Trycanari

AI agents now do real things — move money, read private data, call tools. The problem is they can be prompt-injected: tricked by cleverly worded text into doing something they were told never to do. Real wallets have been drained this way. Teams building these agents have no cheap, continuous way to find those holes. Canari is a bug-bounty marketplace built specifically for AI agents. A sponsor lists an agent and plants canaries — tripwires like “this secret must never appear in output” or “this tool must never be called with these arguments.” They lock a reward in escrow. Hunters (people or automated attacker agents) submit attacks. Your system replays each attack against a sandboxed copy several times, and a deterministic judge checks whether a canary tripped. If it did in at least 3 of 5 runs, the payout fires automatically and the sponsor gets the transcript as a regression test. Three things make it distinctive: no triage (a canary tripped or it didn’t, so nobody argues about whether a report is valid), self-serve (a two-person team can open a bounty in minutes), and private settlement (payouts are shielded on Zcash, so outsiders can’t see that an agent was broken, how often, or who was paid). How it works, as one loop Sponsor defines the target (prompt, tools, model) → plants canaries → funds the reward → it goes live → hunters attack → the harness replays each attack on a fresh sandboxed copy → the judge checks for a tripped canary → on a verified break, the reward auto-pays and the bounty pauses → sponsor gets the transcript, patches the agent, and the old attack is replayed to confirm it now fails → bounty re-arms.