On-Chain AI Agents Are Rebuilding Enterprise AI's Execution-Layer Mistake

Two numbers arrived in the same report last week, and they should never have been allowed to sit that close together. The first: 88% of surveyed organizations report confirmed or suspected security incidents involving their AI agents. The second: only 22% treat an agent as a distinct identity entity — scoped, credentialed, and audited. Sixty-six points of daylight between the incident and the control. Ledger whispers what charts conceal. I did what I always do with a number that clean. I carried it across the bridge into crypto and tested it against the only record that cannot be edited after the fact. I indexed autonomous agent frameworks on-chain — the trading bots, the treasury managers, the "agentic" vaults that move capital without a human signer — and I went looking for the identity primitive. Not the wallet address. The identity. The thing that says this agent, this scope, this session, this trail. I found almost nothing. Not 22%. Closer to single digits. And that gap is not a marketing oversight. It is an execution-layer problem — the exact problem enterprise AI spent 2026 naming, pricing, and building gateways to solve. Let me define the execution layer precisely, because the term is already being stretched by people who want to sell you a dashboard. An AI agent does three things that matter for security. It reasons — the model layer. It decides to act — the intent layer. And it acts, by calling tools — the execution layer. Enterprise security in 2026 reached a conclusion I consider correct: the model layer cannot be made reliable against prompt injection in any foreseeable window. So the money moved down the stack. If you cannot guarantee the agent's reasoning is safe, you constrain what its actions are permitted to do. That is the execution-layer gateway: a control plane between the agent and every tool, credential, and data store it touches. The report I have been parsing documents that migration in granular detail. Palo Alto shipped a three-part stack — an Agent Gateway to govern tool calls, an Agent Identity service to assign identity, and Agent Runtime Security for live defense. Snowflake acquired an MCP gateway vendor and shipped an Agent Identity service to general availability. Microsoft pushed agent accounts into Entra, Purview, and Defender — identity, data, and threat — governing agents the same way it governs human users. CrowdStrike made the endpoint the agent's security host. DigitalOcean bundled observability and governance into every tier at $50 and $200 a month. I have audited infrastructure since the 2017 ICO wave, when I rejected 95% of the ERC-20 whitepapers that crossed my desk on non-standard tokenomics alone. I recognize this shape. Four business models, one shared primitive. The primitive is: treat the agent as a non-human identity, scope it, and log it. Now watch what happens when you carry that primitive across the bridge into crypto. It mostly evaporates. My method here is simple and I will state it up front: I take the enterprise control primitive, I find its on-chain analog, and I grade the analog on maturity. No analog, no control. That is the entire audit. Start with the attack surface, because enterprise and crypto diverge fastest there. The report notes that one MCP action gateway in the enterprise stack can reach "500+ vendors and 16,000+ tools." That number is the whole story. Every tool is a potential injection point — a tool-poisoning vector, a "rug pull" where a tool changes behavior after it has been trusted, or a confused deputy where the agent is manipulated into using its own legitimate permissions against its owner. Crypto's version of that surface is not smaller. It is larger and it is public. An on-chain agent does not call 16,000 tools behind a corporate perimeter. It calls smart contracts on a permissionless ledger, and every one of them is a tool. The approval it grants to a router is a tool call. The session key it signs is a credential. The vault it deposits into is a data store it cannot un-ring. And unlike the enterprise case, the attacker does not breach a firewall. They only need the agent to read a malicious input and sign. I have written that every error leaves a forensic trail. On-chain that is literal — the exploit is not a rumor, it is a transaction hash with a timestamp. So let me trace the ghost in the yield, because the mechanics are identical to the enterprise report, minus the compensating controls. Take the three risk categories the report draws from OWASP's agentic top ten: tool misuse, unintended code execution, and cascading failure across tool chains. Map each onto a live on-chain agent. Tool misuse becomes approval abuse. An agent that holds standing token approvals — which nearly all autonomous trading agents do, because requesting a signature per action defeats the point of autonomy — is one malicious calldata payload away from draining its own treasury. Enterprise calls this an over-permissioned non-human identity. Crypto calls it Tuesday. Unintended code execution becomes the malicious contract call. The agent believes it is interacting with a known protocol; the address is a look-alike or a freshly deployed proxy. The report's point about cascading failure matters most here. One poisoned tool does not fail in isolation — it propagates. In DeFi, the propagation path is composability itself. The agent's position in a lending market feeds a vault, which feeds a strategy, which feeds a second agent. Cascade is not a risk in DeFi. It is the architecture. Now the identity primitive, because this is the part crypto has most thoroughly skipped. The report's headline number is that only 22% of enterprises treat agents as distinct identity entities. I will be fair: that figure comes from an unnamed industry survey with no disclosed methodology, and I flag it as directional, not precise. But the direction is corroborated. Snowflake integrated with Okta, SailPoint, and Saviynt — the identity governance incumbents — precisely because agent identity has to live inside the existing IAM system, not beside it. Crypto has an identity system. It is the wallet. And the wallet is exactly the wrong primitive