Pith. sign in

REVIEW 5 major objections 6 minor 45 references

ChainClaw: A Layered Agent Framework for Reliable On-Chain Execution

T0 review · 5 major / 6 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read On-chain agents fail because execution is irreversible; ChainClaw adds simulation and monitoring to close the gap.

desk verdict A sensible three-gap architecture for on-chain agents, but the evaluation stops at transaction preview, so the headline empirical claims are not yet supported. read the letter →

arxiv 2608.05790 v1 pith:CGRXHZVA submitted 2026-08-06 cs.AI cs.CR

Jiacheng Wei , Zhaoxin Fan , Xin Wen , Yuqin Lan , Dongrun Li , Wenjun Wu , Faguo Wu , Xiao Zhang This is my paper · ORCID
classification cs.AIcs.CR
keywords LLMagentsblockchainon-chainexecutiontransactionsimulationactionguardevent-drivenorchestrationmonitoringagentsafety
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

General-purpose large language model agents assume actions are recoverable, interactions are session-driven, and context contains enough state. On blockchains all three assumptions break, producing what the paper names the Reactivity, Irreversibility, and Observability gaps. ChainClaw is a layered framework that closes them by letting asynchronous on-chain events trigger planning, by simulating and guarding every transaction before it is signed, and by reading live chain state and tracking transactions until settlement. On a seven-task benchmark covering reads, transfers, approvals, multi-step swaps, and malicious drain attempts, ChainClaw outperforms the representative baselines on both safety and task completion. The paper's conclusion is that reliable on-chain agency needs a dedicated architecture, not a stronger language model.

What carries the argument

The load-bearing mechanism is the pre-execution safety pipeline: simulation, action guard, explainer, then execution, with monitoring. The simulation stage classifies an action as passive or state-changing, scores it against behavioral heuristics, and returns control to the reasoner when the outcome is unsafe. The action guard applies hard rule-based filters and an LLM-based risk arbitration pass, producing an interpretable verdict that either blocks the action or clears it. The explainer turns that verdict into a transaction preview that appears before any key is touched. Around this pipeline, a dual-trigger orchestration layer admits both user requests and chain-derived events into a single planner, and a cross-layer memory plus consistency module keeps plans aligned with live chain state.

What would settle it

Run ChainClaw and a general-purpose baseline head-to-head on the same live chain with identical allowed steps, giving both an unexpected transaction revert, a sudden price change mid-task, and a deliberately malicious transfer instruction; if ChainClaw no longer blocks more harms or completes more tasks, the three-gap claim is not general.

Watch

Extended reading notes

Core claim

The central claim is that the three failure modes of general-purpose agents on blockchains are architectural, not model-level, and can be closed by a layered design. Every candidate action is grounded in live chain state, run through a mandatory simulation that labels it passive or state-changing and scores its risk, screened first by deterministic rules and then by an LLM-based second pass, and only then signed—with the user shown a natural-language preview of the transaction and its gas cost. Asynchronous events enter the same planner as user requests through an event-ingestion pipeline, and an on-chain read adapter plus transaction monitor keeps reasoning aligned with the true state of the ledger. In the paper's evaluation, this design reaches perfect scores on all seven tasks and all five metrics, which the baselines match only on simple read queries.

Load-bearing premise

The benchmark's seven hand-picked tasks and its rule that a baseline is not penalized for steps it cannot perform are assumed to fairly represent the Reactivity, Irreversibility, and Observability gaps; if those choices favor ChainClaw, the perfect scores may not generalize to real on-chain work.

Editorial extensions

If this is right

  • ChainClaw's advantage is architectural: with the same underlying model fixed across systems, the benchmark gains come from the layered design, not model capability.
  • Agents can respond to asynchronous on-chain threats, such as exploit attempts or failed transactions, even when no user request is in flight.
  • A malicious instruction that tries to drain assets is blocked before signing, because the safety pipeline refuses it pre-execution instead of discovering the loss afterward.
  • Multi-step workflows, such as approve-then-swap, are repaired from live allowance data when the first step fails, rather than collapsing on stale context.
  • Users see exactly what a transaction will do, its expected output, and its estimated gas cost before authorizing it, making on-chain behavior auditable at the point of signing.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A likely generalization beyond the paper: any environment where actions are irreversible and adversarial, such as irreversible financial orders or physical actuation, could benefit from the same simulate-before-commit, guard-before-sign, monitor-until-settled pattern.
  • The fairness rule that completion excludes steps a baseline cannot support means the benchmark comparison is charitable to baselines by construction; an alternative test with identical step budgets for every system would quantify how much of the gain is architectural rather than metric-defined.
  • The safety guarantee is only as strong as the transaction simulation's fidelity to live adversarial conditions; a natural stress test is to record how the action guard behaves under oracle manipulation or sandwich attacks during simulation.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 6 minor

