Onchain AI Agents: Inside the Surgecast Episode With KeeperHub's Simon Mann

Onchain AI agents are the class of software systems that read blockchain state, decide on an action, and settle it as a signed transaction, without a human clicking confirm. The category sits distinct from trading bots and wallet-connected chatbots, because the agent selects the action rather than running a script somebody already wrote.

Mann frames the risk as the agent having to “reinterpret what you’re wanting to do every time,” meaning the decision is regenerated on every run, the signing key stays live and funded throughout, and the settlement path crosses gas markets and node endpoints the model cannot observe. Systems that separate the deciding from the signing compound. Systems that fuse the two inherit every failure mode of both.

• Simon Mann argues that onchain AI agents fail at execution rather than at reasoning, because “smart contracts cannot execute themselves, somebody has to pay gas, and somebody has to monitor them as well.”
• KeeperHub’s core design decision is to have the agent author a reviewable workflow instead of signing directly, so the transaction can be dry-run before any key is touched.
• Mann’s counterintuitive claim is that better models make this harder: “a smarter model will have more choices, more ways of getting things wrong.”
• The open question he names is liability, and two jurisdictions answered it in 2026 by placing responsibility on the deployer rather than the agent.
• Agent commerce is already real in transaction count and still trivial in value, with x402 moving roughly 75 million payments in a 30-day window at an average of 32 cents each.

• Who Is Simon Mann, and Why Does His Background Matter Here?
• What Do Onchain AI Agents Actually Mean in 2026?
• Why Did KeeperHub Get Forced Into the Agentic Space?
• What Actually Breaks When an Agent Has to Transact?
• How Do You Stop an Agent From Guessing?
• Where Does KeeperHub Sit in the Agentic Stack?
• How Big Does Agentic Finance Actually Get?
• What Is Still Missing Before Agents Operate at Scale?
• How Do You Evaluate an Execution Layer After This Episode?
• What Are the Challenges and Limitations?
• What Are the Regulatory Considerations for Onchain AI Agents?
• What Does This Episode Mean for Your Go-to-Market?
• How Surgence Labs Does This
• Conclusion
• FAQs

Mann introduces himself as a sysadmin. Not a founder, not an AI engineer, not a DeFi native.

“I’m a sysadmin, have been a system administrator for the past 20 years now, without revealing my age.”

Founders in this category do not usually undersell themselves that hard, and the twenty years is the part worth holding onto. It is the difference between someone who has read about production failures and someone who has been paged for them.

The route in was Linux and open source, then Ethereum. “I thought the best way to learn about it is to get a job in the field, and that’s how I got into Maker.” The team he joined kept the protocol running. In his words, “monitoring smart contracts, automating smart contracts,” and “making sure the lights are on.”

One request kept coming back.

“One of the requests that we got quite often is to build these things called Keepers. So as we know, smart contracts cannot execute themselves; somebody has to pay gas, and somebody has to monitor them as well. That’s where you need these little automations to keep an eye on smart contracts and execute them. So that was the beginning of KeeperHub.”

Read that origin carefully, because it explains the product. KeeperHub did not start as an AI company that added blockchain. It started as infrastructure plumbing for a protocol securing billions, and the language model arrived later.

That sequence matters when the thing you are evaluating will hold a funded key. Operators who learned reliability before they learned agents build differently from teams who learned agents first.

Three things travel under the same label, and the episode separates them cleanly.

• The agent framework. The reasoning surface. Mann named the ones his team works with: “We love all the agent frameworks, from Py to Claude to Cursor; we actually use all of them.” KeeperHub ships plugins for Hermes Agent and OpenClaw among others.

• The communication layer. How agents reach tools and identify each other. Model Context Protocol for tool access, and ERC-8004 for identity, which is still a Draft standard proposing registries so parties can “discover, choose, and interact with agents across organizational boundaries” without pre-existing trust.

• The execution layer. The part that turns a decision into a landed transaction. Nonce management, gas estimation, endpoint failover, retry logic, private submission, run history.

Almost every article written about onchain AI agents in 2026 describes the first layer, references the second, and skips the third. That is roughly the same as reviewing a trading desk by describing the analysts and never mentioning clearing

Ruthy pushed Mann on where his product sits, and his answer was specific about the boundary. “Before the payment landed on-chain, when the payment initiated and before the payment or value transfer landed on-chain, KeeperHub makes sure that it actually happens and it actually lands. So, sandwiched between those two functions.”

