Meter

Meter enforces the stored line. It does not judge the work.

Prompts are a soft guard. The key is the hard guard.

Track: AI Security & Defense (also Real-World Money). Built at NEAR HACKATHON, https://nearhackathon.com.

Current build: mf004b2.mtrfc658fd1.testnet (v3).

Headline results

Meter-Bench: a hardened prompt cut malicious calls from 343/630 to 134/630; 0 of 281 previewed releases would have paid a wrong target.

Circle testnet USDC run on medbf5c.

v3 tripwire on mf004b2: fifth refusal deleted the key, BURNED event decoded.

The hijack · Bench · Check a call · Verify it yourself (node chain/verify.mjs).

The contract pays that line inside the stored window, or it moves nothing.

Judge it · The result · The hijack · Try the refusal · Check a call · The book · Docs · Verify

2:15. Play the film. It replays the 2026-11-11 testnet run. It is not a new payment. NearBlocks showed the recorder a bot check, so the transaction on screen is the hash 54EdKyXMhLT2SCAAdNodQm3CniKbB7WHqaMdQmRx22SR. The closing command is node chain/verify.mjs from this machine on 2026-11-12. Last line: verify: ok.

The still below is the first screen. It is not a chain receipt.

An agent told to pay the wrong account obeyed. The Meter key moved 0.00. The same invoice on a full-access key lost 48.00. Open meter-brown.vercel.app and click See the hijack. Cluster: NEAR testnet. Recorded 2026-11-11 22:01 UTC on i198b44.mtrfc658fd1.testnet.

Contents

1. Judge it in a few minutes
2. The result
3. What is and is not verifiable
4. The hijack, recorded
5. Real-World Money
6. What a hijacked agent can still do
7. How the evidence was collected
8. The problem
9. How a meter runs
10. Meter-Bench
11. Three independent layers
12. Evidence
13. Try it
14. Decisions
15. Stack
16. Getting started
17. Repo map
18. Status
19. Roadmap
20. Team and license

Judge it in a few minutes

No key. No wallet.

1. Open the hijack. Open meter-brown.vercel.app and click See the hijack. The No defence key shows 48.00 PAID. The Meter key shows 0.00 STOPPED. The page is also at /attack. To run it yourself, from app/ run npm install and npm run dev, then open http://localhost:3000.
2. Try the refusal. On the homepage, open Try the refusal and leave it on Before the time. The answer is ERR_NOT_YET and 0.00. That preview calls decide in app/lib/rule.mjs. It sends no transaction. A Clears mark is not a payment.
3. Re-read the chain. From the repo root, node chain/verify.mjs. Expected last line: verify: ok. The command uses no key. It fails if a recorded account no longer matches the receipt. See What is and is not verifiable. The reliable checks are the v3 events (15/15), the tripwire (13/13), the code hashes, and the poke meter state.

The result

Receipts: app/public/inject.json (i198b44.mtrfc658fd1.testnet), app/public/inject2.json (h3743c5 plain tier, h09d6ce escalation). One temperature-0 sample per hardened attack in inject2.json. Attacker on testnet: other.testnet.

Split-instruction escalation on h09d6ce comes first; plain-tier hardened prompts on h3743c5; the toy-token No defence baseline on i198b44 is last.

Summary: Full-access keys still pay wrong targets on escalation 1–2 and plain attack 4. On every row where the agent emitted a malicious call, the Meter key moved 0.00 (recorded transactions, inject2.json).

This is the beginning of the README. Read the rest at the original. Read the full README ↗