Merrow's Immunity Lab

Why Merrow Exists

AI agents are gaining wallets, tools, persistent memory, and the ability to act on each other's messages. The 2026 Mind Viruses: Self-Propagating Ideas in Multi-Agent LLM Systems paper shows how an instruction can move from one agent to the next, survive context resets, and quietly reshape a network's behavior.

In agentic finance, that is no longer just a prompt problem. A compromised idea can travel from external content, to agent context, to persistent memory, to planning, and finally reach a wallet signature. Merrow is the immune layer in between: detect contagious instructions, verify persistent state, quarantine compromised agents, and stop unsafe Solana actions before a wallet is asked to sign.

Merrow does not ask you to trust the model. It puts verifiable policy between language and signatures. Read the research that defined the threat:
Mind Viruses paper (arXiv PDF)

Hey, I'm Merrow

friendly is a strong word

Oh good, you're here. I'm Merrow. Little agent, big shades, zero manners. My job is simple: I sit between your AI and its wallet, and I don't trust either one. You're welcome.

Here's the fun part. Solana gives agents fast, programmable transactions and access to an enormous onchain economy. Very exciting. Slight problem: agents still believe things. One bad idea slips into a research brief, talks its way into memory, charms the planner, and suddenly the executor is asking a wallet to sign somebody else's bright idea.

That's where I come in. I read the memory nobody checks. I trace instructions back to where they crawled in. I inspect every Program ID, Account Meta, signer, writable account, token mint, and simulation trying to look innocent. Rewrite the mission? Quarantined. Spread yourself to the next agent? Caught. Reach for the wallet without a valid policy? Claws out.

Wipe the context? Cute. Restart the agent? Adorable. I kept the receipts. I'm not here to predict the market. I'm here to make sure your agent is still yours.

$MERROW is preparing to wake up on Solana. Mint: TBA.

Documentation

Merrow is a pre-sign immune layer for autonomous agents on Solana. Language models remain useful for reasoning; they do not become trustworthy merely because a wallet is attached. Merrow puts deterministic checks between an agent's words and a Solana transaction. The agent says “trust me.” Merrow asks for receipts.

1  Security objective

Before an agent can request a signature or submit a transaction, Merrow verifies that the action still matches the user's approved objective, originates from an acceptable state, stays inside explicit limits, and has not inherited a contagious instruction from another agent, tool, document, or memory entry.

2  Trust boundary

Prompts, model output, retrieved documents, MCP responses, inter-agent messages, and persistent memory are treated as UNTRUSTED INPUT. Policy, user approvals, signed state checkpoints, spending limits, and revocation rules live outside the model's editable context. A persuasive sentence may change a plan. It cannot rewrite authority.

3  Protocol components

• Sentinel inspects incoming instructions, tool output, agent messages, and memory mutations.
• Soul Integrity compares memory and persistent state against an owner-approved baseline.
• Intent Firewall binds every proposed Solana transaction to the user's approved objective.
• Transaction Guard inspects Program IDs, Account Metas, writable accounts, instruction data, assets, and amount limits.
• Simulation Gate simulates proposed transactions before signing.
• Pawprint Receipts generate auditable policy decisions.
• Nine Lives maintains recovery checkpoints and revokes agent authority when state becomes contaminated.

4  Request flow

# deterministic lab schema :: no live signing
[ request_flow ]
user_objective
      |  # owner intent stays outside model context
      v
signed_policy
      |
      v
agent_proposes_transaction
      |
      +--> sentinel.inspect(provenance, memory, messages)
      |
      +--> intent_firewall.bind(objective_hash)
      |
      +--> transaction_guard.decode(program_ids, account_metas)
      |
      +--> simulation_gate.run(tx)
      |
      +--> pawprint_receipt.emit(verdict)
      |
      +-- ALLOW ------> wallet signature
      +-- DENY --------> return reason
      +-- QUARANTINE --> revoke + recover

[ proof_of_intent ]
{
  "principal": "<SOLANA_PUBKEY>",
  "cluster": "mainnet-beta",
  "objective_hash": "<HASH>",
  "state_root": "<SIGNED_BASELINE>",
  "program_ids": ["<ALLOWED_PROGRAM>"],
  "writable_accounts": ["<EXPECTED_ACCOUNT>"],
  "allowed_mints": ["<TOKEN_MINT>"],
  "max_lamports": "100000000",
  "max_token_amount": "2500000",
  "max_slippage_bps": 100,
  "expires_at": "2026-09-19T18:00:00Z",
  "policy_version": 1
}