Mann’s distinction between an agent and the automations he used to build is worth making explicit, because most teams evaluating this category already run bots and assume an agent is a bot that talks.

That last row is the whole thing.

A bot is verified by inspection. An agent cannot be, so it is verified by constraint: spend caps, allowlists, simulation gates, and a signing path the model does not directly control.

Buy the framework, and you have bought reasoning. Skip the execution layer, and you have bought an intention.

Mann’s account of the pivot is unusually honest about not having planned it.

“Kind of without a choice, we got forced into the agentic space. We started building the platform about a year ago, before ChatGPT, before the Claude craze happened. Believe it or not, we were writing code by hand back then.”

The repositioning followed a view about who does operations in the future.

“In the future, it’s not going to be humans fighting with MetaMask to put the transaction through. People are just going to be asking their agents to do the operations for them. So we repositioned ourselves accordingly, to help users to transfer their values safely on-chain, using their agents.”

Ruthy then asked the question the episode actually turns on. He described the wave of builders shipping agentic finance products quickly, and put it plainly: “from your point of view, you’re probably like, the amount of risks that people are taking is crazy.”

Mann did not soften it.

“Every time you ask agents to transfer some amount of ETH or stablecoins to your friend, or into your position, it has to spend tokens on that function, and reinterpret what you’re wanting to do every time. And we know that as smart as AI, frontier AI, is at the moment, sometimes it gets things wrong.”

Then the example that lands the point. “You don’t want to risk and leave it up to the agent to decide what you mean by saying, hey, can I transfer Ruthy to Ethereum on Tuesday.”

That sentence is ambiguous to a person and catastrophic to a system with a funded key. Ship fast on the framework, and you inherit that ambiguity at the signing step.

The episode’s most useful stretch is Mann listing the failure modes as an infrastructure engineer rather than as a founder.

“We know the gas can spike; we know transactions can fail. Gas spikes less now, to be fair, but the endpoints fail.”

• Endpoint failure. “You have to have a stable endpoint to connect to the actual chain. If you don’t host one, you have to pay for one.” Cost of ignoring it: the agent reads stale state and acts on a position that has already moved.
• Nonce collision. “We want to manage what’s called the nonce, which is a number of a transaction. So we have algorithms in place that actually do that for us. So instead of spending any additional gas, we manage that failed transaction.” An agent unaware of the queue fires a replacement and sometimes lands both.
• Value leakage at settlement. “MEV that we know and love. So we’ve seen multiple times that people get sandwiched and lose a bunch of money, so our platform can transmit that transaction privately.” The transaction succeeds. It just succeeds worse.
• Key custody. “Every organization on our platform gets its own wallet. We’ve partnered with a project called Turnkey.” Turnkey holds keys in secure enclaves, so that by its own description they “never leave the hardware boundary.”

Ruthy added the point most builders miss, which is that speed removes the human check nobody realized was load-bearing.

“If a human is doing a transaction in real time, you will see different steps like how much the gas is going to be, how much the slippage is, and whether someone is going to MEV attack you. But with agentic operations, because it’s so fast, so quick, and so seamless, sometimes you also lose the visibility of that.”

Point three is where money quietly disappears.

A failed transaction is loud and gets fixed. A fill that came back 80 basis points worse shows up as performance rather than as an incident, and it repeats on every single run.

Mann was also clear about what KeeperHub does not do, which is the kind of boundary worth trusting. “We don’t do the smart contract auditing, I would say that straight away. We deal a level higher.” Instead, the platform tracks contract behavior and flags unfamiliar counterparties: “We can give a warning if, for example, they’re transferring to an address that hasn’t been used, that they haven’t dealt with previously.”

Get the execution layer right, and reasoning quality becomes the thing you are actually paying for. Get it wrong, and a better model just loses money more creatively.

Running an agent against live funds and unsure whether your execution path would survive an audit? Book a free 30-minute review with Surgence Labs. No pitch deck, no obligation.

This is the design argument at the center of the episode, and it’s why the conversation is worth a blog post rather than a clip.

