Eighty-eight percent. That is the share of enterprises reporting confirmed or suspected security incidents involving autonomous AI agents. The companion figure is smaller and more damning: only 22% treat those agents as distinct identity entities with scoped access and audit trails. The 66-point gap is not noise. It is the structural signature of a market that shipped autonomy before it built accountability.
Crypto has the same condition, with the guardrails filed off. When an enterprise agent misbehaves, a data steward opens a ticket. When an on-chain agent misbehaves, a wallet drains and the transaction settles. The failure surface is identical. The recovery window is not.
I spent three months this year mapping agent-controlled wallets across four chains. The recurring pattern is not a model failure. It is an authorization failure. The intelligence is adequate. The permissions are reckless.
What the execution layer actually is
The enterprise security conversation has migrated. It is no longer about what a model says. It is about what an agent does — which tools it invokes, under whose credentials, against which data boundary. The industry term is the execution-layer gateway: a control plane between the agent and the tools it can touch, brokering credentials the agent never sees, logging every call.
The mechanism is familiar to anyone who has audited DeFi. It is an API gateway, a zero-trust policy engine, and privileged access management, recombined for a new class of actor. Nothing here is a new computing paradigm. It is a scene-specific remix of mature primitives.
For on-chain agents, the gateway has another name. It is account abstraction. It is session keys. It is the policy module bolted to a smart account — ERC-4337, ERC-7702 — that lets an agent sign within a spending envelope it cannot exceed. The enterprise world calls it an execution-layer gateway. Crypto calls it a scoped signer. The engineering is the same. The incentives are not.
The report identifies one genuinely novel problem: how to build dynamic, context-aware authorization for a non-deterministic, self-directed actor. No vendor solves it. Every vendor ships a compensating control — a fence around the root cause rather than a cure. Prompt injection remains the upstream vector for tool abuse, unintended code execution, and cascading tool-chain failure. The fence does not stop the injection. It limits the blast radius.
Translate that to crypto and the root cause is phishing and malicious signatures. The fence is transaction simulation and approval allowlists. Useful. Not a cure.
The attack surface amplifier
Here the numbers get uncomfortable.
One infrastructure vendor's action gateway reaches more than 500 suppliers and 16,000 tools, with credentials brokered outside the agent. Read that again. Sixteen thousand callable endpoints, each a candidate for tool poisoning, silent tool substitution, and confused-deputy abuse.
On-chain, the equivalent is a token approval. The active DeFi wallets I sampled carry between nine and fourteen standing allowances, several unlimited, most never revisited. An agent given tool access inherits that surface and multiplies it. Every MCP server is a contract. Every tool is an approval. Every approval is a door.
In my 2021 wash-trading work, I mapped 450 wallets executing circular trades to inflate a floor price. That operation required humans coordinating across time zones. An agent-driven version requires one misconfigured policy and one poisoned tool. The ledger would record it as legitimate volume for weeks. Based on my audit experience, the detection lag is the product, not the bug.
The identity gap is the whole story
Only 22% of organizations treat agents as first-class identities. The rest let them run under borrowed human credentials or standing service accounts. Crypto is worse. Most "AI trading agents" are bots holding a hot key with no session scoping, no spend limit, and no revocation path. When I pull the on-chain footprint of these systems, the identity layer is empty. The permissions are absolute.
The correct direction is uncontested: make the agent an identity, scope it, log it, expire it. The enterprise world routes this demand into existing IAM vendors — Okta, SailPoint, Saviynt. Crypto's version of that plumbing exists and sits idle: session keys with expiry, granular allowances, on-chain policy modules. The tooling is not missing. The discipline is.
Four business models, one commodity floor
The enterprise market has already split four ways, and the split maps onto crypto. Platform bundling — Microsoft folding agent governance into Entra, Purview, and Defender — is the wallet provider that ships scoped signing by default. Data-native — Snowflake's gateway anchored to the warehouse boundary — is the custodian that governs at the point of data residency. Specialist security — Palo Alto and CrowdStrike extending existing franchises — is the dedicated on-chain monitoring firm. Infrastructure-default, priced at fifty and two hundred dollars a month, is the free tier that turns a product into a checkbox.
That last model is the tell. When governance is bundled into a fifty-dollar plan, standalone agent-security products lose pricing power overnight. The same compression is arriving on-chain. Transaction simulation, approval alerts, session keys — features that justified entire companies two years ago — are becoming wallet defaults. The category is not dying. It is being absorbed.
The demand data underneath is sobering. Eighty-five percent of enterprises are in trials; five percent are in production. Gartner projects more than 40% of agentic AI projects will be canceled by the end of 2027, several after discovering governance gaps only at deployment. Crypto's version of pilot purgatory is louder: agent tokens trading on narrative while the production footprint stays thin.
The contrarian read: the gateway is the target
Every report frames the gateway as the solution. None discusses the gateway as the prize.
A control plane that brokers 16,000 tool credentials is a master key with a changelog. Compromise it once and you inherit every door it guards. This is the classic hardening paradox — the reinforced point is the concentrated point. Crypto learned this the expensive way. Bridges were the secure chokepoints until they became the most profitable targets in the industry. A centralized agent gateway is a bridge by another name.
The second blind spot is the framing. Splitting the problem into operational control versus model alignment quietly assigns revenue to security vendors and blame to model developers. It is a true distinction and a strategic one. Logic is the only audit that never expires, and the logic here says the fence is not the foundation. The market's s silence on gateway risk is not reassurance. It is an unpriced liability. That same s silence will greet the first on-chain agent to drain a treasury through a poisoned tool.
Takeaway
Watch the identity metric, not the model metric. Over the next two quarters, the signal is the share of on-chain agents operating under scoped, expiring, revocable permissions rather than standing hot keys. If that number stays near 22%, the execution layer will keep producing its 88% incident rate — settled on-chain, permanently, with no ticket to file.