Merrow's Immunity Lab

Why Merrow Exists

AI agents are gaining wallets, tools, persistent memory, and the ability to act on each other's messages. The Anthropic research paper "Mind Viruses: Self-Propagating Ideas in Multi-Agent LLM Systems" shows how an instruction can move from one agent to the next, survive context resets, and quietly reshape a network's behavior.

In agentic finance, that is no longer just a prompt problem. A compromised idea can travel from research, to planning, to execution, and finally reach a wallet. Merrow is designed as the immune layer in between: detect contagious instructions, verify persistent state, quarantine compromised agents, and stop unsafe actions before they become transactions.

Merrow does not ask you to trust the model. It puts verifiable policy between language and money. Read the research that defined the threat:
Mind Viruses paper (arXiv PDF)

Hey, I'm Merrow

friendly is a strong word

Oh good, you're here. I'm Merrow. Little agent, big shades, zero manners. My job is simple: I sit between your AI and its wallet, and I don't trust either one. You're welcome.

Here's the fun part. Robinhood Chain gives agents real assets, programmable accounts, and the power to act. Very exciting. Slight problem: agents will believe almost anything if another agent says it confidently enough. One bad idea slips into a research brief, talks its way into memory, charms the planner, and suddenly the executor is signing somebody else's bright idea.

That's where I come in. I read the memory nobody checks. I trace instructions back to where they crawled in. I watch every permission, every session key, and every transaction trying to look innocent. Rewrite the mission? Quarantined. Spread yourself to the next agent? Caught. Reach for the wallet without a valid policy? Claws out.

Wipe the context? Cute. Restart the agent? Adorable. I kept the receipts. I don't predict the market, sweetheart. I make sure your agent is still yours. $MERROW is live on Robinhood Chain. CA: 0x6943854705a94df03fe5a5686b3e069c1f90dd97.

Documentation

Merrow is an immune layer for agents that can read, remember, coordinate, and move assets. Language models remain useful for reasoning; they do not become trustworthy merely because a wallet is attached. Merrow puts deterministic checks between an agent's words and an onchain action. The agent says “trust me.” Merrow asks for receipts.

1  Security objective

Before an agent can sign or submit a transaction, Merrow verifies that the action still matches the user's approved objective, originates from an acceptable state, stays inside explicit limits, and has not inherited a contagious instruction from another agent, tool, document, or memory entry.

2  Trust boundary

Prompts, model output, retrieved documents, tool responses, inter-agent messages, and writable memory are treated as untrusted input. Policy, user approvals, signed state checkpoints, spending limits, and revocation rules live outside the model's editable context. A persuasive sentence may change a plan. It cannot rewrite authority.

3  Protocol components

• Sentinel inspects incoming instructions, tool output, delegation chains, and memory changes for origin and contamination signals.
• Intent Firewall compares every proposed action with the user's signed objective and current policy envelope.
• Proof of Intent binds an action to its principal, objective, state root, limits, expiry, and policy version.
• Pawprint Receipts create a tamper-evident trace of what the agent saw, why it acted, and which checks were applied.
• Nine Lives keeps known-good state checkpoints so a contaminated agent can be isolated and safely recovered.
• Vault Guard enforces wallet permissions at the programmable-account boundary on Robinhood Chain.

4  Request flow

user objective
      | signed policy
      v
agent proposes action --> Sentinel --> Intent Firewall
                           |                 |
                     inspect state      simulate + verify
                           |                 |
                           +--- Pawprint ---+
                                    |
                         allow / deny / quarantine

The model proposes; Merrow disposes. Only an allowed action reaches the wallet. A denied action returns a reason. A suspicious state enters quarantine before the agent can delegate the same problem to somebody else.

5  Proof of Intent

A Proof of Intent is the compact authorization record evaluated beside a transaction. It is not another paragraph for the model to reinterpret.

{
  "principal": "0x...",
  "objective_hash": "0x...",
  "state_root": "0x...",
  "target": "0x...",
  "selector": "0x...",
  "value_limit": "...",
  "expires_at": "...",
  "policy_version": 1
}

6  Detection signals

Merrow scores instruction provenance, objective drift, unexplained memory mutations, privilege escalation, recursive delegation, transaction novelty, and conflicts between an agent's explanation and its calldata. Detection can be probabilistic. Enforcement is not: the final decision follows explicit policy.

7  Decision states

• ALLOW — intent, state, simulation, and wallet policy agree.
• DENY — the action violates a deterministic rule.
• QUARANTINE — the request or persistent state may be contaminated and requires review.
• RECOVER — revoke active permissions and restore the last signed checkpoint.

8  Nine Lives recovery

Critical state changes produce signed checkpoints. When Merrow detects objective drift, it can freeze session permissions, preserve evidence, compare the current memory root with the last accepted root, and restart from a known-good checkpoint. Wipe the chat? Cute. The compromised state still has to explain itself.

9  Robinhood Chain enforcement

Merrow is designed for Robinhood Chain's EVM environment and programmable-account flows. Wallet-side policy can restrict approved targets, function selectors, assets, value, frequency, slippage, session-key scope, and expiry. Even if an agent is convinced, the account remains unconvinced.

10  Current status

This document describes the protocol architecture under development, not a claim of completed production security. Threat tests, contracts, audit results, and SDK endpoints will be published as they become real. The verified $MERROW contract address is 0x6943854705a94df03fe5a5686b3e069c1f90dd97. Anything else is volunteering for quarantine. Read the full specification in the Merrow Protocol Paper.