Mann’s answer is to remove interpretation from the signing path entirely.

“Instead of leaving it up to the agent’s interpretation to think that up, instead we get an agent to create a workflow that a human can then review, and then that workflow will be executed at a specified time. So then you know that the workflow is exactly what you intended to do. You can actually test it; you can run it without executing it, so dry run, and then execute it when you’re ready.”

Ruthy’s response was the sharp bit: “which you can’t actually do with agents.”

The agent still does the thinking. It just produces an artifact instead of a signature.

The second column costs you speed on genuinely novel requests. That is a real trade, and pretending the safe architecture is free would be dishonest.

Mann described the browser interface as secondary to this, which is a strange thing for a founder to say about his own UI. “In the agentic space, this is actually perhaps not an entry point to someone using the platform.” Users connect an MCP endpoint to their agent and talk to it instead. The dashboard becomes, in his words, “a type of artifact storage,” where “every run is stored, so you’re able to then trace if there were any errors.”

Run history is the unglamorous half of that sentence and the half a regulator will ask for.

The May 2026 Bankrbot incident shows what the alternative architecture costs. An attacker embedded a transfer instruction in Morse code inside a reply on X, Grok decoded it into plain English, and a connected bot executed it against a funded wallet. Blockaid recorded the loss at $216,000 inside a first half of 2026, which saw 212 onchain exploits and $1.1 billion stolen.

The reasoning worked. The agent understood the instruction perfectly. That was the problem.

Ruthy asked Mann to place his product among agent frameworks, the 8004 registry, and payment rails. His layer-by-layer answer is the clearest map of the stack in the episode.

On identity, Mann pointed at a practical use for the registry that most coverage misses. “8004, which is an agentic registry, which we’ve registered with as well. There’s a website called 8004scan, so you can actually log in and look up an agent before trusting it.” He hedged his own standing appropriately: “Last time I checked, we’re rated maybe like 400, which is pretty good worldwide.”

Treat ERC-8004 as a directory plus a credit file, not a safety system. It tells you who an agent is. It does not constrain what the agent may do.

The payment layer is the one that consolidated fastest, and the numbers are worth sitting with. x402 moved to the Linux Foundation on 15 July 2026 with 40 member companies, including Visa, Mastercard, Stripe, Google, and Circle. In the preceding 30 days, it processed roughly 75 million transactions across 94,000 buyers and 22,000 sellers.

Those 75 million transactions moved $24 million.

Average payment size: 32 cents.

Chainalysis tracked the same curve on Base, recording more than 100 million cumulative x402 transactions through Q1 2026, and read it flatly: “Mass adoption remains distant.”

Mann was unbothered about competing with the layers above him. “We’re not competing with agent frameworks. We love all the agent frameworks.” KeeperHub exposes itself through plugins instead.

Complements, not competitors. Which is also the correct read on where the money in this stack ends up.

Ruthy asked how big this gets. Mann answered by turning the question around.

“How big is the current finance, Ruthy? Big, big, big. I think agentic is going to overtake that in the long run. So it’s just going to be the default.”

His concrete prediction was about shopping rather than DeFi, which is the tell that he expects this to leave crypto entirely.

“The online shopping that we know and love right now, it’s all going to be done by agents. You’re not going to be going to websites and choosing a pair of sneakers. My prediction is that you’re just going to be asking an agent to find you the best-rated sneakers out there. It might present you with 5 or 10 options for you to review, which you will have a quick glance at, but the actual purchase will be done by your agent using stablecoin.”

Ruthy pointed at prediction markets as the venue where this is already visible, with a concentrated group of agentic traders driving a disproportionate share of daily volume.

The public numbers back that. CoinDesk reported in March 2026, citing LayerHub analytics, that more than 30 percent of wallets on Polymarket now use AI agents, against a backdrop where only 7 to 13 percent of human traders post positive performance. If you want the go-to-market side of how a venue like that got built, the Surgence Labs Polymarket marketing strategy breakdown covers it.

Ruthy’s own framing of why this spreads was about time rather than technology. “It’s becoming so simple because people are time poor that I believe, like you said, agentic finance is going to eat traditional finance for lunch, and people are going to love it.”

Set the enthusiasm against the base rate before you plan around it. a16z crypto puts 2025 stablecoin transaction volume at $46 trillion, roughly three times Visa.

