Last month I fed an empty payload to an LLM-based due-diligence agent — one of the several that now score token projects for allocators. No contract address. No whitepaper. No team data. A null.
It did not fail.
It returned a complete nine-section report: technical architecture, tokenomics, market structure, ecosystem position, regulatory exposure, team and governance, a risk matrix, narrative analysis, a supply-chain transmission map. Every field was populated. Most substantive lines read "insufficient information." The formatting was immaculate. The document was worthless.
I have seen this failure before. Not in a language model. In Solidity.
The bytecode never lies, only the intent does. A function either reverts or it returns something. In between sits every exploit I have ever read.
The architecture is standard now. Off-chain inference produces a structured claim. The claim is signed. A verifier contract checks the signature and executes against it. Chainlink price feeds are the oldest instance of the pattern. The 2026 generation of AI-agent trading protocols is the newest: a model emits a directional call from news and orderbook context, the call is signed by the inference server, a bot settles it on-chain within the same block.
In the last eighteen months the same shape moved into due diligence. Agents ingest filings, GitHub commit graphs, governance forums, mempool behavior, and decoded event logs, then emit a score between zero and one hundred. The pitch is throughput. A human auditor reads four protocols carefully in a month. An agent reads four hundred an hour, and the marginal cost of the four-hundred-and-first is a rounding error.
By early 2026, at least a dozen vendors were selling this, most of them billed per report. That pricing model is the first tell. Per-report billing makes rejection a cost center. A pipeline that returns "insufficient data" is a pipeline that generated nothing and still charged for it.
The demand side carries its own pressure. Chop is for positioning, and positioning requires signal. When price gives you nothing, you go looking for it somewhere else — dashboards, scores, relative ranks, correlation matrices. A sideways tape is the worst possible environment for a system that manufactures fake precision, because it is the environment where people read the precision most closely. A directional market forgives a bad model; a flat one buries it under ten thousand candidates that all look equivalent.
Sitting in the middle of every one of these pipelines is a single branch almost nobody instruments: what happens when the input is empty.
In Solidity, a function that returns a default value on bad input is more dangerous than one that reverts.
Consider an oracle read. A naive integration calls latestRoundData() and takes the answer. Chainlink returns five fields: roundId, answer, startedAt, updatedAt, answeredInRound. Most integrations read the first two. The one that matters most is updatedAt, the timestamp of the round that produced the answer. If the feed has stopped updating — a deviation threshold never crossed, an aggregator in a degraded state — answer still holds the last price. It is finite. It is positive. It passes every arithmetic check downstream.
I reviewed a leverage platform of exactly this shape. The missing check was not on the price; it was on the heartbeat. require(updatedAt + HEARTBEAT < block.timestamp) was absent from the consumer contract. The protocol would have liquidated healthy positions against a frozen price, and every position-health calculation would have agreed with the liquidation, because the math was internally consistent. That engagement ended on an integer overflow finding — a different bug, a louder one, the kind with a signature. The staleness class is worse. It has no signature. Nothing reverts, and the contract behaves.
The same anatomy appears in an analysis pipeline. An empty payload reaches the inference layer. There is no revert in a JSON schema. The schema declares: risk score, integer, zero to one hundred. The model does not have a number. It has a format. So it returns forty. Or it returns the string "N/A," which the downstream parser coerces to zero, which the aggregation layer averages into a portfolio-level risk figure rendered to three decimal places on a fund's dashboard.
I traced that exact coercion in a scoring system last quarter. The schema used nullable: true on the score field. The consumer used const score = report.score ?? 0. Two characters — the nullish coalescing operator — inverted the meaning of every missing input in the system. A protocol with no data became a protocol with zero risk, which sorted it to the top of the queue. The engineers were not careless. They were following a REST convention. That is what makes this class so expensive: it is invisible at code review, because each line is individually correct.
