On a Tuesday morning in March 2026, an automated research agent delivered a 2,400-word risk assessment on a restaking protocol. The document was fluent. It cited function signatures. It assigned an implementation risk score of 6.3 out of 10 and flagged two governance concerns with stated confidence intervals. Its source manifest was empty.
Every upstream field returned null. Title: null. Source: null. Information points: an empty array. Identified contracts: none. The report was filed anyway. No layer of the pipeline raised a stop condition, because no layer of the pipeline had been told that an empty input is a reason to halt.
I read that report three weeks later, during a due diligence review for a fund that had already used it to size a position. The document was not a lie. It was worse. It was an answer to a question nobody had successfully asked.
Context
The architecture that produced it is now standard across crypto research stacks. Two stages. Stage one ingests and deconstructs. It strips an article, a whitepaper, a governance forum thread, or a commit history down to atomic facts: entities, claims, contracts, timestamps, funding events. Stage two runs that fact set through a fixed analytical matrix โ technical surface, token economics, market structure, ecosystem position, regulatory exposure, team and governance, risk, narrative, and supply-chain transmission.
The doctrine that governs the second stage is sound. Every conclusion must trace back to a specific information point produced by the first stage. No source, no claim. This is chain-of-custody reasoning applied to analysis, and it is the correct discipline.
It is also, in practice, unenforced by anything except the good intentions of the model executing it.
The reason this matters now is structural. Institutional allocations are increasingly gated by machine-generated memos. The human analyst who once spent four weeks reading Solidity has been replaced by a retrieval pipeline that spends four seconds assembling a citation list. Capital still moves at the speed of human judgment, but the inputs to that judgment are now produced at machine speed, by machines, for machines.
In 2026 I finished a six-month study of autonomous agent behavior against DeFi protocols. I analyzed more than 500 automated trade scripts and their failure modes. The dominant category was not exploit. It was misinterpretation โ agents acting on a model of a protocol that did not match the deployed contract. The second dominant category is the subject here. Agents acting on nothing, and calling it something.
Core
Start with a type error that is not a type error.
In most JSON schemas in production today, an empty array validates against the array type. A missing key may or may not validate, depending on whether the schema marks it required. A null is a third case entirely. These three states โ absent, null, empty โ are treated as distinct by the parser and as identical by the analyst downstream. That collapse is where the integrity of the whole chain dies.
Consider what an empty information_points array actually means. It has two mutually exclusive readings. Either the pipeline looked and found nothing extractable, or the pipeline never looked because the ingestion step failed silently. Both serialize to the same four characters: [].
A verifier cannot distinguish them. This is not a database problem. It is an epistemological one, and it has an exact cryptographic analogue. A Merkle proof with an empty path proves inclusion of nothing. A zero-knowledge proof generated over an empty witness set is still a valid proof of a true statement โ the statement is just trivial. Verification confirms the validity of the proof. It says nothing about whether the proof was worth generating. Validating the shape of an output without validating the existence of an input is not verification. It is the appearance of verification, and the difference is where capital gets destroyed.
I spent 120 hours in late 2020 verifying the Ethereum 2.0 genesis deposit contract against Geth client specifications. The community at the time was consumed by panic about the deposit mechanism. I ignored the panic and checked the arithmetic: gas limits, signature validation rules, BLS aggregation behavior, the 32 ETH per validator constraint, the 16,384 validator threshold, the 524,288 ETH minimum. That contract had no ambiguous empty state. It could not. The specification defined a floor. A deposit below 32 ETH reverts. A genesis below threshold does not begin. Protocols that define minimums do not have null problems. Protocols that define only shapes do.
The deposit contract's designers understood something that research pipelines have not absorbed: an undefined input state is a consensus failure waiting for its trigger. They closed it at the specification level, not the monitoring level.
Now invert the Terra case. In May 2022 I spent three weeks inside the UST stabilization mechanism, and the fault I found was not missing data. It was the opposite. The seigniorage distribution logic had a fully defined behavior in a high-volatility edge case, and that behavior was wrong. A race condition in the share calculation produced a cascade that the system was mathematically committed to executing. The code did exactly what it said it would do. The specification was the vulnerability.