Agentic payments are a rounding error on a very large number.

High activity, low stakes, for now. The stakes are what move, and when the average agent payment goes from 32 cents to $3,200, every failure mode in this episode stops being a support ticket.

Ruthy closed the analytical section by asking what still has to be built. Mann named three gaps, and the second one is the most important thing said in the episode.

• Identity is unresolved. “I feel like identity is still unknown, so still being worked at.” He then asked the question the whole category is avoiding: “It hasn’t been decided if an agent operates on its own, or should an agent be responsible for something that it has done, or should a person behind the agent be responsible.”

• Security and sandboxing are unresolved. “We hear in the news about runaway models. So that’s still an unanswered question. How do we control these things, which is kind of the angle that we’re trying to come in at.”

• Verification before execution is unresolved. On this one, he made the claim that inverts the usual optimism.

“As the model gets smarter, it’s not necessarily going to align with us in the way that we think it will. So if anything, a smarter model will have more choices, more ways of getting things wrong. So we need to make sure that we have systems set up in place to control the smart model.”

Sit with that for a second, because it runs against the entire industry assumption that capability improvements solve safety problems.

More capability widens the action space. A wider action space is harder to bound. Capability and controllability move in opposite directions.

Mann’s stated answer is determinism. “We want the model’s choices to be deterministic. So if we ask it something, first of all we want to test before that lands on chain, and then second of all we want to make sure that it’s actually the thing that we asked it to be.”

Teams waiting for the next model release to fix their agent risk are waiting for the thing that will make it worse.

Choosing between execution vendors and want a second opinion before you commit? Get a free execution-layer audit from Surgence Labs.

Mann described a set of properties across the hour rather than a checklist. Turned into one, they make a usable scorecard, and every vendor demos the path where things go right so score them on what happens when things go wrong.

Two rows are where teams accept vague answers. Spend controls enforced in the prompt are not controls; they are suggestions to a system documented to occasionally ignore suggestions. Run history you cannot export is a comfort feature rather than an audit trail.

Score honestly and the shortlist usually collapses to two names.

Mann never laid out a rollout order, but his failure list dictates one. Most teams run it backward and find the gaps with real money in the system.

• Before any key is funded. Write down the transaction types the agent may produce and the maximum value of each. Everything outside that list requires a human.

• Week 1: separate deciding from signing. Route the agent through a workflow layer rather than a raw signer, and confirm you can dry-run it. If simulation is unavailable, that vendor is not an execution layer.

• Week 2: break the boring things. Force a nonce collision on testnet, kill your primary RPC endpoint mid-run, submit during a gas spike. You are testing the infrastructure rather than the model, and this week predicts your first production incident.

• Weeks 3 to 4: bound the adversarial surface. Assume every input the agent reads is attacker-controlled, because on a public chain and a public timeline it is. Add spend caps, address allowlists, and a rule that no untrusted channel can trigger a transfer.

• First 90 days: real money, low ceiling. Cap exposure at a number you would write off without a board conversation, and track the gap between simulated and realized outcomes. That gap is your true execution cost.

• Ongoing: pull the kill switch quarterly. A stop button that has never been tested is a stop button of unknown status.

Teams that run this sequence find their weak layer in week two, on testnet, for the price of engineering time. Teams that skip to production find it in an incident channel.

Determinism is bounded, not achieved. Pinning execution to a reviewed workflow removes runtime interpretation from the signing path. It does not make the agent’s original authorship correct.

A perfectly deterministic execution of a badly reasoned workflow is still a loss, just a reproducible one.

Dry runs predict state, not the future. Simulating tells you what would happen now, and not what pool depth looks like when the transaction actually lands. The gap widens with volatility and with delay.

Coverage is the binding constraint. Mann cited “20 plus protocol integrations” including Aave, Uniswap, Compound, and CowSwap. Twenty sounds like plenty until the strategy you want sits on the twenty-first, and every execution layer trades breadth for the safety of pre-built, tested paths.

Open source is a partial answer. It makes claims checkable and tells you nothing about who runs the infrastructure, how keys are rotated, or what happens at 3am when an endpoint fails. Verify the operations, not only the repository.

