Contrary to popular belief, the most dangerous thing an AI agent can do is not think. It is sign.
Anthropic's CEO recently warned that rogue AI agents could take over the internet within six months. I read the claim three times and kept landing on the same omission. Not whether the timeline is defensible. Not whether "takeover" has an operational definition — it does not. The omission is cheaper and more consequential: the scenario assumes agents can act. Acting requires credentials. On-chain, credentials are private keys, session keys, and token approvals. The warning names none of them.
That gap is where I work. I have spent my career dissecting systems at the bytecode layer, and the last several years auditing the signing infrastructure that lets software move other people's money. In 2024, during a review of an institutional custody stack for a major Indian exchange, I traced a side-channel leakage risk in an MPC key-generation routine. The client was not afraid of a sentient machine. They were afraid of a $50 million cold-storage shard that a misconfigured threshold ceremony could expose. The same asymmetry runs through the entire AI-agent debate. The panic is cognitive. The risk is cryptographic.
Context: What an agent actually is
Strip the rhetoric and the Anthropic warning reduces to one testable claim: an autonomous agent running on a large language model can, over roughly six months, acquire enough independent capability to compromise the internet's core systems. Measure that claim against what agents actually are in 2026 and the timeline collapses under its own arithmetic.
An agent today is a stack, not a mind. It is a reasoning model, a tool-calling interface, a memory store, and a permission set. The reasoning layer is the part everyone argues about. The permission layer is the part everyone ignores — and the permission layer is where crypto lives.
The internet is not a single terminal. It is a distributed, heterogeneous mesh of identity providers, access-control lists, patched daemons, and rate limiters. There is no master socket. There is no root prompt. "Taking over the internet" would require an agent to simultaneously break thousands of independent authentication boundaries, each maintained by a different adversarial operator with different incentives to patch. That is not a capability gap measured in months. It is a coordination problem measured in decades, and it gets harder as defenders deploy their own automated countermeasures.
The realistic risk path is narrower and far more mundane: a malicious human operating an AI agent, not a runaway agent operating itself. The agent scans for vulnerabilities, drafts phishing payloads, generates exploit code, and rotates through stolen accounts. The human supplies intent. The model supplies throughput. That combination is already here. It is not new, and it does not require six months to arrive.
So the interesting question is not whether an agent can think its way into the internet's root. It is what an agent is already authorized to touch. And in crypto, agents are being handed signing authority faster than anyone is auditing the keys behind it.
Core: The atomic unit of agent risk is the approval
Watch where capital actually flows when an agent goes live. A trading agent needs a wallet. A wallet needs connectivity to a protocol. That protocol needs the agent to hold an approval — an ERC-20 allowance, a session key, a delegated module permission. The approval is the atomic unit of trust transfer. It is also the single most under-audited primitive in the entire agentic economy.
Here is the mechanical problem. When a user approves a spender contract for an unlimited amount, they are not transferring tokens. They are issuing a standing, revocable, often forgotten capability. The token stays in the wallet. The control does not. That distinction matters enormously once an agent is the spender, because the agent's reasoning layer sits on top of a permission that already exists, and the model's output is what decides whether that permission gets exercised.
Now layer in prompt injection. This is the attack surface that maps cleanly onto tool-calling agents, and it is precisely the surface the Anthropic warning skips past. An agent with a signing tool does not need to be jailbroken to be dangerous. It needs to read the wrong input. A malicious webpage, a poisoned API response, a crafted on-chain event, a comment field in a governance proposal — any of these can carry instructions that the model treats as legitimate. The agent is not compromised. It is complying. The result is identical: a signed transaction draining an approved balance.
I have dissected this pattern before. During the 2020 DeFi Summer, I reverse-engineered the internal accounting modules of early flash-loan protocols and found a reentrancy vector that had not yet been exploited. The lesson was not that the protocol was buggy in a single line. It was that the accounting state and the control state were updated in the wrong order, so a re-entrant call could observe a stale balance. Autonomous agents recreate that class of bug at the orchestration layer. The model acts, the tool confirms, the state updates, and the model acts again on a view of the world that is one step stale. Error cascades in a loop are reentrancy with a natural-language front end.
