Mephis Threat: Defense Against Autonomous Compositional Exploitation

Research Community

Mephis represents a class of smart-contract adversary not previously seen in the wild: a new class of deep learning offensive agents that organizes six hive-mind role-specialized offline language-model agents—Analyst, Strategist, Hunter, Composer, Divergent, and Critic into a memory-sharing society that maps a protocol, hypothesizes multi-stage extraction paths, confirms their profitability against live chain state in a forked simulator, and—absent controls— signs and broadcasts the settling transactions, all without a human in the loop. Every prior generation of automated attack tooling attacked one of these dimensions in isolation—syntax, a single path, a single contract, a single inspired hypothesis. Mephis is the first to unify protocol-scale comprehension, multi-agent shared memory, economic self-confirmation, and staged multi-contract execution into one continuously operating loop, and that unification is precisely what makes it so difficult to defend against: it does not repeat a known exploit signature, it discovers novel ones, verifies them economically before it is ever observable on-chain, and improves across rounds. This paper takes Mephis as its explicit subject and asks the defensive question its architecture forces: given an adversary this advanced—one that reasons about economic intent, shares a blackboard, and validates its own theft economically before acting—how can it be detected and defended against at all? We contribute (i) a formal threat model of Mephis and a decomposition of its operation into a six-phase kill chain; (ii) Sentinel, a defense-in-depth framework whose four layers—hardening, simulation-time deception, behavioral detection, and on-chain containment—each attack a specific phase of Mephis’s loop; (iii) an agent-by-agent countermeasure map that ties each of Mephis’s six agents to the resource it depends on and the defense that denies it; (iv) a set of agentic signatures—profit-bracketed simulation fingerprints, staged-setup call sequences, and reconnaissance fan-out—that distinguish Mephis from ordinary users and classical MEV bots, with detection algorithms; and (v) an evaluation methodology that measures the defense without ever running an offensive agent against third-party funds. Our thesis is that the properties that make Mephis dangerous—its dependence on a simulation oracle, its economic self-confirmation, and its staged, legible call structure—are also its largest attack surface. Mephis is defeatable, but only by a continuously operating, economically aware defense symmetric to the society it faces, not by a one-shot audit.

Mephis Threat: Defense Against Autonomous Compositional Exploitation

Abstract