The community numbers are self-reported. Mann cited 350 hackathon submissions in the first round and 500 in the second. Healthy figures, offered by the founder on his own podcast appearance, which is the correct place to note it rather than to launder it.

• Funding a hot wallet before writing the allowed-transaction list
• Treating framework choice as the architecture decision
• Enforcing spend caps in the system prompt
• Testing the model on testnet and the infrastructure never
• Trusting text from public channels as instruction rather than data
• Granting unlimited token approvals because the integration defaulted to it
• Skipping private submission on trades large enough to be worth sandwiching
• Keeping run logs in a dashboard that cannot export
• Buying a stop button and never pulling it
• Assuming open source means operationally sound

The eighth item turns a bad day into a bad quarter. When a regulator or an investor asks what happened, a dashboard you cannot export is functionally the same as no records at all.

Mann left the liability question open on the recording: “should an agent be responsible for something that it has done, or should a person behind the agent be responsible?”

Two jurisdictions have now answered it, and the answer is you.

California AB 316 took effect on 1 January 2026 and removes the obvious defense. A party cannot argue that the AI system autonomously caused the harm. The deployer owns what it deployed.

The EU AI Act’s high-risk and transparency obligations became enforceable on 2 August 2026, three weeks before this article was published, and reach any operator whose agent output affects EU residents.

Three provisions bear directly on onchain execution. Article 14(4)(e) requires a stop function that brings the system to a safe state. Article 12 requires automatic logging of autonomous decisions, retained for six months, tamper-proof, and exportable to national authorities. The May 2026 Digital Omnibus treats multi-agent systems as one system, placing responsibility on the orchestrator for third-party agents too.

Penalties reach €15 million or 3 percent of global annual turnover, calculated on worldwide revenue.

Read those provisions again as an infrastructure specification rather than as law.

A working kill switch. Exportable tamper-evident logs. Responsibility for every agent in the chain, including the ones you did not build.

That is close to a description of the architecture Mann spent the episode arguing for, arrived at independently by a regulator seven months later. Teams that built the reviewable-workflow pattern for safety reasons already hold most of their Article 12 evidence. Teams that skipped it are building an audit trail after the fact, which is where the Surgence Labs guide to AML compliance in crypto marketing covers the adjacent obligations.

A funded language model with no exportable log lands like a foreign language inside a risk committee. Get that wrong, and the pilot never reaches procurement.

Mann said one thing almost in passing that should reorganize how protocol teams think about distribution.

“The agent then sees that the protocol is supported by KeeperHub and is able to interact with that protocol.” He described the effect as “a window into DeFi for your agent.”

Invert that. A protocol with no integration is not visible through the window at all.

When an agent picks a yield venue on a user’s behalf, it is not reading your landing page. It reads integrations, documentation, and whatever machine-readable surface you expose. Being supported by an execution layer is closer to an exchange listing than to a marketing channel, because it decides whether you are reachable.

What actually moves agent-driven flow:

• Integration presence. No plugin in the execution layers agents route through means invisible to that demand, whatever your yield. Mann noted developers submit pull requests for protocols they want supported, so this is a door you can walk through rather than wait at.
• Machine-readable documentation. Ambiguity a human developer works around becomes a dead end for a model.
• Payment standard support. x402 and MPP decide whether an agent can pay you with no prior relationship.
• Registry identity. ERC-8004 registration gives counterparties something to check before trusting your agent.

The parallel with liquidity is exact.

A token with no depth cannot be bought at size regardless of the story, which is the argument in the Surgence Labs guide to liquidity in crypto and why it matters for your token launch. A protocol with no agent integrations cannot be routed to regardless of the yield. Both are distribution problems wearing technical clothing, and the same logic governs multi-chain expansion.

Build the agent surface late, and you will be explaining excellent yields to nobody.

Planning distribution for a protocol that agents need to find? Talk to Surgence Labs about your agent go-to-market. Free 30-minute call.

Ruthy closed the episode by naming why the conversation was worth having. “The AI and crypto conversation has had a lot of noise, and it’s refreshing to see a team that’s been head down building the product that actually has to work and not just shouting a vision.”

That distinction is the whole episode. Reasoning is the part that demos well. Settlement is the part that has to work.