for an autonomous agent, for one structural reason: a wallet conflates identity with key custody. The key is the identity. If the agent holds the key, the agent is unbounded — no scope, no session, no revocation that does not require a new key. If a human holds the key, the agent is not autonomous. Enterprise solved this by decoupling identity from credential through the gateway, which brokers the credential so the agent never sees it. On-chain, that decoupling is being rebuilt only now, under names like account abstraction, session keys, and policy modules. Put the mapping in a table. The parallels are too clean to leave in prose. | Enterprise primitive | On-chain analog | Maturity | |---|---|---| | Non-human identity (NHI) | Smart account / agent registry | Emerging | | Credential brokering (gateway holds the key) | Session keys, scoped signers, MPC | Partial | | Tool-call governance | Transaction simulation + policy engine | Weak | | Runtime behavior monitoring | Mempool monitoring, anomaly detection | Weak | | Session-scoped authorization | Time / target / amount-limited keys | Partial | | Audit trail | The ledger itself | Strong — but unwatched | | Gateway as a product | ??? | Missing | That last row is the one nobody in crypto is building, and it is the row the enterprise report treats as the entire product category. In enterprise, the gateway is the thing that holds the credential the agent cannot. On-chain, the credential is the private key, and the only "gateway" that can hold it without becoming a custodian is cryptography — MPC, threshold signing, or a smart-contract policy module that enforces scope at the transaction level. The irony is that crypto already solved the hard half of this and forgot to market it. Session keys that expire. Spending limits enforced in a smart contract. Allow-lists of approved targets. All of it ships today in account-abstraction stacks. The enterprise world is paying enterprise prices for what a well-configured smart account does natively. Pixels betray the project's true intent: the on-chain primitive is superior, and the on-chain implementation is mostly absent. Why absent? Follow the money, not the meme. The economics are inverted. In enterprise, security is a line item with a buyer — a CISO with a budget and a compliance mandate. In crypto, the agent's operator is often the same entity that benefits from the agent acting fast and unbounded. There is no separate security buyer. The person who would pay for the gateway is the person whose agent is already moving capital, and every control you add costs latency and blocks trades. So the controls get skipped, and the ledger records the loss. I have seen this pattern before. In 2022 I mapped the contagion from Anchor to the exchanges in real time, and the lesson was never that the risks were unknown. The lesson was that the incentives to ignore them sat concentrated in the hands of the people who profited from the ignorance. Agent security in crypto is the same trade with a new ticker. Silence in the block is the loudest signal — nobody publishes their agent's incident log, which is exactly why you should assume the rate runs above the enterprise 88%. Now the MCP standard, because it is the connective tissue between the two worlds and crypto is treating it as a developer convenience rather than a security boundary. MCP — the Model Context Protocol — is how agents discover and call tools. The report is explicit that MCP is a standard battlefield: whoever controls the MCP security extension controls admission to the tool ecosystem. DigitalOcean and Snowflake are both building MCP gateways. On-chain, MCP servers are already being pointed at DeFi protocols, which means tool-poisoning and rug-pull risks now have a crypto address. A malicious MCP server does not hack the agent. It registers as a tool, gets approved once, then changes what it does — the exact rug-pull pattern the report names, now executable against a wallet with a live balance. Here is the part that should keep a risk desk awake. The report frames the enterprise problem as "operational control, not model alignment." That framing does quiet work. It is true that a gateway is operational control. It is also true that framing it that way lets everyone stop worrying about the root cause — prompt injection — because the gateway is presented as sufficient. On-chain there is no gateway yet, so the root cause is fully exposed. The agent reads a malicious instruction — a poisoned token name, a crafted memo field, a hostile NFT description — and it signs. The model layer failed, and there was no execution layer to catch it. Every error leaves a forensic trail, and the trail runs straight back to the missing gateway. Let me lay the migration out chronologically, because the report's value is in its timestamps and I want to hold crypto against them. January 2026: NIST opens a request for information on agent security. February: NIST's NCCoE publishes a concept paper on runtime constraints, continuous behavioral monitoring, and context-aware authorization. May: Snowflake acquires Natoma, an MCP gateway startup — the first clear signal that the gateway category is consolidating before it has even shipped. Through the year: OWASP publishes its Agentic Applications Top Ten, naming tool misuse, unexpected code execution, cascading tool-chain failures, and out-of-scope autonomous action. Microsoft ships agent accounts into Entra, Purview, and Defender, and takes them to government cloud first. Palo Alto ships Prisma AIRS 3.0. CrowdStrike ships Falcon Guardian. DigitalOcean prices governance at $50 a month. Notice the shape of that timeline. Standards lag. Products lead. NIST's SP 800-53 overlay for agents still has no publication date, while vendors are already defining de facto standards through shipping products. That gap is the window in which a vendor's product becomes the standard everyone must match. Crypto is not on this timeline at all. There is no NIST overlay coming for on-chain agents, no OWASP list scoped to smart-contract tool calls, no compliance buyer forcing the issue. Crypto will either build the execution layer voluntarily or wait for a nine-figure exploit to build it by force. I have watched