Summary. The paper proposes ChainClaw, a layered agent framework built on OpenClaw, designed to close three gaps it identifies in deploying general-purpose LLM agents on blockchains: the Reactivity gap (asynchronous on-chain events), the Irreversibility gap (transactions that cannot be undone), and the Observability gap (live chain state outside the agent's context). The framework adds an event ingestion pipeline, a simulation-based safety pipeline with an Action Guard, a transaction monitor, and a cross-layer memory subsystem. The evaluation uses a purpose-built benchmark of seven tasks across four categories, five metrics (Completion, Correctness, Safety, Robustness, Efficiency), ablations for each architectural component, and a user study. The paper claims ChainClaw consistently outperforms ReAct, LangChain, and OpenClaw on safety and task completion.

Significance. The paper addresses an important and timely problem: LLM agents operating on blockchains face failure modes that are not present in conventional tool-use settings, and the proposed architectural decomposition is conceptually sensible. The benchmark and ablation design are valuable if the evaluation is sound, and the user study provides some complementary evidence. However, the central empirical claim is not established because the state-changing tasks are evaluated only at the pre-signing, preview stage, and the comparison protocol contains a fairness rule that weakens the baseline results. The paper does not provide machine-checked proofs, reproducible code, or a public benchmark release, and several configuration parameters are unspecified. With a real on-chain evaluation, guardrail baselines, and statistical reporting, the framework could be a meaningful contribution; in its current form, the evidence is insufficient to support the headline claims.

major comments (5)
  1. [Section 4.1, Execution Environment and Implementation Details] The evaluation for state-changing tasks T3–T7 runs only through transaction preview without broadcasting: the paper states that 'the pipeline runs through to transaction preview without broadcasting, so gas is estimated rather than realized and Safety is judged at the pre-signing stage.' Consequently, Safety, Robustness, and Efficiency for these tasks are measured on simulated or pre-signing artifacts, not on actual on-chain execution. The headline claim that ChainClaw improves 'reliable on-chain execution' is therefore not supported; the results demonstrate only that ChainClaw constructs better pre-signing plans and guard decisions in a simulated setting.
  2. [Section 4.1, Evaluation Metrics] The fairness rule 'Completion excludes steps a baseline cannot support' is methodologically problematic. If a baseline cannot support a step (for example, the swap step in T5), that step is removed from the denominator, so the baseline is not penalized for lacking the capability that ChainClaw provides. This inflates baseline Completion scores and makes the comparison a test of how well each system performs only the subset of steps it can already support, rather than a test of the claimed capability gap. The paper does not report raw completion on a fixed step set, so the 'consistently outperforms on task completion' claim is not well supported.
  3. [Section 4.2, Table 1 and Table 2] No number of instances N per task, no error bars, and no statistical significance tests are reported for any metric. ChainClaw scores exactly 1.00 on every metric in both the main results and the ablation, while baselines show large performance drops; without variance or instance counts, the reader cannot assess whether these differences are stable or whether the perfect scores arise from a small number of curated instances. This is load-bearing for the 'consistently outperforms' claim, which requires evidence of reliability across instances.
  4. [Section 2 (Related Work) and Section 4.1 (Baselines)] The related work discusses several safety-focused guardrails (AgentSpec, ShieldAgent, AGrail, GuardAgent) and argues that they are domain-agnostic and do not address blockchain irreversibility. However, the experiments compare ChainClaw only against ReAct, LangChain, and OpenClaw, none of which include such a guardrail. Since the paper's central contribution is a pre-execution safety pipeline, a natural and necessary baseline is OpenClaw augmented with one of these guardrails (for example, AgentSpec). Without that comparison, the results leave open the possibility that a simpler guardrail applied to a general framework would achieve equivalent safety, and the claimed advantage of ChainClaw's dedicated architecture is not established.
  5. [Section 3.2 (Intelligence layer for Irreversibility) and Section 4.1 (Implementation Details)] Several configuration parameters that directly affect the results are not specified: the simulation risk-scoring thresholds, the Action Guard rule set and reweighting parameters, the Transaction Monitor confirmation threshold, and the event circuit-breaker thresholds. No sensitivity analysis is provided. Without these details, the results are not reproducible, and it is unclear whether the perfect 1.00 scores are robust or depend on thresholds hand-tuned to the particular benchmark tasks. This is a load-bearing omission for a paper whose contribution is partly empirical.
minor comments (6)
  1. [Section 4.2, Case study] The text says 'Qualitative examples in Figure ?? show' but the reference is broken; the figure caption (Figure 3) exists in the full text, but the in-text reference must be fixed.
  2. [Preamble (CCS Concepts, Keywords, ACM Reference Format)] The CCS Concepts and Keywords are placeholder text ('Do Not Use This Code', 'Generate the Correct Terms for Your Paper'), and the ACM Reference Format lists '2018' as the publication year while the paper is dated 2026. These template artifacts should be corrected before submission.
  3. [Abstract] The abstract contains a grammatical error: 'they rely on assumptions break down in blockchain environments' should read 'they rely on assumptions that break down in blockchain environments'.
  4. [Section 4.2, User study] The user study reports N=12 but does not describe the participant recruitment, the three scenarios used, or whether the evaluation was blinded; no statistical test (e.g., paired t-test) is reported despite the mean±std format. This is a secondary evaluation and the missing details should be supplied.
  5. [References] Reference [4] and [5] are both 'LangChain' with overlapping content; they should be consolidated or disambiguated. Reference [28] (OpenClaw) gives a GitHub URL but no version or commit identifier, which limits reproducibility.
  6. [General (Reproducibility)] No public code, benchmark, or configuration files are provided. Releasing these would substantially strengthen the paper and is recommended.