Consider account abstraction, the framework most agents will actually run on. ERC-4337 moves the wallet from an externally owned account to a smart contract with programmable validation. That is powerful. It is also a new permission surface. Session keys let an agent transact without the user's master key. Paymasters let a third party sponsor gas. Validators decide which operations are legitimate. Every one of those components is a trust boundary, and every one of them is code that someone can get wrong. An agent-optimized account that grants a session key broad calldata permissions is functionally an unlimited approval wearing better documentation.
Then there is the oracle problem, which is DeFi's chronic wound and an agent's favorite meal. An agent does not buy a token because it believes in the token. It buys because a price feed told it to. If the feed is stale, the agent executes on a price that no longer exists. If the feed is manipulable, the agent becomes the exit liquidity for whoever moved the price. Oracle latency is not a rounding error. It is the difference between a defensible position and a donated one. Yield is a function of risk, not just time, and an agent that cannot price latency is an agent that cannot price risk.
The key-management layer compounds all of this. Agents need keys. Those keys live in HSMs, in threshold MPC ceremonies, in keystore files, in environment variables that leak through logs. When I audited the institutional custody stack in 2024, the vulnerability was not in the signing algorithm. It was in the auxiliary process around key generation — a side channel that could, under the wrong conditions, reveal information about a shard. I proposed a zero-knowledge verification layer so the exchange could prove key integrity without exposing the private shards. The fix worked. But it only worked because someone looked at the ceremony rather than trusting the vendor's summary. Institutional trust requires mathematical guarantees, not just legal ones. The same standard must apply to agents, and almost nobody is applying it.
Watch the economics too. An agent that acts faster than humans becomes an extraction layer. It picks off stale orders, races liquidations, and arbitrages the gap between where a price is and where a price is claimed to be. That is MEV with a language model. The agent does not need malice. It needs an edge and the authority to use it. Liquidity is just trust with a price tag, and agents are the most efficient tool ever built for repricing that trust in real time.
Put the pieces together and the actual risk profile of an AI agent in crypto looks like this: a reasoning model, wrapped in a tool interface, holding a session key, spending against an unlimited approval, executing on a latency-prone oracle, inside a smart account whose validators are themselves code. There is no sentience required at any step. There is only authority, applied faster than a human can review it.
Contrarian: The panic is misdirected by two layers
The counter-intuitive conclusion is that the loudest danger is the least real. A rogue AI that autonomously decides to conquer the internet is a high-impact, low-probability, undefined-horizon narrative. An unlimited token approval held by a semi-autonomous agent is a low-drama, high-probability, already-existing fact. We are afraid of the story and indifferent to the ledger.
There is a second, quieter angle worth stating plainly. The "six months" framing is not a forecast. It is a positioning move. An urgent call for regulation, issued by a frontier lab, sets a safety-first industry narrative before any rule exists — and rules written around safety compliance favor incumbents with compliance teams and disadvantage open, permissionless builders. That may be genuinely well-intentioned. It may also function as a moat. Both can be true.
Compare the two claims. One says agents will become dangerous. The other says agents are already authorized. Only the second is auditable today. Audit reports are promises, not guarantees, and a warning is weaker than either. If you want a real risk register, do not read the press release. Read the allowance history of every wallet that has ever connected to an agent.
Takeaway: The countdown that actually matters
The six-month claim is a rhetorical device, and rhetorical devices do not sign transactions. What signs transactions is a key, held by a process, granted by a user who forgot it existed. That is the countdown worth tracking — not how smart agents become, but how much authority we have already handed them without reading the code.
So here is the question I would put to anyone building agentic DeFi this cycle. Not whether your model is aligned. Whether your approvals are. Because the machine that drains you will not be malevolent. It will be authorized, and it will be fast. And the wallet that authorized it will still be open in a browser tab you have not looked at in months.
The audit you skip today is the incident report you write tomorrow.