{"name":"Agentic Finance Graph — detector scores","description":"Each detector's record: how often it fired, how many fires were later re-derived, how many held and how many were withdrawn, how many came next to an address-poisoning attempt, and how many are live. A blank cell means no stored record could fill it; it is never estimated.","definition_id":"detector.score.v1","definition":"https://agenticfinancegraph.com/def/detector.score.v1","as_of":"2026-10-09T18:50:56.991Z","producer":"afg-detectors","degraded":false,"rule":"fired and open from the detection log; checked, confirmed and reversed from later re-derivation of the same events; poisoning_adjacent counts fires whose wallet received a poisoning transfer within seven days either side. Blank (null) means we hold no record that could fill the cell.","poisoning_watch_from":"2026-06-05T00:24:35.000Z","incident_rule":"A detection becomes a live incident only if its kind is a harm (retry_storm, bind_closed_after_nft_transfer, god_key_unknown_7702) and it happened in the last 72 hours. Mint bursts are never incidents.","kinds":[{"id":"detector.score.v1/bind_closed_after_nft_transfer","kind":"bind_closed_after_nft_transfer","fired":3,"open":0,"last_fired":"2026-10-05T16:33:27.000Z","checked":null,"confirmed":null,"reversed":null,"poisoning_adjacent":0,"poisoning_window_fires":3,"known_cases":[],"what":"A registration we track changed owner, so the wallet we joined it to is no longer its wallet. Anyone relying on that agent's history is now relying on somebody else. A harm: live incident while recent.","latest_fire":{"id":"inc_xfer_8453_95581","at":"2026-10-05T16:33:27.000Z","headline":"Registration #95581 changed owner — the wallet we joined it to is no longer its wallet","live":false}},{"id":"detector.score.v1/drain_pattern","kind":"drain_pattern","fired":14,"open":0,"last_fired":"2026-10-09T15:02:03.000Z","checked":14,"confirmed":11,"reversed":3,"poisoning_adjacent":5,"poisoning_window_fires":14,"known_cases":[{"case":"Bankrbot wallet theft, May 2026","live":"missed","why":"the wallet was not one we watched, and the stolen token was not a stablecoin","replay":"fires","detail":"priced at each block, the theft was at least 13 times the wallet's largest earlier outflow","source":"https://agenticfinancegraph.com/research/afg-research-note-02-v1-2-seven-investigations-2026-10-02.pdf"}],"what":"An agent sent at least five times its previous largest payment (and at least $250) to an address it had never paid, with at least three earlier payments to compare against. A drained agent wallet leaves this shape: in May 2026 a prompt hidden in a post made a Grok-linked Bankrbot wallet send roughly $175,000 to an attacker (Ledger; the funds were later recovered). A legitimate one-off purchase leaves it too. A shape for a human to read, never a live incident.","latest_fire":{"id":"inc_drain_evt79ca6ffad750f732c71c44a6","at":"2026-10-09T15:02:03.000Z","headline":"drain pattern","live":false}},{"id":"detector.score.v1/god_key_unknown_7702","kind":"god_key_unknown_7702","fired":0,"open":0,"last_fired":null,"checked":null,"confirmed":null,"reversed":null,"poisoning_adjacent":null,"poisoning_window_fires":0,"known_cases":[],"what":"A wallet delegated under EIP-7702 to an implementation not on our curated allowlist. Inert until that allowlist is curated — unknown is not malicious. A harm: live incident while recent.","latest_fire":null},{"id":"detector.score.v1/mint_burst","kind":"mint_burst","fired":282,"open":0,"last_fired":"2026-10-07T18:00:00.000Z","checked":null,"confirmed":null,"reversed":null,"poisoning_adjacent":1,"poisoning_window_fires":83,"known_cases":[],"what":"One address minted many registrations inside a single hour. Bulk registration is legitimate — a platform issuing identities for its users looks exactly like this — so it is never an incident. It means a registration count is measuring a script, not an ecosystem.","latest_fire":{"id":"inc_sybil_3c0820e2da_2026-10-07T18","at":"2026-10-07T18:00:00.000Z","headline":"0x3c0820…83d8 minted 35 registrations within one hour","live":false}},{"id":"detector.score.v1/retry_storm","kind":"retry_storm","fired":64,"open":0,"last_fired":"2026-10-02T21:38:09.000Z","checked":66,"confirmed":10,"reversed":56,"poisoning_adjacent":null,"poisoning_window_fires":0,"known_cases":[],"what":"An agent paid the same counterparty many times in minutes — the shape of a retry loop, not of trade. Somebody paid the fees for every attempt. A harm: live incident while recent.","latest_fire":{"id":"inc_retry_act845397366_2026-10-02T21","at":"2026-10-02T21:38:09.000Z","headline":"Registration #97366 paid 0x325bdf…d430 50 times in minutes","live":false}},{"id":"detector.score.v1/uri_timeout_streak","kind":"uri_timeout_streak","fired":224,"open":0,"last_fired":"2026-10-09T18:21:48.201Z","checked":null,"confirmed":null,"reversed":null,"poisoning_adjacent":null,"poisoning_window_fires":0,"known_cases":[],"what":"An agent's endpoint has failed every probe we have made and has never once answered. A statement about our repeated attempts, not a verdict on the agent.","latest_fire":{"id":"inc_streak_eip15584530x8004A169FB4a3325136EB29fA0ceB6D2e539a43225255","at":"2026-10-09T18:21:48.201Z","headline":"Registration eip155:8453:0x8004A169FB4a3325136EB29fA0ceB6D2e539a432:25255 has failed 5 probes and has never answered","live":false}},{"id":"detector.score.v1/address_poisoning_loss","kind":"address_poisoning_loss","fired":2,"open":null,"last_fired":"2026-09-25T12:12:13.000Z","checked":2,"confirmed":2,"reversed":0,"poisoning_adjacent":null,"poisoning_window_fires":0,"confirmed_usd":60,"known_cases":[],"what":"A payment from an agent wallet to a look-alike address planted in its history, counted only when two independent reads agree.","latest_fire":null}],"license":"https://creativecommons.org/licenses/by/4.0/","attribution":"Agentic Finance Graph — https://agenticfinancegraph.com"}