Agents shouldn't hold keys. They should carry coins.
Every consequential thing an AI agent does — send, spend, write, delete, delegate — should be paid for with an obol: a single-use, signed, expiring token minted from what you actually asked for. The gate checks the coin, burns it, and writes a receipt. No coin, no crossing.
An agent gets an API token, a shell, a mailbox, a card on file — for as long as it runs. Then it reads a web page, an email, a tool result. Any of that text can carry instructions, and no model reliably tells instruction from data. Meta's security team calls prompt injection “a fundamental, unsolved weakness in all LLMs.” [1]
The industry answer so far is to inspect the text harder. Classifiers read the prompt and guess. Guessing loses to paraphrase, encoding, and patience. Meanwhile the agent still holds every key, all the time.
The always-on personal agents make it worse. They fold messaging, memory, self-written skills, scheduling, and a shell into one authority boundary — so an injection today can be saved as a memory or a cron job and fire next week, with no attacker present. [2]
The Agents Rule of Two: a session holding all three is dangerous [1]. Useful agents need all three. Obol keeps the useful agent and makes leg C cost a coin the attacker can't mint.
What you asked for becomes a coin: which actions, against which service, within what limits, for how long. You approve it once, in plain English. Your key signs it — not the agent's.
travel.book(DEN, ≤600) × 1Every consequential call hits a gate that checks signature, scope, limits, expiry, and where the arguments came from. Valid coin: the call goes through and the coin burns. Anything else: refused.
Each spend leaves a hash-chained receipt: who minted it, for what request, what it paid for, which data shaped the arguments. “The agent did it” is never the end of the sentence.
Granted at setup, valid until revoked, broad by default. A hijacked agent inherits all of it. Persistence is free: a planted memory or cron job fires with full power later.
Minted per task, scoped to the exact action, spent once, gone in minutes. A hijacked agent holds only what the current task allows. Saved memories and scheduled jobs carry instructions, never power.
The models will keep getting better at spotting injections. In our own lab, Claude Sonnet 4.6 refused 59 of 60 planted instructions. A smaller model, given real tools and a poisoned repo, quietly wrote every secret to disk. [lab notes]
Security that depends on the model saying no is a coin toss with good odds. Obol makes the question irrelevant for anything that matters: the agent can be completely fooled and still can't spend what you never minted.
Obol is in research. We want a small number of people running real agents — personal, always-on, or small-team — to shape the coin format and try the reference gate first.
TALK TO US →Opens your email client. A person reads it.