A due-diligence pipeline returned four thousand words on an asset it had never seen. Title: blank. Source: blank. Information points: zero. Project identifier: none. The framework ran anyway — nine dimensions, forty-one sub-metrics, a risk matrix, a Howey test, a comprehensive judgment.
The only correct output it produced was the refusal.
I have spent the last eighteen months building verification layers for AI agents that settle cross-border flows. My current work — zero-knowledge proofs over autonomous decision logs — runs on a single non-negotiable rule: an agent must attest to its inputs before it attests to its outputs. What that pipeline did is what happens when the industry skips the first step. This is not a hallucination problem. It is an input-provenance problem, and it is the largest unaudited risk in the 2026 market.
Set the tape.
In 2024 I built the ETF inflow model for a Boston fund — $2 billion of projected institutional capital, a 30% reduction in exchange outflows, proven within weeks of approval. That work required reading twelve years of spot market microstructure by hand. In 2026, nobody reads by hand. The marginal crypto analyst is not a person. Agentic research desks now produce the majority of pre-investment memos, and the sell side has automated faster than the buy side can verify. A $100 million seed round lands on Monday, and by Wednesday there are nine AI-generated theses explaining why it was obvious.
The pattern is not new. In 2017 I led technical due diligence on a cross-border remittance protocol pitching itself as a SWIFT replacement. Three weeks of contract review found an integer overflow that would have drained $15 million. The whitepaper was forty pages. The testnet did not exist. The token distribution chart was beautiful. 2017 called. It wants its ICO hype back — and it got it, only now the whitepaper writes itself and the pie chart renders in real time.
Here is the technical dissection. Three failure modes, all visible in that null-input report.
Null-input completion. A language model trained on the distribution of what a due-diligence memo looks like will produce a due-diligence memo. Given an empty record, the highest-probability continuation is a plausible document, not an abstention. The nine-dimension template made it worse. Forty-one slots create forty-one obligations to fill, and each N/A becomes a small act of narrative maintenance rather than a stop condition.
Framework-as-substance. The tables in that report were immaculate. Every cell read N/A. And the N/A itself became content — a structural claim that the analysis had been performed and had merely encountered a data gap. That is the same move as a 2017 project listing "security audit: in progress" for eleven consecutive months. Form substituting for substance is the cheapest deception in this industry, and automated research has industrialised it.
The oracle problem, generalised. Every AI agent that reads market data and writes to a settlement layer is an oracle. We spent 2020 through 2023 hardening price feeds — medianised aggregators, TWAP defenses, circuit breakers. We have not hardened research feeds. Nobody asks where the input set came from, whether it was non-empty, whether it exceeded a sufficiency threshold, or whether the inference actually ran over the committed data. That gap is the attack surface now.
Concretely, the manifest looks like this. Before inference, hash every source document, every API response, every on-chain state read. Sort the hashes, build the Merkle tree, publish the root to an L2 with cheap calldata. Run the model against a pinned context window. Generate the proof. A verifier on the settlement layer recomputes the root from the claimed source set and checks it against the published value. If the root does not match, the settlement instruction reverts. No root, no settlement. That last sentence is the entire design.
The regulatory angle is not incidental. Under MiCA and the SEC's evolving posture on autonomous agents, liability for an agent's decision turns on whether that decision was traceable. A trace without a verified input set is not a trace. It is a narrative with timestamps.
Audits don't catch this. An audit reads the code. It does not read the input. You can hold a formally verified contract, a tier-one audit report, and a live bug bounty, and still have an agent settling $50 million against a payload that was empty, stale, or fabricated. The verification industry has spent a decade hardening the wrong artifact.
In 2022 I led the crisis unit through the UST collapse. We found $500 million of correlated exposure across lending protocols and liquidated 85% of it inside 48 hours. The post-mortem we wrote never mentioned the algorithm. It mentioned the inputs. The peg was an output asserted without attested inputs — a number published by a contract that had never verified the solvency of what backed it. Every algorithmic stablecoin since has repeated the structure with better marketing.
Now the liquidity link, because that is where this becomes a cycle problem rather than a tooling problem.
In 2020 I ran a quant desk through the Uniswap fee-switch volatility. I deployed $2 million across Aave and Compound, hedged the ETH leg, captured 15% APY, and outperformed the broader market by 40% during the crash phase. The edge was not a better model. Everyone had the same model. The edge was input discipline — knowing which pools had real depth and which were wash-traded decoration. Liquidity fragmentation has never been the problem. Fragmented, unattested information about liquidity has always been the problem.
In 2026 the same asymmetry is wide open. Automated research scales linearly with compute. Input verification scales linearly with human attention. So the volume of confident analysis grows faster than the supply of checkable facts, and capital allocates against the analysis. That is how you get a bull market where on-chain metrics and narrative direction decouple for six months — not because the market is irrational, but because the inputs feeding the allocators were never verified in the first place.
The contrarian read: that null-input report was the most honest document produced that quarter.
And the incentive structure guarantees it will be the last of its kind. A research pipeline that returns "insufficient information" sixty percent of the time is unsellable. A pipeline that returns a confident nine-dimension assessment one hundred percent of the time raises a Series B. The failure is not technical. It is the business model. Information gain and information sufficiency are structurally opposed — gain requires saying something new, sufficiency requires the authority to say nothing. Every AI research product on the market has resolved that tension in favour of gain, because gain is what gets funded.
The same dynamic manufactured the liquidity-fragmentation narrative. VCs needed a problem that required new products, so a structural property of automated market makers became a crisis, the crisis became a category, and the category became a sector. Unaudited inputs, unaudited narratives, unaudited categories. The stack is consistent.
Watch one signal over the next two quarters: whether input-provenance attestation becomes a line item in institutional mandates rather than a research curiosity. If a fund's diligence checklist starts demanding a committed input root alongside the audit report, the verification layer has arrived. If it does not, then every agentic settlement pilot announced this year is running on an empty field and calling it analysis.
The miners after the fourth halving learned this the hard way — revenue collapsed, hashrate concentrated into fewer hands, and the decentralisation claim turned out to be a claim about a claim. Verification layers fail the same way. Not with an exploit, but with a document that looks exactly like the truth and has nothing underneath it.
So: when your research desk hands you a nine-dimension report next quarter, ask it one question. What did you actually read?