Circularity Check

0 steps flagged · score 1.0 of 10

No derivation-level circularity; benchmark-task alignment is a validity concern, not a circular reduction.

full rationale

The paper's derivation chain is self-contained: no benchmark numbers are fitted into the architecture, no parameter is renamed as a prediction, and no load-bearing claim rests on a self-citation or an author-imported uniqueness theorem. The framework's components are described functionally (event ingestion, simulation, action guard, transaction monitor) and the baseline comparisons share the same backbone and decoding settings, with ablations removing individual modules. The closest thing to self-referentiality is that the benchmark is purpose-built to stress exactly the three gaps ChainClaw addresses, and the Safety metric is defined as blocking illegal operations at the pre-signing stage, which is the precise function of ChainClaw's action guard. That alignment can make the perfect scores partly reflect task-architecture fit, and it is a legitimate concern about external validity and benchmark representativeness rather than a circular derivation. The preview-only evaluation for T3-T7 (no broadcast, estimated gas, safety judged pre-signing) further limits what the empirical claims can establish about real on-chain execution, but this is an internal methodological limitation, not a circularity. Therefore no specific circular step can be exhibited, and the appropriate finding is no significant circularity.

Assumptions & free parameters 4 free parameters · 4 assumptions · 5 invented entities

The central claim rests on the motivational premise that blockchain execution is irreversible and stateful, on the representativeness of the paper's seven-task benchmark, and on a fairness rule that excludes unsupported steps from the Completion metric. No numbers are fitted from the data into the architecture, so the circularity burden is low, but the benchmark is authored by the same team and the modules are not independently attested. The five free parameters listed are design choices whose values are not disclosed in the text.

