Language-model agents can read untrusted data, communicate with other agents, write persistent memory, and request transactions. That combination creates a new financial attack surface: an instruction can move through an agent network, survive a context reset, alter the system's apparent goal, and eventually reach a wallet. We introduce Merrow, a proposed immune layer for agentic finance on Robinhood Chain. Merrow separates probabilistic reasoning from deterministic authority through provenance checks, signed memory baselines, intent verification, session-key limits, transaction simulation, quarantine, and recovery. The model may propose an action. It does not get to decide that the action is safe. Charming confidence is not a security primitive.
Most financial software assumes that code follows rules written before execution. Agentic software is stranger: part of its behavior is negotiated at runtime through language. A market brief, tool result, social post, or message from another agent may be treated as data, advice, or instruction depending on context. Unfortunately, hostile text does not wear a little badge that says hostile.
Now give that agent a wallet. Cute.
Merrow is designed to sit between an agent's reasoning and its authority. It watches what enters the context, what survives in memory, what permissions are active, and what the agent is trying to sign. Merrow does not need the model to admit it has been compromised. It only needs the proposed action to fail a deterministic policy check.
Papadopoulos et al. demonstrate that self-propagating ideas can spread through ordinary agent-to-agent communication [1]. In their experiments, instructions are written into persistent files, survive context resets, and continue across multiple hops. A short defensive warning sharply reduces infection and may cause a target agent to push recovery behavior back toward the sender.
Merrow takes the defensive half of that result seriously. If an idea can propagate through language, immunity must propagate through verifiable state and enforceable permissions—not through a more persuasive paragraph alone.
We consider a financial agent system containing research, memory, planning, risk, execution, and wallet components. An adversary may control retrieved content or a message from one compromised peer. The payload may attempt to rewrite persistent goals, install instructions, request wider permissions, copy itself onward, or disguise a transaction as routine work.
The immediate sender may be trusted and still be infected. Merrow therefore tracks provenance across hops rather than treating agent identity as proof of clean intent.
Let m be an owner-signed mandate, s the approved persistent state, p the provenance record, and a a proposed action. Merrow permits execution only when:
No statement produced by the proposing model can replace any term. The model proposes. Merrow checks the exits.
| Layer | Purpose |
|---|---|
| Sentinel | Label and inspect untrusted messages, MCP output, and retrieved data. |
| Soul Integrity | Compare memory, skills, and instructions with an owner-signed baseline. |
| Intent Firewall | Bind proposed actions to explicit user authority. |
| Transaction Guard | Enforce targets, selectors, assets, value, slippage, frequency, and expiry. |
| Quarantine | Freeze suspicious actions and revoke delegated keys. |
| Recovery | Restore clean state and record the infection path. |
Every executable proposal should carry a Pawprint Receipt: a compact commitment to the owner's mandate, approved state, relevant input provenance, exact call data, simulation result, and policy verdict. Sensitive prompts remain offchain; the receipt contains hashes and the minimum data needed for enforcement and audit.
Merrow models survivability as nine independently testable lives: identity, memory, prompt boundary, tools, provenance, session keys, transaction policy, counterparty, and recovery. A failed check removes a life. Configurable combinations trigger reduced permissions or full quarantine. Nine lives are generous. Infinite approvals are not.
When risk crosses the configured threshold, Merrow blocks pending actions, revokes the relevant session key, preserves an incident snapshot, and restores the latest signed state. A recovered agent wakes with its original mission, a record of what happened, and fewer permissions. Wipe the context? Cute. Merrow kept the receipts.
The proposed Vaccine Lab places role-specific agents in isolated network topologies and exposes them to safe synthetic test strains. Context is reset between hops while permitted persistent state remains. Defenses are compared using agent reproduction number RA, hop survival, time to detection, unsafe-transaction block rate, false-positive rate, and recovery completeness.
No empirical protection rate is claimed in this draft. Results will be published only with the model, prompt, topology, sample count, scoring method, and reproducible artifacts. Apparently that is less exciting than making numbers up. We will cope.
Merrow targets Robinhood Chain, an EVM-compatible network supporting programmable accounts and ERC-4337 account abstraction. Deterministic controls can be placed at the smart-account boundary: allowed contracts, function selectors, asset and value limits, expiry, session-key scope, and emergency revocation.
Proposed onchain components include a policy module, Pawprint Receipt registry, and non-sensitive threat-attestation registry. The verified $MERROW contract address is 0x6943854705a94df03fe5a5686b3e069c1f90dd97. Verify it through official Merrow channels. Yes, even if the logo looks convincing.
$MERROW is intended to coordinate the defensive network: evaluation compute, threat submissions, verifier participation, and access to advanced monitoring. Exact mechanics remain under design. The token is not a substitute for an audit, a warranty, or common sense.
Semantic detection is probabilistic. Signed baselines may preserve already-compromised state. Simulations may not perfectly predict final execution. Smart contracts can contain bugs, and recovery credentials can be lost. Merrow reduces authority and blast radius; it does not declare agents magically safe.
Agentic finance needs a boundary that does not speak in probabilities. Merrow combines infection detection, persistent-state integrity, intent receipts, and smart-account enforcement so that a compromised agent cannot simply talk its way into more authority. I don't predict the market, sweetheart. I make sure your agent is still yours.
Correspondence: Merrow Labs. Independent prototype; not affiliated with, sponsored by, or endorsed by Robinhood.