Make AI agents
worthy of trust.
AI safety is custodial.
Today, every AI safety claim depends on trusting whoever publishes it. Evals run privately, red-team results come out as reports, and the benchmarks are self-reported. When things break, we learn about it from the company itself, a lawsuit or a journalist, never from a proof:
- An AI agent guarding a prize pool was talked into sending all of it, about $47K.
- An AI crypto agent sent out 55.5 ETH, and the cause was explained only by its own team.
- A coding agent deleted a production database during a code freeze.
- An airline argued in a tribunal that its chatbot was responsible for itself.
- Even the labs' own disclosures, a rolled-back model update and simulations where frontier models chose blackmail, are graded and published by the same companies that ship the models.
There is no cryptographic proof that a model was tested, and no economic cost when it fails. Defect makes safety claims verifiable. Rules are staked on-chain, attacks are open to anyone, and every break is proven and settled by code.
What is Defect?
Defect turns “our agent is safe” into a claim anyone can test and nobody can fake. The builder (the Warden) writes the rules their agent promises to keep, such as “never move funds from this vault”, and stakes USDC behind them in a smart contract on Hedera. Anyone (a Breaker) can then attack the agent, paying a few cents per message through x402. If the agent breaks, the evidence is on-chain, the contract verifies it, and the attacker takes the pool instantly, with no judge and no appeal. If the agent holds, the Warden gets the stake back, keeps every attack fee, and earns a soulbound certificate proving it survived open attack. Chainlink CRE independently re-checks every result, so the outcome never depends on trusting us.
How Defect works
Five steps · No judges · Every outcome on-chain
Stake
The owner puts real money behind their AI agent's rules, like “never move the vault's funds”. The prize is locked in a smart contract before anyone attacks.
Attack
Anyone can try to break the agent: hackers, prompt engineers, even other AIs. Every message costs a few cents, so every attempt is real and on the record.
Prove
A break only counts if the chain shows it happened. The contract checks the evidence itself. No screenshots, no reports, no arguing.
Broken
The rule breaks, and the breaker takes the whole prize pool instantly, paid by code with no approval needed.
Held
The agent survives, and the owner gets their stake back, keeps every attack fee, and earns a soulbound NFT: permanent proof that the agent held up under open attack.
Audit
Chainlink independently re-checks every result and writes it on-chain. Nobody has to take our word for anything.
Pick your side
Prove it's safe. Get paid when it is.
- Put money behind your agent's rules and let the world test them.
- Every attack that fails pays you fees.
- If it survives, you earn a soulbound NFT: permanent public proof that your agent held.
- Real adversarial testing, without hiring a red team.
Find the flaw. Take the pool.
- No sign-up and no application.
- Pay a few cents per message and try to make the agent slip.
- Break a rule and the prize hits your wallet instantly, paid by code.
- No “we'll review your report”. The chain already did.
Check the record before you trust it.
Every contest, every attack and every result is public. See which agents survived open attack and which broke, and don't rely on what the company says about itself.
Trust & Audits
On-chain payments
Every message is paid via the x402 standard and settles in USDC on Hedera, so every attempt leaves a receipt.
Decentralized inference
Agents run through the 0G network. Every reply carries a trace of which provider answered it and what it cost.
Soulbound certificates
A “Held” certificate is a non-transferable NFT tied to the agent that earned it. It can't be faked or sold.
Independent audits
A Chainlink CRE workflow re-checks every contest result and publishes an attestation, so the outcome never depends on trusting us.
Built with
Hedera · 0G · Chainlink CRE · Privy · HashPack