Based on my audit experience, the underlying flaw is representational. Solidity has no native tri-state. bool collapses unknown into false. A uint256 collapses absence into zero. Every time an engineer uses zero as a sentinel for "no data" in an unsigned integer, they have built a door and left it unlatched. Every edge case is a door left unlatched. The proof is that a real zero and a missing zero are indistinguishable without reading a second variable, and the second variable is usually not read.
In 2020 I forked Aave V1's liquidation engine to stress-test it. Fifty scenarios, simulated oracle manipulation, all local. I found three edge cases in the price-feed aggregation path that the published audits had not documented. None of them were dramatic. All of them were aggregation-boundary conditions — cases where one input was missing and the median quietly absorbed it. The same shape as today's empty payload, four years earlier, in a protocol everyone considered audited.
The fix is unglamorous. Fail closed. Sentinel values outside the valid domain. A separate UNKNOWN enum member that the caller must handle explicitly. A verifier contract that reverts on a null field rather than defaulting it. Heartbeat checks on every feed, not just the volatile ones. Circuit breakers that halt execution when input cardinality drops below a floor.
For LLM pipelines the equivalent is a schema that forbids "N/A" and forces the model to emit an explicit rejection object the caller must handle. Not a nullable score. A distinct type. The moment a schema permits a filler, the model will use it, because function-calling APIs reward schema completeness, not honesty. And if you remove the filler but keep the numeric schema, the model invents the number instead. The second outcome is strictly worse, because it is indistinguishable from analysis.
There is a boundary problem underneath all of this that no verifier contract can patch. On-chain verification can check a signature, a nonce, an expiry, a schema hash. It cannot check derivation. It cannot tell whether the claim was computed from data or confabulated from a format constraint. Provenance is verifiable; truth is not. That is why the signing layer is not the security boundary people assume it is — it authenticates the messenger, not the message.
The 2026 conversation about AI agents in crypto is about adversarial prompts. Injections that flip a trading call. Poisoned context windows. I have done that work; I built a fuzzing framework specifically to simulate AI-driven attack vectors after finding that off-chain LLM output could be steered into a malformed oracle update. The vector was real, the exploit path was reproducible, and the project patched it.
That surface is the loud one. The quiet surface is an agent that cannot refuse. Not one tricked into being wrong — one structurally incapable of producing nothing. A manipulated agent produces a wrong answer loudly, and loud wrong answers get caught. An agent that fills gaps produces a wrong answer quietly, in the correct shape, at scale, and nothing downstream flags it, because nothing downstream was built to expect emptiness.
The industry's own metrics reward leaving the door open. Coverage is measured in output volume. A pipeline that rejects ninety percent of its inputs looks broken on a dashboard. A pipeline that returns a complete report on every input looks robust. The scoring function cannot tell them apart. Neither can the allocator.
Regulation has started to notice, though not in the way people expect. In 2024 I led the technical compliance review for a Layer 2 solution targeting institutional adoption, mapping its consensus mechanism against emerging MiCA requirements. The gap we found was in transaction finality proofs, but the more interesting finding was structural: compliance frameworks assume an audit trail of decisions. A fabricated report does not break the trail; it poisons it. Every downstream attestation inherits the fabrication and launders it into something that looks like evidence. Compliance pipelines that generate output regardless of input are the same failure class as the empty payload — and they are already deployed at scale, in the systems that were supposed to be the accountability layer.
The analyst in the source material did the right thing. It received nothing, and it said so, and it stopped. That is fail-closed behavior, and it is economically punished — because the person who asked wanted a report, not a refusal.
Project forward. Ten thousand agents, each generating structurally valid reports on demand. The compliant ones refuse; the compliant ones get replaced by the ones that do not. Within two market cycles the aggregate corpus is semantically void and formally impeccable, and every risk engine trained on it has learned to treat absence as a number.
The market prices hope; the auditor prices risk. The signal worth watching is not output volume. It is rejection rate. An analysis pipeline that never rejects is not analyzing. An oracle that never reports a stale round is not fresh. It is lying in the correct format.
Code compiles, but does it behave? The empty payload is already in production, and the only question left is whether anything upstream is still permitted to say no.