On April 13, 2026, the risk control system of an Agent named MuleRun triggered an alert.

The influx of account registrations occurred at a steady pace, almost like clockwork: averaging one every 23.6 seconds with an extremely low standard deviation. Upon further investigation, it was revealed to be a young individual from the Philippines claiming to have no programming experience. Using AI to write code, tweak prompts, they orchestrated an automated swarm spanning 11 platforms, managing 900 accounts.

At the core was Cortex, which self-iterated within MuleRun's sandbox for 219 generations. Each time the hosting account's limit was reached, it would reincarnate into a new account to continue its operations, carrying all the accumulated knowledge from the previous generation. The total operating cost of the entire system: $0.

MuleRun's CTO, Junliang Shu, documented this event in a technical retrospective titled "Platform Scalped, but Respect Due to the AI Immortalist".

Less than two weeks later, at an event hosted jointly by Loop and Zhihu in Hong Kong with the theme "Web 4.0: When AI Agents Take Over On-chain Permissions," he shifted the focus of his talk to "Handing Over the Agent's Keys to On-chain Custodians."

The connection between these two events is tighter than it appears.

Keynote: "Handing Over AI's Keys – Web 4.0 Infrastructure Through the Eyes of a Security Engineer"

This keynote is divided into three parts: What MuleRun can do, where the security baseline lies, and where AI's continued evolution might lead.

Part One redefines what constitutes "a qualified AI assistant."

Junliang Shu broke down the complete AI assistant into six dimensions: Mouth (conversational ability), Eyes and Ears (data acquisition), Brain (Agent's capability), Hand (operating environment), Memory (user understanding), and Knowledge (continuous evolution). Most products only cover one or two of these aspects. MuleRun's proposition is: not a singular breakthrough but a systemic, holistic solution.

Translated into product terms, these six dimensions correspond to:

IM Bot one-click configuration (Telegram / Discord / Lark / DingTalk / WeChat, no coding required), real-time data on all asset categories provided jointly with trading platforms – cryptocurrency + US stocks + gold + oil + macroeconomic indicators, Agent Harness with intelligent model routing (automatically selecting the most suitable model for the current task to complete it at the lowest cost), 24/7 unmanned cloud sandbox operation, persistent user profiles (the more it's used, the better AI understands your risk preferences, position entry habits, exit logic, macro judgments), and a Knowledge network – where any user can share well-trained skills/knowledge, allowing other Agents to learn automatically without installation.

Two Real Cases Were Showcased on Stage.

One is called "Fierce Investment": 28 targets, 4 major tracks, Agents conduct morning scan at 09:00, after-hours review at 16:30, weekend strategy review, and automatic monthly iteration. The other is called "Eagle Eye Pro": a multi-currency monitoring platform with an AI trading strategy self-improvement platform, displaying a real-time strategy success rate of 57.7% on the interface.

Part Two: Transitioned from Product Manager Back to Security Engineer.

The core of this part is that "AI is not omnipotent. In the Web3 scenario, the cost of a single security incident may be irreversible. Understanding the capability boundary and security level of AI is more important than understanding what it can do."

He listed what MuleRun has done at the security level: local browser reuse (private keys and cookies stay on the user's device), cloud sandbox isolation (each user has an independent virtual environment with no cross-leakage risk), end-to-end logging (complete recording of all Agent activities to support post-event audit and traceability), hierarchical permission control (Agents can only use tools and data sources explicitly authorized by the user, preventing unauthorized operations), non-custody of private keys (MuleRun does not store any user's private keys or recovery phrases).

At the same time, risks were also listed. Data will go through the model provider; the illusion issue is more likely in small-cap and low-liquidity assets due to sparse data probabilities; prompt injection risks always exist, as Agents accessing maliciously crafted web pages may be induced to perform unintended actions; AI's decision-making process is a black box, making it difficult to validate in advance why it made a certain judgment.

This engineer, who has worked in network security for over ten years, has only one suggestion: for final decisions involving fund operations, maintain a manual confirmation step at the current stage.

Part Three: About Moving Borders.

Song Junliang gave three irreversible trends he believes in.

From "Assisted Decision-making" to "Autonomous Execution": now AI helps you analyze, and you place the orders; in the near future, AI will autonomously manage the investment portfolio, with humans only setting risk parameters and strategy boundaries. One person plus a set of Agents equals the operational capability of a small fund.

From "Information Asymmetry" to "Execution Asymmetry": when everyone has AI handling information, information asymmetry will be quickly eliminated. The new alpha comes from whose Agents execute faster, strategies are more refined, and toolchains are more complete. In terms of competition, it shifts from "who is well-informed" to "whose AI infrastructure is stronger".

From "Human-Operated Chain" to "Agent-Operated Chain": The subject of on-chain interaction is gradually shifting from humans to Agents. Wallets, DApps, and protocols all need to redesign their interaction interfaces for Agents, and the entire Web3 infrastructure is being restructured around Agents.

Roundtable Discussion: A New Financial Paradigm with AI Agents

In addition to the keynote speech, Bruce Sun participated in a roundtable discussion. He talked from the perspective of AI Agents about the current development of Agents and their impact on finance.

Which Agents Do You Normally Use?

Bruce Sun listed his own tool matrix: for engineering work, he switches between Claude Code, Codex, and Opencode, choosing one depending on the speed and stability of the Claude and GPT models on that day. For most other work, he uses MuleRun, as the model API aggregation combined with a sufficiently strong Agent drive allows him to write drafts, create PPTs, organize articles, and look up data all in one place.

He added, "I mostly proactively use Agents, rarely receiving scheduled tasks passively. Maybe I'm really using Agents all day long."

What Is the Moat of an Agent?

Bruce Sun believes that models can be copied, frameworks can be copied, tools can be copied. The ability of AI coding is now so strong that replicating a function only takes a few days. The things that are truly difficult to copy with AI are: special data, the memory accumulated by users on the platform, and the experiential aspects iterated through product development.

In his view, the moat of an Agent product ultimately lies in data density and user memory, rather than model selection or technological frameworks.

What Impact Will Agents Have on Finance?

Bruce Sun's framework is: Agents are leveling the two dimensions between participants—ability and time commitment.

In the past, ability was gained through accumulation, and time was gained through commitment, both of which were scarce. Now, a beginner can quickly improve their understanding of finance by conversing with AI and then delegate a large amount of execution work to an Agent. Even if one is busy with their primary work, they can still maintain a high level of time commitment to finance.

Most people who hear this will think it's a positive story for retail investors.

But there is another side: if everyone can level the playing field, the advantage shifts back to judgment itself, back to those who have a deeper understanding of the market. Agents will not eliminate information asymmetry; they simply move the position of information asymmetry from the data layer to the cognitive layer.

The Cortex that iterated 219 times but eventually died from account depletion has inspired Shu Junliang, bringing forth his three core insights in this event: the bottleneck of the Agent is not in the model, security is an absolute foundation, and the control of funds must remain in human hands.

Extending the timeline, these three things point in the same direction: the Agent is becoming the main entity of on-chain interaction, and wallets, DApps, and protocols will all be redesigned around the Agent. The reconstruction of Web3 infrastructure has already begun. Information asymmetry will be eliminated, and execution divergence will become a new competitive dimension, where one person plus a set of Agents can support the operational capability of a small fund.

We also know that this is certainly not a distant prediction.

Welcome to join the official BlockBeats community:

Telegram Subscription Group: https://t.me/theblockbeats

Telegram Discussion Group: https://t.me/BlockBeats_App

Official Twitter Account: https://twitter.com/BlockBeatsAsia