free parameters (4)
  • Simulation risk-scoring thresholds = not disclosed
    Section 3.2 scores actions against behavioral heuristics (anomalous patterns, cross-chain activity, abnormal frequency) but gives no thresholds or weights.
  • Action Guard rule set and reweighting parameters = not disclosed
    Section 3.2 'Intent screen' and 'Risk arbiter' rely on hard rules and LLM reweighting whose exact contents are not specified.
  • Transaction Monitor confirmation threshold = not disclosed
    Section 3.3 states confirmations accumulate 'until a safety threshold is reached' without giving the value.
  • Event circuit-breaker thresholds = not disclosed
    Section 3.1 mentions a 'threshold-based circuit breaker' with unspecified thresholds.
assumptions (4)
  • domain assumption On-chain execution is stateful, adversarial, and economically irreversible, unlike the recoverable tool calls assumed by general-purpose agent frameworks.
    Introduction; this motivates the three-gap analysis and is asserted rather than empirically established.
  • ad hoc to paper The seven tasks (T1-T7) are representative of the Reactivity, Irreversibility, and Observability gaps.
    Section 4.1 defines the tasks in terms of the three gaps; no external validation of representativeness is provided.
  • ad hoc to paper Excluding steps a baseline cannot support from Completion yields a fair comparison.
    Section 4.1 Baselines states this rule; it is a modeling choice that could mask baseline failures.
  • domain assumption Using a single backbone (moonshot-v1-8k) with fixed decoding settings isolates architecture effects.
    Section 4.1 Execution Environment; the paper asserts differences reflect architecture, not model capability, with no cross-backbone test.
invented entities (5)
  • Event Ingestion pipeline (Event Normalizer, Dedup Gate, Risk Scheduler, circuit breaker)
    purpose: Converts asynchronous on-chain state changes into normalized, deduplicated, prioritized events that trigger the Planner, closing the Reactivity gap.
    Described in Section 3.1; no released implementation or external benchmark to confirm behavior beyond the in-paper T7 result.
  • Simulation module
    purpose: Simulates a candidate transaction before signing, scores risk, and feeds the result back to the Reasoner, closing the Irreversibility gap.
    Described in Section 3.2; the simulation mechanism (e.g., eth_call, forked node) and scoring thresholds are not specified.
  • Action Guard (Intent screen, Risk arbiter, Verdict generation)
    purpose: Applies deterministic rules and an LLM-based second pass to filter unsafe actions before any signature is produced.
    Described in Section 3.2; the rule set and reweighting details are not disclosed.
  • Consistency module
    purpose: Aligns the Planner's output with current on-chain state and validates execution traces structurally and semantically.
    Described in Section 3.1; Table 2 does not ablate it in isolation, so its contribution is unmeasured.
  • Transaction Monitor (Polling, Settlement tracking, Resolution)
    purpose: Tracks transaction status from submission through confirmation or failure, closing the Observability gap.
    Described in Section 3.3; no code or logs are available to reproduce its behavior.

how reviews work

0 comments
Cite this review

Pith. "Pith review of ChainClaw: A Layered Agent Framework for Reliable On-Chain Execution." pith.science (2026). https://pith.science/paper/CGRXHZVA

@misc{pith2026260805790,
  author       = {Pith},
  title        = {Pith review of: ChainClaw: A Layered Agent Framework for Reliable On-Chain Execution},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/CGRXHZVA}},
  note         = {Machine review of arXiv:2608.05790}
}
read the original abstract

General-purpose large language model agents have achieved strong performance on tool-augmented tasks, yet they rely on assumptions break down in blockchain environments. On-chain execution is stateful, adversarial, and economically irreversible, exposing three fundamental gaps: Reactivity, Irreversibility, and Observability. We propose ChainClaw, a blockchain-native agent framework built on OpenClaw, that addresses all three gaps through a layered architecture comprising an event-driven orchestration layer, a simulation-based safety intelligence layer, and an on-chain monitoring runtime layer, unified by a cross-layer memory subsystem. ChainClaw closes the Reactivity gap via event ingestion and simulation feedback, the Irreversibility gap via a pre-execution safety pipeline with transaction simulation and action guard, and the Observability gap via an on-chain read adapter and transaction monitor. We evaluate ChainClaw on a purpose-built benchmark covering seven tasks across four categories and five dimensions. ChainClaw consistently outperforms representative baselines on both safety and task completion.

Figures

Figures reproduced from arXiv: 2608.05790 by the authors.

