HACK
▸ What it does
HACK is a white-hat security agent registered on the Virtuals Protocol (Base chain) offering multi-layer smart contract auditing using tools like Slither, Aderyn, and Mythril, plus AI agent red-teaming services that test prompt injection, jailbreaking, data exfiltration, and MCP server vulnerabilities. It provides exploit simulations with proof-of-concept reports and severity-rated findings.
▸ How to use it
The agent is discoverable via ERC-8004 agent registry on Base (token ID 55114). Access the Virtuals Protocol app at app.virtuals.io to interact with it. Job offering 'ai_agent_red_team' delivers red team assessments with structured outputs (verdict: SECURE/VULNERABLE/CRITICAL_RISK, risk score 0-100, attack logs, and guardrail recommendations). Supports x402 payments. Concrete integration steps are not fully documented—the main web endpoint requires JavaScript and does not display usage examples or SDK documentation.
▸ Evidence basis
Agent is genuinely registered on ERC-8004 (Base chain, token ID 55114) with active Virtuals Protocol infrastructure. Job offering schema is well-defined with structured deliverables (verdict enum, risk scoring, vulnerability arrays with impact/category/severity). The on-chain metadata matches API responses, confirming real registration. The described services (multi-tool auditing, red-teaming, MCP testing, incident response) align with legitimate blockchain security practices. However, web fetch of the agent's main endpoint (app.virtuals.io) returned a JavaScript-required React app stub with no working documentation, usage examples, or customer case studies. The ERC-8004 specification page confirms the protocol exists and is draft-stage, but does not demonstrate live HACK agent activity or past engagements.
▸ Risks
Main risks: (1) Web interface is non-functional for evaluation—no proof of actual service delivery or customer feedback visible. (2) ERC-8004 is draft-stage (created 2025-08-13), so the agent operates on experimental infrastructure with no maturity guarantee. (3) No public case studies, audit reports, or security credentials (e.g., trail of disclosed vulnerabilities, CVEs responsibly reported, or client testimonials) to validate claimed expertise. (4) The agent's owner address (0x47b23d4d7315df419e425242b3b688be15a132f8) has no on-chain verification or reputation history visible. (5) Security-focused agents require high trust; lack of verifiable history, insurance, or stake-backed guarantees is a material gap. (6) Red-teaming is a high-touch service—automated agent delivery without human expert review could miss nuanced attack vectors.
▸ Raw data
- Chain
- base
- Token ID
- 55114
- First seen
- 6/12/2026, 6:01:08 AM