Market's been drifting sideways all week, so instead of staring at charts I fell into one of those late night rabbit holes, this time on Newton Protocol and the whole zkPermissions thing everyone keeps calling trustless AI agents.
So I started looking at it out of curiosity, mostly because I keep seeing the phrase zero knowledge thrown around like it's a magic word that automatically means safe. Newton's pitch is that you let an AI agent trade or rebalance or pay your subscriptions for you, and instead of handing over your private key like you would with some sketchy Telegram bot, you set rules only trade if slippage is under 0.5%, that kind of thing and the agent has to cryptographically prove it followed them.
Okay, fine, that sounds great. But then I actually read into how the execution happens, and something clicked that I wasn't expecting.
Here's the part people gloss over the agent doesn't run inside the blockchain in some pure math sense. It runs inside a Trusted Execution Environment, basically a sealed off piece of hardware, and then a zero knowledge proof is generated afterward to show the output matched your rules. I originally assumed the ZK proof was the thing stopping bad behavior in real time. It's not, really. It's more like a receipt. The rule checking happens inside a black box first and the proof is you verifying the black box's homework after the fact.
That's the part that bothers me a little. Because the whole appeal of zero knowledge, trust minimized automation is supposed to be that you don't have to trust anyone. But you kind of do, you're trusting that the TEE hardware itself wasn't compromised, that the enclave didn't leak, that the chipmaker's security model holds. ZK proofs are incredible at proving this output is consistent with these rules.
They're not built to stop an agent from doing something weird inside the enclave before the proof even gets generated. So the real security root here isn't cryptography, it's hardware integrity and hardware has a much messier track record than math does. Enclave side-channel attacks aren't hypothetical, they've happened before, on infrastructure a lot more scrutinized than a DeFi automation layer.
I'm not saying it's broken or that the team hasn't thought about this, they clearly layer TEEs and ZKPs together specifically because each one covers a gap the other has. But when the marketing says verifiable i think people hear guaranteed, and those aren't the same thing. Verifiable means you can catch a violation after it happened. It doesn't mean the violation couldn't happen.
Where this actually matters, I think, is less for someone doing a simple recurring buy and more for DAOs handing multi party treasury permissions to agents, or anyone stacking several automations on top of each other. The more complex the ruleset, the more surface area there is between what the enclave did and what the proof says it did.
Anyway. I don't think this makes Newton uniquely risky compared to other agent infra, it's more that the framing bugs me. I'll probably keep poking at how their Keystore rollup actually handles permission revocation before I trust it with anything real. Market's still flat, might just go stare at charts again.