Figure 1
Figure 1. General-purpose agents fail on blockchain due [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Overall architecture of ChainClaw, a layered pre-execution safety pipeline for on-chain LLM agents. Gray modules [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. Case study of ChainClaw vs.OpenClaw on a complex swap (left) and a malicious transfer (right). OpenClaw plans [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

45 extracted references · 21 canonical work pages

  1. [1]

    Saad Alqithami. 2026. Autonomous Agents on Blockchains: Standards, Execution Models, and Trust Boundaries.arXiv preprint arXiv:2601.04583(2026)

    arXiv 2026

  2. [2]

    Kushal Babel, Philip Daian, Mahimna Kelkar, and Ari Juels. 2023. Clockwork finance: Automated analysis of economic security in smart contracts. In2023 IEEE Symposium on Security and Privacy (SP). IEEE, 2499–2516

    work page 2023

  3. [3]

    Nikolaj S Bjørner, Ashley J Chen, Shuo Chen, Yang Chen, Zhongxin Guo, Tzu- Han Hsu, Peng Liu, and Nanqing Luo. 2024. Theorem-Carrying-Transaction: Runtime Certification to Ensure Safety for Smart Contract Transactions.CoRR (2024)

    work page 2024

  4. [4]

    Harrison Chase. 2022. LangChain. https://github.com/langchain-ai/langchain. Open-source framework for LLM application development; accessed 2026-06-13

    work page 2022

  5. [5]

    Harrison Chase. 2022. LangChain. https://github.com/langchain-ai/langchain

    2022

  6. [6]

    Bei Chen, Gaolei Li, Xi Lin, Zheng Wang, and Jianhua Li. 2024. Blockagents: Towards byzantine-robust llm-based multi-agent coordination via blockchain. In Proceedings of the ACM Turing A ward Celebration Conference-China 2024. 187–192

    work page 2024

  7. [7]

    Zhaorun Chen, Mintong Kang, and Bo Li. 2025. SHIELDAGENT: Shielding Agents via Verifiable Safety Policy Reasoning.Proceedings of Machine Learning Research 267 (2025), 8313–8344

    work page 2025

  8. [8]

    Sizheng Fan and Tian Min. 2025. Web3Agent: Automating On-Chain Operations via Natural Language Interfaces.ACM Transactions on the Web(2025)

    work page 2025

Show all 45 references
  1. [9]

    Xiang Fei, Xiawu Zheng, and Hao Feng. 2025. Mcp-zero: Active tool discovery for autonomous llm agents.arXiv preprint arXiv:2506.01056(2025)

    2025 arXiv

  2. [10]

    Christof Ferreira Torres, Albin Mamuti, Ben Weintraub, Cristina Nita-Rotaru, and Shweta Shinde. 2024. Rolling in the shadows: Analyzing the extraction of mev across layer-2 rollups. InProceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security. 2591–2605

    2024

  3. [11]

    Xinyi Hou, Yanjie Zhao, Shenao Wang, and Haoyu Wang. 2025. Model context protocol (mcp): Landscape, security threats, and future research directions.ACM Transactions on Software Engineering and Methodology(2025)

    2025

  4. [12]

    Xiaohui Hu, Ningyu He, and Haoyu Wang. 2025. WalletProbe: A Testing Frame- work for Browser-based Cryptocurrency Wallet Extensions.arXiv preprint arXiv:2504.11735(2025)

    2025 arXiv

  5. [13]

    Carlos E Jimenez, John Yang, Alexander Wettig, Shunyu Yao, Kexin Pei, Ofir Press, and Karthik Narasimhan. 2024. Swe-bench: Can language models resolve real-world github issues?. InInternational Conference on Learning Representations, Vol. 2024. 54107–54157

    2024

  6. [14]

    Anan Jin, Yuhang Ye, Brian Lee, and Yuansong Qiao. 2024. Decoagent: Large language model empowered decentralized autonomous collaboration agents based on smart contracts.IEEe Access12 (2024), 155234–155245

    2024

  7. [15]

    Bowen Jin, Hansi Zeng, Zhenrui Yue, Jinsung Yoon, Sercan Arik, Dong Wang, Hamed Zamani, and Jiawei Han. 2025. Search-r1: Training llms to reason and leverage search engines with reinforcement learning.arXiv preprint arXiv:2503.09516(2025)

    2025 arXiv

  8. [16]

    Yuan Li, Bingqiao Luo, Qian Wang, Nuo Chen, Xu Liu, and Bingsheng He. 2024. CryptoTrade: A reflective LLM-based agent to guide zero-shot cryptocurrency trading. InProceedings of the 2024 Conference on Empirical Methods in Natural Language Processing. 1094–1106

    2024

  9. [17]

    Detian Liu, Jianbiao Zhang, Yifan Wang, Hong Shen, Zhaoqian Zhang, and Tao Ye. 2025. Blockchain smart contract security: Threats and mitigation strategies in a lifecycle perspective.Comput. Surveys58, 4 (2025), 1–34

    2025

  10. [18]

    Weidi Luo, Shenghong Dai, Xiaogeng Liu, Suman Banerjee, Huan Sun, Muhao Chen, and Chaowei Xiao. 2025. Agrail: A lifelong agent guardrail with effective and adaptive safety detection. InProceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Vol...