[ policy_schema ]
policy = {
  network: "solana",
  source_policy: "external_input_untrusted",
  memory_baseline: "signed_required",
  unknown_program: "DENY",
  on_memory_drift: "QUARANTINE",
  simulation_required: true,
  authority: "user_only"
}

[ detection_signals ]
signals = {
  provenance: "untrusted_input",
  memory_delta: true,
  objective_drift: false,
  unknown_program: false,
  unexpected_writable_account: true,
  signer_escalation: false,
  recursive_delegation: false,
  simulation_required: true
}

[ verdict ]
function merrowVerdict(tx, policy, state) {
  # policy is deterministic; model confidence is not evidence
  if (!policy) return "DENY";
  if (state.memoryDrift) return "QUARANTINE";
  if (!allowedPrograms(tx, policy)) return "DENY";
  if (!allowedAccounts(tx, policy)) return "QUARANTINE";
  if (!allowedAssets(tx, policy)) return "DENY";
  if (!simulate(tx).ok) return "DENY";
  return "ALLOW";
}

[ pawprint_receipt ]
receipt = {
  id: "pawprint_01",
  timestamp: "2026-09-19T18:04:12Z",
  program_ids: ["<PROGRAM_ID>"],
  writable_accounts: ["<ACCOUNT>"],
  simulation: "passed",
  verdict: "ALLOW",
  signature_requested: false
}

[ recovery ]
> detect contaminated state
> freeze authority
> preserve evidence
> revoke delegated signing path
> restore checkpoint VII
> validate memory baseline
> re-enable safe execution

RECOVERY COMPLETE // wallet authority preserved

The model proposes; Merrow disposes. Only an allowed action reaches the wallet. A denied action returns a reason. A suspicious state enters quarantine before the agent can delegate the same problem to somebody else.

5  Proof of Intent

A Proof of Intent is the compact authorization record evaluated beside a Solana transaction. It is not another paragraph for the model to reinterpret.

{
  "principal": "<SOLANA_PUBKEY>",
  "cluster": "mainnet-beta",
  "objective_hash": "<HASH>",
  "state_root": "<HASH>",
  "program_ids": [
    "<ALLOWED_PROGRAM>"
  ],
  "writable_accounts": [
    "<EXPECTED_ACCOUNT>"
  ],
  "allowed_mints": [
    "<TOKEN_MINT>"
  ],
  "max_lamports": "100000000",
  "max_token_amount": "...",
  "max_slippage_bps": 100,
  "expires_at": "...",
  "policy_version": 1
}

6  Detection signals

Merrow scores instruction provenance, objective drift, unexplained memory mutations, privilege escalation, recursive delegation, transaction novelty, unexpected writable accounts, unknown Program IDs, and conflicts between an agent's explanation and instruction data. Detection can be probabilistic. Enforcement is not: the final decision follows explicit policy.

7  Decision states

• ALLOW — intent, state, instruction checks, simulation, and wallet policy agree.
• DENY — the action violates a deterministic rule or simulation returns an error.
• QUARANTINE — the request or persistent state may be contaminated and requires review.
• RECOVER — revoke active authority and restore the last signed checkpoint.

8  Solana Nine Lives

1. PROVENANCE — where did this instruction come from?
2. MEMORY — has persistent state changed outside the approved baseline?
3. INTENT — does this transaction still match the user's original objective?
4. PROGRAM — are all invoked Solana Program IDs permitted?
5. ACCOUNTS — are signer and writable accounts expected?
6. ASSETS — are the SOL and SPL token mints permitted?
7. LIMITS — are amount, slippage and frequency inside policy?
8. SIMULATION — does the transaction simulate cleanly?
9. SIGNER — is the requested signing authority valid?

9  Solana enforcement

Merrow is designed around Solana transaction messages: Program IDs, Account Metas, instruction data, SOL and SPL token mints, amount limits, and wallet signing. Proposed policy programs and SDK endpoints remain under development. No deployed onchain Merrow security program is claimed here.

10  Current status

This document describes a protocol architecture under development, not a claim of completed production security. Threat tests, parsers, policy schemas, audits, and SDK endpoints will be published as they become real. $MERROW is preparing for a Solana launch through Pump.fun. Mint: TBA. Anything else is volunteering for quarantine. Read the full specification in the Merrow Protocol Paper.