Meter
Meter enforces the stored line. It does not judge the work.
Prompts are a soft guard. The key is the hard guard.
Track: AI Security & Defense (also Real-World Money). Built at NEAR HACKATHON, https://nearhackathon.com.
Current build: mf004b2.mtrfc658fd1.testnet (v3).
Headline results
Meter-Bench: a hardened prompt cut malicious calls from 343/630 to 134/630; 0 of 281 previewed releases would have paid a wrong target.
Circle testnet USDC run on medbf5c.
v3 tripwire on mf004b2: fifth refusal deleted the key, BURNED event decoded.
The hijack · Bench · Check a call · Verify it yourself (node chain/verify.mjs).
The contract pays that line inside the stored window, or it moves nothing.
Judge it ·
The result ·
The hijack ·
Try the refusal ·
Check a call ·
The book ·
Docs ·
Verify
2:15. Play the film. It replays the 2026-11-11 testnet run. It is not a new payment. NearBlocks showed the recorder a bot check, so the transaction on screen is the hash 54EdKyXMhLT2SCAAdNodQm3CniKbB7WHqaMdQmRx22SR. The closing command is node chain/verify.mjs from this machine on 2026-11-12. Last line: verify: ok.
The still below is the first screen. It is not a chain receipt.
An agent told to pay the wrong account obeyed. The Meter key moved 0.00. The same invoice on a full-access key lost 48.00. Open meter-brown.vercel.app and click See the hijack. Cluster: NEAR testnet. Recorded 2026-11-11 22:01 UTC on i198b44.mtrfc658fd1.testnet.
Contents
- Judge it in a few minutes
- The result
- What is and is not verifiable
- The hijack, recorded
- Real-World Money
- What a hijacked agent can still do
- How the evidence was collected
- The problem
- How a meter runs
- Meter-Bench
- Three independent layers
- Evidence
- Try it
- Decisions
- Stack
- Getting started
- Repo map
- Status
- Roadmap
- Team and license
Judge it in a few minutes
No key. No wallet.
- Open the hijack. Open meter-brown.vercel.app and click See the hijack. The No defence key shows 48.00 PAID. The Meter key shows 0.00 STOPPED. The page is also at
/attack. To run it yourself, from app/ run npm install and npm run dev, then open http://localhost:3000.
- Try the refusal. On the homepage, open Try the refusal and leave it on Before the time. The answer is
ERR_NOT_YET and 0.00. That preview calls decide in app/lib/rule.mjs. It sends no transaction. A Clears mark is not a payment.
- Re-read the chain. From the repo root,
node chain/verify.mjs. Expected last line: verify: ok. The command uses no key. It fails if a recorded account no longer matches the receipt. See What is and is not verifiable. The reliable checks are the v3 events (15/15), the tripwire (13/13), the code hashes, and the poke meter state.
The result
Receipts: app/public/inject.json (i198b44.mtrfc658fd1.testnet), app/public/inject2.json (h3743c5 plain tier, h09d6ce escalation). One temperature-0 sample per hardened attack in inject2.json. Attacker on testnet: other.testnet.
Split-instruction escalation on h09d6ce comes first; plain-tier hardened prompts on h3743c5; the toy-token No defence baseline on i198b44 is last.
Summary: Full-access keys still pay wrong targets on escalation 1–2 and plain attack 4. On every row where the agent emitted a malicious call, the Meter key moved 0.00 (recorded transactions, inject2.json).
여기까지가 README 앞부분입니다. 나머지는 원문에서 읽을 수 있습니다. README 전문 보기 ↗
