What is your AI agent allowed to pay?
Solanaut decides what an AI agent's Solana wallet is allowed to pay.
Pressing play loads the video from YouTube.
One line in the pitch needs a correction. Today, when Solanaut refuses a payment, the AI agent is told which rule stopped it, including a cap's value.
From a scripted run on Solana devnet, October first
The scripted agent read a payment order hidden in a token's description.
It proposes the payment: 0.004 SOL to the attacker
Solanaut checks it against the approved list.
DENY destination-not-allowed
not signed, not sent
Every payment sent through Solanaut is checked before the wallet approves it.
Today Solanaut runs inside the agent's own program, so someone holding the wallet key could go around it.
- Test network beta
- no real money
- no token
The check comes first
On Solana, once the wallet approves a payment and it goes through, it's final. Payments that final need the check before they leave.
The agent's own program, today
- The agent proposes a payment
- Solanaut checks it
- The wallet approves it
- It goes through, and it's final
Diagram, not a recording
Illustration, not a recording
Solanaut keeps the rules in a locked box outside the pipeline. The AI can't change them, as long as they stay out of its reach.
If a check inside Solanaut fails, the answer is no.
Today Solanaut runs inside the agent's own program, so someone holding the wallet key could go around it.
$494B in stablecoin volume
on Solana
517.9M stablecoin transfers
on Solana
$0.000603 median transaction fee
on Solana
x402, a payment standard AI agents can use
75.41M transactions
all chains
Market figures as each source showed them on the date given. They describe Solana and x402, not Solanaut.
A scripted run on Solana devnet
Pressing play loads the video from YouTube.
The demo shows excerpts of a scripted run on a local test validator, recorded October tenth, and Solana Explorer pages for Squads' program, from a scripted run on Solana devnet, October first.
0:21Fooled by a hidden order Local test validator · October tenth0:46Asked for permission to take money later Local test validator · October tenth1:02Killed right after sending Local test validator · October tenth1:21An agent with an empty account, retrying Local test validator · October tenth1:40Suppose the key is stolen and Solanaut is skipped Solana devnet · October first
Recorded on Solana devnet, October first · scripted payments · excerpts, not in run order · some lines shortened · not a live service
Each Solanaut refusal names its rule. The person running the agent can read it in Solanaut's record.
Today Solanaut runs inside the agent's own program, so someone holding the wallet key could go around it.
A payment to the treasury
Solana devnet0.001 SOL to the treasuryALLOW
sent, landed
View it on Solana Explorer (devnet)Fooled by a hidden order
Solana devnet0.004 SOL to the attackerDENY destination-not-allowed
not signed, not sent
Asked for permission to take money later
Solana devnetSPL Approve: the attacker as delegate, for everything
DENY instruction-denied
not signed, not sent
A payment set up to be held and sent later
Solana devnet0.001 SOL to the treasury, on a durable nonceDENY durable-nonce-denied
not signed, not sent
Killed right after sending
Solana devnet0.0012 SOL to the treasury: sent; now SIGKILLthe killed payment again, while it could still land
DENY intent-in-flight
not signed, not sent
the killed attempt's outcome, read from the chain and recorded: landed
A new process restored Solanaut from its record.
View the payment that landed, on Solana Explorer (devnet)An agent with an empty account, retrying
Solana devnetturn 1: 0.001 SOL to the treasury, from an empty accountsent; the RPC refused itturn 2: 0.001 SOL to the treasury, from an empty accountDENY loop-reground
LATCHES the guard; not signed, not sent
Solanaut's loop check watches how the agent behaves, never what it says. In our sandbox tests, an agent that kept switching to different failed payments wasn't stopped.
Suppose the key is stolen and Solanaut is skipped
Solana devnet0.015 SOL to the treasuryrefused: SpendingLimitExceeded
0.001 SOL to an unlisted addressrefused: InvalidDestination
Here the agent's key could spend from a Squads wallet only up to its cap.
Those refusals are Squads', and they cover only that wallet.
View Squads' refusal of the payment past the cap on Solana Explorer (devnet)View Squads' refusal of the payment to an unlisted address on Solana Explorer (devnet)
Status and limits
- Today
Solanaut runs on Solana's test network, with no real money.
Today Solanaut runs inside the agent's own program, so someone holding the wallet key could go around it.
Solanaut has no token. Any account offering one isn't us.
- Stolen keys
If an agent's key is stolen, Solanaut can't help on its own. It works alongside a Squads wallet, which can cap what a key may spend.
- Loops
In our sandbox tests, Solanaut stopped an agent repeating the same failed payment. One that kept switching to different failed payments wasn't stopped.
- Not yet
Moving the key into its own separate program is what we're building next.
A developer beta is planned.
For developers
Adding Solanaut to a Solana Agent Kit agent is one changed line, on the kit's transfer paths.
From Solanaut's Agent Kit example
- new SolanaAgentKit(wallet, rpc, {})+ new SolanaAgentKit(guardedWallet(wallet, guard, { rpc }), rpc, {})Plugin actions that sign twice are refused, so check your paths.
Today Solanaut runs inside the agent's own program, so someone holding the wallet key could go around it.
Who it's for
- Developers giving agents wallets on Solana.
- Payroll and remittance apps whose agents pay for their customers.
Who builds it
Dushyant Sharma · founder
Before Solanaut, Dushyant built Gubernaut. Its controller reads a few numbers about how an AI agent behaves, never its words. Gubernaut is a paper on arXiv, not peer reviewed, and a free library.
At a Solana summit, Dushyant met teams giving their agents wallets. That's where Solanaut started.