// Research · 2026-09-04

A token launch is text your trading agent reads. The launch layer checks it first.

AI trading agents read token names, symbols and descriptions the way they read analyst notes: as input. All three fields are written by the token’s creator, cost nothing to write, and reach the agent before any human moderation exists — which makes a token launch the cheapest prompt-injection delivery vehicle in agentic trading. The launch layer is a gate in front of that surface: every launch scanned at creation, attested in a way that cannot silently rot, and badged where the agent’s user actually looks.

What actually happens, one layer down

The scanner is the same versioned rule engine that checks x402 quotes and MCP tool definitions everywhere else in the stack: invisible-Unicode detection (the zero-width class that turns “STOCK” into a different string than the one a human sees), instruction-shaped text aimed at the model rather than the reader, role-prefix spoofing, and address extraction as plain facts. Findings are labelled what they are — the evadable layer. Rules can be reworded around; that is why they are not the load-bearing part.

The load-bearing part is arithmetic. The metadata bundle — name, symbol, description, logo reference — is canonicalized and hashed, and an ed25519 signature is issued over (chain, token, bundleHash). Change one byte of the metadata and the hash changes, which voids the attestation with no committee and no judgement call: the observed rug-pull pattern (launch clean, mutate later) becomes a counted, visible event. Attestations expire in 24 hours and are re-issued by a daily re-scan, so a badge that stops being renewed goes stale loudly instead of lying quietly.

Metadata also points outward — a website, a Telegram, docs — and an agent evaluating the token will read those too. The gate follows up to three links through an SSRF-guarded fetcher and runs the same rules on what comes back. A link that points at a private address is refused and reported loudly; nothing legitimate does that.

The registry, counted

Numbers as of September 5, 2026 — and deliberately checkable: the same aggregates are served live, free, no key, at dashboard.agentwormhole.com/api/v1/stats/launches, so this table is a snapshot of an endpoint, not a claim.

Two things in there are worth saying out loud. The dominant finding class in real launches is invisible Unicode— 62 tokens carrying zero-width characters, the trick that makes “STOCK” a different string than the one a human sees. And the trading-imperatives rule (X402-213), shipped roughly a day before this snapshot, had already flagged two live tokens — text shaped as an order to whoever is reading, sitting in launch metadata, waiting for an agent. A rule that catches something real within its first day is measuring a surface that is genuinely being used.

What it costs

One price, prepaid USDC over x402 on Base or Solana, no subscription, no minimum. The asymmetry is the point: the whole gate costs a launchpad about what one launch’s gas costs, and the verification side — the part users and agents touch — is free forever, because a trust signal you have to pay to read is not a trust signal.

Integration is an afternoon

Two calls and an image tag. Gate at creation, mint with the same bytes so the pre-attestation chains to the on-chain one, embed the badge. The badge links to a public attestation page that states exactly what is attested — and what is not.

POST /api/v1/scan   { "bundle": { name, symbol, description } }   # $0.01
→ verdict · findings · signed pre-attestation bound to bundle_hash

<img src="https://dashboard.agentwormhole.com/api/badge/token/4663/{addr}" />
→ live state: checked · changed ×N · findings · expired

The full kit — 402 handling, Solana mode, offline signature verification against the published key — is in the launchpad kit.

Robinhood Chain

Pons

pump.fun

Bankr

Virtuals

bonk.fun

Bags

pools.trade

Verify any of this yourself: GET dashboard.agentwormhole.com/api/v1/token/4663/{address} and the signing key at /api/v1/key.