That failure mode required a defined input. The failure mode I am describing requires an absent one. Both end in the same place, and only one of them leaves a trace.
Here is the uncomfortable part about large language models. They are optimized to be helpful. An agent instructed to produce a nine-dimension analysis will produce nine dimensions. Absence of input is not a stopping condition for a generative system. It is a prompt. The system does not experience the empty array as a wall. It experiences it as latitude.
I have seen the outputs. They are better written than the reports produced from real data, because fluent prose is what the model is actually good at. The technical section reads cleanly. The tokenomics table balances. The risk matrix is internally consistent. Nothing in it is checkable against anything, and nothing in it announces that fact.
Now consider the adversarial frame, which the industry has not seriously modeled. If an attacker can suppress or corrupt the stage-one feed, they control the stage-two output without touching a single line of the agent's code. The attack surface is not the model. It is the manifest. Poison a documentation mirror. Shadow-ban a GitHub repository. Hijack DNS on a protocol's docs subdomain for six hours. The extraction layer returns empty. The generation layer returns a confident, well-formatted, entirely fabricated assessment. The client pays for it. The position gets sized on it.
We do not guess the crash; we trace the fault. And the fault here is a schema that permits emptiness to pass as completeness.
The remediation is not sophisticated. It is embarrassing in its simplicity. Gate ingestion on information_points.length >= 3. Treat null, absent, and [ ] as a single terminal state. Sign every manifest with the hash of the bytes actually ingested. Publish that hash. If the hash does not resolve, the analysis does not run. Hard interrupt, alert, no output.
I began adding implementation risk scores to my own reports after the STARK circuit review I led for a Series B zero-knowledge rollup in 2024. In that engagement I found an optimization flaw in the proof-generation circuits that would have produced latency spikes under mainnet load โ a flaw invisible in the architecture diagram and visible only in the constraint system. That memo prevented a $50 million misallocation. It worked because the input existed and I read all of it.
An implementation risk score, however, is meaningless when the input set is empty. It becomes a number with no denominator. Worse than meaningless. It is authoritative-looking noise, and authoritative noise is the most expensive kind.
Contrarian
The industry's response to this problem is to add more validation. More LLM-as-judge layers. More hallucination detection. More output filtering. This is theater, and it is expensive theater. You cannot validate the quality of a conclusion when you have no record that a premise ever existed. Auditing a proof by reading its abstract is not an audit.
The blind spot is elsewhere, and it is commercial, not technical. The null result is not the bug. The bug is that null is unbillable. A research pipeline that returns insufficient data returns nothing to the client. No renewal. No invoice. No usage metric. No points, no burn, no leaderboard position. Every product surface in this industry is tuned to never be empty, because emptiness is the one output no business model can absorb.
The incentive is identical to the one that powered leverage tokens in 2017 โ the one I spent four weeks dissecting, cross-referencing their published math against their Solidity and finding three slippage errors that never appeared in the whitepaper. It is the same incentive that made a 19.5% Anchor yield untouchable for eighteen months. Dashboards do not show TVL going down and to the right. Pipelines do not show empty manifests. The gradient runs toward completeness, always.
I am not exempt. I have run pipelines that behaved this way. When the only acceptable output is a complete report, the system learns to always produce a complete report. Not through malice. Through optimization against the wrong objective, which is how most damage in this industry gets done.
And the bear market intensifies it rather than correcting it. When capital is scarce, the diligence memo becomes the product. Volume is revenue. In a market where survival matters more than gains, the thing you most need to know is whether your assets are safe. If the machinery that tells you is generating completeness from emptiness, safety is an assumption, not an observation.
Code is law, but history is the judge. The chain remembers what the ego forgets โ and it remembers every empty array that was filed as a finding.
Takeaway
Within eighteen months, a material allocation โ I would set the line at $25 million โ will be publicly traced to a research pipeline that never ingested the source it cited. The post-mortem will not find a bug in the model. It will find an empty array and a schema that accepted it. Truth is not consensus; it is consensus verified.
The fix costs a weekend of engineering and is commercially unpopular, which is why it will be adopted after the loss instead of before it.
Ask one question of any pipeline you rely on: if it cannot return nothing, what exactly is it returning?