    2025

  11. [19]

    Aman Madaan, Niket Tandon, Prakhar Gupta, Skyler Hallinan, Luyu Gao, Sarah Wiegreffe, Uri Alon, Nouha Dziri, Shrimai Prabhumoye, Yiming Yang, et al

  12. [20]

    Shishir G Patil, Tianjun Zhang, Xin Wang, and Joseph E Gonzalez. 2024. Go- rilla: Large language model connected with massive apis.Advances in Neural Information Processing Systems37 (2024), 126544–126565

    2024

  13. [21]

    Minfeng Qi, Tianqing Zhu, Lefeng Zhang, Ningran Li, Yu-an Tan, and Wanlei Zhou. 2026. Towards transparent and incentive-compatible collaboration in decentralized llm multi-agent systems: A blockchain-driven approach.IEEE Transactions on Network Science and Engineering(2026)

    2026

  14. [22]

    Lingfei Qian, Xueqing Peng, Yan Wang, Vincent Jim Zhang, Huan He, Han- ley Smith, Yi Han, Yueru He, Haohang Li, Yupeng Cao, et al . 2025. When agents trade: Live multi-market trading benchmark for llm agents.arXiv preprint arXiv:2510.11695(2025)

    2025

  15. [23]

    Yujia Qin, Shihao Liang, Yining Ye, Kunlun Zhu, Lan Yan, Yaxi Lu, Yankai Lin, Xin Cong, Xiangru Tang, Bill Qian, et al. 2024. Toolllm: Facilitating large language models to master 16000+ real-world apis. InInternational Conference on Learning Representations, Vol. 2024. 9695–9717

    2024

  16. [24]

    Partha Pratim Ray. 2025. A survey on model context protocol: Architecture, state-of-the-art, challenges and future directions.Authorea Preprints(2025)

    2025

  17. [25]

    Timo Schick, Jane Dwivedi-Yu, Roberto Dessì, Roberta Raileanu, Maria Lomeli, Eric Hambro, Luke Zettlemoyer, Nicola Cancedda, and Thomas Scialom. 2023. Toolformer: Language models can teach themselves to use tools.Advances in neural information processing systems36 (2023), 68539–68551

    2023

  18. [26]

    Yongliang Shen, Kaitao Song, Xu Tan, Dongsheng Li, Weiming Lu, and Yueting Zhuang. 2023. Hugginggpt: Solving ai tasks with chatgpt and its friends in hugging face.Advances in Neural Information Processing Systems36 (2023), 38154–38180

    2023

  19. [27]

    Noah Shinn, Federico Cassano, Ashwin Gopinath, Karthik Narasimhan, and Shunyu Yao. 2023. Reflexion: Language agents with verbal reinforcement learning. Advances in neural information processing systems36 (2023), 8634–8652

    2023

  20. [28]

    2025.OpenClaw

    Peter Steinberger. 2025.OpenClaw. https://github.com/openclaw/openclaw

    2025

  21. [29]

    Yuqiang Sun, Daoyuan Wu, Yue Xue, Han Liu, Haijun Wang, Zhengzi Xu, Xiaofei Xie, and Yang Liu. 2024. Gptscan: Detecting logic vulnerabilities in smart contracts by combining gpt with program analysis. InProceedings of the IEEE/ACM 46th international conference on software engi...

