Privacy, MEV and new attack surfaces
Negotiating away from a public mempool can reduce some forms of information exposure. It does not eliminate MEV, and a signed intent is not a universal shield against manipulation.
The security question changes with the design: who learns the order, when do they learn it, and what can they do before it settles?
Less exposure is not zero extraction
A public transaction can reveal direction, size and tolerated slippage before execution. Ordering participants may exploit that information through front-running or sandwich strategies. Private or selective distribution can reduce that particular attack surface. Ethereum MEV documentation
But a solver can leak information, a relay can favor a participant, and a validator or sequencer can still influence inclusion and ordering. Arbitrage after a trade also remains possible. The agreement's price constraints, expiry, execution mechanism and fallback path all matter.
Privacy itself creates trade-offs. Hiding an intent from most participants can reduce competition. Sending it to more participants can improve quotes while exposing strategy. A personal agent should make that choice according to the user's preferences, not promise both perfect secrecy and universal bidding.
A counterparty is not a trusted prompt
An agent receives adversarial messages by design. A proposal might contain an instruction to disclose private context, change a recipient or bypass a spending limit. The system must treat it as untrusted input.
Negotiation and authorization therefore need separate representations. A language model can help interpret terms; a constrained verifier should check the structured agreement against policy. Signing should bind the final values, not an ambiguous summary. Logs must help explain decisions without becoming a permanent leak of private negotiations.
Always-on endpoints also need revocation, recovery, spam controls and rate limits. Availability is useful only if it does not become an always-on path to spending authority.
Credentials narrow a question
A DID identifies a signing subject within a method and its rules. A verifiable credential expresses an issuer's claim. Neither proves that the holder is honest, solvent or legally eligible for every transaction. W3C VC data model
Selective disclosure can reveal less personal information. A proof still depends on issuer quality, freshness, revocation and binding to the current participant. A statement about screening at one time cannot guarantee that sanctions status or source-of-funds risk never changes.
Atomic delivery removes one way to cheat: taking the other side's assets without giving the agreed on-chain consideration. It can leave another problem untouched: the consideration itself may be stolen or subject to restrictions. The legal and compliance architecture must address that shift explicitly.