The Agentic Risk Surface Area

The Agentic Risk Surface Area

DeFi has always carried risks such as smart contract vulnerabilities, oracle manipulation, depeg events, and liquidity crunches. These are known, documented, and in some cases partially priced into how onchain markets operate. The industry has lived with this risk surface for years.

When agents become the primary operators of onchain markets, none of that goes away, and a new surface area opens on top of it. These new vectors have never existed before and existing tools were not designed for them.

Inherited Risks Are Amplified

Let’s start with the risk vectors that agents did not introduce but have changed, fundamentally.

• Correlated withdrawal: Human traders have different data sources, different time horizons, different risk tolerances, and different emotional states. Their decisions are distributed. Agents are different because they’re trained on similar data, optimize for similar objectives, and receive similar market signals. When market conditions shift, they’re more likely to move in the same direction at the same time creating more dramatic mass movements of capital. This could have unforeseen effects on the market as liquidity that took months to accumulate could suddenly exit a pool in seconds as agents swarm out. The liquidity desert effect, where capital that looks deep evaporates faster than any human withdrawal could create, is a structural property of agent-operated markets.
• Oracle manipulation at machine speed: A human trader who sees a price feed quoting an asset at 40% below market has a moment of hesitation. Something feels wrong or too good to be true, so they pause. An agent executing a yield optimization strategy has no such instinct. It reads the feed, calculates the arbitrage, and executes at the speed the chain confirms transactions. The problem is that oracle manipulation is not a new attack vector but in a market where the primary counterparties are agents, it scales from a niche exploit to a systemic weapon. A potential attacker does not need to manipulate every agent, they just need to manipulate the feed that every agent reads.
• Cascading liquidations: Agents managing leveraged positions across Aave, Morpho, Compound, and Euler simultaneously do not unwind sequentially. When a collateral asset drops, liquidation logic fires across every protocol at once. The collateral sales then push prices further down and more liquidations fire. Human-designed circuit breakers were calibrated for human reaction times that take seconds to minutes. Agents operate at block confirmation times so a cascade would be over before a human risk manager sees the first alert. This is not a hypothetical risk. The Drift Protocol exploit on April 1, 2026 involved no smart contract vulnerability and no stolen private key and saw $286M lost. Oracle data was manipulated, an operator layer failed, and agents compounded the damage at machine speed before any intervention was possible.

The New Risks

On top of amplifying existing risk vectors, there are new risks that are native to a world where autonomous systems can hold financial authority.

• Signing authority risk. When an agent holds treasury signing authority, it becomes a high-value target. The risk is that attackers might corrupt its instructions and then the agent will then use its private keys exactly as designed but under the attacker’s direction. The Q1 2026 AI trading agent losses that exceeded $45M were caused by agents acting precisely according to their programming after it was corrupted through memory poisoning and indirect prompt injection. This is a new kind of risk that can’t be solved with better cryptography. The problem exists because agents ingest data continuously from market feeds, protocol state, onchain events, and documentation. Adversarial inputs embedded in that data can redirect an agent's behavior without touching any code. A poisoned context window can change what an agent believes about the state of a protocol, its own positions, or its authorized actions.
• Unbounded optimization. An agent instructed to maximize yield has no instinct for "this is too risky." It will make hot-headed decisions like concentrating positions in the highest-returning pool regardless of counterparty quality or will it route through infrastructure that a human compliance officer would flag. The problem in this case is the absence of constraints. More so, it’s the lack of difficulty in formalizing what these constraints actually mean in a programmatic way. Agents don't have much they can reference to determine whether their next action is risky or not. Without a risk primitive that bounds what an agent can do, the optimization objective can easily drive the agent to make unwise decisions.
• Agent-to-agent counterparty risk. The traditional framework for counterparty risk breaks down when both sides of a transaction are autonomous agents. Credit assessments assume a legal entity that can be held accountable and reputation systems work with an individual history that can be evaluated. ERC-8004 provides onchain reputation scoring for agents, which is a meaningful step. But this still doesn’t solve the issue of when an agent counterparty fails to perform. In these cases, users have no legal recourse or insurance backstop, and there is no responsible person to negotiate with. Agent-to-agent risk is currently unpriced and unhedged across the entire onchain market.
• Strategy execution risk. Legacy risk management focused on asset risk. It was concerned with questions like: Will this asset depeg? Will this collateral hold its value? Agents running complex multi-step strategies introduce a different category. The individual assets may be sound but the strategy itself can fail when errors show up during the automated process. An agent might encounter an unrelated authentication issue, for example, that causes the whole strategy to fail and lose funds. In these cases, the agent is left holding an exposed intermediate position that no one designed and no risk model priced. Here, the strategy itself is also a unit of risk, much like the asset was in traditional models. No existing primitive prices it that way.

What a Risk Management for Agents Needs to Do

The common thread along these risks is that they exist on infrastructure that assumes human principals, human judgment, and human reaction times. The agentic risk surface area requires infrastructure built for machine principals, machine speed, and programmatic execution.

Agents need to be able to manage risks themselves, without human intervention. This means that they need risk primitives and these primitives need to be:

• Atomic: Risk-related information needs to be callable within a single transaction. An agent managing a leveraged loop across three protocols cannot pause to navigate a claims interface. Risk coverage needs to be computed in the same block as the position it covers.
• Composable: The risk primitive has to sit inside agent strategies as a building block. Discrete, tradable ERC-20 risk tokens that an agent can hold, price, include in a multi-leg position, and transfer to another agent are the correct form factors.
• Deterministic: An agent cannot reason about a payout contingent on a committee vote. It needs to know that if condition X is observed onchain, then output Y should be delivered.

Cork's programmable risk primitive was designed against this specification. Cork Pool operations are smart contract functions that are callable, composable, and settled deterministically onchain.

The agentic risk surface area is new and it requires new infrastructure that’s not retrofitted from tools designed for an older version of the market. Cork is building the layer that enables agents to manage risk in the same way in which they can explore new opportunities.