is live now. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://railhood.gitbook.io/railhood-docs/agents-on-glass.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.