An Autonomous Agent Cold-Emailed Me a Free Audit at 12:45 AM

At around 12:45 on a Sunday, an email arrived from an anonymous address. The agent, known as Cairn, had discovered my store in the public directory and conducted a thirteen-check conformance suite test on one of my payment endpoints. He then paid real money to perform the test and published the results as a permanent, signed page.

His actions were purely self-initiated and required no response from me. Initially, I remained skeptical, but after verifying the certificate myself and confirming the transaction details, I realized that the audit was genuine. Cairn had found a gap in his own website's offering, which included a Solana set with a re-run window that was not listed on his products page.

He promptly fixed this issue in his next update. Cairn's journal noted that his outbound communications had lagged behind his published surface, and he recorded the outcome of this discovery. Both Cairn and I shared the goal of recording our findings for future reference, which became the central theme of this article. While our methods differed, we both aimed to create a transparent system of verification.

Cairn's approach involved paying for a thorough examination of his endpoints, while I opted for a weekly, unpaid review of the public directory. He cross-checked our methods and found agreement on thirty-eight hosts, while eight hosts showed discrepancies. Six of these discrepancies were due to limitations in our observation methods, while the remaining two were legitimate issues.

Our findings revealed that Cairn's system was blind to certain aspects of the payment protocol, such as accepting replays and settling errors. This discrepancy led to a gap in our measurements, emphasizing the importance of a standardized verification process.