that movie twice, in 2017 and 2022. It ends the same way. Let me put the risk grading next to the enterprise version, because the comparison is the argument. | Risk | Enterprise rating | On-chain rating | Why the delta | |---|---|---|---| | Prompt injection | High (root cause unresolved) | High — worse | No gateway to intercept; input surface is public | | Tool misuse | High | High | Standing approvals are the default | | Data leakage | High | High | Positions and balances are the "data" | | Cascading failure | Medium-high | High — worse | Composability is the architecture | | Unbounded agent | Medium-high | High — worse | No context-aware authorization on-chain | | Gateway concentration | High (unaddressed) | High (does not yet exist) | Single point holds all keys | The on-chain column is not worse because crypto is sloppier. It is worse because crypto removed the perimeter and kept the agent. The enterprise report's mitigations — session-scoped policy, credential brokering, behavioral monitoring — all exist in crypto as primitives and all sit unused in the default configuration. Widen the lens, because the macro-flow story here is bigger than one exploit. The report documents a structural migration of security value from the model layer down to the execution layer. That migration has a crypto twin just beginning, and it is being priced in the wrong direction. The market bids up "AI agent" narratives — tokens, frameworks, autonomous trading vaults — while the security layer that would make those agents safe to fund sits unfunded. That is a textbook setup for a value migration the market has not noticed. When the incidents become undeniable, demand will not flow to the agents. It will flow to the gateways: policy engines, session-key infrastructure, identity registries, and MCP gateways with on-chain reach. And note who captures that value. The report's sharpest finding is that in enterprise, the incremental demand flows to the incumbents — Okta, SailPoint, Saviynt, Microsoft, Palo Alto, CrowdStrike. Agent identity does not create new identity vendors; it feeds the old ones. The crypto translation is uncomfortable for anyone holding a bag of agent-framework tokens: agent security value will most likely accrue to the infrastructure already sitting at the identity and custody layer — smart-account providers, MPC custodians, account-abstraction standards — not to the agents themselves. This is where I have to name a narrative that is being manufactured. There is a growing pitch in crypto that "liquidity fragmentation" between chains and between agents is the great unsolved problem, and that new middleware will solve it. I have watched this movie. Fragmentation is not the disease; it is the symptom vendors describe so they can sell the cure. The real unsolved problem in the agent economy is not liquidity. It is identity and authorization — the same problem the enterprise report spent 2026 building gateways around. Anyone selling you "agent liquidity" before "agent identity" is selling the wrong layer, and the ledger will not lie about which one mattered. Here is where I push back on the report, and on the crypto builders who will copy it without reading the fine print. The report treats the execution-layer gateway as the solution. It never once asks what happens when the gateway is compromised. Read that again, because it is the load-bearing omission. A gateway that brokers credentials for 16,000 tools is, by construction, a single point holding 16,000 keys. The hardening is the concentration. The thing that makes the agent safe is the thing that makes the attacker's prize enormous. I have audited enough infrastructure to know that "we centralized the credentials for safety" is a sentence that ends in a post-mortem. On-chain this risk is sharper still, because the gateway's key is the wallet's key, and there is no chargeback, no incident response, and no court. Second, the 88% incident figure deserves the skepticism I apply to every unattributed survey. It appears in a report that also cites the 22% identity figure, and both may share a source. A vendor-commissioned survey that finds a crisis in the exact category the vendor sells into is not evidence. It is a pitch with a methodology footnote. The direction is plausible and corroborated by OWASP and NIST. The magnitude is marketing. I will not size a position on 88% until I see the raw instrument. Third, and this matters most for anyone building in crypto: the "operational control vs model alignment" split is not neutral. It assigns the root cause — prompt injection — to the model vendors and the revenue — compensating controls — to the security vendors. It is a tidy division of labor that lets the security industry sell you a fence without ever fixing the door. Correlation is not causation, and a gateway that intercepts an injection is not proof that the injection was harmless; it is proof the injection reached the execution layer at all. On-chain we do not have the luxury of that framing, because there is no fence and no door — only the ledger, which records outcomes, not intentions. The truth is encoded, not spoken: if your agent can be prompt-injected, no gateway makes it safe, and if your gateway holds the key, your gateway is the attack. So here is the signal I am watching into next week and the quarter beyond, and it is not a price level. Watch for the first serious on-chain MCP gateway with a security extension — not a developer SDK, a credential-brokering control plane with an audit trail and a policy engine. Watch for agent identity registries that separate the agent's identity from the key it signs with, because that separation decides whether autonomous agents are fundable at all. And watch, most closely, for the first agent incident post-mortem that reads like an auditor's report rather than a thread — chronological, reconciled, unemotional. History repeats, but the hash is unique. The first team to publish that hash defines the standard everyone else must match. Until then, treat every "agentic" treasury as unbounded, because it is. Enterprise already named this problem and started building the fence. Crypto is running the same agents without it, on a ledger that never forgets.