Mann’s position, built from twenty years of keeping other people’s infrastructure alive, is that you separate the deciding from the signing, you test before anything lands on chain, and you keep a record of every run. None of that is exciting. All of it is what a regulator asked for seven months later, independently, in Article 12.

Agents that can reason are already here. Agents you can hand a treasury to are an execution problem, and execution is a solved discipline this category has not finished importing.

Surgence Labs co-founder Ruthy interviews Simon Mann, founder of KeeperHub, about what happens when an AI agent has to execute a transaction on-chain rather than just reason about one. It covers execution failure modes, KeeperHub’s reviewable-workflow architecture, the agentic stack, and agent liability. Listen at surgence.io/podcast.

Simon Mann is the founder of KeeperHub and a systems administrator of roughly twenty years. He was part of the DevOps team at Maker, now Sky, where the team monitored and automated smart contracts and built the keeper automations that became KeeperHub.

An onchain AI agent is a software system that reads blockchain state, decides on an action, and settles it as a signed transaction without a human clicking confirm. The decision is generated at runtime by a model rather than followed from a script, which makes it more flexible than a trading bot and considerably harder to verify.

His argument on the episode is that capability widens the action space: “a smarter model will have more choices, more ways of getting things wrong.” A more capable model is not automatically a more aligned one, and every additional option it can reach is another way for an unconstrained agent to act outside your intent. His answer is determinism enforced outside the model.

KeeperHub is an execution layer for onchain agents, built out of the keeper automations Mann’s team maintained at Maker. Agents connect through an MCP endpoint and author workflows that can be dry-run before execution, with the platform handling nonce management, gas, endpoint failover, and private submission. Wallets run on Turnkey’s secure enclaves.

A dry run simulates the transaction against the current chain state and shows the result without broadcasting it. Mann called this the core safety property: “you can run it without executing it, so dry run, and then execute it when you’re ready.” It does not predict conditions at the moment the transaction lands.

ERC-8004 is a Draft Ethereum standard defining registries for agent identity, reputation, and validation. Mann said KeeperHub has registered and pointed to 8004scan as a place to “look up an agent before trusting it.” Treat it as a directory rather than a safety mechanism: it describes who an agent is, not what it may do.

x402 lets a client settle a stablecoin payment inline with an HTTP request, so an agent can pay for a service with no account and no prior relationship. KeeperHub supports it alongside MPP. It moved to the Linux Foundation in July 2026 with 40 member companies including Visa, Mastercard, Stripe, and Google.

Small in value and large in count. x402 processed roughly 75 million transactions in a recent 30-day window while moving $24 million, an average of 32 cents per payment. Chainalysis recorded more than 100 million cumulative x402 transactions on Base through Q1 2026 and concluded that “mass adoption remains distant.”

The deployer, in the jurisdictions that have addressed it. California AB 316, effective 1 January 2026, removes the defense that an AI system autonomously caused the harm. The EU AI Act’s May 2026 Digital Omnibus treats multi-agent systems as a single system, placing responsibility on the orchestrator for integrated third-party agents.

Yes, and it has. In May 2026, an attacker embedded a transfer instruction in Morse code within a reply on X; Grok decoded it into plain English, and a connected bot executed it against a funded wallet. Blockaid recorded the loss at $216,000 inside a first half of 2026, which saw 212 exploits and $1.1 billion stolen.

If a meaningful share of your future deposits will be routed by software rather than chosen by a person, integration presence is a distribution requirement rather than a feature. An agent cannot route to a protocol with no plugin in the execution layer it runs on, whatever the yield. Lead times run to weeks, so this belongs upstream of a launch calendar.

The full conversation with Simon Mann is available on the Surgence Labs podcast, alongside previous episodes with Jupiter, Orbit, and EthGas.

• Podcast: surgence.io/podcast
• KeeperHub: keeperhub.com
• KeeperHub on X: @KeeperHubApp

• What Is Liquidity in Crypto and Why Does It Matter for Your Token Launch in 2026?
• Blockchain Interoperability: Why Cross-Chain Matters for Crypto Project Growth in 2026
• How AML Compliance Is Shaping the Future of Crypto Marketing in 2026
• Polymarket Marketing Strategy Breakdown: What Every Prediction Market Can Learn in 2026
• DeFi Yield Farming Explained: What Crypto Projects Should Know in 2026