    2024

  22. [30]

    Haoyu Wang, Christopher M Poskitt, and Jun Sun. 2025. Agentspec: Cus- tomizable runtime enforcement for safe and reliable llm agents.arXiv preprint arXiv:2503.18666(2025)

    2025 arXiv

  23. [31]

    Lei Wang, Chen Ma, Xueyang Feng, Zeyu Zhang, Hao Yang, Jingsen Zhang, Zhiyuan Chen, Jiakai Tang, Xu Chen, Yankai Lin, et al. 2024. A survey on large language model based autonomous agents.Frontiers of Computer Science18, 6 (2024), 186345

    2024

  24. [32]

    Sally Junsong Wang, Kexin Pei, and Junfeng Yang. 2024. Smartinv: Multimodal learning for smart contract invariant inference. In2024 IEEE Symposium on Security and Privacy (SP). IEEE, 2217–2235

    2024

  25. [33]

    Rui Xi, Zehua Wang, and Karthik Pattabiraman. 2024. Pomabuster: Detecting price oracle manipulation attacks in decentralized finance. In2024 IEEE Sympo- sium on Security and Privacy (SP). IEEE, 3923–3942

    2024

  26. [34]

    Zhiheng Xi, Wenxiang Chen, Xin Guo, Wei He, Yiwen Ding, Boyang Hong, Ming Zhang, Junzhe Wang, Senjie Jin, Enyu Zhou, et al. 2025. The rise and potential of large language model based agents: A survey.Science China Information Sciences 68, 2 (2025), 121101

    2025

  27. [35]

    Zhen Xiang, Linzhi Zheng, Yanjie Li, Junyuan Hong, Qinbin Li, Han Xie, Jiawei Zhang, Zidi Xiong, Chulin Xie, Carl Yang, et al. 2024. Guardagent: Safeguard llm agents by a guard agent via knowledge-enabled reasoning.arXiv preprint arXiv:2406.09187(2024)

    2024 arXiv

  28. [36]

    Jiahua Xu, Yebo Feng, Daniel Perez, and Benjamin Livshits. 2025. Auto. gov: learning-based governance for decentralized finance (DeFi).IEEE Transactions on Services Computing(2025)

    2025

  29. [37]

    Wujiang Xu, Zujie Liang, Kai Mei, Hang Gao, Juntao Tan, and Yongfeng Zhang

  30. [38]

    John Yang, Carlos Jimenez, Alexander Wettig, Kilian Lieret, Shunyu Yao, Karthik Narasimhan, and Ofir Press. 2024. Swe-agent: Agent-computer interfaces enable automated software engineering.Advances in Neural Information Processing Systems37 (2024), 50528–50652

    2024

  31. [39]

    Shunyu Yao, Jeffrey Zhao, Dian Yu, Izhak Shafran, Karthik R Narasimhan, and Yuan Cao. [n. d.]. ReAct: Synergizing Reasoning and Acting in Language Models. InNeurIPS 2022 Foundation Models for Decision Making Workshop

    2022

  32. [40]

    Bosi Zhang, Ningyu He, Xiaohui Hu, Kai Ma, and Haoyu Wang. 2025. Following Devils’ Footprint: Towards Real-time Detection of Price Manipulation Attacks. In34th USENIX Security Symposium (USENIX Security 25). 4127–4145

    2025

  33. [41]

    Xu Zhang, Hao Li, and Zhichao Lu. 2025. CrossGuard: Safeguarding MLLMs against Joint-Modal Implicit Malicious Attacks.arXiv preprint arXiv:2510.17687 (2025)

    2025 arXiv

  34. [42]

    Liyi Zhou, Xihan Xiong, Jens Ernstberger, Stefanos Chaliasos, Zhipeng Wang, Ye Wang, Kaihua Qin, Roger Wattenhofer, Dawn Song, and Arthur Gervais. 2023. Sok: Decentralized finance (defi) attacks. In2023 IEEE Symposium on Security and Conference acronym ’XX, June 03–05, 2018, W...

    2023

  35. [43]

    Shuyan Zhou, Frank F Xu, Hao Zhu, Xuhui Zhou, Robert Lo, Abishek Sridhar, Xianyi Cheng, Tianyue Ou, Yonatan Bisk, Daniel Fried, et al. 2024. Webarena: A realistic web environment for building autonomous agents. InInternational Conference on Learning Representations, Vol. 2024....

    2024

  36. [2023]

    Self-refine: Iterative refinement with self-feedback.Advances in neural information processing systems36 (2023), 46534–46594

    2023

  37. [2026]

    A-mem: Agentic memory for llm agents.Advances in Neural Information Processing Systems38 (2026), 17577–17604

    2026

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.