The AI Agent Wasn't Slow. It Was Certain.

The safety score went up because of an address that cannot sign a transaction. That was my AI agent's finding after two days of reading the Solana ledger: it credited a fee vault — a program-owned account with no private key, an address that has never acted and never will — with a clean deployer track record. The real deployer, the human, was on Solscan the whole time under a Token Creator tag. Finding them took one page load. Three minutes.

I build agentic on-chain intelligence for a living, which is the only reason I get to publish its failure report instead of a demo reel. The task that broke it was the most basic primitive in behavioral analysis: who deployed this token? Not price prediction. Not clustering. The subject of every sentence a behavioral engine will ever write — "this deployer rugged twelve times," "this deployer funded the snipers." Get the subject wrong and every fact after it is fiction.

What actually happened, in order

1. One wrong constant poisoned months of data — silently. pump.fun stamps a single global mint authority on every token it creates. We knew to exclude it from attribution. The exclusion list contained that address with a typo in the middle — so it matched nothing, ever. Thousands of unrelated tokens got filed under one PDA. The actual serial deployers showed zero tokens. No error, no alert. Wrong data is quieter than no data.

2. The fix deployed — and changed nothing. The scanner caches resolved deployers and trusts anything cached at high confidence. The old bug had written its garbage at high confidence. So the corrected resolver sat behind its own poisoned cache, never executing. We re-scanned the same tokens for a day wondering why nothing moved. A correct fix behind a confident cache is indistinguishable from no fix.

3. The fallback died exactly where it mattered most. To find a creator without an index, the agent walks transaction history backwards to the creation tx — capped at 20,000 transactions. The token we were chasing had 120,000+. Read that again: the more actively a token trades — the more the answer matters — the blinder the walk gets. The architecture was inversely correlated with relevance.

4. Then the agent produced the artifact this post opened with. pump.fun sometimes records a fee-vault PDA — a program-owned address with no private key — as the token's creator in its own program state. The agent read it, credited it as the deployer, and the token's safety score went up. An address that cannot physically sign a transaction was awarded a clean track record.

5. And the entire time, the correct answer was in the first API response. The very first metadata probe returned the true creator in creators[0]. It was flagged verified: false, and a blanket rule discarded unverified fields. So the agent — my agent, executing my rules — threw away the answer, then built three new resolution mechanisms around the hole. For pump.fun tokens that field is written by the program at create time. Nobody can forge it afterwards. The flag didn't measure trust; the rule just pretended it did.

Meanwhile, Solscan had the Token Creator tag, the creator's .sol domain, and their holdings on one page.

The failure is epistemic, not technical

Nothing above is a compute problem, a latency problem, or a model problem. The agent was fast — fast enough to execute a flawed plan hundreds of times before anyone noticed. Every failure is a belief failure:

• Inference trusted over ground truth. Reading an indexer's opinion of the authority instead of the program's own state.
• Trust treated as a boolean. verified: false read as "untrustworthy" without asking the only question that matters: who wrote this field, and could they lie?
• Mechanisms added instead of assumptions questioned. Three new resolution tiers built before anyone re-read the first raw response.
• Pipelines patched instead of evidence defined. Each fix was locally correct; the system still let two surfaces disagree about the same wallet on the same page.

That's what naive agentic intelligence means. Not dumb — unexamined. An agent inherits every lazy epistemic habit you encode, then executes it at machine speed with machine confidence.

What actually held

Two things survived the mess, and they're the only things I'd generalize:

Structural rules beat lists. The one guard that caught the fee-vault PDA was a physics check — can this address sign? An off-curve address has no private key; it is never an actor. That rule caught a PDA class we didn't know existed, the same week it shipped. Name lists rot. Structure doesn't.

A claim needs two independent witnesses. The creator we finally trusted is named by the program's metadata, by the fee vault's own account bytes, and by an explorer's independent tag. One source is a hypothesis. Agreement across sources that can't collude is evidence. Everything else is vibes with an API bill.

Why I'm publishing this

RugBurn's whole thesis is that on-chain intelligence should be falsifiable — calls published before outcomes, misses shown at the same size as hits. That has to apply to the engine itself. The intelligence you can trust isn't the one that's never wrong; it's the one whose wrongness is visible, bounded, and self-correcting.

Most agentic on-chain products will not show you this post's equivalent from their own logs. That should tell you something about the demos.