LedgerLighthouse
An agent that pays for things has to read text written by the people it pays. Put reading and spending in one component and a single prompt injection empties the budget. LedgerLighthouse splits them: the part that reads the attacker's text holds no spending authority, and the part that grants it never reads the attacker's text.
The orchestrator reads 402 bodies, error messages and vendor descriptions, all attacker-controlled. It can ask for a spend. It cannot grant one. The relay holds no key and the signer never reads a word of vendor text.
Inco forbids branching on an encrypted condition, so if (approved) debit cannot be written. The vault selects the operand instead, ok.select(amount, 0), and subtracts unconditionally. The debit commits before anyone, the orchestrator included, can learn whether it was approved.
finalizeDecision verifies the decryption attestation against the handle the vault itself stored. A genuine attestation over a different handle is refused, so a valid signature alone is not enough to approve a spend.
The signer answers one question: is (goalId, seq) finalized and approved on chain? If so it signs exactly what the chain froze, as an EIP-3009 authorization. It has no notion of price and no way to be told one, and its key lives in an Intel TDX enclave on Oasis ROFL.
Even a fully compromised orchestrator is bounded by the per-call cap, the payee allowlist and the call counter. The cap is encrypted, so nobody can aim at it, and each payer is bound to one goal so it holds only what that goal was funded with.
The agent buys API calls the way the web is starting to sell them: a 402 response, a USDC authorization, a facilitator that settles it. An adversary campaign of thirteen attacks runs against the live vault, and every run is logged with its transaction hashes.