Nine dimensions. A six-category risk matrix. A four-element Howey breakdown. Star ratings. A compliance disclaimer.
That was the report that landed in my inbox last week: a two-stage pipeline built to turn crypto news into structured intelligence, returning a complete analytical framework with every field stamped N/A. Stage one had emitted an empty array. Stage two, obeying its instruction to preserve format integrity, filled forty-one table cells with 'insufficient information' and then, correctly, declared itself BLOCKED. Zero claims extracted. Zero projects identified. Zero timestamp. The pipeline could not tell me whether the source was three hours old or three years old.
I have read a lot of bad crypto research. Most of it fails by inventing. This one failed by refusing. That distinction is the most interesting thing to happen to automated due diligence in two years.
The pipeline is not exotic. Since late 2024 a meaningful share of crypto funds, market makers, and listing committees have moved first-pass screening onto LLM agents. The architecture is nearly always identical. A stage-one extractor turns prose into a schema: title, source, projects mentioned, claim list, timestamp, source-quality rating. A stage-two analyst consumes that schema and produces the nine-dimension write-up covering technical, tokenomics, market, ecosystem, regulatory, team, risk, narrative, and supply-chain transmission.
Two stages. A typed boundary between them. Structurally this is a good design. It mirrors how I build audit tooling. Separate the parser from the evaluator so a bad parse cannot silently poison the verdict.
The economics are why it spread so fast. A stage-two pass costs pennies. A junior analyst costs four thousand dollars a month and still misses things. When the bear market cut research budgets, the agent kept its seat at the table. Nobody asked what happens at the seam.
Except the boundary had no contract. Stage one returned an empty claim array. Not null. Not an error. An empty array is a perfectly valid value of the correct type. Stage two's schema validation passed. Every downstream consumer that checked 'is this a list?' got yes. The only thing that failed was reality.
Here is where I want to be precise, because crypto keeps rediscovering this bug at every layer of its stack. There are three distinct states a data pipeline must distinguish: known, unknown, and absent. Finance collapses all three at its peril.
Solidity gives you address(0). It is a sentinel, not a null. It is valid, it is typed, and it will happily accept your funds. The 2020 Compound incident was not a hack. It was an oracle reporting a number that was true to its input and false to the world, and roughly $89 million of DAI positions were liquidated against it in minutes. Venus Protocol on BSC in 2021 was the same shape. A feed delivered a value the risk engine accepted without ever asking whether the value was plausible.
That is bad data in. The emptier and nastier failure is no data in, coerced to a default. Every lending market that has treated a stale Chainlink round as 'last known price' has silently chosen to keep a position solvent on the strength of a number nobody is currently standing behind. Chainlink had to ship a dedicated sequencer-uptime feed for L2s precisely because 'the sequencer is down' and 'the price is unchanged' are indistinguishable to a naive consumer.
The pipeline I was handed did the right thing at the type level and the right thing at the human level. It refused. The refusal is the feature. The nine-dimension report that filled itself in from an empty array would have been the bug.
A concrete detail worth pinning down. The schema almost certainly used required on the claim field but never minItems: 1. In JSON Schema those are different assertions. required asks whether the key exists. minItems asks whether the array has content. The first passed. The second was never asked. I have seen the same gap in oracle adapters that verify a feed exists but never verify its round is fresh.
Because look at what stage two was asked to produce: a risk matrix with probability and impact columns, a Howey test with a verdict, a competitive table with TVL and market share. Feed that machine an empty array and constrain it to format integrity, and you have built a machine that will generate a competitor's TVL out of nothing. The rule that says 'always fill every field' is the vulnerability. It is the analytical equivalent of require(false) being quietly rewritten as return true.
The fix is not sophisticated. Make absence a first-class type. An explicit Unknown that cannot be coerced into T, the way Rust's Option forces a match and the way a well-built oracle hands you a round ID you must validate. Require a source span for every extracted claim, so an empty claim list is visibly empty rather than silently short. Then fail closed. If the extractor returns zero claims, the analyst returns BLOCKED, not a framework. That last item is a one-line policy, and it is the entire distance between the report I received and the one that would have invented a competitor's TVL.
I have spent enough time inside extraction pipelines to know the tell. When the output is more structurally complete than the input was informative, you are not looking at analysis. You are looking at autocomplete in a suit.
The consensus in this market is that AI research agents will compress the analyst function. Cheaper coverage, faster screening, more names per week. The bear-market version of that pitch is survival. When you cannot afford three analysts, you buy the agent.
I think the risk runs the other way. The failure mode of automated due diligence is not that it is wrong. It is that it is formatted. A report with a risk matrix, a Howey breakdown, and a star rating reads as institutional-grade because institutions taught us those artifacts accompany rigor. They do not. They accompany templates. Complexity hides the truth; simplicity reveals it. The only honest line in that whole document was 'technical value: one star, no data,' and it is the line every reader skims past.
The blind spot sits at the seam. Funds audit the model vendor, the prompt, the output schema, the disclaimer. Nobody asks how many of last month's reports had a non-empty claim list, what the null rate on source quality was, or where an empty extraction gets caught. Those three numbers are the only ones that tell you whether the agent is analyzing or decorating.
The market consequence is measurable in a way that should worry anyone holding altcoin exposure this cycle. Research coverage is now a listing input. If a mid-cap protocol receives a formatted nine-dimension report, filled in by an agent that never received a single verifiable claim, that document enters a committee memo, gets cited, and eventually prices a position. The provenance chain looks rigorous at every step and is empty at the root.
I have made this mistake myself. In 2022 I audited a bridge whose withdrawal-proof verifier had a challenge-period parameter that was configurable and defaulted to zero. The code compiled. The tests passed. The default was the exploit. Defaults are where security goes to die, and every pipeline has a default for missing data. Most of them choose zero. Zero is a number. Zero liquidates you.
There is a second, uglier reading. A pipeline that emits fourteen hundred words of N/A is still emitting fourteen hundred words. It is honest, it is disciplined, and it is also a product. The refusal has a template, and templates are what got us here. The difference between this report and a hallucinated one is that this one can be verified as empty in a single query. That is the whole delta. Verifiability, not virtue.
Today this costs you a bad memo. Tomorrow it costs you the treasury. Agentic wallets are already in production. Agents holding signing keys, paying for data, rebalancing collateral with no human in the loop. When the analyst and the executor are the same process, an empty claim list stops being a research inconvenience and becomes a solvency event.
The first nine-figure loss from an autonomous agent will not be a prompt injection. It will be a null, coerced to zero, signed without a revert.
So ask your vendor one question. What does your agent output when stage one returns nothing? If the answer is a framework, you do not have research. You have a rumor with footnotes.
Trust the code, verify the trust, including the code that decides what 'no data' means. Security is not a feature; it is the foundation. And a bug fixed today saves a fortune tomorrow.