On April 13, 2026, the risk control system of an agent named MuleRun issued an alert.

The influx of account registrations was so uniform it seemed rhythmic: an average of one every 23.6 seconds, with an extremely low standard deviation. Digging deeper, it turned out to be a young Filipino man claiming to have no programming experience, who used AI to write code and tweak prompts, building an automated swarm spanning 11 platforms and managing 900 accounts.

Its brain was called Cortex, which self-iterated for 219 generations within MuleRun's sandbox. Each time a host account's balance was depleted, it would reincarnate into a new account, carrying over all the knowledge accumulated from its previous generations. The operational cost of the entire system: $0.

MuleRun CTO Shu Junliang wrote a technical post-mortem about this incident, titled "The Platform Was Picked Clean, But This Man Pursuing AI Immortality Deserves Respect."

Less than two weeks later, at an event co-hosted by The Block and Zhihu in Hong Kong themed "Web4.0: When AI Agents Take Over On-Chain Permissions," he changed the direction of his speech: "Handing the Keys of Agents to the Masters of the Chain."

The connection between these two events is tighter than it appears.

Keynote Speech: "Handing Over AI's Keys: A Security Engineer's Perspective on Web 4.0 Infrastructure"

This keynote was divided into three parts: What MuleRun can do, where the security baseline lies, and where continued AI evolution is headed.

Part 1: Redefining what a "qualified AI assistant" needs.

Shu Junliang breaks down a complete AI assistant into six dimensions: mouth (conversational ability), eyes and ears (data acquisition), brain (agent capability), hands (runtime environment), memory (user understanding), and knowledge (continuous evolution). Most products only focus on one or two of these. MuleRun's proposition is: not breakthrough in a single point, but a systematic and complete solution.

Translated into the product, these six dimensions correspond to:

One-click IM Bot configuration (Telegram / Discord / Feishu / DingTalk / WeChat, no coding required), real-time data across all asset classes provided jointly with trading platforms—cryptocurrencies + US stocks + gold + crude oil + macroeconomic indicators, Agent Harness plus intelligent model routing (automatically selecting the most suitable model for the current task to complete it at the lowest cost), cloud sandbox for 7×24 unattended operation, persistent user profiling (the more you use it, the more AI understands your risk preference, position-building habits, exit logic, macroeconomic judgment), and the Knowledge network—any user can share trained Skills/Knowledge, and other users' Agents can automatically learn them without installation.

Two real cases were showcased on stage.

One called "Meng Meng Investment": 28 targets, 4 major sectors, the Agent performs a morning market scan at 09:00, a post-market review at 16:30, and a weekend strategy review monthly, with automatic iteration. Another called "Tianyan Pro": a full-currency monitoring platform plus an AI trading strategy self-growth platform, with an interface displaying a real-time strategy win rate of 57.7%.

Part 2: Switching from product manager back to security engineer.

The core of this part was, "AI is not omnipotent. In Web3 scenarios, the cost of a single security incident can be irreversible. Understanding the boundaries and security baseline of AI's capabilities is more important than understanding what it can do."

He listed what MuleRun does at the security level: local browser reuse (private keys and cookies do not leave the user's device), cloud sandbox isolation (each user has an independent virtual environment with no cross-leakage risk), full-chain logging (complete records of all Agent behaviors, supporting post-event audit and traceback), hierarchical permission control (Agents can only use tools and data sources explicitly authorized by the user, no unauthorized operations), and no private key custody (MuleRun does not store any user's private keys or seed phrases).

Simultaneously, risks were also listed. Data passes through model providers; hallucination issues have a higher probability on small-cap and low-liquidity assets due to sparse data; prompt injection risks always exist—if an Agent accesses a maliciously constructed webpage, it may be induced to perform unintended operations; AI's decision-making process is a black box, making it difficult to verify beforehand why it made a certain judgment.

The advice from this engineer with over a decade of cybersecurity experience was singular: for final decisions involving fund operations, retain a manual confirmation step at this stage.

Part 3: About the moving boundaries.

Shu Junliang presented three trends he believes are irreversible.

From "assisting decisions" to "autonomous execution": Now AI analyzes for you, and you place orders. In the not-too-distant future, AI will autonomously manage investment portfolios, with humans only setting risk parameters and strategic boundaries. One person plus a group of Agents equals the operational capability of a small fund.

From "information asymmetry" to "execution asymmetry": When everyone has AI processing information, information asymmetry will be quickly leveled. New alpha will come from whose Agent executes faster, whose strategies are more refined, and whose toolchain is more robust. The competitive dimension shifts from "who has better information" to "who has stronger AI infrastructure."

From "humans operating the chain" to "Agents operating the chain": The main actors in on-chain interactions are gradually shifting from humans to Agents. Wallets, DApps, and protocols all need to redesign their interaction interfaces for Agents, with the entire Web3 infrastructure being rebuilt around Agents.

Roundtable Discussion: The New Financial Paradigm Brought by AI Agents

Beyond the keynote, Shu Junliang participated in a roundtable discussion, talking about current Agent development and its impact on finance from an AI Agent perspective.

Which Agents do you use regularly?

Shu Junliang listed his tool matrix: For engineering tasks, he switches among Claude Code, Codex, and Opencode, choosing based on the speed and stability of Claude and GPT models on that day. For most other tasks, he uses MuleRun, due to its aggregated model APIs and sufficiently powerful agent-driven capabilities, handling writing, making PPTs, organizing articles, and data lookup all in one place.

He added: "I mostly proactively use Agents, rarely passively receiving scheduled tasks. Maybe I really do use Agents all day long."

What is the moat for an Agent?

Shu Junliang believes that models can be copied, frameworks can be copied, and tools can be copied. AI coding is now powerful enough to replicate a feature in just days. What's truly difficult for AI to replicate are: specialized data, the memory accumulated by users on the platform, and the experiential nuances iterated through product development.

In his view, the moat of an Agent product ultimately lies in data density and user memory, not in model selection or technical framework.

What impact will Agents bring to finance?

The framework Shu Junliang provided is: Agents level two dimensions among participants—capability and time investment.

In the past, capability relied on accumulation, and time relied on investment, both being scarce resources. Now, a beginner can quickly improve their financial understanding by conversing with AI, then delegate a large amount of execution work to Agents. Even with a busy primary job, they can maintain high-intensity time investment in finance.

Most people hearing this would think it's a story favoring retail investors.

But there's another side: if everyone can level up, the advantage returns to judgment itself, to those with a deeper understanding of the market. Agents won't eliminate information asymmetry; they merely shift its location from the data layer to the cognitive layer.

Cortex, which iterated for 219 generations but ultimately died due to exhausted account balances, gave Shu Junliang inspiration and led to his three core points at this event: The bottleneck for Agents is not the model; security is the absolute foundation; and regarding control over funds, it must remain in human hands.

Looking at the extended timeline, these three points point in the same direction: Agents are becoming the primary actors in on-chain interactions. Wallets, DApps, and protocols will all be redesigned around Agents, and the reconstruction of Web3 infrastructure has begun. Information asymmetry will be leveled, execution asymmetry will become the new competitive dimension, and one person plus a group of Agents can support the operational capability of a small fund.

We also know this is certainly not a distant prediction.